fix(examples): keep Next.js overrides within supported majors (#7102)

## What does this PR do?

The bare `next: ^16.0.10` override forces Next 14 and 15 examples onto
16.1.3, while examples that declare Next 16 resolve to 16.2.3. This
removes the bare override and replaces the overlapping ranges with two
major-scoped security floors:

- Next 15: `15.5.24`
- Next 16: `16.3.3`

These are the patched versions for
[GHSA-2xp9-vwfh-vxw4](https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4)
and
[GHSA-p293-qw3h-jr36](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36).
The rationale is recorded alongside the overrides.

Neither advisory has a Next 14 fix. State Machine, Travel, and the v1
Pages Router example therefore explicitly declare `15.5.24`. The other
nine manifests retain their existing Next ranges. This avoids keeping
those three apps on an unsupported major or silently moving them across
majors through another override.

The updated lockfile covers all 12 Next importers and their compiler,
image-processing, and peer dependencies. Unrelated package versions are
preserved.

The v1 Pages Router example also needs two compatibility adjustments
when it actually runs on Next 15: bundle the SDK's global KaTeX styles
and use the [documented ESM interoperability
setting](https://nextjs.org/docs/messages/import-esm-externals) for
`react-syntax-highlighter`/`refractor`. Its API route now lets
`OpenAIAdapter` create the default client, avoiding a
duplicate-OpenAI-type error that also reproduces with the previous Next
16.1.3 resolution.

## Validation

Node 22.23.2 and pnpm 10.33.4:

- `pnpm install --frozen-lockfile` passes for all 70 workspace projects.
- Resolution audit: nine importers resolve to Next 15.5.24 and three to
Next 16.3.3; every importer matches its declared major.
- Nx production builds pass for State Machine, Travel, the v1 Pages
Router example, `examples/v2/next-pages-router` (which uses the App
Router), and Chat With Your Data (Next 16.3.3).
- Changed source/configuration files pass formatting and lint checks.
- A clean merge with current main (`06b8901d4`) also passes
dependency-reference checks and `pnpm install --frozen-lockfile
--lockfile-only --ignore-scripts` across its 75 workspace projects.

Builds use a placeholder OpenAI key. Next reports the existing
dynamic-import warning from the runtime's channel manager; the v1 Pages
Router build also reports its warning about opting into `esmExternals:
"loose"`.

## Related PRs and Issues

Addresses the Next.js half of #6423. The separate Pino fix is #7089.
This PR does not change Pino or MCP dependencies; the MCP follow-up was
handled separately in #7095.

## Checklist

- [x] I have read the contribution guide.
- [x] The regenerated lockfile is included and the frozen install
passes.
- [x] Allow edits by maintainers.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Improvements**
* Updated the Pages Router, state machine, and travel examples for
compatibility with newer Next.js releases.
* Improved the Pages Router example’s handling of module compatibility
and syntax highlighting dependencies.
* Simplified the example API configuration by using the adapter’s
standard setup.
* Updated supported Next.js version ranges and security-floor settings
across the project.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

examples/v1/next-pages-router/next.config.mjs

@@ -1,6 +1,12 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   reactStrictMode: true,
+  // Bundle the SDK's global KaTeX CSS for the Pages Router.
+  transpilePackages: ["@copilotkit/react-core"],
+  experimental: {
+    // react-syntax-highlighter's CommonJS entry loads ESM refractor languages.
+    esmExternals: "loose",
+  },
 };
 
 export default nextConfig;

examples/v1/next-pages-router/package.json

@@ -18,7 +18,7 @@
     "@google/generative-ai": "^0.11.2",
     "@heroicons/react": "^2.0.18",
     "clsx": "^1.2.1",
-    "next": "14.2.35",
+    "next": "15.5.24",
     "openai": "^4.85.1",
     "react": "^18",
     "react-dom": "^18"

examples/v1/next-pages-router/pages/api/copilotkit.ts

@@ -3,11 +3,9 @@ import {
   OpenAIAdapter,
   copilotRuntimeNextJSPagesRouterEndpoint,
 } from "@copilotkit/runtime";
-import { NextApiRequest, NextApiResponse } from "next";
-import OpenAI from "openai";
+import type { NextApiRequest, NextApiResponse } from "next";
 
-const openai = new OpenAI();
-const serviceAdapter = new OpenAIAdapter({ openai });
+const serviceAdapter = new OpenAIAdapter();
 
 const runtime = new CopilotRuntime({
   actions: [

examples/v1/state-machine/package.json

@@ -15,7 +15,7 @@
     "@copilotkit/runtime-client-gql": "workspace:*",
     "clsx": "^1.2.1",
     "motion": "^11.18.1",
-    "next": "14.2.35",
+    "next": "15.5.24",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "reactflow": "^11.11.4",

examples/v1/travel/package.json

@@ -33,7 +33,7 @@
     "groq-sdk": "^0.5.0",
     "leaflet": "^1.9.4",
     "lucide-react": "^0.414.0",
-    "next": "14.2.35",
+    "next": "15.5.24",
     "openai": "^4.85.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",

package.json

@@ -106,20 +106,20 @@
         "react-dom": "*"
       }
     },
+    "//": "Next.js overrides keep each supported major on its security floor (GHSA-2xp9-vwfh-vxw4, GHSA-p293-qw3h-jr36). Next 14 examples declare Next 15 explicitly because neither advisory has a Next 14 fix.",
     "overrides": {
       "streamdown>react": "^19.0.0",
       "@types/react": "19.1.8",
       "@types/react-dom": "^19.0.2",
       "react": "19.2.3",
       "react-dom": "19.2.3",
-      "next@<=15.4.11": "15.4.11",
-      "next@>=15.5.0 <15.5.15": "15.5.15",
+      "next@>=15.0.0 <15.5.24": "15.5.24",
+      "next@>=16.0.0 <16.3.3": "16.3.3",
       "send@<=0.19.0": "0.19.0",
       "path-to-regexp@<=0.1.12": "0.1.13",
       "serve-static@<=1.16.0": "1.16.0",
       "prismjs@<=1.30.0": "1.30.0",
       "@copilotkit/license-verifier": "~0.5.0",
-      "next": "^16.0.10",
       "defu@<=6.1.4": ">=6.1.5",
       "minimatch": ">=9.0.6",
       "minimatch@>=10.0.0 <10.2.1": ">=10.2.1",
@@ -168,7 +168,6 @@
       "file-type": ">=21.3.1",
       "@langchain/community": ">=1.1.14",
       "langsmith": ">=0.5.18",
-      "next@>=16.0.0 <16.2.3": "16.2.3",
       "validator": ">=13.15.20",
       "markdown-it": ">=14.1.1",
       "mdast-util-to-hast@>=13.0.0 <13.2.1": ">=13.2.1",