rstillwell/deckhearth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

convoy: scope bump-next-js (P0 #8 — unblock Vercel deploys) #3

Closed
varutasu wants to merge 3 commits from convoy/bump-next-js into bootstrap/agent-pipeline-v0.5.0
pull from: convoy/bump-next-js
merge into: rstillwell:bootstrap/agent-pipeline-v0.5.0
Conversation 2 Commits 3 Files changed 7 +1681 -664

3 commits

Author SHA1 Message Date
Randall Stillwell
093a288cc4 bump: next 15.4.3 -> 16.2.6, ESLint flat config (v9 fallback), typescript devDep 
Closes P0 ship-blocker #8 from .convoys/ship-readiness.md. Vercel has
been refusing every deployment since 2025-08-01 with "Vulnerable version
of Next.js detected, please update immediately" — this bump clears
that platform gate and unblocks every downstream preview-smoke and
visual-diff gate that depends on a live preview URL.

Changes (per Brief 1 acceptance criteria, all four gate-1 decisions
applied — see .convoys/bump-next-js.md § Decisions for the audit trail):

- next: ^15.4.2 -> ^16.2.6 (resolves next@16.2.6)
- eslint: ^8 -> ^9.39.4 (Decision D fallback; v10 surfaced Risk R15
  empirically — @typescript-eslint/scope-manager@8.59.4 bundled by
  eslint-config-next@16 doesn't implement v10's new addGlobals API)
- eslint-config-next: 15.4.2 -> ^16.2.6
- typescript: newly added at ^5.9.3 as a devDep (Decision C; required
  by typescript-eslint chain regardless of ESLint major)
- scripts.lint: "next lint" -> "eslint ." (next lint removed in 16)
- next.config.js: images.domains -> images.remotePatterns (deprecated
  and removed in Next 16; preserves the three CDN hosts Scryfall,
  Pokemon TCG, Lorcana API for eventual next/image adoption)
- .eslintrc.json deleted (eslint-config-next@16 is flat-config-only)
- eslint.config.mjs added (verbatim shape from Next docs; verified
  forward-compatible with v10 so bump-eslint-10 will not need to
  touch this file)

Out of scope (deferred to dedicated convoys):
- React 18 -> 19 (bump-react)
- App Router migration (multi-month effort)
- Test runner adoption (adopt-vitest, adopt-playwright-smoke)
- Lint baseline cleanup (fix-lint-baseline) — new v9 baseline is
  128 problems (81 errors, 47 warnings), up from prior ~100 due to
  eslint-plugin-react-hooks@7.1.1 + @next/eslint-plugin-next@16.2.6
  rule additions
- ESLint v10 adoption (bump-eslint-10) — upstream-blocked on
  typescript-eslint shipping a v10-tested release that
  eslint-config-next then bundles
- TypeScript 6 adoption (bump-typescript-6) — same upstream block

Local verification:
- npm install: clean, no ERESOLVE warnings
- npm run build: exit 0, Next 16.2.6 (Turbopack), ~1.4s compile,
  23 static pages + 47 API routes, no images.domains deprecation
- npm run lint: exit 1, 128 problems, runs to completion (tolerated
  by CI's `|| true` wrapper; new baseline for fix-lint-baseline)

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-23 02:04:02 -05:00
Randall Stillwell
df763f8eb5 convoy(bump-next-js): plan + brief 1 (Decisions A-D) 
Adds the architect's plan for bump-next-js (P0 ship-blocker #8) and the
single-brief decomposition that the implementer worked from.

- ## Architecture section: file plan, API surface (none), schema diff
  (none), test plan, risk list (R1-R16), Decomposition table, and
  slice_dependencies YAML.
- Brief 1: bump Next.js 15.4.3 -> 16.2.6, migrate images.domains ->
  images.remotePatterns, install ESLint flat config, replace removed
  'next lint' command with 'eslint .', add typescript devDep.
- Decisions log A-D, dated 2026-05-23, recording four gate-1 scope
  changes driven by Boot-the-brief findings and an empirical R15 firing:
  - A: expand scope to include ESLint v8 -> v9 + flat-config migration
  - B: pivot eslint pin v9.39.4 -> v10.4.0 (latest dist-tag)
  - C: add typescript@^5.9.3 devDep (peerDependenciesMeta.optional
    annotation only suppresses npm warning; runtime hard-requires it)
  - D: re-pin eslint v10.4.0 -> v9.39.4 (R15 fired empirically;
    @typescript-eslint/scope-manager@8.59.4 predates v10 GA, lacks
    new addGlobals API)
- Follow-up convoys queued: bump-eslint-10, bump-typescript-6 (both
  upstream-blocked on typescript-eslint shipping a v10-tested release).

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-23 02:03:45 -05:00
Randall Stillwell
74d9f580c7 convoy: scope bump-next-js (P0 #8 — unblock Vercel deploys) 
Conductor output for the highest-priority convoy in the launch
sequence. Closes P0 ship-blocker #8 from .convoys/ship-readiness.md.

Vercel is currently refusing to deploy any branch (including main)
due to a CVE in next@15.4.3 ("Vulnerable version of Next.js
detected"). Last successful main deploy: 2025-08-01. Until this
convoy lands, every downstream preview-smoke / visual-diff gate is
non-functional.

Classification: feature
Skip: ia, ux, flag
Next role: role-architect

Routing straight to architect (IA + UX skipped — no information
architecture or UX change). Architect reads the Next 15 → 16
migration guide and produces 1–3 briefs covering the bump itself,
any required code migrations (likely next.config.js
images.domains → images.remotePatterns), and Vercel preview
verification.

Audit cohort (post-PR draft, /multitask group):
  reviewer + design-system-auditor + a11y-auditor

Out of scope here (own convoys):
- React 18 → 19 bump        → bump-react (if/when desired)
- App Router migration      → out of horizon
- @playwright/test install  → adopt-playwright-smoke
- ESLint baseline cleanup   → fix-lint-baseline

Convoy file: .convoys/bump-next-js.md
Analytics: emitted via scripts/log-convoy-event.sh

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-22 23:45:14 -05:00