[richshaw]

What

Bumps next (dependency and the pnpm.overrides pin) and eslint-config-next from 15.5.27 to 15.5.28, a patch release on the same line (published 2026-10-14).

Why

pnpm audit --prod flags 15.5.27 for:

• GHSA-2464-fhr4-w9xw (critical): unauthenticated remote code execution in the image optimization API when SVG files are used. The image optimizer is already off here (images.unoptimized: true in next.config.mjs), and /_next/image still answers 404 after the bump, so this one had no way in. The upgrade removes it anyway.
• GHSA-p3m5-59mp-jv5r (high): denial of service in the App Router through Server Actions. This one does apply, because organizer pages use server actions.

After the bump pnpm audit --prod reports no advisories against next. The ones that remain are transitive (sharp, postcss and others), and this PR leaves them alone.

The lockfile diff only touches next, @next/env, @next/swc-* and @next/eslint-plugin-next.

Budgets

The patch adds 0.2–0.3 kB to the shared framework chunk. Both builds below used the CI env values:

page	main	this PR	budget
/	132.9 kB	133.2 kB	133 → 134
/s/[slug]	131.9 kB	132.1 kB	132 → 133
/login	108.9 kB	109.1 kB	109 → 110

Budgets are whole kB, so each of these goes up by 1. The growth is in framework code a security fix brings with it, not in our code.

Testing

• pnpm lint && pnpm typecheck && pnpm knip && pnpm test: 1390 passed
• pnpm test:db: 539 passed
• pnpm build and pnpm budgets pass
• Tophat on pnpm dev (Next.js 15.5.28), driven headlessly. An organizer signed in by magic link, created a signup, filled a slot in the builder, published it, then signed up as a participant. The confirmation dialog showed and the confirmation email was sent, with no browser console errors.
• /_next/image still returns 404, and the security headers (CSP, X-Frame-Options, no X-Powered-By) are still sent.

---

Generated by Claude Code

[richshaw]

e2e failed on 9377627 in "Install Playwright Chromium", before any test ran: "Playwright does not support chromium on ubuntu26.04-x64". It isn't this PR's failure. ubuntu-latest moved to 26.04, and every PR's e2e job fails the same way. #607 fixes it, so I've cherry-picked its commit here (ebffda6, same patch as #604–#608 carry). The suite now runs against Next.js 15.5.28, and the copy changes nothing once #607 merges.

---

Generated by Claude Code

[richshaw]

Tophat: passed

The runtime change is the Next.js 15.5.27 → 15.5.28 bump (the changelog and the CI runner pin since then aren't runtime code).

Check	Result	What I saw
Organizer flow on pnpm dev (Next.js 15.5.28)	✅	Signed in by magic link, created a signup, filled a slot in the builder, published it.
Participant flow	✅	Signed up on the public page; "You're in." dialog shown, confirmation email sent, no browser console errors.
/_next/image	✅	Still 404 (optimizer off).
Security headers	✅	CSP and X-Frame-Options present, no X-Powered-By.
pnpm test:db	✅	539 passed.
e2e on ebffda6	✅	Full chromium suite green on ubuntu-24.04.

Not UX. It is high-risk by the pipeline's list: it raises three budgets.json numbers by 1 kB, carries #607's .github/workflows/ pin, and is a security fix. So it needs the owner's OK before merging.

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[richshaw]

The review hasn't started yet. Copilot had neither reviewed this PR nor been asked to, so I requested a Copilot review at 15:27 UTC and put the PR back at pipeline:review. The next conductor run will do the review once Copilot has answered, or once the request is an hour old. CI is green on ebffda6, and the tophat passed on the same SHA.

Session: https://claude.ai/code/session_01QTL3p3AhapYzfpWdGX6ATp

---

Generated by Claude Code

[richshaw]

Review: passed (round 1)

This PR moves next (the dependency and the pnpm.overrides pin) and eslint-config-next from 15.5.27 to 15.5.28. The lockfile diff touches only next, @next/env, @next/swc-* and @next/eslint-plugin-next. No 15.5.27 is left in the branch outside the changelog line that describes the upgrade. The CHANGELOG entry is a new ### Security section under [Unreleased]. It gives the right reason the image-optimizer advisory never applied here (images.unoptimized) and tells self-hosters to redeploy. The three budget raises are 1 kB each, and the description and changelog both explain them, as CLAUDE.md asks when a budget goes up. The CI pin to ubuntu-24.04 is the same patch as #607, so whichever of the two merges first, the other merges cleanly.

Blocking (0): none
Optional (0): none
Earlier threads: none. Copilot replied that it couldn't review (quota used up).
Checks: CI is green on ebffda6: lint-type-test, e2e and CodeQL. Locally I checked the diff for leftover 15.5.27 references, and pnpm audit --prod reports no next advisories on this branch. The tophat passed on the same SHA.

Waiting on the owner because it's high-risk: it raises three budgets.json numbers (/, /s/[slug] and /login, +1 kB each), it carries #607's .github/workflows/ci.yml change, and it's a security upgrade. Look at the budget table in the description and the e2e runner pin. Nothing here changes what people see, so it isn't UX.

Session: https://claude.ai/code/session_01SM5sAiuLNxSEtWPpSaQeeb

---

Generated by Claude Code

[richshaw]

Closing in favour of #617, Dependabot's bump to the same Next.js 15.5.28. On current main, #617's CI passes pnpm budgets without raising any budget (/ 132.7 of 133 kB, /s/[slug] 131.6 of 132, /login 108.7 of 109), so the 1 kB raises here aren't needed. The CI runner pin this branch carries is already on main via #614.

---

Generated by Claude Code