Block vulnerable nextjs versions.

[annajowang]

No description provided.

[annajowang]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a check to block vulnerable versions of Next.js during the build process. The changes include updating the semver dependency, adding a checkNextJSVersion utility function with corresponding tests, and updating the starter project to a safe Next.js version.

My review focuses on improving the robustness of the new version check and fixing an issue in the tests. I've suggested using a more robust condition to handle unspecified versions and extracting the version range string into a constant for better maintainability. I also found a bug in the new tests where assertions for non-throwing cases were not correctly implemented.

[annajowang]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a mechanism to block deployments using vulnerable versions of Next.js. It adds a version check at build time and updates dependencies in starter templates to safe versions. My review focuses on improving the clarity and maintainability of the implementation. I've suggested refactoring the list of safe versions for better readability and correcting a potentially misleading error message that contains placeholder CVE information.

[gemini-code-assist]

The CVE identifiers and URL in the error message appear to be placeholders and are likely incorrect. CVE-2025-55182 and CVE-2025-66478 reference a future year, and the CVEs are different in the message body and the URL. This could cause confusion for users who encounter this error.

To avoid providing misleading information, consider using a more generic error message until the correct CVE details and a valid advisory link are available.

    throw new Error(
      `Vulnerable Next.js version ${version} detected. Deployment blocked. Please update your app's dependencies to a patched Next.js version and redeploy. For more details, see the relevant security advisory.`,
    );

[gavinsharp]

@annajowang I think this change broke my builds, I am seeing the following error in App Hosting Cloud Build logs:

Running "npm exec --prefix /layers/google.nodejs.firebasenextjs/npm_modules apphosting-adapter-nextjs-build"
node:internal/modules/package_json_reader:314
  throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath(base), null);
        ^
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'semver' imported from /layers/google.nodejs.firebasenextjs/npm_modules/node_modules/@apphosting/adapter-nextjs/dist/utils.js
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:314:9)
    at packageResolve (node:internal/modules/esm/resolve:767:81)
    at moduleResolve (node:internal/modules/esm/resolve:853:18)
    at defaultResolve (node:internal/modules/esm/resolve:983:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:731:20)
    at ModuleLoader.resolve (node:internal/modules/esm/loader:708:38)
    at ModuleLoader.getModuleJobForImport (node:internal/modules/esm/loader:310:38)
    at ModuleJob._link (node:internal/modules/esm/module_job:182:49) {
  code: 'ERR_MODULE_NOT_FOUND'
}