Fix Next.js DoS vulnerability (GHSA-h25m-26qc-wcjf)

[Copilot]

CI failing on pnpm audit due to high-severity vulnerability in Next.js <15.0.8: HTTP request deserialization can trigger DoS in React Server Components.

Changes

• packages/adapters/nextjs/package.json

  • next: ^14.0.0 → ^15.0.8 (resolves to 15.5.12)
  • react-dom: ^18.3.1 → ^19.2.4 (align with React 19, eliminate peer dep warning)

• pnpm-lock.yaml

  • Updated to remove vulnerable Next.js 14.x from dependency tree

Security Status

• @objectstack/nextjs: 15.5.12 (patched)
• @objectstack/docs: 16.1.6 (unaffected)

Advisory: GHSA-h25m-26qc-wcjf

Original prompt

引用: https://github.com/objectstack-ai/spec/actions/runs/21822911292/job/62960629039#step:8:1

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectstack-studio	Ready	Preview, Comment	Feb 9, 2026 11:28am
spec	Ready	Preview, Comment	Feb 9, 2026 11:28am

[Copilot]

Pull request overview

Updates the Next.js adapter dependency constraints and lockfile to remediate the GHSA-h25m-26qc-wcjf DoS vulnerability by moving off vulnerable Next.js (<15.0.8) versions.

Changes:

• Bumped @objectstack/nextjs peer/dev dependency on next from ^14.0.0 to ^15.0.8.
• Bumped @objectstack/nextjs peer/dev dependency on react-dom to align with the existing React 19 version.
• Regenerated pnpm-lock.yaml to reflect the updated Next.js dependency tree.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
packages/adapters/nextjs/package.json	Raises Next.js peer/dev dependency floor to patched versions and aligns React DOM peer/dev dependency.
pnpm-lock.yaml	Updates resolved Next.js and transitive dependencies to remove vulnerable 14.x from the tree.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[Copilot]

This PR changes published package peer/dev dependency requirements for @objectstack/nextjs (Next/React versions). If this is intended to ship to consumers, add a Changeset so the version/changelog get bumped appropriately (or apply the repo’s skip-changeset process if you intentionally don’t want a release).

Suggested change

	"react-dom": "^19.2.4",
	"typescript": "^5.0.0"
	"react-dom": "^19.2.4"

[Copilot]

@objectstack/nextjs doesn’t import react/react-dom directly (it only uses next/server). Pinning react/react-dom to ^19.2.4 as peer deps unnecessarily blocks consumers on React 18, which Next 15 still supports. Consider removing these peer deps or widening them to match Next’s supported peer range (and keep them only in devDependencies for local builds).

[Copilot]

next@15.5.12 now requires Node ^18.18.0 || ^19.8.0 || >=20.0.0 (per engines). The repo-level documented/declared minimum is currently >=18.0.0, which is no longer sufficient to install/run this workspace without warnings or potential failures. Consider bumping the repo (and/or package) Node engine requirement to at least >=18.18.0 to match Next 15.