chore: Move nextJS from v15 to v16

[brunomenezes]

Summary

Next.js 15 reaches end of maintenance on 21 Oct 2026 — about five weeks away. After that date it receives no security patches at all. The framework has been shipping roughly monthly security releases, two of them rated Critical, so sitting on an unsupported line is not a position we want to be in.

Patching to the latest 15.x would buy five weeks and then need doing again. This goes straight to Next 16, which supersedes every fix in that patch and puts us back on a supported line.

No user-facing changes. No features added, removed or altered — same pages, same behaviour.

What changed

	From	To
next	15.5.9	16.3.5
react / react-dom	19.2.4	19.3.0
storybook	9.1.10	9.1.20
vite	7.1.9	7.3.6

The Storybook and Vite bumps are required, not incidental: Storybook 9.1.10 refuses to install alongside Next 16, and 9.1.20 also closes two known dev-server vulnerabilities that affect developer machines (not production).

Beyond dependencies, four things were needed:

• Turbopack is now the default bundler for next build. Next 16 fails the build if a custom webpack config is present. Ours only existed to work around a pino-pretty resolution issue — that package is no longer in the dependency tree at all, so the workaround was removed rather than ported.
• Stricter type checking at build time surfaced ten pre-existing type errors, all in test fixtures (placeholder strings passed where a route path was expected). Application code was already correct; the fixtures were typed properly rather than silenced.
• next-env.d.ts is no longer tracked in git. Next 16 gives dev and build separate output directories, so this generated file now rewrites itself depending on which command ran last. Next's own documentation reversed its previous guidance and asks for it to be gitignored.
• agentRules: false in next.config.js stops Next 16 from generating AGENTS.md and CLAUDE.md in the repo root on every next dev.

CI now builds

build.yml ran format, lint and tests but never actually built the app — a bundler regression would have shown up on a Vercel deploy rather than in CI. Given this PR changes the bundler, a build step was added.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
staking	Ready	Preview	Sep 18, 2026 4:36pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@​15.5.9 ⏵ 16.3.5	-4	+75
	@​storybook/​react@​9.1.10 ⏵ 9.1.20
	@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	@​storybook/​nextjs-vite@​9.1.10 ⏵ 9.1.20	-2		-23
	@​types/​react@​19.2.14 ⏵ 19.3.0
	vite@​7.1.9 ⏵ 7.3.6	+1	+31		-1
	react@​19.2.4 ⏵ 19.3.0	+1		+1
	@​storybook/​addon-onboarding@​9.1.10 ⏵ 9.1.20	+1
	storybook@​9.1.10 ⏵ 9.1.20		+22
	react-dom@​19.2.4 ⏵ 19.3.0			+1
	react-is@​19.2.4 ⏵ 19.3.0	+1		+1
	eslint-plugin-storybook@​9.1.10 ⏵ 9.1.20
	@​storybook/​addon-links@​9.1.10 ⏵ 9.1.20

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm storybook is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/storybook@9.1.20 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/storybook@9.1.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm storybook is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/storybook@9.1.20 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/storybook@9.1.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm storybook is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/storybook@9.1.20 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/storybook@9.1.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[coveralls]

Coverage Report for CI Build 35369518353

Coverage remained the same at 66.43%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	3800
Covered Lines:	2648
Line Coverage:	69.68%
Relevant Branches:	1982
Covered Branches:	1193
Branch Coverage:	60.19%
Branches in Coverage %:	Yes
Coverage Strength:	29.84 hits per line

---

💛 - Coveralls