chore: merge 1.3.6 back into canary (#2766)

* chore: fix next.js and react CVEs

* Version Packages (canary)

Author: chanceaclark

core/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 1.3.6
+
+### Patch Changes
+
+- [#2762](https://github.com/bigcommerce/catalyst/pull/2762) [`7f3a184`](https://github.com/bigcommerce/catalyst/commit/7f3a184508acb50a09ecbdb811ec5ce34865e363) Thanks [@chanceaclark](https://github.com/chanceaclark)! - # Next.js 15.5.8 Upgrade
+
+  Catalyst has been upgraded to Next.js 15.5.8. This is a patch version upgrade that requires migration steps for existing stores to fix a security vulnerability.
+
+  ## 🔒 Critical Security Update
+
+  **This upgrade addresses a critical security vulnerability ([CVE-2025-55184 + CVE-2025-55183](https://nextjs.org/blog/security-update-2025-12-11))** that affects React Server Components. These vulnerabilities allow a Denial of Service attack and Source Code Exposure attach. This upgrade includes:
+  - Next.js 15.5.8 with the security patch
+  - React 19.1.3 and React DOM 19.1.3 with the security patch
+
+  **All users are strongly encouraged to upgrade immediately.**
+
+  ## Key Changes
+  - ⚡ **Next.js 15.5.8**: Upgraded from Next.js 15.5.7 to 15.5.8
+  - ⚛️ **React 19**: Upgraded to React 19.1.3 and React DOM 19.1.3
+
+  ## Migration Guide
+
+  ### Update Dependencies
+
+  If you're maintaining a custom Catalyst store, update your `package.json`:
+
+  ```json
+  {
+    "dependencies": {
+      "next": "15.5.8",
+      "react": "19.1.3",
+      "react-dom": "19.1.3"
+    },
+    "devDependencies": {
+      "@next/bundle-analyzer": "15.5.8",
+      "eslint-config-next": "15.5.8"
+    }
+  }
+  ```
+
+  Then run:
+
+  ```bash
+  pnpm install
+  ```
+
 ## 1.3.5
 
 ### Patch Changes

core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bigcommerce/catalyst-core",
   "description": "BigCommerce Catalyst is a Next.js starter kit for building headless BigCommerce storefronts.",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "private": true,
   "scripts": {
     "dev": "npm run generate && next dev",
@@ -57,14 +57,14 @@
     "lodash.debounce": "^4.0.8",
     "lru-cache": "^11.1.0",
     "lucide-react": "^0.474.0",
-    "next": "15.5.7",
+    "next": "15.5.8",
     "next-auth": "5.0.0-beta.30",
     "next-intl": "^4.1.0",
     "nuqs": "^2.4.3",
     "p-lazy": "^5.0.0",
-    "react": "^19.1.2",
+    "react": "19.1.3",
     "react-day-picker": "^9.7.0",
-    "react-dom": "^19.1.2",
+    "react-dom": "19.1.3",
     "react-headroom": "^3.2.1",
     "schema-dts": "^1.1.5",
     "server-only": "^0.0.1",
@@ -79,7 +79,7 @@
     "@bigcommerce/eslint-config-catalyst": "workspace:^",
     "@faker-js/faker": "^9.8.0",
     "@gql.tada/cli-utils": "^1.6.3",
-    "@next/bundle-analyzer": "15.5.7",
+    "@next/bundle-analyzer": "15.5.8",
     "@playwright/test": "^1.52.0",
     "@tailwindcss/container-queries": "^0.1.1",
     "@tailwindcss/typography": "^0.5.16",
@@ -94,7 +94,7 @@
     "dotenv": "^16.5.0",
     "dotenv-cli": "^8.0.0",
     "eslint": "^8.57.1",
-    "eslint-config-next": "15.5.7",
+    "eslint-config-next": "15.5.8",
     "postcss": "^8.5.4",
     "postcss-preset-env": "^10.2.1",
     "prettier": "^3.6.2",