chore(deps): update react and next (CVE-2025-55182)

[bottarocarlo]

This pull request updates the advisory data for GHSA-fv66-9v8q-g76r.json by adding version range information for the affected next and react npm packages. These additions clarify which versions are impacted and when fixes were introduced, improving the accuracy of vulnerability tracking for downstream consumers.

[Copilot]

Pull request overview

This PR enhances the GitHub Security Advisory (GHSA-fv66-9v8q-g76r) for CVE-2025-55182 by adding version range information for the next and react npm packages. The advisory tracks a critical RCE vulnerability in React Server Components that affects multiple React packages and Next.js framework versions.

Key Changes:

• Added 7 version range entries for the next package covering canary and stable releases from 14.3.0-canary.77 through 16.0.7
• Added 3 version range entries for the react package (19.0.0, 19.1.0, and 19.2.0 series) with corresponding fixes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Serubin]

@bottarocarlo perhaps the existing GHSA for Next should be updated to include the CVE alias - advisories/github-reviewed/2025/12/GHSA-9qr9-h5gf-34mp/GHSA-9qr9-h5gf-34mp.json?

[bottarocarlo]

@Serubin this was my initial though #6524 but as per comment #6496 (comment) the cveid cannot be added there

[Serubin]

@bottarocarlo makes sense. You may need to clean up the style issues from Copilot before this gets merged. I would also recommend removing/rejecting the old GHSA as a part of this PR or an immediate follow-up.

[shelbyc]

@bottarocarlo I have a question about the scanning tool you're using and other advisories about CVE-2025-55182, such as GHSA-fmh4-wr37-44fp. The global advisory for GHSA-fmh4-wr37-44fp doesn't have CVE-2025-55182 attached because CVE-2025-55182 is already attached to GHSA-fv66-9v8q-g76r, but the repository advisory for GHSA-fmh4-wr37-44fp lists CVE-2025-55182 as the CVE ID. Would your tool pick up the information from GHSA-9qr9-h5gf-34mp if the repository advisory listed CVE-2025-55182 as the CVE ID?

[Serubin]

@shelbyc, the issue is that GHSA-9qr9-h5gf-34mp doesn't have the correct CVE attached. Scanners may pick up GHSA-9qr9-h5gf-34mp and alert on it, but we cannot determine the canonical ID (CVE) associated with GHSA-9qr9-h5gf-34mp.

Either the next versions affected by CVE-2025-55182 should be added to GHSA-fv66-9v8q-g76r, or CVE-2025-55182 needs to be associated as an alias on GHSA-9qr9-h5gf-34mp (but I understand there is a technical limitation here).