fix(build): upgrade stable Next.js and capture collision diagnostics

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -477,3 +477,15 @@ jobs:
           ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
           TURBO_CACHE_DIR: .turbo
         run: bunx turbo run build --filter=@sim/app
+
+      - name: Upload conflicting build assets
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: build-collision-diagnostics
+          path: |
+            apps/sim/.next/????????????????.js
+            apps/sim/.next/????????????????.map
+          include-hidden-files: true
+          if-no-files-found: ignore
+          retention-days: 7

apps/docs/package.json

@@ -28,7 +28,7 @@
     "fumadocs-mdx": "14.3.2",
     "fumadocs-openapi": "10.8.1",
     "fumadocs-ui": "16.8.5",
-    "next": "16.3.4",
+    "next": "16.3.6",
     "next-themes": "^0.4.6",
     "react": "19.2.4",
     "react-dom": "19.2.4",

apps/sim/package.json

@@ -212,7 +212,7 @@
     "mssql": "12.7.0",
     "mysql2": "3.24.2",
     "neo4j-driver": "6.0.1",
-    "next": "16.3.4",
+    "next": "16.3.6",
     "next-mdx-remote": "^6.0.0",
     "next-themes": "^0.4.6",
     "nodemailer": "9.1.1",
@@ -261,7 +261,7 @@
     "zustand": "^5.0.13"
   },
   "devDependencies": {
-    "@next/env": "16.3.4",
+    "@next/env": "16.3.6",
     "@sim/testing": "workspace:*",
     "@sim/tsconfig": "workspace:*",
     "@tailwindcss/postcss": "^4.3.3",

bun.lock

@@ -3,6 +3,8 @@ exact = true
 # Supply-chain gate: only install package versions published at least 7 days ago
 # (blocks freshly published, potentially compromised releases).
 minimumReleaseAge = 604800
+# Reviewed Next.js 16.3.6 security patch; remove after 2026-09-29 once it clears the age gate.
+minimumReleaseAgeExcludes = ["next"]
 
 [run]
 env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }

bunfig.toml

@@ -126,8 +126,8 @@
   "overrides": {
     "react": "19.2.4",
     "react-dom": "19.2.4",
-    "next": "16.3.4",
-    "@next/env": "16.3.4",
+    "next": "16.3.6",
+    "@next/env": "16.3.6",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.5",
     "minimatch": "^10.2.5",
@@ -150,10 +150,10 @@
     "ws": "8.21.3"
   },
   "optionalDependencies": {
-    "@next/swc-darwin-arm64": "16.3.4",
-    "@next/swc-darwin-x64": "16.3.4",
-    "@next/swc-linux-arm64-gnu": "16.3.4",
-    "@next/swc-linux-x64-gnu": "16.3.4"
+    "@next/swc-darwin-arm64": "16.3.6",
+    "@next/swc-darwin-x64": "16.3.6",
+    "@next/swc-linux-arm64-gnu": "16.3.6",
+    "@next/swc-linux-x64-gnu": "16.3.6"
   },
   "devDependencies": {
     "@babel/parser": "7.29.2",

package.json

@@ -85,7 +85,7 @@
     "class-variance-authority": "^0.7.1",
     "framer-motion": "^12.5.0",
     "input-otp": "^1.4.2",
-    "next": "16.3.4",
+    "next": "16.3.6",
     "prismjs": "^1.30.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",

packages/emcn/package.json

@@ -49,7 +49,7 @@
   },
   "devDependencies": {
     "@clack/prompts": "1.7.0",
-    "@next/env": "16.3.4",
+    "@next/env": "16.3.6",
     "@sim/deployment-config": "workspace:*",
     "@sim/security": "workspace:*",
     "@sim/tsconfig": "workspace:*",

packages/sim-setup/package.json

@@ -60,7 +60,7 @@
   },
   "devDependencies": {
     "@sim/tsconfig": "workspace:*",
-    "next": "16.3.4",
+    "next": "16.3.6",
     "stripe": "18.5.0",
     "typescript": "^7.0.2",
     "vitest": "^5.0.1"