Skip to content

Release v3.0.1 - Critical Security Patches

Latest
Latest

Choose a tag to compare

View all tags
@rlajous rlajous released this 04 Dec 19:45
· 29 commits to main since this release
v3.0.1
49a3b8e

Released: December 4, 2025

🔒 Security Updates

This release addresses critical security vulnerabilities affecting React Server Components and Next.js:

  • CVE-2025-55182: React Server Components vulnerability in React 19
  • CVE-2025-66478: Next.js vulnerability affecting versions 15.x-16.x

Security Patches Applied

  • Next.js: 16.0.6 → 16.0.7
  • React: 19.2.0 → 19.2.1
  • React-DOM: 19.2.0 → 19.2.1
  • eslint-config-next: 16.0.6 → 16.0.7

Impact: These patches fix vulnerabilities in React Server Components that could potentially be exploited in server-side rendering scenarios. All users are strongly encouraged to update immediately.

🔧 Configuration Updates

Node.js Version Requirement

  • Node.js: Updated requirement from >=20.9.0 to >=22.0.0
  • .nvmrc: Updated from v20.9.0 to v22.12.0

Reason: Eliminates compatibility warnings from @react-email packages which require Node.js >=22.0.0 for optimal performance.

Action Required: If you're running this locally, upgrade to Node.js 22:

nvm install
nvm use
npm install

✅ Testing & Validation

All automated tests passed:

  • TypeScript compilation ✓
  • Production build ✓
  • Development server ✓
  • Production server ✓
  • No hydration errors ✓

📦 Dependencies

Security Updates

  • next: 16.0.6 → 16.0.7
  • react: 19.2.0 → 19.2.1
  • react-dom: 19.2.0 → 19.2.1
  • eslint-config-next: 16.0.6 → 16.0.7

Configuration

  • Node.js engine requirement: 20.9.0 → 22.0.0

🚀 Deployment

This release was automatically deployed via Vercel:

📋 Files Changed

3 files modified:

  • .nvmrc - Node.js version specification
  • package.json - Dependency versions and engine requirements
  • package-lock.json - Dependency resolution updates

🔗 References

Full Changelog: v3.0.0...v3.0.1

Assets 2
Loading