fix(create-sei): bump the template to next 15.5.28 and sharp 0.35.5

.changeset/fix-create-sei-next-sharp-october-advisories.md

@@ -0,0 +1,18 @@
+---
+'@sei-js/create-sei': patch
+---
+
+Bump the Next template's `next` and `sharp` pins to clear five newly published advisories.
+
+Five advisories landed against the pinned `next@15.5.25` and the `sharp@0.35.4` override, so every generated app installed them without any change to the template:
+
+- `GHSA-2464-fhr4-w9xw` — critical, unauthenticated remote code execution in the Image Optimization API, `>=10.0.0 <=15.5.27`.
+- `GHSA-p3m5-59mp-jv5r` — high, denial of service in the App Router through Server Actions, `>=13.0.0 <=15.5.27`.
+- `GHSA-mcj8-r9mp-w47p` and `GHSA-4jqv-mc3x-m676` — moderate, cache poisoning of SSG and ISR pages, `>=15.0.0 <15.5.27`.
+- `GHSA-wq5f-xc86-pv6w` — high, a memory bug in Sharp's bundled librsvg (CVE-2026-96889) that can allow remote code execution on glibc-based Linux, `<0.35.5`.
+
+`next` moves `15.5.25` to `15.5.28` and the `sharp` override `0.35.4` to `0.35.5`, both inside their pinned minors.
+
+Next 15.5.28 declares Sharp `^0.34.3 || ^0.35.5`, so the override stays inside the range Next supports. The image notes in the template README and `next.config.mjs` now name `0.35.5` as the advisory floor, because the `0.34.x` half of Next's range is inside both Sharp advisories.
+
+The remaining `decode-uri-component` finding is moderate and does not block the smoke.

packages/create-sei/templates/next-template/README.md

@@ -32,7 +32,7 @@ bun run build
 
 Next.js image optimization is disabled so the generated app needs no native Sharp build. Turning it on is a template choice rather than a security tradeoff.
 
-The manifest's `sharp` override is a separate matter and has to stay. The pinned Next 15 line declares Sharp `^0.34.3 || ^0.35.4`, and the `0.34.x` half of that range is still inside [GHSA-rgj7-g3m4-5g8c](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c), so `0.35.4` is the advisory floor. Loosening or removing the override reintroduces a high audit finding whether or not optimization is enabled.
+The manifest's `sharp` override is a separate matter and has to stay. The pinned Next 15 line declares Sharp `^0.34.3 || ^0.35.5`, and the `0.34.x` half of that range is still inside [GHSA-rgj7-g3m4-5g8c](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c) and [GHSA-wq5f-xc86-pv6w](https://github.com/advisories/GHSA-wq5f-xc86-pv6w), so `0.35.5` is the advisory floor. Loosening or removing the override reintroduces high audit findings whether or not optimization is enabled.
 
 ## Development bundler
 

packages/create-sei/templates/next-template/next.config.mjs

@@ -7,9 +7,10 @@ const nextConfig = {
 	images: {
 		// Images stay unoptimized so the generated app needs no native Sharp
 		// build. Keep the manifest's Sharp override: Next declares
-		// `^0.34.3 || ^0.35.4`, and the 0.34.x half is still inside
-		// GHSA-rgj7-g3m4-5g8c, so 0.35.4 is the advisory floor. Loosening that
-		// pin reintroduces a high finding even though this flag is off.
+		// `^0.34.3 || ^0.35.5`, and the 0.34.x half is still inside
+		// GHSA-rgj7-g3m4-5g8c and GHSA-wq5f-xc86-pv6w, so 0.35.5 is the
+		// advisory floor. Loosening that pin reintroduces high findings even
+		// though this flag is off.
 		unoptimized: true,
 	},
 	webpack: (config) => {

packages/create-sei/templates/next-template/package.json

@@ -25,7 +25,7 @@
 		"@tailwindcss/postcss": "4.3.3",
 		"@tanstack/react-query": "5.85.3",
 		"ethers": "6.17.0",
-		"next": "15.5.25",
+		"next": "15.5.28",
 		"pino-pretty": "13.1.3",
 		"postcss": "8.5.26",
 		"react": "19.1.2",
@@ -46,7 +46,7 @@
 		"@metamask/sdk": "0.33.1",
 		"@metamask/sdk-communication-layer": "0.33.1",
 		"postcss": "8.5.26",
-		"sharp": "0.35.4",
+		"sharp": "0.35.5",
 		"use-sync-external-store": "1.6.0",
 		"uuid": "11.1.1",
 		"ws": "8.21.3"