fix(agentex-ui): bump next 15.5.21 to 15.5.24 and sharp 0.35.3 to 0.35.4

[scale-prodsec]

Summary

• next 15.5.21 → 15.5.24 (direct dep, exact pin preserved) in agentex-ui — clears two CRITICAL unauthenticated RCEs.
• sharp 0.35.3 → 0.35.4 via the existing root overrides floor (^0.35.0 → ^0.35.4) — ships libheif 1.23.2. sharp is transitive (next requires ^0.34.3), so the override is the governing surface; raising the floor prevents a future re-lock from reselecting 0.35.3.
• Surface: agentex-ui/package.json + agentex-ui/package-lock.json, the build inputs for agentex-ui/Dockerfile (npm ci → next build).

Coverage

Tickets: GFDVR-60540, GFDVR-60541 (children: GFDVR-60545, GFDVR-60546, GFDVR-60547)

CVEs: CVE-2026-75604, GHSA-2xp9-vwfh-vxw4, GHSA-rgj7-g3m4-5g8c

Validation

• Version gate (OSV): next@15.5.24 and sharp@0.35.4 both return zero known advisories. 15.5.24 is the lowest clean release, keeping the bump inside the 15.5 line rather than the 16.3.3 alternative.
• npm ci clean (exact Dockerfile build gate) — lockfile complete and consistent; lockfileVersion 3 unchanged, no file-mode changes, no first-party code touched.
• Diff scope: 38 lock entries, zero added/removed packages — next/@next/*, sharp/@img/*, @img/sharp-libvips-* 1.3.2→1.3.3, and @emnapi/runtime 1.11.3 (required by @img/sharp-wasm32@0.35.4). All true closure members.
• npm run typecheck clean; npm run test:run 97/97 passed across 13 files.
• npm run build (NODE_ENV=production) succeeded — all 10 routes compiled, including the next/server middleware and Node-runtime auth path.
• next start runtime smoke: /api/health 200, gated page request 200 (middleware matcher exercised), and /_next/image?w=128&q=75 returned a valid 128×128 WebP — the image-optimization path that invokes sharp, i.e. the GHSA-2xp9 surface. No server errors.
• AVIF decode via bundled libheif 1.23.2 verified (sharp.versions.heif === "1.23.2", encode+decode round-trip), matching the fixed version named in GHSA-rgj7-g3m4-5g8c.
• Behavior-contract review of every crossed release (15.5.22 TypeScript ≥7.0 rejection — repo pins 5.9.2, gate does not fire; 15.5.23 FlightClient traversal guards; 15.5.24 security-only; sharp 0.35.4 resize/composite bounds, palette bit depth, info.pages, stream lifecycle). No first-party code reads any changed contract: no sharp import, no error-code/instanceof branching, and the app's only <Image> renders an SVG. Upstream tracker sweep found no open regression against 15.5.22–15.5.24; sharp #4595 (pipelineColourspace with device-independent colourspaces) is pre-existing and off this path.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or repository-rule violations identified.

Summary

• Pins Next.js at 15.5.24 and updates its matching environment and SWC platform packages.
• Raises the sharp override floor to 0.35.4 and updates the native sharp/libvips packages.
• Keeps package.json and the npm lockfile consistent for lockfile-based builds.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​15.5.21 ⏵ 15.5.24		+75	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential vulnerability: npm next with risk level "medium" Location: Package overview From: agentex-ui/package-lock.json → npm/next@15.5.24 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@15.5.24. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report