## React Flight / Next.js RCE Advisory Patch

### Summary
Successfully updated the repository to address the React Flight / Next.js RCE advisory (CVE-2025-66478).

### Vulnerabilities Detected
- **Next.js 15.3.3** - Project was using affected version of Next.js
- **React 19.0.0** - Vulnerable React version that was used

### Changes Made

#### 1. Package Dependency Updates
Modified `package.json` to patch the vulnerable Next.js version:
- Updated `next` from `^15.3.3` to `^15.3.6` (dependencies)
- Updated `eslint-config-next` from `15.3.3` to `15.3.6` (devDependencies)

#### 2. Lockfile Updates
Ran `npm install` to resolve dependencies:
- The caret constraint (^15.3.6) allowed npm to install `next@15.5.7`, which is a patched version that includes the security fix
- React and react-dom were automatically updated by Next.js to `19.1.0` (patched versions)
- No React Flight/RSC packages (`react-server-dom-webpack`, `react-server-dom-parcel`, `react-server-dom-turbopack`) were found in the project

#### 3. Verification Steps Completed

**Build Verification:**
- ✅ `npm run build` completed successfully
- ✅ All 12 static pages generated without errors
- ✅ No build-time dependency resolution errors

**Linting:**
- ✅ `npm run lint` passed
- ✅ Only pre-existing warnings about image optimization (unrelated to security patch)

**Final Resolved Versions:**
- `next@15.5.7` (patched, resolves ^15.3.6 constraint)
- `react@19.1.0` (patched, not vulnerable)
- `react-dom@19.1.0` (patched, not vulnerable)

### Implementation Details

The project was identified as affected because:
1. It depends on Next.js (found `next` in dependencies)
2. It does NOT use React Flight packages (no `react-server-dom-*` packages found)

Per the advisory instructions:
- For Next.js projects, manual React version updates are NOT performed since Next.js provides patched versions automatically
- The Next.js version was upgraded from 15.3.3 to 15.3.6 as per the upgrade rules for 15.3.x
- The caret constraint allows resolution to 15.5.7, which contains the security fix

### Files Modified
- `package.json` - Updated `next` and `eslint-config-next` versions
- `package-lock.json` - Updated with resolved patched versions (auto-generated by npm install)

### No Changes Required
- No React version manual updates (handled by Next.js)
- No React Flight packages present
- No application code changes needed

### Security Impact
The repository is now protected against the React Flight / Next.js RCE vulnerability (CVE-2025-66478). The patched Next.js version resolves the security issue without requiring major version upgrades.

Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>