[MohamedBassem]

No description provided.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b77f9f5f-bef1-4e5f-9f62-3bf94c5cd602

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

React runtime and type dependencies are upgraded from 19.2.1 to 19.2.6 across all workspace apps (browser-extension, landing, mobile, web, docs). Next.js in the web app is upgraded from 15.5.18 to 16.2.6. Build configuration is updated to add Turbopack SVG handling, adjust TypeScript and ESLint settings, and configure allowed development origins. Generated next-env.d.ts is cleared and ignored.

Changes

React and Next.js Dependency Upgrades

Layer / File(s)	Summary
React and type dependency upgrades apps/browser-extension/package.json, apps/landing/package.json, apps/mobile/package.json, apps/web/package.json, docs/package.json	React and react-dom are bumped to 19.2.6 across all apps. React type definitions (@types/react, @types/react-dom) are updated to 19.2.15 and 19.2.3 respectively.
Next.js 16 configuration and build settings apps/web/next.config.mjs, .gitignore	Next.js is upgraded to 16.2.6 in apps/web package.json. Turbopack SVG rule is added for @svgr/webpack bundling. TypeScript build errors remain ignored; ESLint build errors ignore is removed. allowedDevOrigins is set to ["10.0.10.13"]. The auto-generated next-env.d.ts is cleared from tracking and added to .gitignore via **/next-env.d.ts.

---

🎯 2 (Simple) | ⏱️ ~12 minutes

---

Possibly related PRs

• karakeep-app/karakeep#2740: Adds oxlint/oxfmt configuration that depends on the .gitignore updates in this PR to control which files are processed by formatting and linting tools.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	No pull request description was provided by the author. The required template sections including Description, How Has This Been Tested, and Checklist are completely missing.	Add a comprehensive PR description following the template, including: rationale for the upgrade, testing performed (especially for Next.js 16 compatibility), and completion of the required checklist items.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'deps: upgrade nextjs to 16' accurately describes the main change in the changeset, which involves upgrading Next.js from version 15 to 16 along with related dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

This PR upgrades Next.js from 15.5.18 to 16.2.6 across the monorepo, pins React and @types/* packages to exact versions (19.2.6 / 19.2.15 / 19.2.3), and migrates PWA manifest handling from the next-pwa plugin to Next.js's native app/manifest.ts route.

• Next.js upgrade: next and @next/bundle-analyzer moved to 16.2.6; next-pwa removed; Turbopack SVG rule added alongside the existing webpack rule; next typegen prepended to the typecheck script so route types are regenerated before tsc.
• Manifest migration: public/manifest.json deleted and replaced with app/manifest.ts; the static manifest: "/manifest.json" metadata field removed from layout.tsx since Next.js now auto-injects the manifest link tag.
• allowedDevOrigins: the previously hardcoded private IP is replaced by a comma-separated env variable ALLOWED_DEV_ORIGINS, and next-env.d.ts is removed from version control and added to .gitignore.

Confidence Score: 5/5

Straightforward dependency upgrade with no logic changes; the manifest migration is mechanically equivalent to the deleted static file.

All changes are package version bumps and a well-scoped migration of PWA manifest handling to the Next.js native API. No application logic was modified, and the manifest content matches the deleted static file. The two concerns from prior review threads (ESLint build suppression and the allowedDevOrigins filter) were already flagged and are known to the author.

No files require special attention.

Important Files Changed

Filename	Overview
apps/web/package.json	Next.js upgraded from 15.5.18 to 16.2.6; next-pwa removed; react/react-dom pinned to exact 19.2.6; @types/* pinned to exact versions
apps/web/next.config.mjs	Removed next-pwa wrapper; added Turbopack SVG rule; ESLint ignoreDuringBuilds removed (already flagged in prior thread); allowedDevOrigins now reads from env var (prior thread concern addressed)
apps/web/app/manifest.ts	New Next.js native manifest route replaces the static public/manifest.json; functionally equivalent with minor omission of the purpose field on the 16x16 icon
apps/web/app/layout.tsx	Removed manifest metadata link; Next.js now auto-discovers app/manifest.ts and injects the link tag, so this removal is correct
.gitignore	Added **/next-env.d.ts to gitignore; the existing apps/web/next-env.d.ts was deleted as it is now auto-generated by next typegen

