Upgrade Next.js to 16.4.3 and pin Node 24

Next 16.2.6 carried ~20 advisories fixed in 16.4.x, including
unauthenticated RCE in the Image Optimization API (GHSA-2xp9-vwfh-vxw4,
GHSA-2464-fhr4-w9xw) and SSG/ISR cache poisoning (GHSA-mcj8-r9mp-w47p).
npm audit fix clears the remaining sharp/postcss/source-map-js/nanoid
findings; npm audit now reports 0 vulnerabilities.

Node 20 is EOL and receives no fix for Node2Shell (CVE-2026-111497,
bundled Brotli decoder OOB write). Pin .nvmrc and render.yaml to Node 24
LTS; Amplify SSR compute runs the major version used at build time.

.nvmrc

@@ -1 +1 @@
-20
+24

AMPLIFY_DEPLOY.md

@@ -171,7 +171,7 @@ significantly, the costs scale roughly linearly with Lambda invocations.
 ## When something breaks
 
 - **Build fails on `npm ci`** → usually a Node version mismatch. The
-  `.nvmrc` pins Node 20; if Amplify's build image doesn't have it, the
+  `.nvmrc` pins Node 24; if Amplify's build image doesn't have it, the
   `amplify.yml` `nvm install` falls back. Open the build log, search
   for "Node version".
 - **Build fails on `next build`** → typecheck or lint error. Reproduce

README.md

@@ -108,7 +108,7 @@ works while in stub mode. The report is at `/report?cid=1&cs=anything`.
 The repo ships with `amplify.yml` for [AWS Amplify Hosting](https://aws.amazon.com/amplify/)
 (see `AMPLIFY_DEPLOY.md` for a first-time walkthrough) and `render.yaml`
 for [Render](https://render.com) (see `DEPLOYMENT.md`). The app is a
-standard Next.js 16 App Router project and runs anywhere Node 20+ can
+standard Next.js 16 App Router project and runs anywhere Node 24+ can
 run `next start` — Vercel, App Runner, Fly, self-hosted, etc.
 
 Build + start:

package.json

@@ -13,18 +13,18 @@
     "test": "node --test lib/staff-field-mapping.test.mjs lib/mime.test.mjs"
   },
   "dependencies": {
-    "next": "16.2.6",
+    "next": "16.4.3",
     "react": "19.2.4",
     "react-dom": "19.2.4",
     "react-hook-form": "^7.75.0"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4",
-    "@types/node": "^20",
+    "@types/node": "^24",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "eslint": "^9",
-    "eslint-config-next": "16.2.6",
+    "eslint-config-next": "16.4.3",
     "tailwindcss": "^4",
     "typescript": "^5"
   }

render.yaml

@@ -17,7 +17,7 @@ services:
       - key: NODE_ENV
         value: production
       - key: NODE_VERSION
-        value: "20"
+        value: "24"
       # Set these manually in the Render dashboard (UI → Environment).
       # Marked sync:false so they're not echoed in this committed file.
       - key: CIVI_BASE_URL