[OOlashyn]

Fixed for Critical Issues in Next.js
https://nextjs.org/blog/nextjs-security-update-october-14-2026

and in Node.js
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Dependency changes

Package	Before	After	Reason
next	16.3.8	16.4.2	Critical: remote code execution in the image optimizer with SVGs (GHSA-2464-fhr4-w9xw), remote code execution in use cache functions returning typed arrays (GHSA-673q-mjm6-r5xr), denial of service through Server Actions (GHSA-p3m5-59mp-jv5r)
eslint-config-next	16.3.8	16.4.2	Kept in step with next
@react-email/ui (dev)	^6.9.5	^6.11.3	Older versions depend on a vulnerable next
sharp (root devDependency)	0.34.3	removed	High: bundled libvips, libheif and librsvg CVEs. Nothing imports it directly; next brings in its own fixed sharp@0.35.5

allowScripts: removed sharp@0.34.3 and changed esbuild@0.28.1 to esbuild@0.28.2, because the @react-email/ui bump pulled in that esbuild patch version.

Runtime / CI changes

• .nvmrc (new): 24.22.1, the patched Node 24 LTS.
• package.json: "engines": { "node": "24.x" }. Vercel takes the Node major version from this field, so production is pinned to Node 24 from the repo.
• ci.yml: Node now comes from node-version-file: ".nvmrc" with check-latest: true, and a new step runs npm audit --omit=dev --audit-level=high after npm ci.
• vercel.json: installCommand changed from npm install to npm ci, so Vercel installs exactly what's in the lockfile.

Contributors

After pulling, switch to Node 24.22.1 (nvm use reads .nvmrc) and run npm ci.

• next-env.d.ts: removed from git tracking. It's already in .gitignore, Next.js regenerates it on every next dev and next build, and its import paths differ between the two, so it changed on every build.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
web	Ready	Preview	Oct 25, 2026 2:40am UTC