## React Flight / Next.js RCE Advisory - Security Update

### Summary
The ethonline-2025-frontend project has been updated to address the React Flight / Next.js RCE advisory (CVE-2025-55182 / CVE-2025-66478 / GHSA-9qr9-h5gf-34mp).

**Status: ✅ PATCHED** - Updated Next.js to the patched version

### Changes Made

#### frontend/package.json
- **Next.js**: Updated from `15.5.6` → `15.5.7` (patched version for 15.5.x)

#### pnpm-lock.yaml
- Updated lockfile to reflect Next.js 15.5.7 and all associated SWC compiler binaries
- All transitive dependencies properly resolved to compatible versions

### Advisory Details
The React Flight RCE vulnerability (CVE-2025-55182) affects:
- React versions: 19.0.0, 19.1.0, 19.1.1, 19.2.0 (when using react-server-dom packages)
- Next.js versions: 14.3.0-canary.77+, 15.0.0+, 16.0.0+

**Patched versions for Next.js by minor version:**
- 15.0.x → 15.0.5
- 15.1.x → 15.1.9
- 15.2.x → 15.2.6
- 15.3.x → 15.3.6
- 15.4.x → 15.4.8
- **15.5.x → 15.5.7** ← Applied ✅
- 16.x → 16.0.7

### Vulnerability Assessment

**Project Structure:**
- **Type**: Monorepo with pnpm workspaces
- **Packages**:
  - `frontend/` - Next.js application (AFFECTED)
  - `blockchain/` - Smart contracts (NOT affected - no Next.js)
  - `circuits/` - ZK circuits (NOT affected - no Next.js)

**Dependency Analysis:**
- ✅ No react-server-dom packages found (not vulnerable)
- ✅ React 19.1.0 and React-DOM 19.1.0 included with patched Next.js 15.5.7
- ✅ No manual React version updates needed (Next.js handles this)
- ✅ Next.js 15.5.7 includes necessary React Flight patches

### Implementation Details

1. **Upgrade Strategy**: Only upgraded affected package
   - Next.js was on 15.5.6 (vulnerable version)
   - Upgraded to 15.5.7 (patched version for 15.5.x line)
   - No cross-major-version upgrades performed

2. **Dependencies**: 
   - React and React-DOM versions remain unchanged (19.1.0)
   - Next.js 15.5.7 is compatible with React 19.1.0
   - Next.js automatically provides patched React versions through its dependencies

3. **Lockfile**: 
   - Updated pnpm-lock.yaml with Next.js 15.5.7 and all platform-specific SWC binaries
   - No dependency conflicts introduced
   - All resolutions valid and consistent

### Files Modified
- `frontend/package.json` - Next.js version bump
- `pnpm-lock.yaml` - Updated dependency resolution

### Files NOT Modified
- `blockchain/package.json` - No vulnerability
- `circuits/package.json` - No vulnerability
- Root `package.json` - No workspace-level changes needed

### Verification Notes
- Project uses pnpm workspace configuration
- Only frontend workspace is affected by the advisory
- Other workspaces (blockchain, circuits) do not use Next.js or React Flight packages
- Build should work correctly with patched Next.js 15.5.7

### Important Information
- This update addresses the critical RCE vulnerability in React Server Components
- The vulnerability allows unauthenticated remote code execution through malformed deserialization
- All affected Next.js 15.5.x users should upgrade to 15.5.7
- No application code changes were necessary - only dependency update

Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>