chore: bump next to 16.3.3 / 15.5.24 across the Next.js examples

with-crossmint/package.json

@@ -13,7 +13,7 @@
     "@crossmint/client-sdk-react-ui": "4.5.0",
     "@formo/analytics": "^1.38.2",
     "clsx": "^2.1.1",
-    "next": "^16.3.1",
+    "next": "^16.3.3",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "react-transition-group": "^4.4.5",

with-crossmint/pnpm-workspace.yaml

@@ -5,6 +5,17 @@
 # Browser-compat data packages (browserslist ecosystem) update daily — exclude
 # from the release-age gate since they are pure data, not executable code.
 minimumReleaseAgeExclude:
+  # Remove after 2026-09-01, once 16.3.3 is seven days old (fixes GHSA-2xp9-vwfh-vxw4).
+  - 'next@16.3.3'
+  - '@next/env@16.3.3'
+  - '@next/swc-darwin-arm64@16.3.3'
+  - '@next/swc-darwin-x64@16.3.3'
+  - '@next/swc-linux-arm64-gnu@16.3.3'
+  - '@next/swc-linux-arm64-musl@16.3.3'
+  - '@next/swc-linux-x64-gnu@16.3.3'
+  - '@next/swc-linux-x64-musl@16.3.3'
+  - '@next/swc-win32-arm64-msvc@16.3.3'
+  - '@next/swc-win32-x64-msvc@16.3.3'
   # GHSA high-severity ReDoS; every 1.x/2.x/5.x patch is newer than the
   # 7-day gate, so the package is exempted by name rather than by version.
   - brace-expansion

with-metamask/package.json

@@ -21,7 +21,7 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "lucide-react": "^1.31.0",
-    "next": "^15.5.22",
+    "next": "^15.5.24",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "tailwind-merge": "^2.6.1",