fix CVE-2025-55182

[maxwofford]

This PR patches the React RSC vulnerability. You might like to merge it?

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
hcb-engr	Error			Dec 11, 2025 11:40pm

[maxwofford]

Sorry! Script went a little haywire on this. You can merge it but this isn't exploitable with this codebase.

[sentry]

Bug: The version of @next/mdx is incompatible with the installed version of next. This will cause a peer dependency conflict or build failure when processing MDX content.
_{Severity: CRITICAL | Confidence: High}

🔍 Detailed Analysis

The application's package.json specifies an incompatible version of @next/mdx. The project uses next@14.2.34 but requires @next/mdx@^15.1.6. The @next/mdx package at version 15.x is designed for Next.js 15.x and has a peer dependency on next@^15.0.0. This version mismatch will cause a peer dependency conflict during installation or lead to build-time failures when the application attempts to process MDX files, which are actively used for blog posts as configured in next.config.js.

💡 Suggested Fix

Update the @next/mdx package in package.json to a version compatible with next@14.2.34. For example, change "@next/mdx": "^15.1.6" to a version in the 14.x range, such as "@next/mdx": "^14.2.3".

🤖 Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L23

Potential issue: The application's `package.json` specifies an incompatible version of
`@next/mdx`. The project uses `next@14.2.34` but requires `@next/mdx@^15.1.6`. The
`@next/mdx` package at version 15.x is designed for Next.js 15.x and has a peer
dependency on `next@^15.0.0`. This version mismatch will cause a peer dependency
conflict during installation or lead to build-time failures when the application
attempts to process MDX files, which are actively used for blog posts as configured in
`next.config.js`.

_{Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 7272856}