Joel Brock
fe9bfed0d6
Next 16.2.6 carried ~20 advisories fixed in 16.4.x, including unauthenticated RCE in the Image Optimization API (GHSA-2xp9-vwfh-vxw4, GHSA-2464-fhr4-w9xw) and SSG/ISR cache poisoning (GHSA-mcj8-r9mp-w47p). npm audit fix clears the remaining sharp/postcss/source-map-js/nanoid findings; npm audit now reports 0 vulnerabilities. Node 20 is EOL and receives no fix for Node2Shell (CVE-2026-111497, bundled Brotli decoder OOB write). Pin .nvmrc and render.yaml to Node 24 LTS; Amplify SSR compute runs the major version used at build time.
32 lines
839 B
JSON
32 lines
839 B
JSON
{
|
|
"name": "next-app",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint",
|
|
"sync-help": "node --env-file=.env.local scripts/sync-help-from-civi.mjs",
|
|
"test:mapping": "node --test lib/staff-field-mapping.test.mjs",
|
|
"test:mime": "node --test lib/mime.test.mjs",
|
|
"test": "node --test lib/staff-field-mapping.test.mjs lib/mime.test.mjs"
|
|
},
|
|
"dependencies": {
|
|
"next": "16.4.3",
|
|
"react": "19.2.4",
|
|
"react-dom": "19.2.4",
|
|
"react-hook-form": "^7.75.0"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/postcss": "^4",
|
|
"@types/node": "^24",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.4.3",
|
|
"tailwindcss": "^4",
|
|
"typescript": "^5"
|
|
}
|
|
}
|