## React Flight / Next.js RCE Advisory Security Update

### Vulnerability Assessment

The project was scanned for vulnerability to the React Flight / Next.js Remote Code Execution (RCE) advisory.

**Detection Results:**
- ✅ **Next.js Detected**: The project uses `next@15.0.1` (vulnerable version in 15.0.x range)
- ❌ **React Flight Packages**: Not used (no react-server-dom-webpack, react-server-dom-parcel, or react-server-dom-turbopack)
- ℹ️ **React Version**: Uses React 18.3.1 (not affected by React 19 vulnerability)

### Changes Made

Since the project uses Next.js 15.0.x (an affected version range), the following security update was applied:

**Modified Files:**
1. `package.json`
   - Updated `next` from `^15.0.1` to `15.0.5` (patched version for 15.0.x series)

2. `pnpm-lock.yaml`
   - Updated lockfile to resolve to Next.js 15.0.5 and its dependencies

### Implementation Details

According to the React Flight / Next.js RCE advisory patched version requirements:
- For Next.js 15.0.x → upgrade to **15.0.5**

The patched version was selected and installed. No changes were needed for React or React DOM as Next.js automatically supplies the correct versions.

### Verification

✅ **Build Verification**: Successfully ran `pnpm run build` with Next.js 15.0.5
- All 19 routes compiled successfully
- No build errors or dependency conflicts
- Lockfile properly resolved to patched version

✅ **Dependency Installation**: Ran `pnpm install` to update lockfile
- All dependencies resolved correctly
- Lockfile reflects Next.js 15.0.5 pinned version

### Non-Affected Dependencies

The following packages were NOT modified as they are not vulnerable:
- `react@18.3.1` - React 18.x is not affected by the RCE advisory
- `react-dom@18.3.1` - React DOM 18.x is not affected
- All other dependencies remain unchanged

### Summary

This repository was vulnerable to the React Flight / Next.js RCE advisory due to its use of Next.js 15.0.1. The project has been successfully patched by upgrading to Next.js 15.0.5. The build completes successfully with the patched version, confirming compatibility and security resolution.

Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>