Sync ncd copy to upstream gitlab/main (tree = gitlab/main 6db4473)

GitLab (guncad-index) is the maintained upstream and what production
runs. This records ncd/main's history (fc4edc4, Next 16.4.0) as merged
but keeps upstream's tree exactly, so ncd/main fast-forwards with no
force push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015TH5RRwUukmnBav9aoro9S

Dockerfile

@@ -17,7 +17,17 @@ FROM docker.io/library/node:$nodever-alpine AS prod
 WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN addgroup -S nextjs && adduser -S nextjs -G nextjs
+RUN addgroup -S nextjs && adduser -S nextjs -G nextjs \
+    && apk add --no-cache --upgrade "libcrypto3>=3.5.8-r0" "libssl3>=3.5.8-r0" \
+    && rm -rf \
+        /usr/local/lib/node_modules/npm \
+        /usr/local/lib/node_modules/corepack \
+        /opt/yarn-v* \
+        /usr/local/bin/npm \
+        /usr/local/bin/npx \
+        /usr/local/bin/corepack \
+        /usr/local/bin/yarn \
+        /usr/local/bin/yarnpkg
 # Copy standalone server and assets
 COPY --from=builder /app/.next/standalone ./
 COPY --from=builder /app/.next/static ./.next/static

next.config.ts

@@ -1,8 +1,12 @@
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
-  /* config options here */
   output: "standalone",
+  // App uses Chakra Image (plain <img> to /public). Next Image Optimization
+  // is unused and is the GHSA-2xp9-vwfh-vxw4 AVIF RCE surface.
+  images: {
+    unoptimized: true,
+  },
   experimental: {
     optimizePackageImports: ["@chakra-ui/react"],
   },

package.json

@@ -1,6 +1,6 @@
 {
   "name": "lmgcitfy",
-  "version": "0.1.1",
+  "version": "0.1.0",
   "description": "Helping people use the search feature on GunCAD Index",
   "private": true,
   "scripts": {
@@ -12,10 +12,10 @@
   "dependencies": {
     "@chakra-ui/react": "^3.32.0",
     "@emotion/react": "^11.14.0",
-    "next": "16.4.0",
+    "next": "16.3.4",
     "next-themes": "^0.4.6",
-    "react": "19.2.3",
-    "react-dom": "19.2.3",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
     "react-icons": "^5.5.0"
   },
   "devDependencies": {
@@ -24,8 +24,11 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "eslint": "^9",
-    "eslint-config-next": "16.4.0",
+    "eslint-config-next": "16.3.4",
     "tailwindcss": "^4",
     "typescript": "^5"
+  },
+  "overrides": {
+    "yaml": "1.10.3"
   }
 }