fix(ui): bump next to 16.4.0 so the preview server runs on Next.js 16.4

[AmineBenzaazaa]

Fixes #3785

Problem

@react-email/ui ships a prebuilt .next that only loads on the Next.js minor it was built with, and it pins next to exactly 16.3.3. Next.js 16.4 reads a new server/preview-props.json manifest during app.prepare() that a 16.3 build doesn't emit. Projects on Next 16.4 that dedupe next (e.g. "@react-email/ui>next": "$next") therefore fail on email dev with:

Error: ENOENT: no such file or directory, open '.../@react-email/ui/.next/server/preview-props.json'

Adding the manifest by hand isn't enough (the 16.3 server chunks then 500 on 16.4), so the preview app has to be rebuilt against 16.4.

Fix

Bump next in the catalog to 16.4.0 (current latest) and update the lockfile. The lockfile diff only touches next, @next/*, and next's own sharp/@img/* deps.

Verification

• Reproduced on canary: packed react-email + @react-email/ui, installed them in a project on next@16.4.0 with the override from the issue, and email dev failed with the ENOENT above.
• After the bump, @react-email/ui builds on Next.js 16.4.0 and emits .next/server/preview-props.json. With the repacked tarballs in the same project, email dev starts, /, /preview/<template> and ?view=source return 200 with the rendered email, and /_next/static chunks load.
• email build also succeeds on Next.js 16.4.0.
• packages/ui tests pass (111/111), tsc --noEmit is clean in packages/ui and packages/react-email, and biome check is clean.
• Not built locally: apps/web and apps/demo, which also take next from the catalog; leaving those to CI.

🤖 Generated with Claude Code

---

Summary by cubic

Fixes email dev failing on Next.js 16.4 by bumping the catalog's next to 16.4.1 so @react-email/ui's prebuilt preview server matches the runtime it ships with.

Next 16.4 reads a server/preview-props.json manifest during app.prepare() that the 16.3 build doesn't emit, so email dev crashed with ENOENT when next was deduped to 16.4. Rebuilding against 16.4.1 emits the manifest and compatible server chunks, and a build on 16.4.1 also runs in projects that dedupe to 16.4.0. 16.4.1 additionally fixes three Next security advisories with no 16.3 backport (GHSA-673q-mjm6-r5xr, GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r). The lockfile diff only touches next, @next/*, and sharp/@img/*.

^{Written for commit 4571b97. Summary will update on new commits.}

[vercel]

@AmineBenzaazaa is attempting to deploy a commit to the resend Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4571b97

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@react-email/ui	Patch
react-email	Patch
@react-email/editor	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR