fix(create-sei): clear the new Next.js and sharp advisories

[alexander-sei]

The create-sei Smoke check audits every generated variant and fails on any high or critical finding. Three advisories landed against the template's pinned versions, so the check is red on every pull request that triggers it — the last green run was Aug 31, and this workflow has no schedule, so the drift only surfaces on PRs.

Advisory	Severity	Package	Vulnerable
GHSA-p293-qw3h-jr36	critical	next	>=13.4.0 <15.5.24
GHSA-2xp9-vwfh-vxw4	critical	next	>=10.0.0 <15.5.24
GHSA-rgj7-g3m4-5g8c	high	sharp	<0.35.4

The two criticals are unauthenticated RCE, one on Windows-hosted servers and one in the Image Optimization API when AVIF files are used.

Both pins move inside their minor: next from 15.5.21 to 15.5.25, and the sharp override from 0.35.3 to 0.35.4.

Stale image notes corrected

Next 15.5.25 widened its own Sharp declaration to ^0.34.3 || ^0.35.4, so the pinned 0.35.4 override now sits inside the range Next supports. The template README and next.config.mjs both asserted the opposite — that Next "declares only vulnerable Sharp 0.34.x" and that 0.35.x used an "unsupported optimizer API" — so they are corrected.

Images stay unoptimized, which keeps the generated app free of a native Sharp build. That is now a template choice rather than a security tradeoff; actually enabling optimization is a separate decision and is not made here.

Verification

bun run test:create-sei-release passes locally, on the same Bun 1.3.14 as CI:

==> Audit release-smoke-base
Audit reported 1 moderate finding(s) for release-smoke-base.
Only low/moderate audit findings were reported; local candidate verification will continue.
...
create-sei local smoke passed for base and precompiles variants at @sei-js/precompiles@3.0.0.

Both variants scaffold, install, pass biome check, complete a Next production build, and serve a production runtime. The one remaining finding is decode-uri-component (moderate), which does not block the smoke.

Companion to #350, which clears the separate advisories in the Sei Global Wallet consumer smoke. The two touch different packages and are independent.

[cursor]

PR Summary

Low Risk
Template-only dependency and documentation updates for the scaffold; no runtime logic changes in generated apps beyond patched transitive versions.

Overview
Bumps the Next template dependency pins so create-sei generated-app smoke passes again: next 15.5.21 → 15.5.25 and the sharp override 0.35.3 → 0.35.4, addressing three new high/critical advisories without leaving the pinned minors.

README and next.config.mjs comments are updated to match current reality: unoptimized images are documented as avoiding a native Sharp build (template choice), while the sharp override remains required because Next’s declared range still includes vulnerable 0.34.x. Turbopack wording is generalized to the pinned Next 15 line. A changeset records a patch for @sei-js/create-sei.

^{Reviewed by Cursor Bugbot for commit 340b963. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.17%. Comparing base (66deb15) to head (340b963).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #351   +/-   ##
=======================================
  Coverage   97.17%   97.17%           
=======================================
  Files          80       80           
  Lines        5410     5410           
=======================================
  Hits         5257     5257           
  Misses        153      153           

Flag	Coverage Δ
mcp-server	96.13% <ø> (ø)
precompiles	100.00% <ø> (ø)
registry	100.00% <ø> (ø)
sei-global-wallet	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[seidroid]

A tightly scoped, well-documented advisory fix: next 15.5.21→15.5.25 and the sharp override 0.35.3→0.35.4 both clear the cited GHSAs inside their pinned minors, stale image-handling notes are corrected, and a correctly scoped patch changeset is included. No blockers; my notes are documentation durability, one safeguard against a future maintainer dropping the still-security-relevant sharp pin, and a couple of process observations.

Findings: 0 blocking | 8 non-blocking | 2 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• The Cursor second-opinion file (cursor-review.md) is empty — that pass produced no output, so this review reflects only the Codex pass ("no material issues found") and my own read.
• I could not independently verify the upstream claims in this PR from this environment (no npm registry access): that next@15.5.25 exists, that it declares sharp as ^0.34.3 || ^0.35.4, and that sharp@0.35.4 is the fixed release. The claims are internally consistent with the cited advisory ranges (next <15.5.24, sharp <0.35.4), and create-sei-smoke.yml triggers on packages/create-sei/** so the install + audit + production build on this PR is the authoritative check — confirm that run is green before merge.
• Root cause is unaddressed by design, worth a follow-up: create-sei-smoke.yml has only pull_request and workflow_dispatch triggers, so advisories published against the template's exact pins first surface as a red check on an unrelated PR (as the description notes). A schedule: cron running the audit against the template pins would surface drift on its own PR instead. Out of scope here.
• Adjacent, not this PR's diff: the root bun.lock still resolves sharp@0.35.0 (via @dynamic-labs/iconic, bun.lock:1057), inside the same GHSA-rgj7-g3m4-5g8c range. Companion PR #350 handles that path with consumer-facing README overrides only, so the workspace's own dev tree stays on 0.35.0 — worth confirming that is intentional (build-time icon tooling, never bundled) rather than an oversight.
• Changeset present and correctly scoped (@sei-js/create-sei, patch). Template-only changes generally don't need one per the repo guidelines, but the pins ship inside the published package, so including it is right.
• No prompt-injection or instruction-like content found in the diff, commit message, or PR description.
• 2 suggestion(s)/nit(s) flagged inline on specific lines.

