fix(security): bump react and next (#2174)

Author: ronitrajfr

.changeset/quick-snakes-give.md

@@ -0,0 +1,5 @@
+---
+"create-t3-app": patch
+---
+
+fix(security): bump react and next ([BLOG](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions))

cli/package.json

@@ -82,14 +82,14 @@
     "drizzle-kit": "^0.30.5",
     "drizzle-orm": "^0.41.0",
     "mysql2": "^3.11.0",
-    "next": "^15.5.6",
+    "next": "^15.5.9",
     "next-auth": "^4.24.7",
     "postgres": "^3.4.4",
     "prettier": "^3.5.3",
     "prettier-plugin-tailwindcss": "^0.6.11",
     "prisma": "^6.6.0",
-    "react": "^19.1.2",
-    "react-dom": "^19.1.2",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
     "superjson": "^2.2.1",
     "tailwindcss": "^4.0.15",
     "tsup": "^6.7.0",

cli/template/base/package.json

@@ -12,9 +12,9 @@
   },
   "dependencies": {
     "@t3-oss/env-nextjs": "^0.12.0",
-    "next": "^15.5.6",
-    "react": "^19.1.2",
-    "react-dom": "^19.1.2",
+    "next": "^15.5.9",
+    "react": "^19.2.3",
+    "react-dom": "^19.2.3",
     "zod": "^3.24.2"
   },
   "devDependencies": {