chore: merge the latest release into canary (#2749)

* chore: update next to latest v15

* Version Packages (canary)

Author: chanceaclark

core/CHANGELOG.md

@@ -1,5 +1,96 @@
 # Changelog
 
+## 1.3.5
+
+### Patch Changes
+
+- [#2744](https://github.com/bigcommerce/catalyst/pull/2744) [`720fe17`](https://github.com/bigcommerce/catalyst/commit/720fe1722295841a995277ec514bc8280644b879) Thanks [@chanceaclark](https://github.com/chanceaclark)! - # Next.js 15.5.7 Upgrade
+
+  Catalyst has been upgraded to Next.js 15.5.7. This is a patch version upgrade that requires migration steps for existing stores to fix a security vulnerability.
+
+  ## 🔒 Critical Security Update
+
+  **This upgrade addresses a critical security vulnerability ([CVE-2025-55182](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components))** that affects React Server Components. The vulnerability allowed unauthenticated remote code execution on servers running React Server Components. This upgrade includes:
+  - Next.js 15.5.7 with the security patch
+  - React 19.1.2 and React DOM 19.1.2 with the security patch
+
+  **All users are strongly encouraged to upgrade immediately.**
+
+  ## Key Changes
+  - ⚡ **Next.js 15.5.7**: Upgraded from Next.js 15.5.1-canary.4 to 15.5.7 (no more canary)
+  - ⚛️ **React 19**: Upgraded to React 19.1.2 and React DOM 19.1.2
+  - 🔄 **Partial Prerendering (PPR) Removed**: Removed partial prerendering as it's unsupported in non-canary versions of Next.js 15.
+
+  ### ⚠️ Partial Prerendering (PPR) Removed
+
+  **Important**: PPR (Partial Prerendering) has been **removed** in this release as it's unsupported in non-canary versions of Next.js 15.
+  - The `ppr` experimental flag has been removed from `next.config.ts`
+  - Full support for Next.js 16's and it's new cache component patterns will be added in a future release
+  - This may result in different performance characteristics compared to the Next.js 15 + PPR setup
+
+  ## Migration Guide
+
+  ### Step 1: Update Dependencies
+
+  If you're maintaining a custom Catalyst store, update your `package.json`:
+
+  ```json
+  {
+    "dependencies": {
+      "next": "15.5.7",
+      "react": "^19.1.2",
+      "react-dom": "^19.1.2"
+    },
+    "devDependencies": {
+      "@next/bundle-analyzer": "15.5.7",
+      "eslint-config-next": "15.5.7"
+    }
+  }
+  ```
+
+  Then run:
+
+  ```bash
+  pnpm install
+  ```
+
+  ### Step 2: Update next.config.ts
+
+  Remove or comment out PPR configuration:
+
+  ```typescript
+  // Remove or disable:
+  // experimental: {
+  //   ppr: 'incremental',
+  // }
+  ```
+
+  Remove or comment out eslint config
+
+  ```typescript
+  // eslint: {
+  //     ignoreDuringBuilds: !!process.env.CI,
+  //     dirs: [
+  //     'app',
+  //     'auth',
+  //     'build-config',
+  //     'client',
+  //     'components',
+  //     'data-transformers',
+  //     'i18n',
+  //     'lib',
+  //     'middlewares',
+  //     'scripts',
+  //     'tests',
+  //     'vibes',
+  //     ],
+  // },
+  ```
+
+  ### Step 3: Remove `export const experimental_ppr`
+
+  Remove any references to `export const experimental_ppr` in your codebase as it is not being used anymore.
+
 ## 1.3.4
 
 ### Patch Changes

core/app/[locale]/(default)/compare/page.tsx

@@ -130,7 +130,3 @@ export default async function Compare(props: Props) {
     </CompareAnalyticsProvider>
   );
 }
-
-// Disabled to circumvent a bug in Next.js and PPR
-// More info: https://github.com/vercel/next.js/issues/59407
-export const experimental_ppr = false;

core/app/[locale]/(default)/layout.tsx

@@ -23,5 +23,3 @@ export default async function DefaultLayout({ params, children }: Props) {
     </>
   );
 }
-
-export const experimental_ppr = true;

core/next.config.ts

@@ -64,28 +64,10 @@ export default async (): Promise<NextConfig> => {
     reactStrictMode: true,
     experimental: {
       optimizePackageImports: ['@icons-pack/react-simple-icons'],
-      ppr: 'incremental',
     },
     typescript: {
       ignoreBuildErrors: !!process.env.CI,
     },
-    eslint: {
-      ignoreDuringBuilds: !!process.env.CI,
-      dirs: [
-        'app',
-        'auth',
-        'build-config',
-        'client',
-        'components',
-        'data-transformers',
-        'i18n',
-        'lib',
-        'middlewares',
-        'scripts',
-        'tests',
-        'vibes',
-      ],
-    },
     // default URL generation in BigCommerce uses trailing slash
     trailingSlash: process.env.TRAILING_SLASH !== 'false',
     // eslint-disable-next-line @typescript-eslint/require-await

core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bigcommerce/catalyst-core",
   "description": "BigCommerce Catalyst is a Next.js starter kit for building headless BigCommerce storefronts.",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "private": true,
   "scripts": {
     "dev": "npm run generate && next dev",
@@ -57,14 +57,14 @@
     "lodash.debounce": "^4.0.8",
     "lru-cache": "^11.1.0",
     "lucide-react": "^0.474.0",
-    "next": "15.5.1-canary.4",
+    "next": "15.5.7",
     "next-auth": "5.0.0-beta.30",
     "next-intl": "^4.1.0",
     "nuqs": "^2.4.3",
     "p-lazy": "^5.0.0",
-    "react": "^19.1.0",
+    "react": "^19.1.2",
     "react-day-picker": "^9.7.0",
-    "react-dom": "^19.1.0",
+    "react-dom": "^19.1.2",
     "react-headroom": "^3.2.1",
     "schema-dts": "^1.1.5",
     "server-only": "^0.0.1",
@@ -79,7 +79,7 @@
     "@bigcommerce/eslint-config-catalyst": "workspace:^",
     "@faker-js/faker": "^9.8.0",
     "@gql.tada/cli-utils": "^1.6.3",
-    "@next/bundle-analyzer": "15.2.3",
+    "@next/bundle-analyzer": "15.5.7",
     "@playwright/test": "^1.52.0",
     "@tailwindcss/container-queries": "^0.1.1",
     "@tailwindcss/typography": "^0.5.16",
@@ -94,7 +94,7 @@
     "dotenv": "^16.5.0",
     "dotenv-cli": "^8.0.0",
     "eslint": "^8.57.1",
-    "eslint-config-next": "15.2.3",
+    "eslint-config-next": "15.5.7",
     "postcss": "^8.5.4",
     "postcss-preset-env": "^10.2.1",
     "prettier": "^3.6.2",