bump Next and React version for CVE-2026-23864 (#1096)

Author: vicb

create-cloudflare/next/package.json

@@ -14,16 +14,16 @@
 	},
 	"dependencies": {
 		"@opennextjs/cloudflare": "^1.15.1",
-		"next": "16.1.4",
-		"react": "19.1.4",
-		"react-dom": "19.1.4"
+		"next": "16.1.5",
+		"react": "19.1.5",
+		"react-dom": "19.1.5"
 	},
 	"devDependencies": {
 		"@eslint/eslintrc": "^3",
 		"@tailwindcss/postcss": "^4",
 		"@types/node": "^20",
-		"@types/react": "^19",
-		"@types/react-dom": "^19",
+		"@types/react": "^19.1.5",
+		"@types/react-dom": "^19.1.5",
 		"eslint": "^9",
 		"eslint-config-next": "15.4.6",
 		"tailwindcss": "^4",

examples/bugs/gh-119/package.json

@@ -14,7 +14,7 @@
 		"cf-typegen": "wrangler types --env-interface CloudflareEnv"
 	},
 	"dependencies": {
-		"next": "15.5.9",
+		"next": "15.5.10",
 		"react-dom": "^18.3.1",
 		"react": "^18.3.1"
 	},

examples/bugs/gh-219/package.json

@@ -28,12 +28,12 @@
 		"nanoid": "^5.0.9",
 		"next-auth": "^4.24.11",
 		"next-themes": "^0.4.4",
-		"next": "15.5.9",
+		"next": "15.5.10",
 		"qrcode.react": "^4.2.0",
-		"react-dom": "^19.0.3",
+		"react-dom": "^19.0.4",
 		"react-hook-form": "^7.54.2",
 		"react-icons": "^5.4.0",
-		"react": "^19.0.3",
+		"react": "^19.0.4",
 		"sonner": "^1.7.1",
 		"tailwind-merge": "^2.6.0",
 		"tailwindcss-animate": "^1.0.7",

examples/bugs/gh-223/package.json

@@ -16,17 +16,17 @@
 	"dependencies": {
 		"@aws-sdk/client-s3": "^3.971.0",
 		"@aws-sdk/s3-request-presigner": "^3.971.0",
-		"next": "15.5.9",
-		"react": "^19.0.3",
-		"react-dom": "^19.0.3"
+		"next": "15.5.10",
+		"react": "^19.0.4",
+		"react-dom": "^19.0.4"
 	},
 	"devDependencies": {
 		"@cloudflare/workers-types": "catalog:",
 		"@opennextjs/cloudflare": "workspace:*",
 		"@playwright/test": "catalog:",
 		"@types/node": "^22.10.2",
-		"@types/react": "^19.0.3",
-		"@types/react-dom": "^19.0.3",
+		"@types/react": "^19.0.4",
+		"@types/react-dom": "^19.0.4",
 		"eslint": "^9.17.0",
 		"eslint-config-next": "15.1.3",
 		"postcss": "^8.4.49",

examples/playground15/package.json

@@ -16,9 +16,9 @@
 		"cf-typegen": "wrangler types --env-interface CloudflareEnv"
 	},
 	"dependencies": {
-		"next": "^15.5.9",
-		"react": "^19.0.3",
-		"react-dom": "^19.0.3"
+		"next": "^15.5.10",
+		"react": "^19.0.4",
+		"react-dom": "^19.0.4"
 	},
 	"devDependencies": {
 		"@opennextjs/cloudflare": "workspace:*",

examples/playground16/package.json

@@ -17,17 +17,17 @@
 		"cf-typegen": "wrangler types --env-interface CloudflareEnv"
 	},
 	"dependencies": {
-		"next": "16.1.4",
-		"react-dom": "19.2.3",
-		"react": "19.2.3"
+		"next": "16.1.5",
+		"react-dom": "19.2.4",
+		"react": "19.2.4"
 	},
 	"devDependencies": {
 		"@opennextjs/cloudflare": "workspace:*",
 		"@playwright/test": "catalog:",
 		"@tailwindcss/postcss": "^4",
 		"@types/node": "catalog:",
-		"@types/react-dom": "^19.2",
-		"@types/react": "^19.2",
+		"@types/react-dom": "^19.2.3",
+		"@types/react": "^19.2.4",
 		"tailwindcss": "^4",
 		"wrangler": "catalog:"
 	}

examples/ssg-app/package.json

@@ -13,16 +13,16 @@
 		"e2e": "playwright test -c e2e/playwright.config.ts"
 	},
 	"dependencies": {
-		"react": "^19.0.3",
-		"react-dom": "^19.0.3",
-		"next": "15.5.9"
+		"react": "^19.0.4",
+		"react-dom": "^19.0.4",
+		"next": "15.5.10"
 	},
 	"devDependencies": {
 		"@opennextjs/cloudflare": "workspace:*",
 		"@playwright/test": "catalog:",
 		"@types/node": "catalog:",
-		"@types/react": "^19",
-		"@types/react-dom": "^19",
+		"@types/react": "^19.0.4",
+		"@types/react-dom": "^19.0.4",
 		"typescript": "catalog:",
 		"wrangler": "catalog:"
 	}

packages/cloudflare/package.json

@@ -86,6 +86,6 @@
 	},
 	"peerDependencies": {
 		"wrangler": "catalog:",
-		"next": "^14.2.35 || ~15.0.7 || ~15.1.11 || ~15.2.8 || ~15.3.8 || ~15.4.10 || ~15.5.9 || ^16.0.10"
+		"next": "~15.0.8 || ~15.1.12 || ~15.2.9 || ~15.3.9 || ~15.4.11 || ~15.5.10 || ~16.0.11 || ^16.1.5"
 	}
 }