fix: bump next to 16.2.4 in frontend
From the PR description
Summary
Fixes the broken npm install --prefix frontend reported during local setup.
The frontend pinned next@16.0.3, but @opennextjs/cloudflare@^1.13.1 resolves to 1.19.6, which requires next peer >=15.5.15 <16 || >=16.2.3. This caused ERESOLVE errors and forced contributors to use --legacy-peer-deps. Additionally, next@16.0.3 is flagged by CVE-2025-66478.
Changes
frontend/package.jsonnext:16.0.3→16.2.4eslint-config-next:16.0.3→16.2.4
frontend/package-lock.jsonregenerated
Verification
rm -rf node_modules package-lock.json && npm installcompletes cleanly with no--legacy-peer-deps.npm run build --prefix frontendcompiles successfully and TypeScript passes (the prerender step requires populatedfrontend/.env.local, which is expected for fresh local setups).- Vulnerabilities reported by
npm audit: 9 (1 critical, 1 high, 7 moderate) → 8 (all moderate).
Test plan
- Pull branch on a clean checkout, run
npm install --prefix frontendwithout flags - expect success. - Populate
frontend/.env.localand runnpm run build --prefix frontend- expect end-to-end build success. - Run
npm run dev --prefix frontendand smoke-test the app athttp://localhost:3000.
Our analysis
Bump Next.js to clear a critical CVE and fix the install break — read the full analysis →
Think the analysis missed something the PR description covers?
Capture this PR into my fork
Download a Markdown prompt that tells Claude how to port every
commit in this PR into your working tree. Run it via
claude -p < capture-pull-1.md from
inside the repo you want the changes in.