Next 16.3.2: pages router + React 18 (security landing)

[rdtiv]

Goal

Leave Next 13.5.11 for 16.3.2 (npm latest, Active LTS). Stay on the pages router and React 18.2. Clear the two npm audit highs (next and bundled postcss) that #18 deliberately left.

This is the #17 follow-up. That issue parked a 14.2.x hop; that landing is now EOL (14 security support ended Oct 2025; 15 maintenance ends Oct 2026). 16.3.2 is the only line with a year of support left (~Oct 2027). Pages Router is still supported in 16; it is frozen for new APIs. Next 16.3.2 still peers react@^18.2 — Pages Router uses the React in package.json, so 19 is not required.

Do not npm audit fix --force. That dumps 16.x into the lockfile and skips the config/lint/pin work below.

Related: #17 (closed, remaining highs), #41 finding 1 (this issue owns that finding).

Out of scope

• App Router (pages/ → app/). Separate product decision, not a prerequisite.
• Rewriting pages/api/chat.js as a Route Handler. Node req/res NDJSON stays. Edge / AI Gateway still drop logprobs.
• React 19, React Compiler, cacheComponents, Instant Navigations.
• Anything from React audit: 12 actionable findings + 4 missed opportunities (score 45, 27 diagnostics) #41 except the Next bump.

Plan

1. Bump next and eslint-config-next to 16.3.2. Leave react / react-dom at 18.2.0.
2. Drop the exact pins on @next/env and @swc/helpers — they must follow next (16.3.2 ships @swc/helpers@0.5.23; we pin 0.5.2). Keep the minimatch@9 override unless the new tree makes it redundant.
3. next.config.js: delete swcMinify: true (default, then removed). Re-check transpilePackages: ['geist'] — written for a 13.5 font-loader hole; keep it if the pages-router “collecting page data” step still needs it, drop it if the build is clean without it. Leave reactStrictMode: true.
4. Replace next lint (removed in 16). package.json "lint" becomes eslint . (or equivalent). next build no longer lints.
5. Node 20.9+ is the floor. Confirm local + Vercel.
6. Turbopack is now next dev / next build. No custom webpack here, so it should just run. If geist or CSS import order breaks, next build --webpack is the fallback — not an API rewrite.
7. README Stack / Checks: 13.5.11 → 16.3.2, lint command, Node floor, geist note if it changed.

Gates

• package.json / lockfile / next.config.js / lint script / README only, unless a listed fallback forces a one-line webpack opt-out.
• npm run lint, npm test (188), npm run build — exit-code checked.
• npm audit after: report what remains. Never --force.
• Live smoke on the dev server, same as Dependency security bump: npm audit fix (no --force) + Next 13.5.11 #17, plus the 16-specific surfaces:
  • streaming reply with logprobs / top_logprobs / n: 3
  • sync (non-stream) reply
  • one weather-tool turn (JSON path)
  • Stop mid-stream (abort + aborted-turn note)
  • exact-request disclosure
  • reload / localStorage
  • geist: system fallback then font variables after mount
  • Liquid Glass + #lg-refract in _document
  • dark scheme + token heatmap (CSS import order is load-bearing)

Invariants

• Pages router. pages/_app.js, pages/_document.js, pages/index.js, pages/api/chat.js stay where they are.
• React 18.2. No React 19 in this PR.
• Node runtime on /api/chat. Not Edge, not the Vercel AI Gateway — those paths drop logprobs.
• logprobs, top_logprobs: 5, n: 3, NDJSON stream (res.writeHead / flushHeaders / req.on('close')) unchanged.
• maxDuration: 60 stays.
• No app-code changes unless a gate fails and the fix is a config flag (e.g. --webpack).

Kill criterion

If the NDJSON stream buffers, drops n: 3 deltas, or swallows req close under Turbopack, stop. Fall back to next build --webpack / next dev --webpack in this PR. Do not rewrite the route. If webpack also fails the stream, park and report — that is a different issue.

[rdtiv]

xmission provisioned

driver: grok
ref: 42
worktrees: .grok/worktrees/wt-42-next16
branches: x/chore/next-16.3.2
port: 4042
tier: in-loop
base: origin/main (874fa67)

Grok-only: no Claude subagents, no @claude on the PR. CI remains .github/workflows/ci.yml (Node 24, npm test / npm run lint / npm run build) — that workflow is not being edited.

Kill criterion: if Turbopack buffers or swallows the pages-API NDJSON stream, this PR falls back to --webpack. No route rewrite.

[rdtiv]

xmission in flight

PR: #43 (x/chore/next-16.3.2, e33fe97)

driver: grok
ref: 42
worktrees: .grok/worktrees/wt-42-next16
branches: x/chore/next-16.3.2
port: 4042

Gates: lint 0, tests 188/188, Turbopack next build, npm audit 0. Stream TTFB 18ms — kill criterion not hit, no --webpack.

Operator owns merge. iOS sheet + after-mount Geist still yours to eyeball. Dev server is up on 4042 in the mission worktree.

[rdtiv]

Merged

PR #43 squash-merged to main as 8adbfc7 (operator-ordered).

Worktree .grok/worktrees/wt-42-next16 still present until /xmission end.

[rdtiv]

xmission end

driver: grok
ref: 42
worktrees: []
port: none

• PR chore: bump Next.js to 16.3.2 on the pages router #43 merged as 8adbfc7 (operator-ordered). Docs (README Stack/Checks) landed in that PR — no separate docs PR.
• landed.sh x/chore/next-16.3.2 origin/main exit 0 (7 files).
• Removed .grok/worktrees/wt-42-next16. Deleted x/chore/next-16.3.2 local + remote.
• Stopped mission next dev on 4042. Left the unrelated :3000 server on main.
• Claude worktree wt-punch-list-docs untouched.