[Snyk] Security upgrade next from 13.4.7 to 15.0.8

[snyk-io]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-NEXT-15921797	635

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[snyk-io]

This is a significant upgrade from Next.js v13 to v15, introducing multiple high-impact breaking changes across two major versions. A thorough migration effort is required, and developers should expect to make mandatory code and configuration changes.

Next.js 15 Breaking Changes

1. Async Request APIs (High Impact)
Request-specific APIs are now asynchronous to improve performance and enable features like Partial Prerendering. Code must be updated to use await when calling these functions.

• Affected APIs: cookies(), headers(), draftMode(), and accessing params or searchParams in layouts and pages.
• Example:
  • Before: const cookieStore = cookies();
  • After: const cookieStore = await cookies();

2. Caching Behavior Changed (High Impact)
fetch requests, GET Route Handlers, and client-side navigations are no longer cached by default. This is a fundamental shift from previous versions. Applications relying on the old caching behavior must be updated to explicitly opt-in to caching to avoid performance regressions or unintended dynamic behavior.

3. React 19 Integration
Next.js 15 uses React 19, which introduces its own set of features and potential breaking changes. Your application must be compatible with React 19.

Next.js 14 Breaking Changes

1. Minimum Node.js Version
The required Node.js version was raised to 18.17 in v14 and is now 18.18.0 for v15.

**

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

⛔ Snyk checks have failed. 2 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (2)
⛔	Open Source Security	0	2	0	0	2 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	OSS Licenses	0   11   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Failed	Vulnerabilities	1   0   0   0	View in Orca

📦 The following Open Source License Violations have been detected

	PACKAGE	VERSION	LICENSE	FILE PATH
	@img/sharp-libvips-darwin-arm64	1.0.4	LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-libvips-darwin-x64	1.0.4	LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-libvips-linux-arm	1.0.5	LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-libvips-linux-arm64	1.0.4	LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-libvips-linux-s390x	1.0.4	LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-libvips-linux-x64	1.0.4	LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-libvips-linuxmusl-arm64	1.0.4	LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-libvips-linuxmusl-x64	1.0.4	LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-wasm32	0.33.5	Apache-2.0 AND LGPL-3.0-or-later AND MIT	./package-lock.json	View in code
	@img/sharp-win32-ia32	0.33.5	Apache-2.0 AND LGPL-3.0-or-later	./package-lock.json	View in code
	@img/sharp-win32-x64	0.33.5	Apache-2.0 AND LGPL-3.0-or-later	./package-lock.json	View in code

☢️ The following Vulnerabilities (CVEs) have been detected

	PACKAGE	FILE	CVE ID	INSTALLED VERSION	FIXED VERSION
	next	./package-lock.json	CVE-2025-49826	15.0.8	15.1.8	View in code