Next 16.2.5 support (because of Next.js vulnerability)

See: https://github.com/advisories/GHSA-c4j6-fc7j-m34r → CVSS 8.6

Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected.

Tried [email protected] and [email protected] → both fail to build with our [email protected] setup:

• Webpack build: "You are attempting to export 'metadata' from a component marked with 'use client'" on every .mdx page (Nextra wraps MDX in a client component; Next 16.2.x no longer allows metadata export through that wrapper).
• Turbopack build: Module not found: next-mdx-import-source-file — Nextra's MDX import source isn't being aliased.

Nextra status: [email protected] is the latest published; no released version is compatible with Next 16.2.x yet.

I really want to upgrade NextJS to at least 16.2.5, but Nextra does not support it. Is there a way to fix? Is there an alpha/beta version?

We have no WebSocket endpoints on our application (for now), so are not at risk, but I can imagine that does not hold for all users of Nextra