Upgrade Next.js to 16.3.4 security release

[kenny2077]

Summary

• upgrade next and @next/mdx from the previously locked 16.0.7 release to 16.3.4
• require Node.js 20.9.0 or newer, matching the Next.js 16 runtime requirement
• regenerate both npm and Yarn 1 lockfiles from the official npm registry without changing React or unrelated direct dependencies

Security impact

Next.js 16.3.3 was a security release, and 16.3.4 is its current follow-up release.

Against the current main lockfile, npm audit --omit=dev --package-lock-only classifies next@16.0.7 as a direct critical vulnerability. Its advisory list includes unauthenticated remote-code-execution issues on Windows-hosted servers (GHSA-p293-qw3h-jr36) and in AVIF image optimization (GHSA-2xp9-vwfh-vxw4). After this upgrade, the production audit contains no advisory attributed to next.

Compatibility

The existing >=18.x engine declaration was also looser than Next.js 16's actual >=20.9.0 requirement, so this PR makes that contract explicit.

Verification

• npm ci
• Yarn 1.22.22 install --frozen-lockfile --force --non-interactive
• npx tsc --noEmit
• npx eslint . --ext .js,.jsx,.ts,.tsx --ignore-pattern next-env.d.ts (0 errors; one existing react-hooks/exhaustive-deps warning)
• npm run build
• production smoke tests returned HTTP 200 for /, /class/CSCI1933, and /api/search?q=CSCI
• npm audit --omit=dev --package-lock-only: production findings decrease from 18 to 14, critical findings decrease from 2 to 1, and the next entry is removed
• both lockfiles contain no third-party registry URLs

Scope

The remaining production audit findings include existing sqlite3 and lodash dependency paths and should be handled separately. React, unrelated dependency upgrades, and cleanup of the existing lint script are intentionally excluded from this PR.

[vercel]

@kenny2077 is attempting to deploy a commit to the umn social coding Team on Vercel.

A member of the Team first needs to authorize it.

[devin-ai-integration]

Devin Review found 1 potential issue.

⚠️ 1 issue in files not directly in the diff

⚠️ Yarn installs depend on unrelated mirror

Yarn installs now fetch 31 platform packages from registry.npmmirror.com, including the Linux Next.js compiler. Yarn follows each resolved URL directly. An inaccessible mirror blocks frontend installation and deployment on affected platforms.

[kenny2077]

Resolved the lockfile registry issue in a8b604d. I regenerated yarn.lock with Yarn 1.22.22 against https://registry.npmjs.org, confirmed that both committed lockfiles now reference only registry.npmjs.org, and reran a fresh-cache frozen Yarn install, TypeScript, ESLint, and the production build successfully.