# Which Problems Are Solved
Temporary update of nextjs and react to fix major CVE (described #11140)
Build passing and force dependency for old deps, but we will need to
update packages (I update qrcode-react, minimal impact, not feasible for
react-hook-form which needs more work).
# How the Problems Are Solved
Upgrade dependencies to patched version of the same major and minor,
remove experimental flag dynamicIO and added flag useCache (used in
code)
# Additional Changes
# Additional Context
- https://nextjs.org/blog/CVE-2025-66478
-
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Co-authored-by: Max Peintner <peintnerm@gmail.com>
