build(deps): upgrade Next.js examples to 16.2.6

[arcjet-rei]

What

Bumps next and eslint-config-next from ^15.5.18 → 16.2.6 (exact) in all 9 nextjs-* examples, and regenerates their lockfiles.

Why

@arcjet/next and nosecone-next already dev-depend on Next.js 16.2.6, but the examples still pinned Next 15.5.18. Because the examples live in the monorepo, the hoisted @next/swc@16.2.6 native binary gets loaded under an example's Next 15.5.18 during next build, which fails with:

⚠ Mismatching @next/swc version, detected: 16.2.6 while Next.js is on 15.5.18
Failed to compile.
  Caused by: unknown field `disablePageConfig`

(Surfaced on PR #6089's example builds; it affects any PR that builds the examples.)

Next's @next/swc version check is exact, so the fix is to put the whole tree on a single Next version. Pinning the examples to the exact 16.2.6 the SDK packages use guarantees no skew (matching their existing exact-pin convention).

This unblocks the security fixes that are backed up behind the Next 16 move.

Scope / notes

• React is already on 19 in every example (satisfies Next 16's peer), Node engine requirement (>=20.9) is met, and the next.config.* files are trivial (empty or just reactStrictMode) — so no other changes were needed.
• Verified next build + tsc --noEmit locally on representative examples covering the App Router (nextjs-react-hook-form), the Pages Router (nextjs-pages-wrap), and a next.config.ts (nextjs-server-actions). CI builds the rest.
• The diff is intentionally just package.json + package-lock.json ×9; the tsconfig.json/next-env.d.ts that next build auto-rewrites are regenerated at build time and were left out.

Known follow-up

Next 16 removed next lint, so the examples' "lint": "next lint" scripts no longer work (these are not run in CI). Migrating them to the ESLint CLI / flat config is left as a separate follow-up — happy to fold it in here if preferred.

🤖 Generated with Claude Code

[arcjet-review]

Arcjet Review — 🟡 Medium Risk

Decision: Approved

Rationale: This PR only updates Next.js and eslint-config-next versions in example package.json files. It triggers the dependency-changes escalation trigger and is a major dependency upgrade from Next.js 15 to 16, so the risk is Medium. I am approving because the changes are limited to examples, pin exact versions, and do not introduce application logic, auth changes, secrets, or direct input-handling changes. No security issues were identified in the diff.

Summary of Changes

Upgrades multiple Next.js example projects from next/eslint-config-next ^15.5.18 to pinned version 16.2.6.

Escalation Triggers

• Dependency Changes: Multiple package.json files update next and eslint-config-next from 15.x to 16.2.6.

Review Focus Areas

• Confirm the examples have been built or smoke-tested against Next.js 16.2.6.
  This is a major Next.js upgrade and may introduce breaking changes even though the modified files are examples.
• Confirm whether a root or per-example lockfile needs to be updated alongside these package.json changes.
  If lockfiles are committed in this repository, leaving them unchanged can cause installs or CI to use stale dependency resolution.

Notes

Dependency audit: Next.js and eslint-config-next are well-known dependencies, and this PR pins exact versions, which reduces version drift. The main residual risk is major-version compatibility across the examples.

Path filtering: 9 files excluded by ignore paths. 9 of 18 files included in review.

_{Review: fd29ad22 | Model: openai/gpt-5.5 | Powered by Arcjet Review}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​arcjet/​inspect@​1.5.0 ⏵ 1.5.0
	@​arcjet/​ip@​1.5.0 ⏵ 1.5.0
	@​nosecone/​sveltekit@​1.5.0
	eslint-config-next@​15.5.18 ⏵ 16.2.6	+1		+3

View full report

[qw-in]

I'll submit this to the queue as I think its blocking #6089?