[Security] Urgent: Upgrade Next.js & React to fix critical vulnerability (2025-12-11)

[searchstefano]

Describe the Bug

Description

Both Next.js and React have released critical security updates today (December 11, 2025).
These vulnerabilities include Denial of Service and potential Source Code Exposure in Server Components.

We need to upgrade our core dependencies immediately to patch these issues.

References

• Next.js Advisory: https://nextjs.org/blog/security-update-2025-12-11
• React Advisory: https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components

Task

• Upgrade next to the latest patched version.
• Upgrade react and react-dom to the patched versions (to match the advisory).
• Verify build and basic functionality.

Priority: Critical

Database

PostgreSQL

Relevant log output

Which Umami version are you using? (if relevant)

No response

Which browser are you using? (if relevant)

No response

How are you deploying your application? (if relevant)

No response

[nickradford]

Fixed in v3.0.3
https://github.com/umami-software/umami/releases/tag/v3.0.3