[alexander-sei]

Five advisories published since October 6 cover the Next template's pinned next@15.5.25 and its sharp@0.35.4 override, so every app create-sei generates installs them. The worst is GHSA-2464-fhr4-w9xw, a critical unauthenticated RCE in Next's Image Optimization API, published yesterday.

• GHSA-2464-fhr4-w9xw — critical, unauthenticated RCE in the Image Optimization API, next >=10.0.0 <=15.5.27.
• GHSA-p3m5-59mp-jv5r — high, App Router denial of service through Server Actions, next >=13.0.0 <=15.5.27.
• GHSA-mcj8-r9mp-w47p and GHSA-4jqv-mc3x-m676 — moderate, SSG and ISR cache poisoning, next >=15.0.0 <15.5.27.
• GHSA-wq5f-xc86-pv6w — high, a memory bug in Sharp's bundled librsvg (CVE-2026-96889) that can lead to RCE on glibc-based Linux, sharp <0.35.5.

Changes

• Bump the template's next from 15.5.25 to 15.5.28 and its sharp override from 0.35.4 to 0.35.5, both inside their pinned minors.
• Next 15.5.28 declares Sharp ^0.34.3 || ^0.35.5, so the image notes in the template README and next.config.mjs now name 0.35.5 as the advisory floor. The 0.34.x half of that range is inside both Sharp advisories.
• Add a @sei-js/create-sei patch changeset.

Merge order

The Sei Global Wallet Consumer Smoke runs here because the PR adds a changeset, and it fails on the sharp drift that #356 fixes, the same failure main has had since October 6. Merge #356 first, then rebase this.

Verification

• bun run test:create-sei-release passes locally on Bun 1.3.14, the version main pins. auto selects registry mode on this branch, where the audit is report-only. Both variants now report only the existing moderate decode-uri-component finding, down from 1 critical, 2 high, and 3 moderate on main.
• bun run check and the create-sei unit tests pass.

No published dependency or peer range changes.

[cursor]

PR Summary

Low Risk
Template-only dependency pin and documentation updates; no runtime or scaffold logic changes beyond what new projects install.

Overview
Bumps the @sei-js/create-sei Next.js starter so newly scaffolded apps no longer inherit vulnerable next and sharp versions.

next is pinned 15.5.25 → 15.5.28 to address four advisories (including critical Image Optimization RCE and high App Router DoS). The sharp override moves 0.35.4 → 0.35.5 for the librsvg RCE advisory. Comments in the template README and next.config.mjs now document 0.35.5 as the Sharp advisory floor and Next’s supported range ^0.34.3 || ^0.35.5. A patch changeset records the @sei-js/create-sei release.

^{Reviewed by Cursor Bugbot for commit 883362a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.82%. Comparing base (14103db) to head (883362a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #355   +/-   ##
=======================================
  Coverage   97.82%   97.82%           
=======================================
  Files          81       81           
  Lines        5652     5652           
=======================================
  Hits         5529     5529           
  Misses        123      123           

Flag	Coverage Δ
mcp-server	96.92% <ø> (ø)
precompiles	100.00% <ø> (ø)
registry	100.00% <ø> (ø)
sei-global-wallet	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[seidroid]

This is a narrow security bump of the Next template: next goes from 15.5.25 to 15.5.28 and the sharp override from 0.35.4 to 0.35.5. The README and next.config.mjs notes are updated to match, and a @sei-js/create-sei patch changeset is included. Nothing stale remains in the template, and I found no correctness issues.

Findings: 0 blocking | 3 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• The Cursor review file (cursor-review.md) was empty, so that pass produced no output. Codex found no material issues, and I agree.
• I could not check the advisory IDs, CVE-2026-96889, or Next 15.5.28's Sharp declaration (^0.34.3 || ^0.35.5) from the diff alone. The changeset and docs repeat these details, so a reviewer should open the linked GHSA pages before merge to confirm the version ranges are correct.
• I searched packages/create-sei for leftover 15.5.25 or 0.35.4 pins and found none outside the historical CHANGELOG entries. The sharp override still sits inside the Sharp range Next declares.