Upgrade Next.js to 14.2.33 to fix SSRF vulnerability (CVE-2025-57822)

[Copilot]

• Upgrade Next.js from 14.2.31 to 14.2.33 to fix SSRF vulnerability (GHSA-4342-x723-ch2f / CVE-2025-57822)
• Upgrade eslint-config-next to 14.2.33 to match Next.js version
• Run npm audit fix to address other vulnerabilities (js-yaml, playwright, vite)
• Verify build works with upgraded dependencies
• Run tests to confirm no regressions
• Run code review and security checks
• Add Node.js version requirements (>=20.0.0) via engines field and .nvmrc for Vercel deployment

Original prompt

upgrade next.js because of its currently vulnerability

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
weakauras	Ready	Preview	Comment	Dec 10, 2025 5:46pm

[fx]

@copilot The build has failed now

Error: Node.js Version "18.x" is discontinued and must be upgraded. Please set Node.js Version to 24.x in your Project Settings to use Node.js 24. Learn More: http://vercel.link/node-version

[Copilot]

@copilot The build has failed now

Error: Node.js Version "18.x" is discontinued and must be upgraded. Please set Node.js Version to 24.x in your Project Settings to use Node.js 24. Learn More: http:/...

Fixed in 37e0d38. Added Node.js version requirements:

• Added engines field to package.json specifying node: ">=20.0.0"
• Added .nvmrc file with version 20 for Vercel deployment

This should resolve the Vercel build failure by specifying Node.js 20 as the required version.

[fx]

👌👀👌👀👌👀👌👀👌👀 good shit go౦ԁ sHit👌 thats ✔ some good👌👌shit right👌👌there👌👌👌 right✔there ✔✔if i do ƽaү so my self 💯 i say so 💯 thats what im talking about right there right there (chorus: ʳᶦᵍʰᵗ ᵗʰᵉʳᵉ) mMMMMᎷМ💯 👌👌 👌НO0ОଠOOOOOОଠଠOoooᵒᵒᵒᵒᵒᵒᵒᵒᵒ👌 👌👌 👌 💯 👌 👀 👀 👀 👌👌Good shit

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.78%. Comparing base (73c8565) to head (37e0d38).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #18   +/-   ##
=======================================
  Coverage   56.78%   56.78%           
=======================================
  Files          35       35           
  Lines         678      678           
  Branches       29       29           
=======================================
  Hits          385      385           
  Misses        281      281           
  Partials       12       12           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR upgrades Next.js from version 14.2.31 to 14.2.33 to address a critical SSRF (Server-Side Request Forgery) vulnerability (CVE-2025-57822 / GHSA-4342-x723-ch2f). The upgrade ensures the application is protected against this security vulnerability while maintaining compatibility with the existing codebase.

Key changes:

• Next.js upgraded to 14.2.33 to fix SSRF vulnerability
• Related packages updated for version consistency (eslint-config-next, transitive dependencies)
• Node.js version requirement formalized with engines field and .nvmrc file

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
package.json	Updated Next.js to 14.2.33, eslint-config-next to 14.2.33, and added engines field requiring Node.js >=20.0.0
package-lock.json	Updated lock file with new versions of Next.js, its platform-specific binaries, eslint-config-next, and transitive dependencies (glob, js-yaml, playwright, vite)
.nvmrc	Added Node.js version specification (20) for consistent development environment and Vercel deployment
public/index.json	Reordered Rogue: Outlaw entry (likely from running prebuild script, no functional change)