[JuroUhlar]

Part of INTER-2697.

Context

GHSA-2464-fhr4-w9xw | GHSA-673q-mjm6-r5xr

Why

The Next.js example apps pin next@16.2.10, which has 2 critical remote code execution advisories fixed in 16.4.1.

Things to note

• Examples only. The published @fingerprint/react package doesn't depend on next, so there's no changeset and no release.
• The lockfile diff is large, but only next and its own sub-dependencies changed (@next/*, sharp, @swc/helpers, postcss). The rest is pnpm adding a peer suffix (supports-color@8.1.1) to existing entries, which the new next triggers. Re-resolving main without this bump changes nothing.

Verification

Locally, after building the SDK: both examples build on next 16.4.2 with React 18 (with a placeholder NEXT_PUBLIC_FPJS_PUBLIC_API_KEY), and typecheck and lint pass in both. The e2e matrix, including React 19, runs in CI only.

Change outline

Example	next from	next to
examples/next	16.2.10	16.4.2
examples/next-appDir	16.2.10	16.4.2

---

Generated by Claude Code

[github-actions]

⚠️ This PR doesn't contain any changesets. If there are user-facing changes, don't forget to run:

pnpm exec changeset

to create a changeset.

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	96.79%	151/156
🟢	Branches	95.51%	85/89
🟢	Functions	97.78%	44/45
🟢	Lines	97.33%	146/150

Test suite run success

41 tests passing in 15 suites.

Report generated by 🧪jest coverage report action from 772b4d3

Show full coverage report

St	File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
🟢	All files	96.79	95.5	97.77	97.33
🟢	src	100	100	100	100
🟢	detect-env.ts	100	100	100	100
🟢	env.types.ts	100	100	100	100
🟢	...nt-context.ts	100	100	100	100
🟢	ssr.ts	100	100	100	100
🟢	...sitor-data.ts	100	100	100	100
🟢	src/components	100	100	100	100
🟢	...-provider.tsx	100	100	100	100
🟢	...vironment.tsx	100	100	100	100
🟢	src/utils	88.09	87.5	92.3	90
🟢	...is-defined.ts	100	100	100	100
🟢	...-cache-key.ts	80.76	83.33	85.71	84	5,10,43,52
🟢	to-error.ts	100	100	100	100
🟢	...mise-store.ts	100	100	100	100

[Copilot]

🟢 Approval recommended

Both dependency-pin changes match the lockfile and compatibility requirements, with no unresolved findings.

No open issues 🎉

What changed in this PR

Updates the Next.js examples to address the security advisories cited in the PR, without changing the published @fingerprint/react package.

Changes:

• Bumps next from 16.2.10 to 16.4.2 in both example apps.
• Keeps both examples on the same pinned Next.js version.

File	Description
examples/​next/​package.json	Updates the Pages Router example’s Next.js dependency.
examples/​next-appDir/​package.json	Updates the App Router example’s Next.js dependency.

_{Review effort: Balanced}