_{Reviews (2): Last reviewed commit: "fix build" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/web/next.config.mjs`:
- Line 67: Remove the unused dead configuration property allowedDevOrigins from
the Next.js config in next.config.mjs: locate the allowedDevOrigins:
["10.0.10.13"] entry (it isn’t referenced elsewhere) and delete that line so the
config no longer contains the unused setting; ensure no other code depends on
allowedDevOrigins after removal.

In `@apps/web/package.json`:
- Line 76: Update the app to be compatible with Next.js 16: audit all
server/route handlers and change uses of params and searchParams to await the
async values, and update any calls to cookies(), headers(), and draftMode() to
await their promises; replace legacy caching config with the new 'use cache'
directive and update revalidateTag(tag) calls to include the second arg (e.g.,
revalidateTag(tag, 'max')); migrate next/image config from images.domains to
images.remotePatterns and adjust handling of local images with query strings;
rename middleware.ts to proxy.ts and ensure Node.js >=20.9.0 and TypeScript
>=5.1.0 in project tooling; run the official Next.js upgrade codemod and
manually review data-fetching patterns for any additional breaking-change fixes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2b3ad58c-42b5-41be-a361-1318c766b304

📥 Commits

Reviewing files that changed from the base of the PR and between b45d41c and 49c2018.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (8)

• .gitignore
• apps/browser-extension/package.json
• apps/landing/package.json
• apps/mobile/package.json
• apps/web/next-env.d.ts
• apps/web/next.config.mjs
• apps/web/package.json
• docs/package.json

💤 Files with no reviewable changes (1)

• apps/web/next-env.d.ts

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

# First, let's check if the file exists and read the relevant section
if [ -f "apps/web/next.config.mjs" ]; then
  echo "=== File exists, reading content around line 67 ==="
  sed -n '60,75p' apps/web/next.config.mjs
else
  echo "File not found, searching for next.config files"
  find . -name "next.config.*" -type f
fi

Repository: karakeep-app/karakeep

Length of output: 409

---

🏁 Script executed:

# Read the full next.config.mjs file to understand context
wc -l apps/web/next.config.mjs
echo "---"
cat -n apps/web/next.config.mjs

Repository: karakeep-app/karakeep

Length of output: 2332

---

🏁 Script executed:

# Search for allowedDevOrigins usage
rg "allowedDevOrigins" --type mjs --type js --type ts

Repository: karakeep-app/karakeep

Length of output: 93

---

🏁 Script executed:

# Search for allowedDevOrigins in all files
rg "allowedDevOrigins"

Repository: karakeep-app/karakeep

Length of output: 127

---

🏁 Script executed:

# Check for environment files and variables used
find . -name ".env*" -type f | head -20
echo "---"
# Search for origin validation or CORS logic
rg "origin" -i --type js --type ts | grep -i "allow\|cors\|valid" | head -20

Repository: karakeep-app/karakeep

Length of output: 305

---

🏁 Script executed:

# Check the main .env.sample
cat .env.sample
echo "---"
# Search for any middleware or validation of origins
rg "middleware\|CORS\|origin" --type ts --type js -i -l | head -10

Repository: karakeep-app/karakeep

Length of output: 176

---

🏁 Script executed:

# Search for middleware files in the web app
find apps/web -name "*middleware*" -type f
echo "---"
# Search for any validation of this property
rg "allowedDev\|ALLOWED_DEV"

Repository: karakeep-app/karakeep

Length of output: 69

---

🏁 Script executed:

