fix(deps): bump next to 15.5.24 and sharp to 0.35.4 for critical RCE advisories

[polylane]

Fixes: Live ding.one and dex.group run Next.js versions exposed to critical unauthenticated RCE advisories

The public ding.one site ran a Next.js version affected by two critical unauthenticated remote-code-execution advisories, and the dependency update that fixes it could not reach production because the project's own build was broken under its pinned toolchain. The site's image optimizer, which the more severe advisory targets, answered requests on the live host. After this merges, the site builds on a supported Node release and ships the patched Next.js and image library.

flowchart LR
  A["ding.one pins next 15.1.0 and sharp 0.33.5"] --> B["GHSA-p293-qw3h-jr36 / GHSA-2xp9-vwfh-vxw4 / GHSA-rgj7-g3m4-5g8c"]
  A --> C["Node CI runs Node 8/10/12; build fails"]
  C --> D["Prepared renewals #389 and #393 cannot merge"]
  E["This change: CI/build repair from #394 plus next and sharp bumps"] --> F["CI and Vercel build pass; merge ships patched code"]
  D -.-> E

Loading

What caused this

Affected: int_0a8732aaa001flf6s11fmt73

Why this fix

ding.one pinned next 15.1.0 and sharp 0.33.5. GitHub advisory GHSA-p293-qw3h-jr36 (CVE-2026-75604, CVSS 9.0) and GHSA-2xp9-vwfh-vxw4 mark Next.js >=13.4.0, <15.5.24 and >=16.0.0, <16.3.3 vulnerable; GHSA-rgj7-g3m4-5g8c marks sharp <0.35.4. The live optimizer answered a real asset request with HTTP 200 image/png, so the Image Optimization API the second advisory targets is reachable rather than disabled.

The version bump alone cannot land. The repo's Node CI installs on Node 8/10/12 and the committed app code does not build under a current Next, which is why the prepared Renovate updates (#389, #393) have sat unmergeable. This change stacks the bumps on the build/CI repair already prepared in #394 (Node 22 with pnpm, tinykeys named import, next/font, environment guards), so a single merge removes the exposure instead of waiting on a separate repair to land first. Validation is a real build on that tree: pnpm install --frozen-lockfile is a no-op and pnpm build compiles and prerenders all 12 pages with next@15.5.24 and sharp@0.35.4.

Remaining work is recorded on the issue: dingyi/dex.group still pins next 13.5.6 on its live "coming soon" deploy and needs an owner decision to upgrade in one pass or retire, since the advisory covers every Next.js below 15.5.24 and the repo has no CI to validate a major upgrade.

Out of scope

• dingyi/dex.group (next 13.5.6): dormant Vercel deploy with no CI; needs an upgrade-vs-retire decision, tracked on the issue timeline.
• ding.one's remaining Dependabot backlog (~100 open alerts): unrelated to these three advisories.
• Absorbs/supersedes the prepared Renovate updates Update dependency next to v15.5.24 [SECURITY] #389 and Update dependency sharp to v0.35.4 [SECURITY] #393 and the CI repair fix(ci): run Node CI on Node 22 with pnpm and repair the build #394.

13 files changed (+332/-273)

• .github/workflows/nodejs.yml: modified, +14/-13
• components/CommandMenu/index.tsx: modified, +1/-1
• components/PageTitle/index.tsx: modified, +2/-2
• lib/bookmarks.ts: modified, +4/-0
• lib/reading.ts: modified, +4/-0
• next.config.js: modified, +0/-3
• package.json: modified, +3/-3
• pages/_app.tsx: modified, +2/-2
• pages/gear.tsx: modified, +3/-0
• pages/newsletters.tsx: modified, +3/-0
• pages/podcasts.tsx: modified, +3/-0
• pages/stack.tsx: modified, +3/-0
• pnpm-lock.yaml: modified, +290/-249

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ding-one	Error		Sep 19, 2026 4:33pm UTC

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[what-the-diff]

PR Summary

• Workflow Improvements in GitHub Actions: The process used in GitHub Actions for checking out code, setting up the required Node.js environment, and handling dependencies has been updated for better performance and reliability.

• Modification in CommandMenu Import: The way tinykeys is imported has been tweaked for better code readability.

• Upgrades to PageTitle Component: Certain changes have been made to the way the 'Unbounded' font is imported for more extensive usage.

• Addition of API Key Checks: We've added extra precautions to verify the availability of vital keys before retrieving and loading data, ensuring smoother operations and reducing disruptions.

• Cleaning Up Next.js Configuration: We've eliminated an unnecessary configuration related to font loading, leading to a cleaner, more efficient codebase.

• Package Version Updates: We've updated various software packages to their newer versions to take advantage of their latest offerings and improvements.

• Adjustments in Font Import: Certain font imports have been updated to align with a consistent font usage pattern in various components of code.

• Enhancements in Data Fetching Process: We've implemented API key validations on various pages to prevent the retrieval of data without necessary credentials, ensuring secure data handling.

[code-terrier]

Code Terrier Review unavailable for this commit: every reviewer model hit an infrastructure fault (upstream provider unavailable, not a code problem) - push a new commit or @code-terrier review to retry once it clears.