chore(deps): update Next.js 16.3, React, Prisma, MUI, and related packages - #160
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
cursor
Bot
changed the title
cursor
Bot
changed the title
- next 16.2.6 → 16.2.12 - react / react-dom 19.2.6 → 19.2.8 - next-auth 4.24.14 → 4.24.15 - @trpc/* 11.17.0 → 11.18.0 - @tanstack/react-query 5.100.11 → 5.101.4 - @next/eslint-plugin-next, @types/react, @types/react-dom
- next 16.2.12 → 16.3.0 - @next/eslint-plugin-next 16.2.12 → 16.3.0 - pnpm minimumReleaseAgeExclude entries for fresh 16.3 packages - next-env.d.ts route type paths updated by Next 16.3
Prisma: - prisma, @prisma/client, @prisma/adapter-pg 7.8.0 → 7.9.1 UI & runtime: - @mui/material, @mui/icons-material 9.0.1 → 9.2.0 - @mui/lab 9.0.0-beta.3 → 9.0.0-beta.6 - @mui/x-charts 9.3.0 → 9.10.1 - @react-three/fiber 9.6.1 → 9.7.0 - three 0.183.2 → 0.185.1, @types/three 0.173.0 → 0.185.3 - axios 1.16.1 → 1.19.0, sharp 0.34.5 → 0.35.3 - monaco-editor 0.55.1 → 0.56.0 - react-resizable-panels, react-virtuoso, sanitize-html, joi, etc. Dev tooling: - eslint 10.4.0 → 10.8.0, prettier 3.8.3 → 3.9.6 - typescript-eslint 8.59.4 → 8.66.0, sass, tsx, semantic-release Prettier 3.9 reformatted union types in a few files (no logic changes).
Next.js 16.3.0 + Turbopack + Pages Router i18n breaks Vercel routing: /api/* requests fall through to static /en/404 instead of serverless functions (known adapter issue; i18n-api-support test disabled for Turbopack). 16.2.12 previews work; keep other dependency updates.
- Design doc: App Router requirement, i18n conflict, Vercel 16.3 gate, phased rollout - TODO checklist for phases 0-4 - CLAUDE.md imports AGENTS.md - AGENTS.md: Instant Nav doc paths and Pages Router guardrail
Retry 16.3.0 after adapter-vercel i18n API routing fix. Local production build and API smoke tests pass (/api/auth/session, /api/trpc/*). Vercel preview verification pending.
- Add app/internal-marketing/[locale] with generateMetadata, MUI AppRouterCacheProvider, and shared client shell (tRPC, Redux, Session, Apollo, i18n).
- Extend src/proxy.ts: merge former /api/config edge handler, rewrite / and /{locale} to internal-marketing, inject x-dstruct-app-locale for root html lang/dir.
- Replace createTRPCNext/withTRPC with createTRPCReact + TrpcProvider in _app and App layout; drop @trpc/next.
- Move landing UI from pages/index to MarketingHomeView (remove pages/index to avoid App/Pages / conflict per Next 16).
- Add loadI18nForLocale, AppRouterI18nProvider split from Pages I18nProvider.
Co-authored-by: Max Kayander <mkayander@users.noreply.github.com>
- Proxy: bare locale rewrites only; exclude /api/* from matcher - AppRootLayoutClient: CookieConsentRoot - app/layout: font variables - next.config: cacheComponents TODO comment - Prettier fix for #128 files after rebase onto main
cursor
Bot
force-pushed
the
cursor/update-nextjs-react-8f0a
branch
from
August 4, 2026 21:14
75b045e to
be49144
Compare
…pilot 16.3.0 + Pages i18n still routes /api/* and / to /en/404 on Vercel. Keep App Router marketing home and other dependency upgrades; retry 16.3.x when Turbopack preview API routing is fixed.
Shared chrome (app bar, side panel, cookie banner, search/slug hooks) used next/router, which throws on App Router. Route through next/compat/router and pathname fallbacks so Pages and App shells share UI.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Pages i18n cannot rewrite bare /{locale} into App routes (invoke becomes
/{locale}/internal-marketing/... → 404; Vercel / was edge NOT_FOUND).
Restore pages/index with MarketingHomeView; keep App internal-marketing
as Instant Nav pilot. Proxy only handles /api/config + pilot locale header.
Replace window.location.assign (DOM text → navigation sink) with an isLocale-guarded App Router redirect child so Pages Router tests and shells do not call next/navigation useRouter unconditionally.
CodeQL flags template-built URLs from Select values (DOM text sink).
Look up bare home paths from a fixed Record<Locales, string> after
isLocale validation instead of interpolating /{locale}.
Parse MUI Select values through a literal switch map so DOM text never flows directly into router.push or locale redirect state. Replaces the old window.location.assign path that triggered CodeQL alert #16.
mkayander
marked this pull request as ready for review
August 9, 2026 19:26
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
🎉 This PR is included in version 1.380.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
mkayander
added a commit
that referenced
this pull request
Aug 9, 2026
* chore(deps): retry Next.js 16.3.0 and extract shared app shell Phase 1: bump next and @next/eslint-plugin-next to 16.3.0 (local lint, test, build pass — Vercel API routing must be verified on preview). Prep for public App cutover: - Move authOptions to src/server/auth/authOptions.ts - Add AppShellProviders shared by Pages _app and AppRootLayoutClient * fix(deps): stay on Next.js 16.2.12 — Vercel API routing still broken on 16.3.0 Preview smoke on PR #165: /api/auth/session and /api/trpc/* return 404 with x-matched-path: /en/404 (same regression as #160). Keep authOptions and AppShellProviders refactor; defer 16.3.x until adapter/i18n fix lands. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SidePanel CodeQL follow-up
Removes the last DOM → navigation taint path in the language picker:
parseSelectLocaleValue()— literalswitchmap from select value toLocales(CodeQL sanitizer)handleChangeLocalenow takes a typedLocalesargument;onChangeparses via the switch before anyrouter.push/ redirect statelocaleBareHomePath()static lookupThe PR review comment on old line 83 (
window.location.assign) is from an earlier commit; this change supersedes that path entirely.