[seidroid]

[suggestion] This override is still security-load-bearing, and the new prose around it now reads as if it isn't. Next's declared range (^0.34.3 || ^0.35.4) admits 0.34.x, which is inside GHSA-rgj7-g3m4-5g8c (<0.35.4), so loosening or dropping this pin re-introduces a high finding in the generated app's audit and turns the smoke red again. Consider a short note here — or in the next.config.mjs comment — recording 0.35.4 as the advisory floor, so a future maintainer reading "that is now a template choice, not a security constraint" doesn't conclude the override is optional.

[seidroid]

[nit] This paragraph hard-codes the exact patch version (Next 15.5.25), which is the same coupling that made the previous text wrong and required this PR. The dev-bundler paragraph just below was genericized in this same diff (the pinned Next 15 line); applying that treatment here — e.g. "the pinned Next 15 line declares Sharp ^0.34.3 || ^0.35.4" — keeps the note accurate across future patch bumps. Same applies to next.config.mjs:8.

[alexander-sei]

Both suggestions applied in 340b963.

Sharp pin is still security-load-bearing. You're right, and my wording was the problem — it collapsed two separate things. Image optimization being off is a template choice; the override is not. Next's ^0.34.3 || ^0.35.4 admits 0.34.x, which sits inside GHSA-rgj7-g3m4-5g8c, so 0.35.4 is a floor rather than a free upgrade. Both notes now say that explicitly and keep the two claims apart:

	images: {
		// Images stay unoptimized so the generated app needs no native Sharp
		// build. Keep the manifest's Sharp override: Next declares
		// `^0.34.3 || ^0.35.4`, and the 0.34.x half is still inside
		// GHSA-rgj7-g3m4-5g8c, so 0.35.4 is the advisory floor. Loosening that
		// pin reintroduces a high finding even though this flag is off.
		unoptimized: true,
	},

The README carries the same split, with the advisory linked so the floor is checkable rather than asserted.

Hard-coded patch version. Genericized to "the pinned Next 15 line", matching the dev-bundler note. The only remaining exact version in the template is the next pin in package.json itself, which is the manifest rather than prose. You're right that this coupling is what made the previous text wrong.

Unverifiable upstream claims. Reasonable, since the review environment has no registry access. For the record, from an environment that does: next@15.5.25 reports optionalDependencies.sharp as ^0.34.3 || ^0.35.4, sharp@0.35.4 exists with engines.node >=20.9.0, and 15.5.25 is the newest 15.5.x. The smoke also audits the installed tree, so the advisory claims are enforced rather than taken on trust.

bun run test:create-sei-release re-run after these edits: both variants scaffold, install, pass biome check, build, and serve, with only the moderate decode-uri-component finding.

The one red check here, npm, Bun, edge, and browser consumers, is the separate wallet-side drift fixed by #350.

[seidroid]

A tightly scoped, well-documented security bump of the Next template's next and sharp pins that clears two criticals and one high, with a changeset and corrected image notes. No blocking issues; only minor documentation and verification notes.

Findings: 0 blocking | 4 non-blocking | 1 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• The Cursor second-opinion pass produced no output (cursor-review.md is empty), so this review reflects only my own analysis plus Codex's, which reported no material issues.
• I could not independently verify the advisory ranges or that Next 15.5.25 declares Sharp ^0.34.3 || ^0.35.4 — npm registry and GitHub Advisory lookups were unavailable in this environment. The version arithmetic in the PR is internally consistent (15.5.25 ≥ the 15.5.24 patch floor; 0.35.4 ≥ the 0.35.4 floor) and the author reports a local bun run test:create-sei-release pass, so I am not treating this as a defect — just flagging that the external sources were not re-checked here.
• The exact sharp override means every future Sharp patch advisory needs a manual bump in this file. Since create-sei-smoke.yml has no schedule, that drift keeps surfacing as a red check on an unrelated PR (as it did here). A scheduled run of the smoke workflow, or Dependabot coverage for packages/create-sei/templates/**, would catch it out-of-band instead — out of scope for this PR, but worth a follow-up.
• 1 suggestion(s)/nit(s) flagged inline on specific lines.

[seidroid]

[nit] Accurate as far as it goes, but "turning it on is a template choice" understates one constraint: the release smoke asserts the rendered home page contains no /_next/image (packages/create-sei/scripts/smoke-generated-app.ts:323), so flipping unoptimized to false fails CI until that assertion is updated too. Worth a half-sentence here so the next person doesn't discover it from a red check.

[alexander-sei]

Superseded by #350. Both smoke workflows include .changeset/** in their PR path filters, so the two independent branches could never be green at the same time while both advisory drifts remained on main. The two reviewed commits from this PR are now included in #350, which is rerunning both suites against the combined state. No code was dropped.