fix: bump next.js to patched versions (15.5.24, 16.3.3) addressing cr…

[Piyush-85]

Changes

• Bump next devDependency to 15.5.24 (addresses critical RCE vulnerabilities GHSA-2xp9-vwfh-vxw4, GHSA-p293-qw3h-jr36)
• Bump next in all examples to patched versions (15.5.24 for 15.x, 16.3.3 for 16.x)
• Update lockfiles across root and all examples

Notes

No breaking changes. This is a dev/example dependency update only, the SDK's peerDependency range already accepts the patched versions, so no consumer-facing changes are required.

Summary by CodeRabbit

• Chores
  • Updated the Next.js version across multiple example applications.
  • Updated the development Next.js version used by the main project.
  • These updates provide newer framework releases and associated improvements across supported examples.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2dfa2049-5956-446b-a1da-476fc8a1ae7b

📥 Commits

Reviewing files that changed from the base of the PR and between 537fc29 and 1e19f24.

⛔ Files ignored due to path filters (11)

• examples/with-cte/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-dpop/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-ipsie-session-expiry/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-mrrt/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-mtls/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-next-intl/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-passkeys/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-passwordless-db/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-passwordless/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• examples/with-shadcn/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (11)

• examples/with-cte/package.json
• examples/with-dpop/package.json
• examples/with-ipsie-session-expiry/package.json
• examples/with-mrrt/package.json
• examples/with-mtls/package.json
• examples/with-next-intl/package.json
• examples/with-passkeys/package.json
• examples/with-passwordless-db/package.json
• examples/with-passwordless/package.json
• examples/with-shadcn/package.json
• package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates the Next.js dependency versions in the root project and ten example applications.

Changes

Next.js dependency updates

Layer / File(s)

Summary

Next.js version alignment package.json, examples/with-cte/package.json, examples/with-dpop/package.json, examples/with-ipsie-session-expiry/package.json, examples/with-mrrt/package.json, examples/with-mtls/package.json, examples/with-next-intl/package.json, examples/with-passkeys/package.json, examples/with-passwordless-db/package.json, examples/with-passwordless/package.json, examples/with-shadcn/package.json

The Next.js dependency versions are updated in the root project and ten examples.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 1e19f

This PR updates Next.js dependencies and lockfiles to patched versions without changing SDK behavior or public contracts; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: amitsingh05667

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: it updates Next.js to the patched versions 15.5.24 and 16.3.3 to address critical vulnerabilities.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (11 skipped: 11 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/nextjs-security-patch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.06%. Comparing base (537fc29) to head (1e19f24).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2824   +/-   ##
=======================================
  Coverage   89.06%   89.06%           
=======================================
  Files          80       80           
  Lines       11978    11978           
  Branches     2501     2501           
=======================================
  Hits        10668    10668           
  Misses       1265     1265           
  Partials       45       45           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[semgrepcode-auth0]

Semgrep found 1 ssc-7b3c1e5a-9d24-4f80-b6a1-2c8e0f35d719 finding:

• examples/with-shadcn/pnpm-lock.yaml
  • L1722 - Triage

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity. An attacker can supply a YAML document containing a large !!omap sequence, which js-yaml resolves with a linear duplicate-key scan inside its per-element loop. Resolution is therefore quadratic in the number of entries, so a modestly sized document consumes disproportionate CPU inside the load call and blocks the event loop, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 4.3.1 at nextjs-auth0/examples/with-shadcn/pnpm-lock.yaml:1722.

Reference(s): GHSA-5p4m-2wfm-xmqj

Semgrep found 1 ssc-b5be3fd7-c1fb-4156-b16f-2fc35cb62b00 finding:

• examples/with-shadcn/pnpm-lock.yaml
  • L1722 - Triage

Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using js-yaml on the CLI

Fix: Upgrade this library to at least version 4.3.0 at nextjs-auth0/examples/with-shadcn/pnpm-lock.yaml:1722.

Reference(s): GHSA-52cp-r559-cp3m, CVE-2026-59869