fix(frontend): upgrade next 16.1.6 → 16.2.6 (advisory close-out)

[mikevitelli]

Closes the 19 Next.js advisories deferred from v0.3.0 — CVSS 8.6 SSRF (GHSA-c4j6-fc7j-m34r), 8.1 Middleware bypass (GHSA-492v-c6pp-mqqv), 7.5 DoS × 3, plus moderates.

The v0.3.0 attempt failed CI because npm install next@16.2.6 from the frontend/ subdir created two copies of next (16.2.6 in frontend, stale 16.1.6 at root from next-auth's peer-dep resolution). TSC saw both and broke next.config.ts:75.

Fix: declare next in root devDependencies so npm hoists a single copy to root that everything (frontend, next-auth peer, eslint-config-next, @next/bundle-analyzer) shares. No more split.

Verified locally: tsc / lint / 212 tests / build all pass.

Frontend-only change — no .deb, no version bump. Vercel auto-deploys on merge to main.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
uconsole-cloud	Ready	Preview, Comment	May 26, 2026 4:22pm

[greptile-apps]

Greptile Summary

This PR upgrades Next.js from 16.1.6 to 16.2.6 across the monorepo to close 19 security advisories (including a CVSS 8.6 SSRF and an 8.1 middleware bypass). The hoisting fix — adding next to root devDependencies — resolves the dual-copy problem that broke tsc in a prior attempt.

• package.json (root): next: ^16.2.6 added to devDependencies so npm workspaces hoist a single resolved copy, eliminating the previous split between the root and frontend/node_modules.
• frontend/package.json: next bumped from the exact pin 16.1.6 to the range ^16.2.6; eslint-config-next was not updated and remains at 16.1.6.
• package-lock.json: All @next/swc-* platform binaries updated to 16.2.6; two duplicate react-is workspace sub-entries removed as a side-effect.

Confidence Score: 4/5

Safe to merge — the dependency upgrade is straightforward and the hoisting strategy is sound. The only rough edge is eslint-config-next trailing behind.

The upgrade itself is clean and the lock file is consistent. The one thing worth fixing is eslint-config-next still being at 16.1.6 while next is now 16.2.6 — the bundled @next/eslint-plugin-next rules are one minor version behind. This won't break a build today but is easy to align in the same commit.

frontend/package.json — eslint-config-next should be bumped to match next 16.2.6.

Important Files Changed

Filename	Overview
frontend/package.json	Upgrades next from 16.1.6 to ^16.2.6; eslint-config-next remains at the old pinned version 16.1.6 — a minor version mismatch worth aligning.
package.json	Adds next ^16.2.6 to root devDependencies to force npm workspace hoisting of a single shared copy; correct and intentional approach.
package-lock.json	Lock file updated to reflect next 16.2.6 across all @next/swc-* binaries and sub-packages; deduplication of react-is workspace copies is a clean side-effect.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[npm install - root workspace] --> B{Hoisting decision}
    B -->|Before PR: conflict| C[next 16.1.6 in node_modules/next\nfrom next-auth peer-dep]
    C --> D[next 16.1.6 also in frontend/node_modules/next]
    D --> E[❌ Two copies → TSC error on next.config.ts:75]
    B -->|After PR: root devDep wins| F[next 16.2.6 hoisted to node_modules/next]
    F --> G[frontend/ workspace symlinks to root copy]
    G --> H[next-auth peer-dep satisfied by same hoisted copy]
    H --> I[✅ Single copy → TSC passes]

Loading

Comments Outside Diff (1)

1. frontend/package.json, line 30 (link)

   eslint-config-next is still pinned to 16.1.6 while next has been upgraded to ^16.2.6. It bundles @next/eslint-plugin-next at the same version (confirmed in package-lock.json), so linting rules are running against 16.1.6 rule sets rather than 16.2.6. Keeping them in sync is the standard recommendation from the Next.js team.

   

_{Reviews (1): Last reviewed commit: "chore(frontend): upgrade next 16.1.6 → 1..." | Re-trigger Greptile}

[greptile-apps]

The previous pin of 16.1.6 has been relaxed to ^16.2.6. While package-lock.json locks the current resolved version, a future npm update or fresh workspace install could pick up an unreviewed minor release (e.g. 16.3.x). Given that the motivation here is a security advisory close-out, re-pinning to the exact resolved version keeps the dependency graph fully deterministic and makes version-bump decisions explicit.

Suggested change

	"next": "^16.2.6",
	"next-auth": "^5.0.0-beta.30",
	"next": "16.2.6",
	"next-auth": "^5.0.0-beta.30",