next@15.5.23 bundles vulnerable postCSS and Sharp

Link to the code that reproduces this issue

https://github.com/advisories/GHSA-r28c-9q8g-f849

To Reproduce

1. Run npx create-next-app@15.5.23 my-audit-test --typescript --eslint --no-tailwind --src-dir --app --import-alias "@/*"
2. Navigate into the directory: cd my-audit-test
3. Run npm audit
4. Observe high severity vulnerabilities reported for postcss and sharp.

Current vs. Expected behavior

Current beavior: Running npm audit on a project with Next.js 15.5.23 reports 3 high-severity security vulnerabilities originating from transitive dependencies (postcss and sharp).

Expected beavior: npm audit should pass with zero high-severity vulnerabilities on supported Next.js releases, and transitive dependencies like postcss and sharp should be bumped to secure patch versions.

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Enterprise
  Available memory (MB): 16333
  Available CPU cores: 4
Binaries:
  Node: 25.3.0
  npm: 11.6.2
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 15.5.23
  eslint-config-next: 15.5.15
  react: 19.2.5
  react-dom: 19.2.5
  typescript: 5.9.3
Next.js Config:
  output: standalone

Which area(s) are affected? (Select all that apply)

Not Found

Which stage(s) are affected? (Select all that apply)

next build (local)

Additional context

• PR #96739 ([15.x] support sharp 0.34 and 0.35) already addresses the sharp update for the 15.x release branch.
• A similar version bump is still needed for postcss (to >=8.5.23) on the 15.x branch to completely clear the high-severity security warnings reported by npm audit.

Run the provided create-next-app and npm audit reproduction with Next.js 15.5.23, then inspect how the 15.x release resolves postcss and sharp. Review PR #96739 for the sharp update and verify that postcss reaches >=8.5.23; done means the supported 15.x release no longer reports high-severity vulnerabilities.