[eshurakov]

Summary

CI on main fails at pnpm install --frozen-lockfile from 695a71fd79 (#7042) onward:

ERR_PNPM_OUTDATED_LOCKFILE … pnpm-lock.yaml is not up to date with packages/web-shared/package.json
  - next (lockfile: 16.3.3, manifest: 16.3.6)

The failure comes from two merges that overlapped:

• (janitor/dependencies): fix high/medium Dependabot vulnerabilities #7042 pinned next 16.3.6 with a pnpm-workspace.yaml override and in apps/web.
• [AISAGE-502] feat(ai-gateway): add a standalone ai-gateway app serving /api/v1 from a web-shared package #6806 added packages/web-shared and apps/ai-gateway at 16.3.3.

The override rewrites those packages' specifiers to 16.3.6, so the lockfile no longer matches. Every job that installs dependencies fails. The scheduled production and staging deploys only ship the newest main commit with green CI, so nothing merged after 05e6e5d819 can deploy.

This PR pins next 16.3.6 in both packages, matching apps/web and the override, and refreshes the lockfile. The lockfile change touches only the two importers' next entries and the next@ peer suffix on their @sentry/nextjs and next-auth resolutions. Both packages already resolved to 16.3.6 through the override, so installed versions don't change.

Verification

• pnpm install --frozen-lockfile --lockfile-only on this branch passes.
• The same command on origin/main without this change fails with CI's error (next (lockfile: 16.3.3, manifest: 16.3.6)).
• No build or test run locally: the change is version specifiers only, and CI on this PR covers the rest.

Visual Changes

N/A

Reviewer Notes

@next/bundle-analyzer, @next/mdx and @next/third-parties in apps/web stay at 16.3.3, as #7042 left them, because the override covers only next.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• apps/ai-gateway/package.json
• packages/web-shared/package.json
• pnpm-lock.yaml

Verified that next is now pinned to 16.3.6 in both manifests, matching the pnpm-workspace.yaml override (line 121) and apps/web/apps/storybook. The lockfile importer entries for apps/ai-gateway and packages/web-shared were updated consistently, including the next@16.3.6 peer suffixes on @sentry/nextjs and next-auth; no next@16.3.3 resolution remains. The remaining 16.3.3 references are the @next/* scoped tooling packages, which the override does not cover and which the PR intentionally leaves unchanged.

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}