🔴 A dev on r/nextjs upgraded to 15.5.28, ran npm audit, saw green, and went home happy.
His app was still vulnerable. Here's why 👇
On v15, Next.js 15.5.28 still accepts the broken sharp 0.34.x. The upgrade looks done. The old vulnerable version just... stays there.
And npm...