[MantisClone]

Problem

Request Scan needs the October Next.js and Node.js security updates, including the eMudhra certificate-trust fix. Tracked in REQ-719.

Proposed Solution

• Pin Next.js 15.5.28, sharp 0.35.5 and Node 22.23.4; use the Node pin in CI.
• Update React to 19.1.10 and the packages needed for compatibility, and adapt the two detail pages to asynchronous route parameters.
• Add an address-rendering smoke check and separate dependency caches by Node version.

Design Rationale

Next 15.5.28 is the patched 15.x release. React and route-parameter changes support that upgrade; the existing search behavior and Hasura queries stay unchanged. The explicit sharp pin ensures the patched image-processing dependency is installed.

Considerations

• Local checks passed: clean install, five tests, TypeScript, Biome, workflow validation, production build and HTTP smoke checks. The selected Node binary accepted a trusted HTTPS control and rejected all 14 compromised-chain test hosts. Two existing hook-dependency warnings remain.
• Browser testing and real staging request/address lookups are pending. CI's dummy upstream does not validate request data. Easypanel's actual build/serving Node and certificate stores still need verification; the source pin alone does not establish deployed versions.
• The inspected source has no Server Actions; image-processing RCE exposure in the deployed image has not been established.
• Merging to main automatically deploys staging. Production remains a separate human-triggered workflow. If a regression appears, fix it forward while retaining the security patches; do not restore the vulnerable version.

UAT

On staging, search for an existing request and address, open the request details and both address tabs, then reload both pages. Confirm the existing data remains available. Verify the resulting image's versions and certificate behavior before repeating these checks in production.

[MantisClone]

• fix: update Request Scan framework and Node security versions #121 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The reviewed changes appear safe to merge.

Summary

Updates Next.js, React, sharp, and Node, and adapts both detail pages to asynchronous route parameters.

• Request Scan builds on pinned Next.js and Node.js releases.
• Request and address detail pages resolve their route IDs asynchronously.
• CI checks that an address page renders its route ID.

_{Reviews (1) · Last reviewed commit: "fix: update Request Scan framework and N..." · Reviewed by Greptile}

[MantisClone]

Merge activity

• Oct 30, 1:29 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Oct 30, 1:30 AM UTC: @MantisClone merged this pull request with Graphite.