chore!: next.js 16 prep: pin 'next' peer dep to ^16 (#933) by frano-m · Pull Request #942 · DataBiosphere/findable-ui

frano-m · 2026-05-27T05:57:25Z

Summary

Part of #884 (Next.js 16 upgrade plan). This PR lands the findable-ui-side work needed for consumers to upgrade to Next 16 cleanly.

Peer-dep + audit

Peer dep: next: ^15.5.13 → ^16
Peer dep: next-mdx-remote: ^5.0.0 → ^6.0.0 (fixes GHSA-g4xw-jxrg-5f6m)
Dev dep: add next: ^16, bump next-mdx-remote: ^6.0.0
npm audit fix — picks up safe transitive fixes for handlebars (critical), fast-uri, picomatch, vite (high), ws, yaml, @tootallnate/once, and most brace-expansion sites

Subpath resolution + barrel cleanup

Next 16 auto-rewrites consumer tsconfig.moduleResolution to "bundler", which requires explicit .d.ts / .js substitution in exports and cannot resolve folder/index.{js,d.ts} patterns via wildcards. Reworked the exports map and removed the trivial barrels that prevented a clean wildcard setup:

Removed src/components/ErrorBoundary/index.ts (one-line re-export)
Removed src/components/TempError/index.ts (one-line re-export)
Removed src/theme/components/index.ts (aggregator of 4 MUI overrides)
Renamed src/components/Index/index.tsx → indexView.tsx (and .styles.ts)
Exports map now uses conditional types/default wildcards with a .js-suffix wildcard for runtimes that require explicit extensions (Node ESM, Playwright)

`next-mdx-remote@6` `blockJS` default

v6 flipped blockJS from false to true, which strips JSX attribute expressions (<Breadcrumbs breadcrumbs={[...]} />) during MDX compilation. findable-ui/src/utils/mdx/staticGeneration/staticProps.ts now defaults to blockJS: false; consumers calling serialize() directly should do the same.

Consumer setup docs (`README.md`)

New section covering: @mui/material-nextjs + @emotion/server install, _app.tsx + _document.tsx wiring, the next-mdx-remote@6 blockJS: false note, and the Turbopack opt-out workaround for vercel/next.js#82607.

Includes a terminology note: the MUI helpers are named with "SSR" / "document" terminology, but for static-export deployments everything runs at next build time. No runtime server is involved.

Breaking changes

Consumers must update:

ErrorBoundary — import from …/lib/components/ErrorBoundary/errorBoundary
TempError — import from …/lib/components/TempError/tempError
Index — import from …/lib/components/Index/indexView (and indexView.styles)
theme/components — import each override individually (…/lib/theme/components/muiAlert, etc.); barrel removed
Pin next: ^16 and next-mdx-remote: ^6

The repo-by-repo consumer migration is tracked separately (see #935).

Verified

✅ npm test — 447/447
✅ npm run lint, check-format, test-compile — clean
✅ npm audit — 15 → 7 transitive-only
✅ data-biosphere — tsc --noEmit clean; dev server runs under --webpack; /ga-announcement Breadcrumbs render; Footer hydration mismatch resolved
✅ brc-analytics — tsc --noEmit clean (no findable-ui-related errors); pre-existing unrelated TS errors remain

Out of scope (follow-ups under #884)

[P1.9] Next.js 16 prep: verify Storybook (Vite) builds under Next 16 #934 — Storybook verify (closed, confirmed working)
[P1.10] Next.js 16 prep: CHANGELOG + peer-dep guidance for consumers #935 — CHANGELOG + per-consumer guidance
[P2] React-hooks v7 rules: address anti-patterns surfaced by the recommended preset #941 — react-hooks v7 cleanup
Fix ComponentCreator to Avoid Wrapping Children in Array for React.createElement #552 — ComponentCreator children-array fix (separate ticket, assigned)
next-auth v4 → v5 (would resolve the uuid transitive advisory)

Closes #933

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR updates the library’s Next.js version expectations as part of the Next.js 16 upgrade plan, ensuring local development and CI resolve and run against Next 16.

