fpvetleseter gets a Vercel security bump for a critical React RCE

Vercel's security bot opened a pull request against fpvetleseter's fork to upgrade React and Next.js to patched releases. The advisory it cites describes an unauthenticated remote code execution flaw in the wire format that React Server Components use to stream content from server to browser - the kind of bug where a malicious request can run code on your server without ever logging in.

The PR is narrow on purpose: bump the framework packages, no application rework, no change to how the fork actually uses Server Components. It's open, not merged. The bot warns it can't guarantee the upgrade is clean, so the maintainer still has to confirm nothing else breaks on the way in.