[Snyk] Security upgrade next from 14.2.35 to 15.5.21

[crchong1]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Server-side Request Forgery (SSRF) SNYK-JS-NEXT-18233136
	Server-side Request Forgery (SSRF) SNYK-JS-NEXT-18233752

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)

[crchong1]

The upgrade from Next.js v14 to v15 is a major version jump with significant breaking changes that require developer action. The two most critical changes are a fundamental shift in caching behavior and the transition of several core APIs to be asynchronous.

Key Breaking Changes:

• Caching is Now Opt-In: In a major reversal, fetch requests, GET Route Handlers, and client-side navigations are no longer cached by default. This change requires a thorough audit of your application's data fetching strategy to explicitly enable caching where needed (e.g., using fetch(url, { cache: 'force-cache' })) to prevent performance degradation and increased backend load.

• Asynchronous Request APIs: Previously synchronous APIs are now asynchronous and require await. This affects cookies(), headers(), draftMode(), params, and searchParams. A codemod is available to help automate this migration (npx @next/codemod@canary next-async-request-api).

• React 19 Required: Next.js 15 now requires React 19. This includes changes like the deprecation of useFormState in favor of useActionState. You must also update react, react-dom, and their associated @types packages.

• Node.js Version: The minimum required Node.js version has been increased to 18.18.0.

Source: Official Upgrade Guide

Recommendation: This upgrade requires careful planning. Developers must review all data-fetching patterns to apply correct caching logic and update all instances of newly async APIs. Use the provided codemods to ease the transition and test thoroughly, paying close attention to application performance and data freshness.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.