[scale-avr]

Before flowchart TB n0["agentex-ui image"] n1["@img/sharp-darwin-arm64@0.35.4"] n2["@img/sharp-darwin-x64@0.35.4"] n3["@img/sharp-freebsd-wasm32@0.35.4"] n4["@img/sharp-libvips-darwin-arm64@1.3.3"] n5["@img/sharp-libvips-darwin-x64@1.3.3"] n6["+33 more"] n7["6 advisories"] n0 --> n1 n0 --> n2 n0 --> n3 n0 --> n4 n0 --> n5 n0 --> n6 n1 --> n7 n2 --> n7 n3 --> n7 n4 --> n7 n5 --> n7 n6 --> n7 classDef bad stroke:#d1242f,stroke-width:3px class n1,n2,n3,n4,n5,n6,n7 bad Loading

After flowchart TB n0["agentex-ui image"] n1["@img/sharp-darwin-arm64@0.35.5"] n2["@img/sharp-darwin-x64@0.35.5"] n3["@img/sharp-freebsd-wasm32@0.35.5"] n4["@img/sharp-libvips-darwin-arm64@1.3.4"] n5["@img/sharp-libvips-darwin-x64@1.3.4"] n6["+33 more"] n7["6 advisories closed"] n0 --> n1 n0 --> n2 n0 --> n3 n0 --> n4 n0 --> n5 n0 --> n6 n1 --x n7 n2 --x n7 n3 --x n7 n4 --x n7 n5 --x n7 n6 --x n7 classDef good stroke:#1a7f37,stroke-width:3px class n1,n2,n3,n4,n5,n6,n7 good Loading

Tickets	Files	Risk	Proof
0 of 0	2	Low: minor or patch only	CI 11 pass

Root cause: package-lock.json resolves vulnerable @img/sharp-darwin-arm64, @img/sharp-darwin-x64, @img/sharp-freebsd-wasm32 and @img/sharp-libvips-darwin-arm64.

Used in code: yes: next in agentex-ui/middleware.ts.

Before merge: nothing beyond the normal review.

Details: packages, coverage, files, sources

Package	From	To	Via	Used in code
@img/sharp-darwin-arm64	0.35.4	0.35.5	next → sharp	no import found
@img/sharp-darwin-x64	0.35.4	0.35.5	next → sharp	no import found
@img/sharp-freebsd-wasm32	0.35.4	0.35.5	next → sharp	no import found
@img/sharp-libvips-darwin-arm64	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-darwin-x64	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-linux-arm	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-linux-arm64	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-linux-ppc64	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-linux-riscv64	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-linux-s390x	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-linux-x64	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-linuxmusl-arm64	1.3.3	1.3.4	next → sharp	no import found
@img/sharp-libvips-linuxmusl-x64	1.3.3	1.3.4	path not recorded	no import found
@img/sharp-linux-arm	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-linux-arm64	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-linux-ppc64	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-linux-riscv64	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-linux-s390x	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-linux-x64	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-linuxmusl-arm64	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-linuxmusl-x64	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-wasm32	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-webcontainers-wasm32	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-win32-arm64	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-win32-ia32	0.35.4	0.35.5	path not recorded	no import found
@img/sharp-win32-x64	0.35.4	0.35.5	path not recorded	no import found
@next/env	15.5.24	15.5.28	path not recorded	no import found
@next/swc-darwin-arm64	15.5.24	15.5.28	path not recorded	no import found
@next/swc-darwin-x64	15.5.24	15.5.28	path not recorded	no import found
@next/swc-linux-arm64-gnu	15.5.24	15.5.28	path not recorded	no import found
@next/swc-linux-arm64-musl	15.5.24	15.5.28	path not recorded	no import found
@next/swc-linux-x64-gnu	15.5.24	15.5.28	path not recorded	no import found
@next/swc-linux-x64-musl	15.5.24	15.5.28	path not recorded	no import found
@next/swc-win32-arm64-msvc	15.5.24	15.5.28	path not recorded	no import found
@next/swc-win32-x64-msvc	15.5.24	15.5.28	path not recorded	no import found
next	15.5.24	15.5.28	path not recorded	imported in 5+ file(s)
sharp	0.35.4	0.35.5	path not recorded	no import found
source-map-js	1.2.1	1.2.2	path not recorded	no import found

Coverage

CVEs: GHSA-2464-fhr4-w9xw, CVE-2026-94482, CVE-2026-94484, CVE-2026-94543, GHSA-wq5f-xc86-pv6w, CVE-2026-93749

Ticket	Package	Status	Advisories

Files changed

File	+	−
agentex-ui/package-lock.json	223	162
agentex-ui/package.json	2	2

Sources

• Npm ci --ignore-scripts in agentex-ui passes.
• Npm ls confirms next 15.5.28, sharp 0.35.5, source-map-js 1.2.2.
• Dependency path: cd agentex-ui && npm ls @img/sharp-darwin-arm64 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-darwin-x64 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-freebsd-wasm32 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-darwin-arm64 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-darwin-x64 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-linux-arm --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-linux-arm64 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-linux-ppc64 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-linux-riscv64 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-linux-s390x --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-linux-x64 --all --json --package-lock-only.
• Dependency path: cd agentex-ui && npm ls @img/sharp-libvips-linuxmusl-arm64 --all --json --package-lock-only.

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Updates the UI’s dependencies for the stated security fixes.

• The UI installs updated Next.js and image-processing packages.

No actionable issues were found. Dependency checks and the whitespace check passed. No install, build, or runtime tests were run during this review.

_{Reviews (1) · Last reviewed commit: "fix(agentex-ui): bump next 15.5.24 -> 15..." · Reviewed by Greptile}

[scale-avr]

Reviewer notes (non-blocking; the linked Linear tickets were moved to In Review)

• missing Linear ticket(s): a tracked finding, a tracked finding, a tracked finding

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​next@​15.5.24 ⏵ 15.5.28		+75	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Potential vulnerability: npm next with risk level "medium" Location: Package overview From: agentex-ui/package-lock.json → npm/next@15.5.28 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@15.5.28. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report