fix(ui): bump next to 16.4.0 so the preview server runs on Next.js 16.4

Merged
AM
1d ago
+176-171

Fixes #3785

Problem

@react-email/ui ships a prebuilt .next that only loads on the Next.js minor it was built with, and it pins next to exactly 16.3.3. Next.js 16.4 reads a new server/preview-props.json manifest during app.prepare() that a 16.3 build doesn't emit. Projects on Next 16.4 that dedupe next (e.g. "@react-email/ui>next": "$next") therefore fail on email dev with:

Error: ENOENT: no such file or directory, open '.../@react-email/ui/.next/server/preview-props.json'

Adding the manifest by hand isn't enough (the 16.3 server chunks then 500 on 16.4), so the preview app has to be rebuilt against 16.4.

Fix

Bump next in the catalog to 16.4.0 (current latest) and update the lockfile. The lockfile diff only touches next, @next/*, and next's own sharp/@img/* deps.

Verification

  • Reproduced on canary: packed react-email + @react-email/ui, installed them in a project on next@16.4.0 with the override from the issue, and email dev failed with the ENOENT above.
  • After the bump, @react-email/ui builds on Next.js 16.4.0 and emits .next/server/preview-props.json. With the repacked tarballs in the same project, email dev starts, /, /preview/<template> and ?view=source return 200 with the rendered email, and /_next/static chunks load.
  • email build also succeeds on Next.js 16.4.0.
  • packages/ui tests pass (111/111), tsc --noEmit is clean in packages/ui and packages/react-email, and biome check is clean.
  • Not built locally: apps/web and apps/demo, which also take next from the catalog; leaving those to CI.

🤖 Generated with Claude Code

Summary by cubic

Fixes email dev failing on Next.js 16.4 by bumping the catalog's next to 16.4.1 so @react-email/ui's prebuilt preview server matches the runtime it ships with.

Next 16.4 reads a server/preview-props.json manifest during app.prepare() that the 16.3 build doesn't emit, so email dev crashed with ENOENT when next was deduped to 16.4. Rebuilding against 16.4.1 emits the manifest and compatible server chunks, and a build on 16.4.1 also runs in projects that dedupe to 16.4.0. 16.4.1 additionally fixes three Next security advisories with no 16.3 backport (GHSA-673q-mjm6-r5xr, GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r). The lockfile diff only touches next, @next/*, and sharp/@img/*.