feat(security) Allow end users to get automatic security patches without having to do a release of this package

[stefanoruth]

By addding ^ to the most common dependencies we allow other developers consuming this package to get security updates (patches) without having to release a new version of this package everytime.

Currently i see a code fix for using nextjs 16.0.10 that have been fixed 5 days ago, but there is no release for it yet unfortunatly.

---

Summary by cubic

Enable automatic security updates for consumers by switching fixed dependency versions to caret ranges in components, preview-server, and react-email. Compatible patches (and minors where safe) now roll in without releasing a new package version.

• Dependencies
  • Switched to caret ranges for: next, react, react-dom, typescript, nypm, prompts, tsconfig-paths, and related @types.
  • Updated pnpm-lock.yaml to reflect new ranges.

^{Written for commit 302dfe5. Summary will update automatically on new commits.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 302dfe5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

@stefanoruth is attempting to deploy a commit to the resend Team on Vercel.

A member of the Team first needs to authorize it.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/resend/react-email/@react-email/components@2739

npm i https://pkg.pr.new/resend/react-email/@react-email/preview-server@2739

npm i https://pkg.pr.new/resend/react-email@2739

commit: 302dfe5

[cubic-dev-ai]

No issues found across 3 files

[gabrielmfern]

We can do this for other packages, but not for Next.js. We publish a built version of the Next app and the built app between different versions of Next.js is not guaranteed to not break, and it has broken before so we'd rather keep this one pinned.