Security: upgrade Next.js to 16.4.3 and pin Node 24 #1

Merged

joelbrock merged 1 commits from security/next-16.4.3-node-24 into main

2026-10-30 11:06:40 -07:00

Author	SHA1	Message	Date
Joel Brock	fe9bfed0d6	Upgrade Next.js to 16.4.3 and pin Node 24 Next 16.2.6 carried ~20 advisories fixed in 16.4.x, including unauthenticated RCE in the Image Optimization API (GHSA-2xp9-vwfh-vxw4, GHSA-2464-fhr4-w9xw) and SSG/ISR cache poisoning (GHSA-mcj8-r9mp-w47p). npm audit fix clears the remaining sharp/postcss/source-map-js/nanoid findings; npm audit now reports 0 vulnerabilities. Node 20 is EOL and receives no fix for Node2Shell (CVE-2026-111497, bundled Brotli decoder OOB write). Pin .nvmrc and render.yaml to Node 24 LTS; Amplify SSR compute runs the major version used at build time.	2026-10-30 11:04:08 -07:00

Author

SHA1

Message

Date

Joel Brock

fe9bfed0d6

Upgrade Next.js to 16.4.3 and pin Node 24

Next 16.2.6 carried ~20 advisories fixed in 16.4.x, including
unauthenticated RCE in the Image Optimization API (GHSA-2xp9-vwfh-vxw4,
GHSA-2464-fhr4-w9xw) and SSG/ISR cache poisoning (GHSA-mcj8-r9mp-w47p).
npm audit fix clears the remaining sharp/postcss/source-map-js/nanoid
findings; npm audit now reports 0 vulnerabilities.

Node 20 is EOL and receives no fix for Node2Shell (CVE-2026-111497,
bundled Brotli decoder OOB write). Pin .nvmrc and render.yaml to Node 24
LTS; Amplify SSR compute runs the major version used at build time.

2026-10-30 11:04:08 -07:00