Bump Next, React, and @opennextjs/aws to fix vulnerabilities (#1042)

Author: vicb

.changeset/common-chairs-reply.md

@@ -0,0 +1,9 @@
+---
+"@opennextjs/cloudflare": patch
+---
+
+Bump Next, React, and @opennextjs/aws to fix vulnerabilities (CVE-2025-55184 and CVE-2025-55183)
+
+See <https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components>
+See <https://nextjs.org/blog/security-update-2025-12-11>
+See <https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.5>

create-cloudflare/next/package.json

@@ -14,9 +14,9 @@
 	},
 	"dependencies": {
 		"@opennextjs/cloudflare": "^1.14.4",
-		"next": "15.5.7",
-		"react": "19.1.2",
-		"react-dom": "19.1.2"
+		"next": "15.5.8",
+		"react": "19.1.3",
+		"react-dom": "19.1.3"
 	},
 	"devDependencies": {
 		"@eslint/eslintrc": "^3",

examples/bugs/gh-119/package.json

@@ -14,7 +14,7 @@
 		"cf-typegen": "wrangler types --env-interface CloudflareEnv"
 	},
 	"dependencies": {
-		"next": "15.5.7",
+		"next": "15.5.8",
 		"react-dom": "^18.3.1",
 		"react": "^18.3.1"
 	},

examples/bugs/gh-219/package.json

@@ -28,12 +28,12 @@
 		"nanoid": "^5.0.9",
 		"next-auth": "^4.24.11",
 		"next-themes": "^0.4.4",
-		"next": "15.5.7",
+		"next": "15.5.8",
 		"qrcode.react": "^4.2.0",
-		"react-dom": "^19.0.0",
+		"react-dom": "^19.0.2",
 		"react-hook-form": "^7.54.2",
 		"react-icons": "^5.4.0",
-		"react": "^19.0.0",
+		"react": "^19.0.2",
 		"sonner": "^1.7.1",
 		"tailwind-merge": "^2.6.0",
 		"tailwindcss-animate": "^1.0.7",

examples/bugs/gh-223/package.json

@@ -16,9 +16,9 @@
 	"dependencies": {
 		"@aws-sdk/client-s3": "^3.721.0",
 		"@aws-sdk/s3-request-presigner": "^3.721.0",
-		"next": "15.5.7",
-		"react": "^19.0.0",
-		"react-dom": "^19.0.0"
+		"next": "15.5.8",
+		"react": "^19.0.2",
+		"react-dom": "^19.0.2"
 	},
 	"devDependencies": {
 		"@cloudflare/workers-types": "catalog:",

examples/playground15/package.json

@@ -16,9 +16,9 @@
 		"cf-typegen": "wrangler types --env-interface CloudflareEnv"
 	},
 	"dependencies": {
-		"next": "^15.5.7",
-		"react": "^19.0.0",
-		"react-dom": "^19.0.0"
+		"next": "^15.5.8",
+		"react": "^19.0.2",
+		"react-dom": "^19.0.2"
 	},
 	"devDependencies": {
 		"@opennextjs/cloudflare": "workspace:*",

packages/cloudflare/package.json

@@ -54,7 +54,7 @@
 	"dependencies": {
 		"@ast-grep/napi": "0.40.0",
 		"@dotenvx/dotenvx": "catalog:",
-		"@opennextjs/aws": "3.9.4",
+		"@opennextjs/aws": "3.9.5",
 		"cloudflare": "^4.4.1",
 		"enquirer": "^2.4.1",
 		"glob": "catalog:",
@@ -86,6 +86,6 @@
 	},
 	"peerDependencies": {
 		"wrangler": "catalog:",
-		"next": "14 - 14.2 || 14.3.0-canary.0 - 14.3.0-canary.76 || ~15.0.5 || ~15.1.9 || ~15.2.6 || ~15.3.6 || ~15.4.8 || ~15.5.7 || ^16.0.7"
+		"next": "^14.2.34 || ~15.0.6 || ~15.1.10 || ~15.2.7 || ~15.3.7 || ~15.4.9 || ~15.5.8 || ^16.0.9"
 	}
 }