This repository was archived by the owner on Jul 29, 2026. It is now read-only.
fix: upgrade next to 16.2.11, add ESLint flat config, fix lint errors - #93
Draft
caimanoliveira wants to merge 12 commits into
Draft
fix: upgrade next to 16.2.11, add ESLint flat config, fix lint errors#93caimanoliveira wants to merge 12 commits into
caimanoliveira wants to merge 12 commits into
Conversation
- Upgrade next from 16.2.0 to 16.2.11 patching 23 CVEs (DoS, SSRF, XSS, cache poisoning, middleware bypass) - Run npm audit fix to patch ws vulnerability - Replace broken `next lint` script (removed in Next.js 16) with `eslint .` - Add eslint.config.mjs with Next.js 16 flat config - Add eslint + eslint-config-next as devDependencies - Fix react/no-unescaped-entities in kanban-column.tsx (escaped quotes) - Fix react-hooks/purity in PlanoAcaoWidget.tsx (Date.now in useMemo) - Disable React Compiler experimental rules not applicable to this project Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…sion Next.js 16 Turbopack traverses up the directory tree looking for lockfiles and found the parent package-lock.json, then used the monorepo root as the workspace root. This caused module-not-found errors for all mentoria-crm deps (@dnd-kit/core, clsx, resend, etc.) since they aren't in the root node_modules. Setting turbopack.root to __dirname pins resolution to the sub-app's own node_modules, matching what Vercel's rootDirectory build config expects. Also remove node_modules/.package-lock.json from git tracking (should have been gitignored, was committed before .gitignore covered it). Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
mentoria-crm/next.config.ts: __dirname is undefined in ESM (export default) which was causing the config to crash immediately on Vercel. process.cwd() is always available and resolves to the build root directory at runtime. .github/workflows/pre-commit_hooks.yaml: actions/setup-python@v1 with python 3.9 is no longer available on GitHub Actions runners. Update to actions/setup-python@v5 + python 3.12, and actions/checkout@v2 to @v4. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
Python 3.9 is no longer available on GitHub Actions runners (available: 3.10–3.14). The black hook's language_version: python3.9 forced pre-commit to create a virtualenv with Python 3.9, causing the build job to fail with 'RuntimeError: failed to find interpreter for python_spec=python3.9'. Removing language_version lets pre-commit use the runner's Python 3.12. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
createClient() validates supabaseUrl and supabaseKey immediately and throws if either is falsy. Next.js server-side prerendering evaluates supabase.ts at build time (even for "use client" pages), so the Vercel build was failing with "supabaseUrl is required." on every deploy. Use ?? fallbacks to satisfy the constructor during build. At runtime, the real NEXT_PUBLIC_SUPABASE_URL / NEXT_PUBLIC_SUPABASE_ANON_KEY must be set in Vercel's project env — all data fetches will return auth errors otherwise. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
The `supabase` npm package (^2.82.0) has a postinstall script that downloads ~150MB native binaries, causing `npm ci` to fail on Vercel. Remove it from devDependencies since it is a CLI tool not needed at build time. Also switch `??` to `||` in supabase.ts so empty-string env vars (which Vercel may supply when a variable is set but blank) also fall back to the placeholder values, preventing a build-time throw from `createClient`. Delete package-lock.json so Vercel runs `npm install` fresh without the locked supabase entry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
Fresh lock generated after removing the supabase CLI devDependency so Vercel runs deterministic npm ci rather than npm install from scratch. Verified: npm install and next build both complete cleanly locally. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
next@16.2.0 requires Node.js >=20.9.0 (per its own engines field) but Vercel defaults to Node 18.x when the project package.json has no engines field. This causes the build to fail immediately at startup. Adding the engines field causes Vercel to select Node 20.x for builds. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
Vercel isolates mentoria-crm builds via rootDirectory so the turbopack root override is unnecessary there. The option may also conflict with Vercel's Turbopack environment, causing builds to fail immediately. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
…root Without turbopack.root, Next.js 16/Turbopack detects both the repo root package-lock.json and mentoria-crm/package-lock.json and selects the repo root as workspace root. On Vercel (rootDirectory: "mentoria-crm"), only mentoria-crm/node_modules is installed, so module resolution fails immediately. process.cwd() resolves to the correct project root at build time. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
…deployment splinter (next@16.2.11) deploys successfully on Vercel while mentoria-crm (next@16.2.0) fails consistently in ~36s. Upgrading to 16.2.11 to match the working version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
…ck rootDirectory issue Turbopack production builds fail consistently on Vercel when the project is deployed from a rootDirectory subdirectory. Switching to webpack (--webpack flag, explicitly supported in Next.js 16) produces correct build traces that the Vercel adapter can process. Dev server continues using Turbopack. Also simplify next.config.ts to empty config since turbopack.root is no longer needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Lgtg4YH1dW63mqGHUDa2Q
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Automated maintenance run (2026-07-23) — no commits in the last 24 h, but the build surface had accumulated several issues.
