[presendapp]

Fragments resolves next 14.2.35. There is no fixed release in the 14.x line for the critical advisories that affect it, such as GHSA-2xp9-vwfh-vxw4 (unauthenticated remote code execution in the Image Optimization API under certain configurations), so this moves to Next.js 15 and React 19:

• next / @next/third-parties ^15.5.28, eslint-config-next 15.5.28, react / react-dom ^19.2.0, @types/react(-dom) ^19
• next-themes ^0.4.6 and lucide-react ^0.420.0 (first versions whose peer range includes React 19); ThemeProviderProps is now imported from next-themes
• JSX.Element -> React.JSX.Element in components/auth.tsx (the global JSX namespace is gone in @types/react 19)
• @vercel/kv is deprecated: replaced with @upstash/redis through a small lib/kv.ts, reading the same KV_REST_API_URL / KV_REST_API_TOKEN variables and created only when used; the middleware, the publish action and the rate limiter use it
• nanoid ^5.1.16 (5.1.6 has a high-severity advisory)

Checked locally: type check, lint, the 76 tests and next build (including the middleware) pass. Not tested: live KV calls, since I have no Upstash credentials; the calls themselves are unchanged (get, set with px, and the Ratelimit client).

Renovate's #223 also moves next to v15; this PR covers the rest of the migration that a version bump alone does not (React 19 peer ranges, the two type fixes, and replacing the deprecated @vercel/kv), so either can be closed in favour of the other.

[cla-bot]

We require contributors to sign our Contributor License Agreement, and we don't have @presendapp on file. You can sign our CLA at https://e2b.dev/docs/cla . Once you've signed, post a comment here that says '@cla-bot check'

[vercel]

@presendapp is attempting to deploy a commit to the E2B Team on Vercel.

A member of the Team first needs to authorize it.