fix(deps): update dependency next to v15.4.10 [security] - autoclosed

[ribtoks]

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	15.4.9 -> 15.4.10

GitHub Vulnerability Alerts

GHSA-5j59-xgg2-r9c4

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and did not fully prevent denial-of-service attacks in all payload types. This affects React package versions 19.0.2, 19.1.3, and 19.2.2 and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x and 16.x using the App Router. The issue is tracked upstream as CVE-2025-67779.

A malicious HTTP request can be crafted and sent to any Server Function endpoint that, when deserialized, can enter an infinite loop within the React Server Components runtime. This can cause the server process to hang and consume CPU, resulting in denial of service in unpatched environments.

---

Release Notes

vercel/next.js (next)

v15.4.10

Compare Source

Please see the Next.js Security Update for information about this security patch.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[ribtoks]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: next-app@0.1.0
npm error Found: react@19.2.3
npm error node_modules/react
npm error   react@"^19.1.0" from next-app@0.1.0
npm error   packages/next-app
npm error     next-app@0.1.0
npm error     node_modules/next-app
npm error       workspace packages/next-app from the root project
npm error   peer react@"^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0" from next@15.4.10
npm error   node_modules/next
npm error     next@"15.4.10" from next-app@0.1.0
npm error     packages/next-app
npm error       next-app@0.1.0
npm error       node_modules/next-app
npm error         workspace packages/next-app from the root project
npm error
npm error Could not resolve dependency:
npm error peer react@"^18.3.1" from react-dom@18.3.1
npm error node_modules/react-dom
npm error   react-dom@"^18.0.0" from next-app@0.1.0
npm error   packages/next-app
npm error     next-app@0.1.0
npm error     node_modules/next-app
npm error       workspace packages/next-app from the root project
npm error   peer react-dom@"^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0" from next@15.4.10
npm error   node_modules/next
npm error     next@"15.4.10" from next-app@0.1.0
npm error     packages/next-app
npm error       next-app@0.1.0
npm error       node_modules/next-app
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /tmp/renovate/cache/others/npm/_logs/2025-12-19T02_12_02_793Z-eresolve-report.txt
npm error A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2025-12-19T02_12_02_793Z-debug-0.log