[Snyk] Upgrade next from 15.1.3 to 15.5.6

[SMSDAO]

Snyk has created this PR to upgrade next from 15.1.3 to 15.5.6.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 418 versions ahead of your current version.

• The recommended version was released 2 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	HTTP Request Smuggling SNYK-JS-NEXT-10598339	636	No Known Exploit
	Server-side Request Forgery (SSRF) SNYK-JS-NEXT-12299318	636	Proof of Concept
	Race Condition SNYK-JS-NEXT-10176058	636	Proof of Concept
	Use of Cache Containing Sensitive Information SNYK-JS-NEXT-12301496	636	No Known Exploit
	Missing Origin Validation in WebSockets SNYK-JS-NEXT-10259370	636	No Known Exploit
	Missing Source Correlation of Multiple Independent Data SNYK-JS-NEXT-12265451	636	No Known Exploit
	Improper Authorization SNYK-JS-NEXT-9508709	636	Mature

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[Copilot]

Pull request overview

This PR upgrades Next.js from version 15.1.3 to 15.5.6, intending to address multiple security vulnerabilities identified by Snyk. However, the upgraded version itself is marked as deprecated with a security vulnerability (CVE-2025-66478), making this PR unsuitable for merging.

• Snyk automated security upgrade to address 7 vulnerabilities (1 critical, 2 high, 2 medium, 2 low)
• Updates Next.js dependency and its associated transitive dependencies
• Critical Issue: The target version 15.5.6 is deprecated and contains a security vulnerability

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
package.json	Updates Next.js version from 15.1.3 to 15.5.6 (deprecated version)
pnpm-lock.yaml	Updates dependency resolution with deprecation warning for Next.js 15.5.6 and transitive dependencies including sharp upgrade from 0.33.5 to 0.34.5

Files not reviewed (1)

• examples/tg-bot-starter/basic-tg-bot/pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The upgraded version of Next.js (15.5.6) is marked as deprecated in the lock file with a security vulnerability warning (CVE-2025-66478). This PR should be updating to a newer, patched version instead of 15.5.6. Please upgrade to a version that addresses this vulnerability rather than this deprecated version.

Suggested change

	"next": "15.5.6",
	"next": "^15.5.7",

[Copilot]

Next.js 15.5.6 is marked as deprecated with a security vulnerability (CVE-2025-66478). This indicates that even though this upgrade was intended to fix security issues, it introduces or retains a different vulnerability. The package should be upgraded to a version newer than 15.5.6 that has been patched for this CVE.