16.2.6 is affected by ~20 advisories fixed in 16.4.x. They include unauthenticated RCE in the Image Optimization API (GHSA-2xp9-vwfh-vxw4, GHSA-2464-fhr4-w9xw) and SSG/ISR cache poisoning (GHSA-mcj8-r9mp-w47p). The image endpoint is live because SiteChrome.tsx uses next/image.
npm audit fix (non-forced) also clears the sharp, postcss, source-map-js, nanoid and baseline-browser-mapping findings.
Node 20 is end-of-life and gets no fix for Node2Shell (CVE-2026-111497, the out-of-bounds write in Node's bundled Brotli decoder).
.nvmrc and NODE_VERSION in render.yaml are now set to 24. @types/node is bumped to ^24, and the Node version mentions in README.md and AMPLIFY_DEPLOY.md are updated.
Amplify server-side rendering runs on the major Node version used at build time, and Amplify supports Node 24.
Test plan
npm run build succeeds on Node 24.22.2
npm test: 27/27 pass
npm run lint: 3 errors / 4 warnings, the same set as main before this change (React Compiler purity/setState rules in AttachmentLightbox, DateTimeline, MembershipChart), so nothing new
If the Render dashboard sets NODE_VERSION, it overrides render.yaml. Check it there.
After the Amplify deploy, confirm the build log shows Node 24 and /healthz returns 200
Smoke test the form (/?cid=&cs=), /report, and the staff report embedded in CiviCRM, including the attachment lightbox
## Summary
Fixes the two dependency/runtime findings from the security review.
**1. Next.js 16.2.6 → 16.4.3** (plus `eslint-config-next`)
- 16.2.6 is affected by ~20 advisories fixed in 16.4.x. They include unauthenticated RCE in the Image Optimization API ([GHSA-2xp9-vwfh-vxw4](https://github.com/advisories/GHSA-2xp9-vwfh-vxw4), [GHSA-2464-fhr4-w9xw](https://github.com/advisories/GHSA-2464-fhr4-w9xw)) and SSG/ISR cache poisoning ([GHSA-mcj8-r9mp-w47p](https://github.com/advisories/GHSA-mcj8-r9mp-w47p)). The image endpoint is live because `SiteChrome.tsx` uses `next/image`.
- `npm audit fix` (non-forced) also clears the sharp, postcss, source-map-js, nanoid and baseline-browser-mapping findings.
- `npm audit`: 6 vulnerabilities (1 critical, 4 high) → **0**.
**2. Node 20 → 24 LTS**
- Node 20 is end-of-life and gets no fix for Node2Shell (CVE-2026-111497, the out-of-bounds write in Node's bundled Brotli decoder).
- `.nvmrc` and `NODE_VERSION` in `render.yaml` are now set to 24. `@types/node` is bumped to `^24`, and the Node version mentions in `README.md` and `AMPLIFY_DEPLOY.md` are updated.
- Amplify server-side rendering runs on the major Node version used at build time, and Amplify supports Node 24.
## Test plan
- [x] `npm run build` succeeds on Node 24.22.2
- [x] `npm test`: 27/27 pass
- [x] `npm run lint`: 3 errors / 4 warnings, the **same set as `main`** before this change (React Compiler purity/setState rules in `AttachmentLightbox`, `DateTimeline`, `MembershipChart`), so nothing new
- [ ] If the Render dashboard sets `NODE_VERSION`, it overrides `render.yaml`. Check it there.
- [ ] After the Amplify deploy, confirm the build log shows Node 24 and `/healthz` returns 200
- [ ] Smoke test the form (`/?cid=&cs=`), `/report`, and the staff report embedded in CiviCRM, including the attachment lightbox
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Next 16.2.6 carried ~20 advisories fixed in 16.4.x, including
unauthenticated RCE in the Image Optimization API (GHSA-2xp9-vwfh-vxw4,
GHSA-2464-fhr4-w9xw) and SSG/ISR cache poisoning (GHSA-mcj8-r9mp-w47p).
npm audit fix clears the remaining sharp/postcss/source-map-js/nanoid
findings; npm audit now reports 0 vulnerabilities.
Node 20 is EOL and receives no fix for Node2Shell (CVE-2026-111497,
bundled Brotli decoder OOB write). Pin .nvmrc and render.yaml to Node 24
LTS; Amplify SSR compute runs the major version used at build time.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Fixes the two dependency/runtime findings from the security review.
1. Next.js 16.2.6 → 16.4.3 (plus
eslint-config-next)SiteChrome.tsxusesnext/image.npm audit fix(non-forced) also clears the sharp, postcss, source-map-js, nanoid and baseline-browser-mapping findings.npm audit: 6 vulnerabilities (1 critical, 4 high) → 0.2. Node 20 → 24 LTS
.nvmrcandNODE_VERSIONinrender.yamlare now set to 24.@types/nodeis bumped to^24, and the Node version mentions inREADME.mdandAMPLIFY_DEPLOY.mdare updated.Test plan
npm run buildsucceeds on Node 24.22.2npm test: 27/27 passnpm run lint: 3 errors / 4 warnings, the same set asmainbefore this change (React Compiler purity/setState rules inAttachmentLightbox,DateTimeline,MembershipChart), so nothing newNODE_VERSION, it overridesrender.yaml. Check it there./healthzreturns 200/?cid=&cs=),/report, and the staff report embedded in CiviCRM, including the attachment lightbox🤖 Generated with Claude Code