[tefkah]

Changes

• Next.js ^15.5.28 Fixes GHSA-xqc2-xf4c-x3h3 (RSC RCE), GHSA-2464-fhr4-w9xw (image optimizer SVG RCE), GHSA-2xp9-vwfh-vxw4 (image optimizer AVIF RCE), GHSA-p3m5-59mp-jv5r (server action DoS), and the earlier DoS, SSRF. its not really likely we will be target by it.

• sharp ^0.35.5 override: the workaround listed for the SVG RCE.

• images.unoptimized: true: nothing uses next/image, so /_next/image now returns 404 instead of exposing the optimizer. The unused remotePatterns are gone too, including cloudflare-ipfs.com.

• Sentry labels for server action probes. Scanners (React2Shell-style) POST garbage to pages like /login, which shows up as raw SyntaxError: Expected ',' or '}'… issues. onRequestError now spots these and reports them as two warning-level issues, each with a fixed fingerprint and a probe tag:

  • MalformedServerAction (probe:malformed-server-action): the payload didn't decode. Almost always a scanner.
  • UnknownServerAction (probe:unknown-server-action): the action ID doesn't exist. Either a stale tab after a deploy or a scanner.

  The original error stays attached as cause. The probe context records the user agent, the action ID and the forwarded IP. Everything else goes through captureRequestError as before.

Also in this PR

• MinIO images: minio/minio and minio/mc are gone from Docker Hub and quay.io, so they're now pgsty/minio:RELEASE.2026-08-04T00-00-00Z and pgsty/mc:RELEASE.2026-10-18T00-00-00Z, the community fork. The healthcheck and the bucket and user setup were tested locally against the test compose file.
• e2e: installs only Chromium, the only browser core's suite uses, and drops the flaky azure.archive.ubuntu.com mirror before running apt.