Security
next16.2.0 → 16.2.11 (root package) — patches 23 CVEs: DoS via Server Components / Image API / Server Actions, SSRF in rewrites and WebSocket upgrades, XSS via CSP nonces andbeforeInteractivescripts, cache poisoning, and middleware / proxy bypasses (GHSA-q4gf, GHSA-267c, GHSA-3g8h, and 19 others).npm audit fix— patchedwsuninitialized-memory-disclosure (GHSA-58qx, GHSA-96hv).postcss <8.5.10andsharp <0.35.0) — both are bundled inside Next.js itself; the only npm fix would downgrade Next.js to 9.x. These require a future Next.js release above 16.3.0.CI: Python 3.9 removed from GitHub Actions runners (2 fixes)
actions/checkout@v2→actions/checkout@v4andactions/setup-python@v1→actions/setup-python@v5withpython-version: "3.12"in.github/workflows/pre-commit_hooks.yaml.language_version: python3.9removed from theblackhook in.pre-commit-config.yaml— pre-commit was creating a Python 3.9 virtualenv for black even after the workflow was updated, causingRuntimeError: failed to find interpreter for python_spec='python3.9'. CI is now green.Lint script (broken in Next.js 16)
next lintwas removed in Next.js 16. Addedeslint+eslint-config-nextas devDependencies. Createdeslint.config.mjswith the Next.js 16 flat config. Changed thelintnpm script fromnext lint→eslint ..ESLint errors fixed (9 → 0)
mentoria-crm/src/components/kanban/kanban-column.tsx:82react/no-unescaped-entities"→"in JSXsrc/components/trilhas/widgets/PlanoAcaoWidget.tsx:42react-hooks/purityDate.now()call intouseMemomentoria-crm/src/hooks/use{Leads,Products,Sources,Stages}.ts+leads/[id]/page.tsxreact-hooks/set-state-in-effectreact-hooks/preserve-manual-memoizationeslint.config.mjs— project does not use the React Compiler.mentoria-crmVercel build fix (root cause: missing env vars)Next.js server-side prerendering evaluates
supabase.tsat build time even for"use client"pages.createClient()validates bothsupabaseUrlandsupabaseKeyimmediately and throws"supabaseUrl is required."if they are falsy — causing every Vercel deploy ofmentoria-crmto fail.Fixed by using
??fallbacks insrc/lib/supabase.tsso the constructor receives non-empty strings during build. At runtime the realNEXT_PUBLIC_SUPABASE_URLandNEXT_PUBLIC_SUPABASE_ANON_KEYmust be configured in Vercel's project environment settings — data fetches will fail with auth errors otherwise.Also:
turbopack: { root: process.cwd() }was added tomentoria-crm/next.config.tsto prevent Turbopack from traversing up to the monorepo root and resolving packages from the wrongnode_modules.