fix(security): bump react and next (#2170)

Author: juliusmarminge

.changeset/tender-humans-hide.md

@@ -0,0 +1,5 @@
+---
+"create-t3-app": patch
+---
+
+fix(security): bump react ([CVE-2025-55182](https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r))

cli/package.json

@@ -77,19 +77,19 @@
     "@trpc/server": "11.0.0",
     "@types/fs-extra": "^11.0.4",
     "@types/gradient-string": "^1.1.6",
-    "@types/node": "^20.14.10",
+    "@types/node": "^24.10.1",
     "better-auth": "^1.3",
     "drizzle-kit": "^0.30.5",
     "drizzle-orm": "^0.41.0",
     "mysql2": "^3.11.0",
-    "next": "^15.2.3",
+    "next": "^15.5.6",
     "next-auth": "^4.24.7",
     "postgres": "^3.4.4",
     "prettier": "^3.5.3",
     "prettier-plugin-tailwindcss": "^0.6.11",
     "prisma": "^6.6.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.1.2",
+    "react-dom": "^19.1.2",
     "superjson": "^2.2.1",
     "tailwindcss": "^4.0.15",
     "tsup": "^6.7.0",

cli/template/base/package.json

@@ -12,15 +12,15 @@
   },
   "dependencies": {
     "@t3-oss/env-nextjs": "^0.12.0",
-    "next": "^15.2.3",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "next": "^15.5.6",
+    "react": "^19.1.2",
+    "react-dom": "^19.1.2",
     "zod": "^3.24.2"
   },
   "devDependencies": {
-    "@types/node": "^20.14.10",
-    "@types/react": "^19.0.0",
-    "@types/react-dom": "^19.0.0",
+    "@types/node": "^24.10.1",
+    "@types/react": "~19.1.0",
+    "@types/react-dom": "~19.1.0",
     "typescript": "^5.8.2"
   }
 }

package.json

@@ -52,7 +52,7 @@
     "@ianvs/prettier-plugin-sort-imports": "^4.2.1",
     "@manypkg/cli": "^0.20.0",
     "@total-typescript/ts-reset": "^0.3.7",
-    "@types/node": "^20.14.10",
+    "@types/node": "^24.10.1",
     "eslint": "^9.23.0",
     "eslint-plugin-import-x": "^4.9.1",
     "eslint-plugin-isaacscript": "^4.0.0",