fix(deps): upgrade Next.js to 15.5.27

[0xApotheosis]

Description

Upgrade Next.js from the vulnerable version in the lockfile to 15.5.27 and pin that version in package.json. Fresh installs and production builds now resolve the same patched release.

What this affects

The public marketing website (website-frontend): its Next.js runtime, page rendering and server routes. This does not update the trading web app, mobile binaries, or the Strapi backend.

Risk

Medium: framework upgrade across the marketing site. Check rendering, navigation and server routes before release.

Deployment and QA environment

Already merged: QA this change on the Railway website-frontend project's develop environment at https://website-frontend-develop.up.railway.app. Engineering checks that its deployment is successful and contains #114 and #115, then posts the deployed commit. A running older deployment is not a pass.

Deploy: Rebuild/redeploy the marketing frontend so the patched runtime reaches running servers and previews. The Strapi backend needs no code deployment or schema migration for this PR. Before promoting the marketing site to Railway production, complete the checks below on develop; repeat a short page/navigation check after production deployment. This repository uses Railway environments, not the trading app's release/ephemeral web branches.

QA handoff: Environment inventory was checked on 9 October 2026. Before Operations starts, Engineering posts the exact app/install links, deployed commit/build numbers, test fixtures and readiness confirmation in this PR. Operations records the browser/device, steps passed/failed and screenshots of failures. Environment preparation and tests described here are a plan, not a claim that deployment or live QA has already happened.

Testing

Engineering

Validated locally: lint and the production Next.js build passed.

bun install --frozen-lockfile
bun run lint
bun run build
bun -e 'console.log(require("next/package.json").version)'

The installed version must be 15.5.27; the build must complete without changing the lockfile.

Integration/security checks — Engineering

The checks below require service configuration, API tools or backend observation. Engineering owns them; the click-through Operations checklist follows. Any environment setup mentioned here must follow the deployment plan above.

1. Start the production build with bun run start and visit the homepage, localized pages, blog, newsroom, support and FAQ pages. Confirm pages render and internal links work.
2. Check the announcement banner and image loading. Confirm the CMS-backed pages still load published content.
3. After deployment, check the Next.js version inside the running artifact. It must be 15.5.27 on production and previews.

Operations

Open: https://website-frontend-develop.up.railway.app once Engineering has confirmed the new deployment is ready.

1. Open the home page. Check that the page, images and announcement banner display normally.
2. Use the site's links to open Blog and Newsroom. Open an article from each, then use Back to return to the list. Text and images should load on both the list and article pages.
3. Open Support and FAQ. Open a support article and expand an FAQ answer. Both should display their content.
4. Open the localized-page links supplied in the QA handoff. Navigate between two pages, then refresh one directly. The selected language and page should still load.
5. Repeat the home page and article checks at a mobile screen size. Navigation should remain usable and there should be no blank/error page.

Pass: All the existing page journeys work on the confirmed patched deployment. Engineering verifies the installed Next.js version; Operations does not need a terminal.

Summary by CodeRabbit

• Chores
  • No user-facing changes are included in this release. The update does not change the app’s visible features or behavior. There are no new capabilities or user-facing fixes to note.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6aad9ea8-a016-4028-8293-cefd2e71c5aa

📥 Commits

Reviewing files that changed from the base of the PR and between 6d843e8 and 11f28dc.

⛔ Files ignored due to path filters (1)

• bun.lockb is excluded by !**/bun.lockb

📒 Files selected for processing (1)

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The package.json manifest changes the next dependency from the range ^15.1.9 to the exact version 15.5.27.

Changes

Next.js dependency

Layer / File(s)	Summary
Pin Next.js version package.json	The next dependency changes from ^15.1.9 to the exact version 15.5.27.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 11f28

The Next.js pin and inspected lockfile version agree, with no concrete merge blocker identified; proceed with normal install, build, and deployment checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main change: upgrading Next.js to version 15.5.27. It matches the dependency update described in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the version line
A single pin is set in place
No range remains beside the name
The manifest holds its chosen number
Then off I hop through clover green}

_{Comment @coderabbitai help to get the list of available commands.}