[Aikido] Fix 2 critical issues in next and 9 other issues

[aikido-autofix]

Upgrade dependencies to fix critical RCE vulnerabilities in image optimization (AVIF heap buffer overflow) and high-severity XSS/prototype pollution in rich text editor.

⚠️ Incomplete breaking changes analysis (3/5 analyzed)

⚠️ Breaking changes analysis not available for: next, @tiptap/core

✅ No breaking changes from the axios upgrade (1.18.0 => 1.20.0) affect this codebase.

The codebase uses axios only as a transitive dependency through the @i-dot-ai-npm/utilities-auth package. After searching the entire frontend codebase, I found:

1. No direct axios usage: The codebase does not import or use axios directly. It only uses the @i-dot-ai-npm/utilities-auth package which internally depends on axios.

2. No affected breaking changes:

   • No code checks for HTTP status codes PayloadTooLarge, UnprocessableEntity, ContentTooLarge, or UnprocessableContent

   • No code checks for status === 0 (navigation-canceled XHR behavior change)

   • No code checks for ECONNABORTED or ERR_BAD_OPTION_VALUE error codes

   • No axios interceptors are configured or used

   • No axios configuration options like httpVersion, NO_PROXY, or DNS settings are used

3. Error handling is generic: The only error handling in frontend/utils/auth.ts uses a generic catch (error) block that logs the error and returns null, which will continue to work regardless of axios error format changes.

The upgrade should be safe to proceed.

All breaking changes by upgrading axios from version 1.18.0 to 1.20.0 (CHANGELOG)

Version	Description
1.20.0	Added ContentTooLarge (413) and UnprocessableContent (422) HTTP status codes, while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases.
1.20.0	Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects, with documented compatibility effects on Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection.
1.20.0	Navigation-canceled XHR requests now reject with ECONNABORTED instead of resolving with status 0.
1.20.0	Invalid DNS lookup and httpVersion failures are now standardized as AxiosError.ERR_BAD_OPTION_VALUE.

✅ 11 CVEs resolved by this upgrade, including 2 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-553733	🚨 CRITICAL	[next] A heap buffer overflow in libheif during AVIF image processing allows unauthenticated remote code execution in the Image Optimization API. Self-hosted deployments optimizing attacker-supplied or remotely fetched AVIF images are vulnerable.
GHSA-2xp9-vwfh-vxw4	🚨 CRITICAL	[next] A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.
GHSA-rgj7-g3m4-5g8c	HIGH	[sharp] Upstream libheif vulnerabilities can lead to remote code execution when processing untrusted AVIF images on glibc-based Linux systems. Affected versions prior to 0.35.4 should be upgraded immediately or AVIF decoding should be blocked.
AIKIDO-2026-613639	HIGH	[@tiptap/core] The mergeAttributes() helper is vulnerable to prototype pollution via untrusted attribute objects, allowing attackers to inject malicious DOM attributes through XSS when content is serialized as ProseMirror output.
AIKIDO-2026-65180	HIGH	[@tiptap/core] A prototype pollution vulnerability in the mergeAttributes() helper allows attackers to inject malicious properties into object prototypes via __proto__ keys in document data, leading to arbitrary JavaScript execution when attributes are rendered in the DOM.
GHSA-cp6q-959q-f8rh	MEDIUM	[@tiptap/core] A prototype pollution vulnerability in the mergeAttributes() helper allows attackers to manipulate an object's prototype through a __proto__ key in untrusted JSON, enabling arbitrary inherited properties to be injected into DOM attributes and execute JavaScript code. The vulnerability affects applications that merge untrusted data and use the result with ProseMirror's DOM serializer.
GHSA-55q2-fjhq-7xh7	MEDIUM	[dompurify] A hook-based element removal during IN_PLACE sanitization can leave detached descendants with executable event handlers, allowing an attacker-provided onload handler to fire after sanitization completes. This enables XSS execution in applications using IN_PLACE mode with element-removal hooks.
AIKIDO-2026-904917	MEDIUM	[dompurify] A vulnerability allows unsanitized content, including javascript: URLs and event handlers, to be returned when sanitizing DOM fragments containing shadow hosts, as the shadow root traversal operates on an empty fragment instead of the working body.
AIKIDO-2026-404587	LOW	[dompurify] A mutation XSS vulnerability allows bypassing sanitization through literal-text elements (style, xmp, noembed, noframes, noscript) and uppercase attribute names that survive filtering and become executable after serialization and reparsing. This enables attackers to inject malicious scripts when these risky tags are allow-listed or attributes aren't properly removed by case-sensitive matching.
AIKIDO-2026-925458	LOW	[dompurify] A vulnerability allows event handlers to persist in detached DOM nodes when sanitization hooks remove containing elements with the IN_PLACE option enabled, enabling arbitrary code execution after sanitization completes when pending resource events fire.
AIKIDO-2026-872099	LOW	[axios] Request interceptors can replace the merged config with a plain object, allowing prototype pollution attacks to hijack transport or rewrite responses through inherited fields like adapter, proxy, or transformResponse.

