Skip to content

Bump next from 13.5.2 to 15.5.18 - #24

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-15.5.18
Open

Bump next from 13.5.2 to 15.5.18#24
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/next-15.5.18

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 13, 2026

Copy link
Copy Markdown
Contributor

Bumps next from 13.5.2 to 15.5.18.

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.16

This release contains security fixes for the following advisories:

High:

Moderate:

Low:

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits
  • 9ff92ce v15.5.18
  • 00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
  • 62c97ab v15.5.17
  • 423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
  • fa78739 Turbopack: Fix middleware matcher suffix (#93590)
  • 36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
  • 36589b5 [backport][test] Pin package manager to patch versions (#93596)
  • ad6fd4e v15.5.16
  • 79d7dff Ignore malformed CSP nonce headers (#103)
  • c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by CodeRabbit

  • Chores
    • Updated Next.js framework to a newer version for improved performance and stability.

Review Change Stack

Bumps [next](https://github.com/vercel/next.js) from 13.5.2 to 15.5.18.
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v13.5.2...v15.5.18)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.5.18
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 13, 2026
@coderabbitai

coderabbitai Bot commented May 13, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Next.js framework dependency updated from version 13.5.2 to 15.5.18 in package.json. This is a major version bump spanning two major releases (13 → 14 → 15).

Changes

Dependency Update

Layer / File(s) Summary
Next.js version bump
package.json
Next.js dependency updated from 13.5.2 to 15.5.18.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 The hopping framework leaps ahead,
From thirteen to fifteen spread,
New features bloom in the dev's bed,
One line changed, the future's read! 📦

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately and concisely describes the main change: bumping the Next.js dependency from version 13.5.2 to 15.5.18.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dependabot/npm_and_yarn/next-15.5.18

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Around line 30-33: package.json currently pins eslint-config-next to an older
13.x release while "next" is 15.5.18; update the eslint-config-next dependency
version to a 15.x release (e.g. "eslint-config-next": "^15.0.0" or specifically
"^15.5.0") so ESLint rules match Next.js 15, then reinstall (npm/yarn/pnpm) and
run the linter to confirm no rule breakages; modify the dependency entry named
eslint-config-next in package.json and verify peer/dependency warnings after
install.
- Around line 29-30: The packages are mismatched: "next" is at major 15 but
"eslint-config-next" is still at 13; update "eslint-config-next" to the matching
major (set "eslint-config-next" to the v15 release, e.g. same version as "next"
or a compatible ^15.x range) in package.json, then reinstall dependencies
(npm/yarn/pnpm) and update the lockfile; afterwards run ESLint (and the Next.js
migration checks) to confirm there are no plugin/config compatibility errors.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9f779601-3072-4d2e-a2e6-17cd0757b2c2

📥 Commits

Reviewing files that changed from the base of the PR and between 63ecddb and b175e13.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (1)
  • package.json

Comment thread package.json
Comment on lines 29 to +30
"eslint-config-next": "13.5.2",
"next": "13.5.2",
"next": "15.5.18",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "next@15.5.18 peerDependencies:"
curl -s https://registry.npmjs.org/next/15.5.18 | jq '.peerDependencies'

echo
echo "eslint-config-next@13.5.2 peerDependencies:"
curl -s https://registry.npmjs.org/eslint-config-next/13.5.2 | jq '.peerDependencies'

echo
echo "eslint-config-next@15.5.18 peerDependencies:"
curl -s https://registry.npmjs.org/eslint-config-next/15.5.18 | jq '.peerDependencies'

Repository: ayhansipahi/github-explorer

Length of output: 589


🏁 Script executed:

cat package.json | head -40

Repository: ayhansipahi/github-explorer

Length of output: 1251


🏁 Script executed:

rg "eslint-config-next|next" package.json -A 1 -B 1

Repository: ayhansipahi/github-explorer

Length of output: 345


🌐 Web query:

Next.js 15 migration guide eslint-config-next version compatibility

💡 Result:

Next.js 15 migration requires updating eslint-config-next to version 15.x to match the Next.js version for compatibility [1][2]. The official upgrade guide explicitly instructs installing eslint-config-next@latest alongside next@latest: pnpm add next@latest react@latest react-dom@latest eslint-config-next@latest (or equivalent for npm/yarn/bun) [1]. Next.js 15 adds ESLint 9 support while remaining backwards compatible with ESLint 8; if using ESLint 9 without flat config, Next.js applies ESLINT_USE_FLAT_CONFIG=false automatically [3][4]. Use eslint-config-next/core-web-vitals for stricter Core Web Vitals rules [4]. In Next.js 15.5+, next lint is deprecated in favor of direct ESLint/Biome CLI usage; a codemod helps migrate [5]. For custom configs with ESLint 9 flat format, import from eslint-config-next (e.g.,...coreWebVitals,...typescript) or use @next/eslint-plugin-next directly [4][6][7][8]. Mismatching versions (e.g., Next.js 15 with eslint-config-next@14) causes compatibility issues [2]. Latest eslint-config-next is 16.2.4 as of 2026-05 [9], but for Next.js 15 specifically, use ^15.x or @latest during upgrade [1].

