build(deps): bump next from 15.5.2 to 15.5.7 in /docs #1642
Conversation
Bumps [next](https://github.com/vercel/next.js) from 15.5.2 to 15.5.7. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.5.2...v15.5.7) --- updated-dependencies: - dependency-name: next dependency-version: 15.5.7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
|
WalkthroughThe pull request bumps the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes This is a straightforward dependency version bump with no code logic changes. Review consists of verifying the version constraint is appropriate and checking for any known breaking changes between the two versions. Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
docs/package-lock.jsonis excluded by!**/package-lock.jsondocs/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
docs/package.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: coverage
| "js-cookie": "^3.0.5", | ||
| "motion": "^12.9.2", | ||
| "next": "^15.2.4", | ||
| "next": "^15.5.7", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, inspect the docs/package.json file to see the current state
cat -n docs/package.json | head -50Repository: rad-ui/ui
Length of output: 1710
🌐 Web query:
CVE-2025-66478 Next.js security vulnerability
💡 Result:
Short summary — CVE-2025-66478 (Next.js)
- What it is: a critical RCE-class vulnerability in the React Server Components (RSC) protocol that affects Next.js App Router builds. (Next.js advisory published Dec 3, 2025). [1]
- Severity: rated critical (CVSS 10.0 in the Next.js advisory); can lead to remote code execution in unpatched deployments. [1]
- Affected Next.js versions: Next.js 15.x and 16.x, and Next.js 14.3.0-canary.77+ canaries using the App Router. (Stable 13/14, Pages Router and Edge Runtime are not affected). [1][2]
- Fixed in: 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, and 16.0.7. React fixes are in React 19.0.1 / 19.1.2 / 19.2.1. [1][2]
- Immediate action: upgrade Next.js to the appropriate patched release for your release line (or downgrade any 14.3 canary to the latest stable 14.x), and update React to patched 19.x where applicable. If hosted on Vercel, platform-level protections are in place but you should still upgrade. [1][2]
Sources:
[1] Next.js security advisory — CVE-2025-66478 (Next.js blog, Dec 3, 2025).
[2] Vercel changelog: Summary of CVE-2025-55182 (Dec 3, 2025).
🏁 Script executed:
# Check if lock file exists and inspect relevant package versions
if [ -f "docs/pnpm-lock.yaml" ]; then
echo "=== Checking @next/mdx version constraints ==="
rg '@next/mdx' docs/pnpm-lock.yaml -A 3 | head -30
echo ""
echo "=== Checking next version in lock ==="
rg '"next":' docs/pnpm-lock.yaml -B 2 -A 3 | head -40
fiRepository: rad-ui/ui
Length of output: 711
🌐 Web query:
Next.js 15.5.7 breaking changes from 15.2.4 @next/mdx compatibility
💡 Result:
Short answer — Next.js 15.5.x introduced changes (Turbopack/loader handling and stricter loader option serialization) that break some @next/mdx setups that worked on 15.2.4. Common symptoms: build/dev errors from the @next/mdx loader about "does not have serializable options" or MDX not building under Turbo/production. Recommended fixes/workarounds:
- Cause: Turbopack and the updated loader in 15.5.x enforce that loader options be plain serializable JS values (no functions/require() calls).
🌐 Web query:
@next/mdx 15.5.x version changelog compatibility with next 15.5.7
💡 Result:
Short answer: Yes — @next/mdx 15.5.x is the official MDX integration for Next.js 15 and is intended to be compatible with Next.js 15.5.7. See the Next.js MDX docs for usage. [1]
Notes / gotchas:
- Some users reported a Turbopack/loader options issue in the 15.5.x line (errors about "mdx-js-loader ... does not have serializable options"); a known workaround is to pass plugin names (strings) instead of require() calls in next.config when configuring remark/rehype plugins. Test dev/build with your exact setup. [2]
- Confirm the exact @next/mdx subversion you install (match minor/patch where possible) — package listings show the 15.5.x releases available. [3]
If you want, tell me the exact @next/mdx version you plan to use and your next.config.js so I can check for any specific incompatibilities.
Sources: Next.js MDX docs. [1] Issue/workaround writeup. [2] Package/version listing. [3]
🏁 Script executed:
# Check what version of @next/mdx is available that matches next 15.5.x
rg '@next/mdx' docs/package.json
# Also verify React version requirement for CVE-2025-66478
rg '"react":' docs/package.json
# Check eslint-config-next version mismatch
rg 'eslint-config-next' docs/package.jsonRepository: rad-ui/ui
Length of output: 139
Update @next/mdx to ^15.5.0 and react to ^19.0.1 to fully resolve CVE-2025-66478.
The next@15.5.7 upgrade addresses the critical RCE vulnerability CVE-2025-66478 (CVSS 10.0) in the React Server Components protocol. However, two related updates are required:
-
@next/mdxmust be updated from^15.2.0to^15.5.0— The 15.5.x line introduced stricter loader option serialization in Turbopack that breaks compatibility with 15.2.x. Known issue: ifnext.config.jspasses plugin functions viarequire()in remark/rehype configuration, Turbopack will fail with "does not have serializable options" errors. Use plugin name strings instead. -
reactmust be bumped from19.0.0to^19.0.1— The CVE fix includes React-side patches in 19.0.1+; the current version needs this update for complete protection. -
Consider updating
eslint-config-nextfrom15.1.2to^15.5.0— Version alignment with Next.js is recommended for lint rule consistency.
Test the dev and build scripts after merging to verify Turbopack compatibility and MDX rendering.
🤖 Prompt for AI Agents
In docs/package.json around line 32, the Next.js upgrade to "next": "^15.5.7"
requires companion updates: bump "@next/mdx" from "^15.2.0" to "^15.5.0" to
match Turbopack loader option serialization changes, update "react" from
"19.0.0" to "^19.0.1" to include the CVE-2025-66478 React-side fix, and
optionally align "eslint-config-next" to "^15.5.0"; after changing these
versions run npm/yarn install and verify dev and build (Turbopack) along with
MDX rendering, and if you pass functions in next.config.js remark/rehype options
replace them with plugin name strings to avoid "does not have serializable
options" errors.
Bumps next from 15.5.2 to 15.5.7.
Release notes
Sourced from next's releases.
Commits
3eaf68bv15.5.78367ce5update version script9115040Update React Version for Next.js 15.5.7 (#10)96f6999update tag55ef0e3v15.5.692bbbb1Backport: don't defineprocess.cwd()in node_modules (#84957)f895b72Fix url-imports test on 15-5 (#84966)81f530dv15.5.59abbc0e[backport] fix: missingnext/linktypes withtypedRoutes(#82814) (#84779)121e1b5[backport] docs: early October improvements and fixes (#84334)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.