[mmabrouk]

Description

This pull request updates next from 15.5.24 to 15.5.27 across the web workspace (web/ee, web/oss, web/packages/*, web/storybook, and web/pnpm-workspace.yaml).

Addressed Dependabot Security Advisories

• GHSA-3757-v58w-757p (Next.js vulnerable to denial of service from unhandled Server Action errors)
• GHSA-5h2c-m8p9-f62w (Cache key collision when using fetch() in Server Actions in Next.js)
• GHSA-7gfc-2v99-x9w2 (Next.js Server Actions CSRF Protection Bypass via Origin Spoofing)
• GHSA-8c5v-p3cq-45j5 (Next.js Server Actions CSRF bypass via prototype pollution of has())
• GHSA-c4hp-4p5v-9w62 (Unchecked next-action parameter leads to DoS in Next.js Server Actions)

Hetzner Test Server Verification

Ran on Hetzner test server in isolated worktree /data/mahmoud/wt-dependabot-next-15.5.27:

• pnpm type-check: PASSED
• pnpm --filter @agenta/mobile types:check: PASSED
• pnpm --filter @agenta/mobile test:unit: PASSED (69 test files, 431 tests passed)
• pnpm --filter @agenta/storybook lint: PASSED (0 errors, 0 warnings)
• pnpm --filter @agenta/storybook build-storybook: PASSED
• pnpm build-mobile: PASSED (all 6 tasks successful)
• pnpm build-oss: PASSED (all 10 tasks successful)
• pnpm build-ee: PASSED (all 11 tasks successful)
• pnpm lint: PASSED (all 28 tasks successful)

Pre-existing Baseline Failures

• None.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0ce41b5d-698e-4501-85f2-d91049f7c724

📥 Commits

Reviewing files that changed from the base of the PR and between a0fb9dd and aed647d.

⛔ Files ignored due to path filters: 1

• web/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 11

• web/ee/package.json
• web/oss/package.json
• web/package.json
• web/packages/agenta-entity-ui/package.json
• web/packages/agenta-home-ui/package.json
• web/packages/agenta-navigation-ui/package.json
• web/packages/agenta-playground-ui/package.json
• web/packages/agenta-sessions-ui/package.json
• web/packages/agenta-skills-ui/package.json
• web/pnpm-workspace.yaml
• web/storybook/package.json

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the web app and related packages to Next.js 15.5.27.

Next.js dependency declarations across the web workspace were updated from 15.5.24 to 15.5.27. The playground peer dependency minimum and workspace override range were also raised to 15.5.27.

Changes: Next.js version alignment

Layer / File(s)	Summary
Update Next.js version declarations web/package.json, web/ee/package.json, web/oss/package.json, web/packages/*/package.json, web/storybook/package.json, web/pnpm-workspace.yaml	Dependency versions were updated to 15.5.27. The playground peer dependency minimum and workspace override threshold were raised to 15.5.27.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to aed64

This is a security patch update of Next.js across the web workspace. The remaining advisory for this version applies only to App Router apps that use Server Actions, and these apps use neither. The change is ready to merge.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the Next.js dependency update from 15.5.24 to 15.5.27 across the web workspace.
Description check		The description directly explains the dependency update, affected workspace areas, addressed security advisories, and reported verification results.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (11 skipped: 11 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Website preview

Preview URL: https://pr-7665-agenta-website-preview.mahmoud-637.workers.dev

Built from aed647d1171b50c094d64be8a640be1aaf3b6442. This comment updates in place on every push.

[github-actions]

Railway Preview Environment

Item	Value
Status	stopped
Commit	aed647d1171b50c094d64be8a640be1aaf3b6442
Manual expiry (UTC)	Not granted
CI deadline (UTC)	Not granted
Workflow	https://github.com/Agenta-AI/agenta/actions/runs/39013850915

Dependent tests finished. Post /preview for manual review. Environment absence verified; retained storage requires separate provider accounting.

Post /preview as a new comment to request a one-hour preview. Repeating it while active does not extend the hour.
Preview data is disposable. Expiry is enforced by the next successful cleanup sweep, not an exact timer.
Environment deletion stops its compute. Provider-retained storage and permanent services may still be billed.

[mmabrouk]

🤖 The AI agent says: Closing: superseded. #7548 and #7621 already put next 15.5.27 on the release line, and #7742 bumps to 15.5.28.