#360 fix(security): bump next to 15.5.28 / 16.4.1+ for the 2026-10-22 advisories

Why

Next.js advisories published 2026-10-22 (Aikido flags examples as critical):

• GHSA-2464-fhr4-w9xw (critical): RCE in image optimization via sharp. Fixed in 15.5.28 / 16.4.1.
• GHSA-673q-mjm6-r5xr (critical): RCE in use cache. Fixed in 16.4.1.
• GHSA-p3m5-59mp-jv5r (high): Server Actions DoS. Fixed in 15.5.28 / 16.4.1.

Changes

Each example stays on its major line:

Example	Spec	Resolves
with-next-app-router	~15.5.28 (+ pnpm-workspace override)	15.5.28
with-next-page-router, with-metamask, with-solana, with-solana-framework-kit	^15.5.28	15.5.28
with-turnkey	^15.5.28 (+ pnpm-workspace override)	15.5.28
with-crossmint, with-privy, with-reown, with-thirdweb, with-web3-onboard	^16.4.1	16.4.2
with-porto, with-tempo	latest (lockfile refreshed)	16.4.2

All fix versions are more than 7 days old, so no release-age exclusions.

with-porto and with-tempo request latest for React, viem, wagmi and react-query by design, so the refresh also moves those patch versions (React 19.3.0 -> 19.3.1, react-query 5.104.1 -> 5.104.3, ox 0.14.45 -> 0.14.56).

Verification

• CI builds and audits every changed example except two, which the workflow excludes: with-thirdweb (install fails from the shared runner IP) and with-crossmint (install only).
• with-thirdweb built locally CI-style (pnpm install --frozen-lockfile, placeholder .env, next build --webpack): passes on 16.4.2. Audit: critical 2 -> 0, high 7 -> 4. The 4 left were already on main and are not Next.js (braces, no fix yet; follow-redirects; source-map-js).
• Note: a stale local node_modules gave a false @walletconnect/utils import error for with-thirdweb; a clean install builds. The lockfile is not affected.

Audit fixes (second commit)

The audit jobs for with-next-app-router, with-next-page-router, with-privy and with-web3-onboard, and the e2e/metamask audit, failed on issues that were already on main (the nightly e2e job has failed since Oct 21):

• follow-redirects 1.16.0 (GHSA-8r9p-f939-6h3c, GHSA-q3jh-wrc6-jgq8): override to 1.16.1 in all five folders.
• toml 4.2.0 (prototype pollution): override to 5.0.1 in with-next-app-router. Only the foundry ListAccount.js script uses it, through the unchanged parse() export.
• The with-next-page-router lockfile is patched by hand. A full re-resolve also moved the optional zod peer from 3.25.76 to 4.6.5 across the wallet packages, which is out of scope.
• Verified locally: a frozen --lockfile-only install accepts every changed lockfile, and each folder passes the audit with the CI flags (--prod for the examples, no flag for e2e/metamask).
• Not fixed: braces <=3.0.3 (GHSA-vfj7-8cjw-p6xm) has no patched release. It comes only from dev tools such as lint-staged, so the --prod audits do not report it.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}