Upgrade to Next.js 16.x #42

New issue

Closed

opened 2026-06-14 02:09:49 +00:00 by james · 0 comments

james commented

2026-06-14 02:09:49 +00:00

Owner

Scope

Bump next and eslint-config-next past the ^15.3.0 cap to the current stable 16.x (npm view next dist-tags reports latest: 16.2.9 at time of writing).
Reconcile every direct and peer-pinned consumer of Next.js: @serwist/next (currently ^9), eslint-config-next, @types/react/react-dom if 16 ships a new floor, and any experimental.* flags in next.config.mjs that 16 has stabilized, renamed, or removed.
Walk the 15→16 breaking-changes list and adapt the codebase: API route handler shapes, middleware runtime config, async params/searchParams follow-ups, image handling, ESLint flat-config changes — whatever 16's changelog actually changes.
Verify the PWA pipeline still functions end-to-end: Serwist build, /sw.js, /manifest.webmanifest, /offline fallback, and the public-allowlist surface from #18.
Refresh .trivyignore entries that referenced bundled Next.js CVEs from 15.x — drop the lines that no longer apply on 16.

Out of scope

Switching bundlers (Turbopack as default) unless it lands as the only supported path on 16.x. Default to staying on webpack if it remains an option, given the project's existing webpack externals in next.config.mjs.
Pre-emptive React 19 or Node major bumps beyond what Next 16's floor requires.

Acceptance criteria

package.json pins Next.js 16.x; npm ci produces a coherent lockfile with no peer-range warnings on @serwist/next or eslint-config-next.
npm run typecheck, npm run lint, npm test, and npm run build all pass.
npm run dev starts clean; the Invalid next.config.mjs options detected: 'nodeMiddleware' warning is gone (either because the experiment was stabilized — drop the flag — or because the schema gap is fixed).
CI pipeline (build, dual-engine tests, security scans) stays green on the upgrade PR.
ADR added under docs/adr/ recording the Next.js major-version pin and the reasoning (per ADR-0001).
Any .trivyignore entries that no longer apply on 16.x are removed; the file's remaining entries still have valid justifications.

Part of epic #1.

## Scope - Bump `next` and `eslint-config-next` past the `^15.3.0` cap to the current stable 16.x (`npm view next dist-tags` reports `latest: 16.2.9` at time of writing). - Reconcile every direct and peer-pinned consumer of Next.js: `@serwist/next` (currently `^9`), `eslint-config-next`, `@types/react`/`react-dom` if 16 ships a new floor, and any `experimental.*` flags in `next.config.mjs` that 16 has stabilized, renamed, or removed. - Walk the 15→16 breaking-changes list and adapt the codebase: API route handler shapes, middleware runtime config, async `params`/`searchParams` follow-ups, image handling, ESLint flat-config changes — whatever 16's changelog actually changes. - Verify the PWA pipeline still functions end-to-end: Serwist build, `/sw.js`, `/manifest.webmanifest`, `/offline` fallback, and the public-allowlist surface from #18. - Refresh `.trivyignore` entries that referenced bundled Next.js CVEs from 15.x — drop the lines that no longer apply on 16. ## Out of scope - Switching bundlers (Turbopack as default) unless it lands as the only supported path on 16.x. Default to staying on webpack if it remains an option, given the project's existing webpack externals in `next.config.mjs`. - Pre-emptive React 19 or Node major bumps beyond what Next 16's floor requires. ## Acceptance criteria - [ ] `package.json` pins Next.js 16.x; `npm ci` produces a coherent lockfile with no peer-range warnings on `@serwist/next` or `eslint-config-next`. - [ ] `npm run typecheck`, `npm run lint`, `npm test`, and `npm run build` all pass. - [ ] `npm run dev` starts clean; the `Invalid next.config.mjs options detected: 'nodeMiddleware'` warning is gone (either because the experiment was stabilized — drop the flag — or because the schema gap is fixed). - [ ] CI pipeline (build, dual-engine tests, security scans) stays green on the upgrade PR. - [ ] ADR added under `docs/adr/` recording the Next.js major-version pin and the reasoning (per ADR-0001). - [ ] Any `.trivyignore` entries that no longer apply on 16.x are removed; the file's remaining entries still have valid justifications. Part of epic #1.

james added the

area:service

label

2026-06-14 02:10:25 +00:00

james referenced this issue from a commit

2026-06-14 19:53:20 +00:00

Upgrade to Next.js 16.x (#42)

james referenced this issue from a pull request that will close it,

2026-06-14 19:53:41 +00:00

Upgrade to Next.js 16.x (#42) #57

james referenced this issue from a commit

2026-06-14 19:58:31 +00:00