reviewing-nextjs-16-patterns

Next.js 16 Patterns Review

Comprehensive review for Next.js 16 compliance covering security vulnerabilities, caching patterns, breaking changes, and migration readiness.

Review Process

For comprehensive security review patterns, use the reviewing-security skill from the review plugin. For dependency auditing, use the reviewing-dependencies skill from the review plugin.

1. Security Audit

CVE-2025-29927 - Server Action Authentication

Check all Server Actions for proper authentication:

# Find all Server Actions
grep -r "use server" --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx"

For each Server Action verify:

• Authentication check at function start
• Authorization validation before data access
• No reliance on client-side validation only
• Proper error handling without leaking sensitive data

Middleware Security

# Find middleware files
find . -name "middleware.ts" -o -name "middleware.js"

Verify:

• Authentication logic present in middleware
• Protected routes defined in config.matcher
• No authentication logic removed in Next.js 16 migration
• Proper redirect handling for unauthorized access

Server Component Data Access

# Find async Server Components
grep -r "export default async function" app/

Check each Server Component:

• Session validation before data queries
• User context verified before personalized data
• No direct database queries without auth checks
• Proper error boundaries for auth failures

2. Caching Patterns

use cache Adoption

# Find fetch calls that should use cache
grep -r "fetch(" --include="*.ts" --include="*.tsx"
# Find functions that should be cached
grep -r "export async function" --include="*.ts"

Verify:

• use cache directive for cacheable functions
• Proper cache tags with cacheTag() for revalidation
• Cache lifecycle control with cacheLife()
• No unstable_cache in new code
• fetch() caching replaced with use cache

Cache Lifecycle Configuration

Check for proper cache profiles:

• cacheLife('seconds') for rapidly changing data
• cacheLife('minutes') for moderate update frequency
• cacheLife('hours') for stable content
• cacheLife('days') for rarely changing data
• cacheLife('weeks') for static content
• Custom profiles defined in next.config.js if needed

Revalidation Strategy

# Find revalidation calls
grep -r "revalidateTag\|revalidatePath" --include="*.ts" --include="*.tsx"

Verify:

• revalidateTag() matches cacheTag() definitions
• revalidatePath() used for page-level invalidation
• No orphaned cache tags
• Proper error handling in revalidation

3. Breaking Changes

Async Request APIs

# Find synchronous API usage
grep -r "cookies()\|headers()\|params\|searchParams" --include="*.ts" --include="*.tsx"

Check for required async usage:

• await cookies() in Server Components/Actions
• await headers() in Server Components/Actions
• await params in page/layout/route components
• await searchParams in page components
• React.use() wrapper in Client Components if needed

Middleware to Proxy Migration

# Check for removed middleware patterns
grep -r "NextResponse.rewrite\|NextResponse.redirect" middleware.ts

Verify migration:

• Simple rewrites moved to next.config.js redirects/rewrites
• Complex logic converted to Middleware Proxies
• Authentication logic preserved
• Header manipulation handled correctly

Route Handler Changes

# Find route handlers
find app -name "route.ts" -o -name "route.js"

Check each route handler:

• Dynamic functions require dynamic = 'force-dynamic'
• No synchronous cookies()/headers() calls
• Proper TypeScript types for request/params
• Error handling updated for new patterns

generateStaticParams Changes

# Find static param generation
grep -r "generateStaticParams" --include="*.ts" --include="*.tsx"

Verify:

• Returns array of param objects (not nested)
• Works with new async params
• Proper TypeScript types
• No deprecated patterns

4. Migration Verification

Dependency Updates

Check package.json:

• next: ^16.0.0 or higher
• react: ^19.0.0 or higher
• react-dom: ^19.0.0 or higher
• @types/react: ^19.0.0 (if using TypeScript)
• @types/react-dom: ^19.0.0 (if using TypeScript)

Configuration Updates

Check next.config.js:

• experimental.dynamicIO enabled if using dynamic APIs
• staleTimes configured if controlling client-side cache
• Custom cacheLife profiles defined if needed
• TypeScript config updated for async params

Build Validation

Run and verify:

npm run build

• No deprecation warnings
• No type errors
• No runtime errors in build
• Static generation works correctly
• Dynamic routes render properly

Runtime Testing

• Authentication flows work correctly
• Protected routes require login
• Server Actions validate permissions
• Cache invalidation triggers updates
• Dynamic content updates appropriately
• Static content serves from cache

Violation Severity

Critical

• Missing authentication in Server Actions (CVE-2025-29927)
• Synchronous cookies()/headers() calls
• Security middleware removed or broken

High

• Missing cache directives on expensive operations
• Incorrect async params usage
• Broken revalidation strategy

Medium

• Using deprecated unstable_cache
• Middleware patterns that should be proxies
• Missing cache lifecycle configuration

Nitpick

• Suboptimal cache profiles
• Missing cache tags for fine-grained invalidation
• Legacy fetch caching patterns

Best Practices

1. Run security audit first - Critical vulnerabilities take priority
2. Group related violations - Fix all async API issues together
3. Test incrementally - Verify each category before moving on
4. Document decisions - Record why certain patterns were chosen
5. Update documentation - Keep project docs current with Next.js 16 patterns