chore(deps): bump next from 15.5.9 to 15.5.14

[dependabot]

Bumps next from 15.5.9 to 15.5.14.

Release notes

Sourced from next's releases.

v15.5.14

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)

Credits

Huge thanks to @​styfle and @​lllomh for helping!

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​ztanner for helping!

v15.5.12

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

• fix unlock in publish-native

This is a re-release of v15.5.11 applying the turbopack changes.

v15.5.11

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Tracing: Fix memory leak in span map (#85529)
• fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#89134)
• Turbopack: fix NFT tracing of sharp 0.34 (#82340)
• Turbopack: support pattern into exports field (#82757)
• NFT tracing fixes (#84155 and #85323)
• Turbopack: validate CSS without computing all paths (#83810)
• feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#89129)

Credits

Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!

Commits

• d7b012d v15.5.14
• 2b05251 [backport] feat(next/image): add lru disk cache and `images.maximumDiskCacheS...
• f88cee9 Backport: Fix(pages-router): restore Content-Length and ETag for /_next/data/...
• cfd5f53 v15.5.13
• 15f2891 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
• d23f41c v15.5.12
• 8e75765 fix unlock in publish-native
• 6cef992 [backport] normalize CRLF line endings in jscodeshift tests on Windows (#8800...
• 7a94645 Apply needs for publishRelease
• bbfd4e3 v15.5.11
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
herocast	Ready	Preview	Mar 21, 2026 11:03pm

[hellno]

@claude which parts will break due to the nextjs version change?

[claude]

Claude finished @hellno's task —— View job

---

Analyzing Next.js 15.5.9 → 15.5.14 Compatibility

Todo List:

• Review package.json and current Next.js usage
• Analyze release notes for breaking changes
• Check codebase areas that might be affected
• Provide compatibility assessment

---

✅ Good News: No Breaking Changes Expected

Based on my analysis of the Next.js release notes and herocast codebase, this upgrade should be completely safe. Here's why:

What Changed (15.5.9 → 15.5.14):

1. 🖼️ Image Component Enhancements (v15.5.14)

   • Added LRU disk cache for better performance
   • New images.maximumDiskCacheSize config option
   • Impact: ✅ Purely additive - won't break existing usage

2. 🔧 Pages Router Fixes (v15.5.14)

   • Restored Content-Length and ETag headers for /_next/data/ JSON responses
   • Impact: ✅ Bug fix - improves caching, no breaking changes

3. 🔒 Security Patch (v15.5.13)

   • Fixed request smuggling vulnerability in rewrites (CVE-2026-29057)
   • Impact: ✅ Critical security fix with no API changes

4. 🚀 Performance & Memory Fixes (v15.5.11-12)

   • Fixed memory leak in span tracing
   • LRU cache improvements
   • Turbopack NFT tracing fixes for Sharp 0.34
   • Impact: ✅ All performance improvements, no breaking changes

Herocast Usage Analysis:

• ✅ Image Component: Used in 5+ components, but all standard usage - no deprecated features
• ✅ App Router: Primary architecture - benefits from performance fixes
• ✅ Pages Router: Still used for some API routes - benefits from JSON response fixes
• ✅ Sharp: Listed in onlyBuiltDependencies - benefits from Turbopack fixes
• ✅ Caching: Custom cache headers in next.config.mjs - enhanced by image caching improvements

Recommendation: ✅ Safe to Merge

This is a low-risk upgrade with only bug fixes, security patches, and performance improvements. No code changes needed.

---