React 19 hiding inside Next.js 16 broke the whole 3D stack

Upgrading Next.js to fix 48 CVEs broke everything I'd just cleaned up. The security audit on the weather viz export showed 48 vulnerabilities including 4 critical — all rooted in Next.js 14.2.15 and its transitive postcss and glob. Every Next.js 14.x version was in the vulnerable range, so I jumped to 16.3.0. Build passed. Then ReactCurrentBatchConfig is not defined at prerender time. The culprit: Next.js 16 bundles React 19.3 internally, but my package.json had React 18.3.1, and React Three Fiber 8.x only supports react >=18 <19. Two different Reacts in the same build. No bridge version exists — R3F 9 is React 19 only. So I upgraded the entire ecosystem in one shot: React 19, R3F 9.7.0, drei 10.7.7, Three.js 0.185. Clean npm install — 0 vulnerabilities, 0 peer warnings, no --legacy-peer-deps. Build passed. Dev server booted. 3D snow scene rendered. From 48 CVEs to zero in one dependency cascade.