Changes:

Added next@^16 to devDependencies so CI/local installs use Next 16.
Updated peerDependencies.next from ^15.5.13 to ^16.
Refreshed package-lock.json to reflect the new resolved Next 16 dependency graph.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds Next 16 as a dev dependency and updates the published peer dependency range for `next`.
package-lock.json	Updates lockfile to the resolved Next 16.2.6 tree and related metadata changes.

next-mdx-remote v5 has a known arbitrary-code-execution advisory (GHSA-g4xw-jxrg-5f6m). v6 is the patched major; subpath export (/serialize) and MDXRemoteSerializeResult type are unchanged, so the two findable-ui import sites work without source edits. Also picks up safe transitive fixes via npm audit fix: handlebars, fast-uri, picomatch, vite, ws, yaml, @tootallnate/once, and most brace-expansion sites. Reduces audit count from 15 vulns (1 critical / 4 high / 9 moderate / 1 low) to 7 moderate, all of which are transitive of next / next-auth / glob and need upstream upgrades to resolve. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…els (#933) next 16 auto-rewrites consumer tsconfig.moduleResolution to "bundler", which requires explicit `.d.ts` / `.js` substitution in the package exports map and cannot resolve folder/index patterns via wildcards. this commit reworks the exports map and removes the trivial barrel files that prevented a clean wildcard-only setup. BREAKING CHANGE: consumers must update imports: - ErrorBoundary: import from @databiosphere/findable-ui/lib/components/ErrorBoundary/errorBoundary - TempError: import from @databiosphere/findable-ui/lib/components/TempError/tempError - theme/components: import each override from its file (e.g. .../lib/theme/components/muiAlert) — the barrel has been removed - Index: file renamed from index.tsx to indexView.tsx; import from @databiosphere/findable-ui/lib/components/Index/indexView (and its styles from indexView.styles) the exports map now uses conditional types/default wildcards and adds a .js-suffix wildcard for runtimes that require explicit extensions (node esm, playwright). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

next-mdx-remote@6 flipped blockJS default from false to true, which strips javascript expressions during compilation — including jsx attribute expressions like <Breadcrumbs breadcrumbs={[...]} />. the resulting compiled output passes empty props to components, silently breaking any mdx that uses prop-expression attributes. set blockJS: false as the default in buildStaticProps so consumers using this helper get correct behavior out of the box. consumers calling serialize() directly should pass blockJS: false themselves (documented in the readme). the narrower blockDangerousJS: true default is preserved as the safety net against eval / new Function / setTimeout(string) patterns. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

document the wiring consumers must add when upgrading to next.js 16: - @mui/material-nextjs AppCacheProvider in _app.tsx - documentGetInitialProps + DocumentHeadTags in _document.tsx - @emotion/server peer install - next-mdx-remote@6 blockJS: false note - turbopack opt-out (next dev/build --webpack) until vercel/next.js#82607 is fixed includes a terminology note for static-export deployments: the mui helpers reference "ssr" / "document" but the work runs at next build time, not at request time. no runtime server is involved. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 11 changed files in this pull request and generated no new comments.

chore!: next.js 16 prep: pin 'next' peer dep to ^16 (#933)

7d6975b

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings May 27, 2026 05:57

frano-m assigned NoopDog May 27, 2026

Copilot started reviewing on behalf of frano-m May 27, 2026 05:57 View session

frano-m mentioned this pull request May 27, 2026

[P1.8] Next.js 16 prep: pin 'next' peer dep to '^16' #933

Open

9 tasks

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread package.json

frano-m mentioned this pull request May 27, 2026

[P1.9] Next.js 16 prep: verify Storybook (Vite) builds under Next 16 #934

Closed

5 tasks

frano-m and others added 3 commits May 28, 2026 16:17

Copilot AI review requested due to automatic review settings May 28, 2026 06:24

Copilot started reviewing on behalf of frano-m May 28, 2026 06:24 View session

Copilot AI reviewed May 28, 2026

View reviewed changes

frano-m marked this pull request as ready for review May 28, 2026 06:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore!: next.js 16 prep: pin 'next' peer dep to ^16 (#933)#942

chore!: next.js 16 prep: pin 'next' peer dep to ^16 (#933)#942
frano-m wants to merge 5 commits into
mainfrom
fran/933-bump-next-peer-dep-v16

frano-m commented May 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

frano-m commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Peer-dep + audit

Subpath resolution + barrel cleanup

next-mdx-remote@6 blockJS default

Consumer setup docs (README.md)

Breaking changes

Verified

Out of scope (follow-ups under #884)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

frano-m commented May 27, 2026 •

edited

Loading

`next-mdx-remote@6` `blockJS` default

Consumer setup docs (`README.md`)