🤖 Remediation details

Fix security vulnerabilities in next, sharp, @tiptap/core, dompurify, and axios

Short summary

This PR remediates security vulnerabilities in five npm packages: next, sharp, @tiptap/core, dompurify, and axios. Direct dependency specs in frontend/package.json were updated for next and the full @tiptap/* family; two existing overrides were tightened to reflect new patched floors; and frontend/package-lock.json was refreshed to resolve all five vulnerable packages to patched versions, with sharp and dompurify resolved transitively through their respective parents.

next

next is a direct dependency in frontend/package.json. Its declared spec was raised from ^15.5.21 to ^15.5.24 to clear two critical Next.js vulnerabilities; npm install --package-lock-only resolved it to 15.5.25 in the lockfile. Bumping next also served as the parent-bump path for sharp (see below), since next@15.5.24+ widens its optional dependency on sharp to ^0.35.3, allowing the patched 0.35.4 to be resolved.

sharp

sharp is an optional transitive dependency pulled in exclusively by next. It was pinned to 0.35.0 under next@15.5.22 and could not be updated independently. Bumping next to 15.5.25 (see above) caused npm to resolve sharp to 0.35.4, satisfying the patched version requirement. The pre-existing override sharp@<0.35.0: 0.35.0 was also updated to sharp@<0.35.4: 0.35.4 to ensure the patched floor is enforced for any other consumers.

@tiptap/core

@tiptap/core is a direct dependency in frontend/package.json, and all six sibling @tiptap/* packages declared in the same manifest shared the same ^3.27.0 range. All seven specs were raised together to ^3.30.4 (the minimum patched release) and resolved to 3.31.3 in the lockfile after npm install --package-lock-only --legacy-peer-deps; the --legacy-peer-deps flag was required because intermediate tiptap extension packages in the existing lockfile carried exact peer-dependency pins on the old version, which would have caused a false ERESOLVE conflict during the lockfile-only refresh. Moving the entire tiptap family in one edit ensures all peer-dependency relationships remain internally consistent.

dompurify

dompurify is a transitive dependency pulled in by posthog-js, which is a direct dependency in frontend/package.json. Because posthog-js declares dompurify as ^3.3.2, the patched version 3.4.15 already satisfies that range; running npm update dompurify --package-lock-only from the lockfile root was sufficient to advance the resolved version from 3.4.12 to 3.4.15 without any manifest change.

axios

axios is a transitive dependency pulled in by @i-dot-ai-npm/utilities-auth, which is a direct dependency in frontend/package.json. That parent declares axios as ^1.16.0, so the patched version 1.20.0 already satisfies the declared range; running npm update axios --package-lock-only advanced the resolved version from 1.18.0 to 1.20.0. The pre-existing override axios@<1.18.0: 1.18.0 was also updated to axios@<1.20.0: 1.20.0 to enforce the new patched floor for any other consumers.

Version changes

Package	From	To	Why updated
next	^15.5.21 → 15.5.22 resolved	^15.5.24 → 15.5.25 resolved	Direct CVE fix
sharp	0.35.0	0.35.4	Transitive; resolved via parent bump of next
@tiptap/core	^3.27.0 → 3.29.2 resolved	^3.30.4 → 3.31.3 resolved	Direct CVE fix
@tiptap/extension-document	^3.27.0 → 3.29.2 resolved	^3.30.4 → 3.31.3 resolved	Sibling group alignment with @tiptap/core
@tiptap/extension-hard-break	^3.27.0 → 3.29.2 resolved	^3.30.4 → 3.31.3 resolved	Sibling group alignment with @tiptap/core
@tiptap/extension-paragraph	^3.27.0 → 3.29.2 resolved	^3.30.4 → 3.31.3 resolved	Sibling group alignment with @tiptap/core
@tiptap/extension-text	^3.27.0 → 3.29.2 resolved	^3.30.4 → 3.31.3 resolved	Sibling group alignment with @tiptap/core
@tiptap/react	^3.27.0 → 3.29.2 resolved	^3.30.4 → 3.31.3 resolved	Sibling group alignment with @tiptap/core
@tiptap/starter-kit	^3.27.0 → 3.29.2 resolved	^3.30.4 → 3.31.3 resolved	Sibling group alignment with @tiptap/core
dompurify	3.4.12	3.4.15	Transitive CVE fix; lockfile refresh under posthog-js
axios	1.18.0	1.20.0	Transitive CVE fix; lockfile refresh under @i-dot-ai-npm/utilities-auth
override axios@<1.18.0	1.18.0 floor	1.20.0 floor (axios@<1.20.0)	Override tightened to match new patched minimum
override sharp@<0.35.0	0.35.0 floor	0.35.4 floor (sharp@<0.35.4)	Override tightened to match new patched minimum

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: [Aikido] Fix 2 critical issues in next and 10 other issues