[Snyk] Security upgrade next from 15.5.3 to 15.5.9

[dennislee928]

Snyk has created this PR to fix 2 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• Frontend/package.json
• Frontend/yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Deserialization of Untrusted Data SNYK-JS-NEXT-14400636	852
	Exposure of Sensitive System Information to an Unauthorized Control Sphere SNYK-JS-NEXT-14400644	678

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Deserialization of Untrusted Data

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
carbon-trading-for-individuals-tbcr	Ready	Preview, Comment	Dec 19, 2025 9:13am

[dennislee928]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR addresses security vulnerabilities by upgrading Next.js from version 15.5.3 to 15.5.9, which fixes two high-severity vulnerabilities: Deserialization of Untrusted Data (SNYK-JS-NEXT-14400636) and Exposure of Sensitive System Information (SNYK-JS-NEXT-14400644).

Key changes:

• Updated Next.js dependency from 15.5.3 to 15.5.9 in package.json
• Updated yarn.lock with new Next.js package versions and dependency tree reorganization

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
Frontend/package.json	Updates the Next.js dependency version from 15.5.3 to 15.5.9
Frontend/yarn.lock	Updates Next.js and related packages, reorganizes dependency entries alphabetically

Critical Issue Found: There is a version mismatch in the yarn.lock file where Next.js 15.5.9 is referencing SWC compiler packages at version 15.5.7 instead of 15.5.9. This inconsistency could cause runtime or build issues and should be corrected by regenerating the lockfile.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.