Citations:


Align eslint-config-next with next major version.

next is upgraded to 15.5.18, but eslint-config-next remains on 13.x. The official Next.js 15 migration guide requires version alignment—mismatching versions causes ESLint configuration and plugin compatibility issues.

Proposed fix
-    "eslint-config-next": "13.5.2",
+    "eslint-config-next": "15.5.18",
     "next": "15.5.18",
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"eslint-config-next": "13.5.2",
"next": "13.5.2",
"next": "15.5.18",
"eslint-config-next": "15.5.18",
"next": "15.5.18",
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 29 - 30, The packages are mismatched: "next" is at
major 15 but "eslint-config-next" is still at 13; update "eslint-config-next" to
the matching major (set "eslint-config-next" to the v15 release, e.g. same
version as "next" or a compatible ^15.x range) in package.json, then reinstall
dependencies (npm/yarn/pnpm) and update the lockfile; afterwards run ESLint (and
the Next.js migration checks) to confirm there are no plugin/config
compatibility errors.

Comment thread package.json
Comment on lines +30 to 33
"next": "15.5.18",
"postcss": "8.4.31",
"react": "18.2.0",
"react-dom": "18.2.0",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "1) Check app for potentially affected Next request APIs"
rg -n --type=ts --type=tsx --type=js --type=jsx '\b(cookies|headers|draftMode)\s*\(' -C2

echo
echo "2) Check route handlers and GET handlers that may rely on old caching defaults"
rg -n --type=ts --type=tsx --type=js --type=jsx 'export\s+async\s+function\s+GET\s*\(' -C2
rg -n --type=ts --type=tsx --type=js --type=jsx 'export\s+const\s+dynamic\s*=' -C2

echo
echo "3) Check for params/searchParams usage patterns in App Router files"
rg -n --type=ts --type=tsx --type=js --type=jsx '\b(params|searchParams)\b' -C2

echo
echo "4) Current dependency versions relevant to Next 15 migration"
rg -n '"(next|react|react-dom|eslint-config-next)"\s*:' package.json -C1

Repository: ayhansipahi/github-explorer

Length of output: 173


🏁 Script executed:

# First, list the repository structure to understand what we're working with
git ls-files | head -20

Repository: ayhansipahi/github-explorer

Length of output: 457


🏁 Script executed:

# Search for potentially affected Next.js APIs without problematic file type flags
echo "1) Checking for cookies, headers, draftMode usage:"
rg -n '\b(cookies|headers|draftMode)\s*\(' --glob='*.{ts,tsx,js,jsx}' || true

echo
echo "2) Checking for GET route handlers:"
rg -n 'export\s+(async\s+)?function\s+GET\s*\(' --glob='*.{ts,tsx,js,jsx}' || true
rg -n 'export\s+const\s+GET\s*=' --glob='*.{ts,tsx,js,jsx}' || true

echo
echo "3) Checking for dynamic exports:"
rg -n 'export\s+const\s+dynamic\s*=' --glob='*.{ts,tsx,js,jsx}' || true

echo
echo "4) Checking for params/searchParams usage:"
rg -n '\b(params|searchParams)\b' --glob='*.{ts,tsx,js,jsx}' | head -30 || true

echo
echo "5) Current package.json dependencies:"
cat package.json | grep -A2 '"next"\|"react"\|"react-dom"\|"eslint-config-next"' || true

Repository: ayhansipahi/github-explorer

Length of output: 2834


Update eslint-config-next to version 15.x to match the Next.js version.

The Next.js 15.x jump is generally safe for this codebase. Scans show the app doesn't heavily use the APIs with breaking changes (async cookies(), headers(), draftMode()). The existing params and searchParams usage in page components and the URL searchParams in utility functions are compatible with Next 15.x.

However, there's a version mismatch: eslint-config-next is still pinned to 13.5.2 while Next.js is at 15.5.18. Update this to 15.x to ensure ESLint rules align with the active Next.js version.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 30 - 33, package.json currently pins
eslint-config-next to an older 13.x release while "next" is 15.5.18; update the
eslint-config-next dependency version to a 15.x release (e.g.
"eslint-config-next": "^15.0.0" or specifically "^15.5.0") so ESLint rules match
Next.js 15, then reinstall (npm/yarn/pnpm) and run the linter to confirm no rule
breakages; modify the dependency entry named eslint-config-next in package.json
and verify peer/dependency warnings after install.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants