Update Next.js to a Patched Version (Netlify Security Block + Build Failures)

[mariana-caldas]

What do we need to build or fix?

Netlify is currently blocking all deploys of the Web Dev Path platform because the version of Next.js (15.3.2) used in our project is affected by a critical security vulnerability (reported by Netlify as CVE-2025-55182). When we tried to deploy recent changes (including the new Mailjet API keys, which affect our ability to receive messages), Netlify refused the deploy with an HTTP 400 error and a message saying that our Next.js version is vulnerable and must be updated.

This means:

• No new deploys can go live until we upgrade Next.js.

• The build completes, but the deploy step is blocked by Netlify’s security checks.

• Our production pipeline is effectively frozen until this library is updated.

We need to upgrade Next.js to a patched version and ensure the app still builds and runs correctly so Netlify will allow deploys again.

---

Technical details
Current relevant entries in package.json:

"dependencies": {
"next": "^15.3.2",
"react": "^19.1.0",
"react-dom": "^19.1.0",
...
}

Netlify is blocking deploys for this Next.js version. The fix is to:

Pin Next.js to a patched, secure 15.x version (no ^). Example:

"next": "15.4.8"

1. or another current patched version in the 15.x line that satisfies the Netlify requirement.

Keep React and ReactDOM versions aligned with the chosen Next.js version.
Initially, we can try to keep the current React versions:

"react": "19.1.0",
"react-dom": "19.1.0"
If the build or runtime throws compatibility errors, fall back to React 18 LTS:

"react": "18.3.1",
"react-dom": "18.3.1"

After updating package.json, run the following locally with yarn:

rm -rf node_modules .next
yarn install
yarn build

3. • If yarn build passes: open a PR with the updated package.json and yarn.lock.

   • If yarn build fails: fix any compatibility or type errors surfaced by the upgrade (for example, any Next.js API changes or stricter checks).

4. Once the PR is merged, Netlify should detect the updated Next.js version and allow deploys again.

---

Approach suggestions

1. Primary approach (recommended)

   • Pin Next.js to a patched version within the 15.x line (for example, 15.4.8).

   • Keep React and ReactDOM at 19.1.0 initially.

   • Run yarn build locally; if the build and dev server work fine, proceed with a PR.

   • Verify that routing, pages, API routes, and PWA behavior remain intact.

2. Fallback approach (if compatibility issues arise)

   • If the new Next.js version complains about React 19, downgrade React and ReactDOM to 18.3.1, then:

     • Re-run yarn install

     • Re-run yarn build

   • Fix any minor breaking changes introduced by the Next.js upgrade (e.g., warnings about deprecated APIs, stricter config validations).

---

Deadline
Once you assign this task to yourself, you’ll need to complete it within 5 days.

---

Acceptance criteria

• next in package.json is updated to a patched, secure version and pinned (no ^).

• react and react-dom are aligned with the chosen Next.js version and do not cause build/runtime issues.

• yarn install and yarn build run successfully on a local environment.

• The site deploys successfully on Netlify without the Next.js vulnerability warning.

• Key flows (home, blog, project pages, contact forms, etc.) work as expected after the upgrade.

• Test the section and components in many screen sizes, using the browser Inspect/DevTools.

• Verify that the updated dependencies do not break other parts of the application (navigation, images, PWA behavior, etc.).

• Test the feature in multiple browsers: Chrome, Firefox, Edge, and Safari (macOS).

• If there are any build problems when submitting your PR, run yarn build locally to solve the issues and commit the necessary fixes.

• Update the CHANGELOG.md file to document:

  • The Next.js security upgrade (version change).

  • Any additional code changes required to make the project compatible with the new Next/React version.