[kaladinlight]

Summary

• next 15.5.27 → 15.5.28: Oct 14 Next.js security update (CVE-2026-96889 Image Optimization RCE, GHSA-p3m5-59mp-jv5r Server Actions DoS)
• sharp override ^0.35.5: next@15.5.28 still accepts sharp ^0.34.3, and our lockfile had sharp@0.34.5, which is still vulnerable to CVE-2026-96889. The lockfile now resolves 0.35.5.
• engines.node: ^22.23.4: Oct 21 Node.js security releases (CVE-2026-111497 Brotli RCE and 9 others). Production was stuck on 22.23.3: with no version source, Railpack reuses the "previous installed version". With engines.node set, Railpack resolves the major version (22) and installs the newest 22.x on each build.

Deploy notes

• package.json/bun.lockb are in railway.json watchPatterns, so the build triggers once this reaches the deployed branch.
• After deploy, check the Railpack log: node should be ≥ 22.23.4 with source package.json > engines > node. If it still says "previous installed version", set RAILPACK_NODE_VERSION=22.
• Future Node patches only land on a rebuild, so redeploy after Node security releases.

Test plan

• bun install and bun pm ls --all show next@15.5.28 and sharp@0.35.5
• bun run build passes
• Railway deploy log shows patched Node version
• Smoke test next/image-heavy pages (blog, chains) after deploy

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated the project’s required Node.js version to 22.23.4 or a compatible later 22.x release.
  • Other updates are internal and do not change the app’s user-facing features or behavior. No new features or bug fixes are included in this release.

[railway-app]

🚅 Deployed to the website-frontend-pr-119 environment in website-frontend

Service	Status	Web	Updated
website-frontend	✅ Success (View Logs)	Web	Oct 22, 2026 at 5:46 pm UTC

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4d93ef16-95ee-406e-af01-f047d016c9d4

📥 Commits

Reviewing files that changed from the base of the PR and between b717b81 and 92c858c.

⛔ Files ignored due to path filters: 1

• bun.lockb is excluded by !**/bun.lockb

📒 Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The package manifest now requires Node.js ^22.23.4, updates Next.js to 15.5.28, and adds a sharp override at ^0.35.5.

Changes: Package configuration

Layer / File(s)	Summary
Runtime and dependency constraints package.json	The manifest adds the Node.js engine constraint, updates the exact Next.js version, and adds the sharp override. The @wagmi/connectors override remains 6.2.0.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Suggested reviewers: 0xapotheosis

Merge Risk: ⚪ Minimal · up to 92c85

No actionable issue is established before merge. Confirm the deployed Node version and exercise image-heavy pages after deployment.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarizes the main changes: security-related updates to Next.js, sharp, and the Node.js requirement.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the package list,
Node bounds and versions neatly twist.
Next takes one small step ahead,
Sharp joins the override thread.
The burrow hums; the changes sit.}

_{Comment @coderabbitai help to get the list of available commands.}