[JuroUhlar]

Part of INTER-2697.

Context

GHSA-2464-fhr4-w9xw | GHSA-673q-mjm6-r5xr

Why

The Next.js example apps pin [email protected], which has 2 critical remote code execution advisories fixed in 16.4.1.

Things to note

• Examples only. The published @fingerprint/react package doesn't depend on next, so there's no changeset and no release.
• The lockfile diff only touches next and its own sub-dependencies (@next/*, sharp, @img/*, @swc/helpers, postcss, @emnapi/runtime).
• next-env.d.ts in both examples is regenerated by Next 16.4, which adds a root-params.d.ts import.

Verification

Locally, after building the SDK: both examples build on next 16.4.2 with React 18 (with a placeholder NEXT_PUBLIC_FPJS_PUBLIC_API_KEY), and typecheck and lint pass in both. The e2e matrix, including React 19, runs in CI only.

Change outline

Example	next from	next to
examples/next	16.2.10	16.4.2
examples/next-appDir	16.2.10	16.4.2

---

Generated by Claude Code

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	96.79%	151/156
🟢	Branches	95.51%	85/89
🟢	Functions	97.78%	44/45
🟢	Lines	97.33%	146/150

Test suite run success

43 tests passing in 15 suites.

Report generated by 🧪jest coverage report action from 6a0da9c

Show full coverage report

St	File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
🟢	All files	96.79	95.5	97.77	97.33
🟢	src	100	100	100	100
🟢	detect-env.ts	100	100	100	100
🟢	env.types.ts	100	100	100	100
🟢	...nt-context.ts	100	100	100	100
🟢	ssr.ts	100	100	100	100
🟢	...sitor-data.ts	100	100	100	100
🟢	src/components	100	100	100	100
🟢	...-provider.tsx	100	100	100	100
🟢	...vironment.tsx	100	100	100	100
🟢	src/utils	88.09	87.5	92.3	90
🟢	...is-defined.ts	100	100	100	100
🟢	...-cache-key.ts	80.76	83.33	85.71	84	5,10,43,52
🟢	to-error.ts	100	100	100	100
🟢	...mise-store.ts	100	100	100	100

[Copilot]

🟢 Approval recommended

Both dependency-pin changes match the lockfile and compatibility requirements, with no unresolved findings.

No open issues 🎉

What changed in this PR

Updates the Next.js examples to address the security advisories cited in the PR, without changing the published @fingerprint/react package.

Changes:

• Bumps next from 16.2.10 to 16.4.2 in both example apps.
• Keeps both examples on the same pinned Next.js version.

File	Description
examples/​next/​package.json	Updates the Pages Router example’s Next.js dependency.
examples/​next-appDir/​package.json	Updates the App Router example’s Next.js dependency.

_{Review effort: Balanced}

[github-actions]

🚀 Following releases will be created using changesets from this PR:

@fingerprint/[email protected]

Minor Changes

• Support tags in useVisitorData and deprecate tag (7e66a5c)

Patch Changes

• Bump @fingerprint/agent dependency to ^4.1.6 (7e66a5c)

[Copilot]

🔵 Needs a closer look

No concrete defects were identified, but the React 18/19 end-to-end CI results remain unverified for this framework and native-dependency upgrade.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Successful React 18/19 CI results remain unconfirmed for the framework, generated types, and native-dependency updates.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

_{Review effort: Balanced}