# Check package.json to see what next-pwa version is used and search for comments about this config
cat apps/web/package.json | grep -A 5 -B 5 "next-pwa\|pwa" || echo "Not in web package.json, checking root"
echo "---"
cat package.json | grep "next-pwa" || echo "Not found in root package.json"
echo "---"
# Check git history of this file
git log --oneline apps/web/next.config.mjs | head -5

Repository: karakeep-app/karakeep

Length of output: 450

---

🏁 Script executed:

# Let's check the next-pwa plugin documentation or source to see if allowedDevOrigins is a valid property
# First check if there's any node_modules reference or documentation
rg "allowedDevOrigins" -r . --max-depth 5 node_modules/next-pwa 2>/dev/null | head -5 || echo "Not in node_modules (expected)"
echo "---"
# Check git history more thoroughly - when was this added?
git log -p apps/web/next.config.mjs | grep -A 3 -B 3 "allowedDevOrigins" | head -20

Repository: karakeep-app/karakeep

Length of output: 69

---

🏁 Script executed:

# Let's check the git log differently
git log --follow -p apps/web/next.config.mjs 2>/dev/null | head -100

Repository: karakeep-app/karakeep

Length of output: 2213

---

Remove unused allowedDevOrigins configuration.

The allowedDevOrigins property is hardcoded but not referenced or consumed anywhere in the codebase. It appears to be dead code that was added but never wired up. Since it has no functional effect and the CORS headers already allow all origins ("Access-Control-Allow-Origin": "*"), simply remove this line:

Suggested fix

-  allowedDevOrigins: ["10.0.10.13"],
});

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

allowedDevOrigins: ["10.0.10.13"],

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/web/next.config.mjs` at line 67, Remove the unused dead configuration
property allowedDevOrigins from the Next.js config in next.config.mjs: locate
the allowedDevOrigins: ["10.0.10.13"] entry (it isn’t referenced elsewhere) and
delete that line so the config no longer contains the unused setting; ensure no
other code depends on allowedDevOrigins after removal.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🌐 Web query:

What are the breaking changes and migration requirements for Next.js 16?

💡 Result:

Next.js 16, which reached stable release in late 2025 and is currently supported (latest version 16.2.6 as of May 2026), introduces significant architectural changes that require careful migration [1][2][3][4]. Breaking Changes and Migration Requirements Async Request APIs Synchronous access to request APIs is fully removed [5]. You must update your code to use asynchronous access: - Props such as params and searchParams must be awaited (e.g., await params) [5][2]. - Core request helpers including cookies, headers, and draftMode are now strictly asynchronous and must be awaited [5][2]. - Metadata image generation functions now receive params and id as promises [5][2]. Caching and Data Fetching Next.js 16 introduces "Cache Components" as a new directive-based caching model, replacing older route-segment configurations [6][7]. - The 'use cache' directive is now the primary way to manage component and function caching [7]. - Legacy flags like experimental_ppr and force-static / force-dynamic are deprecated or removed in favor of this new model [2][6]. - The revalidateTag function now requires a second argument (a profile, e.g., revalidateTag(tag, 'max')) [2][8]. Omitting the second argument will result in a TypeScript error [8]. Next/Image Updates - Local images used with query strings now require updated images.localPatterns configuration to prevent security vulnerabilities [2]. - Default values for images.maximumRedirects (now capped at 3), imageSizes, and qualities have been adjusted [5][2]. - The images.domains configuration is deprecated in favor of the more secure images.remotePatterns [2]. Infrastructure and Deprecations - Middleware: The middleware.ts filename is deprecated and should be renamed to proxy.ts to clarify its role in the network boundary [5][2][7]. - Node.js: The minimum required Node.js version has been increased (typically 20.9.0+) [5]. - TypeScript: The minimum supported TypeScript version is now 5.1.0 [5]. Upgrade Path To migrate to Next.js 16, you can use the official upgrade codemod provided by the framework [5]. Due to the architectural shift in caching and async APIs, manual review of data-fetching patterns is strongly recommended [2][8]. Additionally, all users on versions 16.2.5 or older are advised to update immediately to 16.2.6 to patch critical security vulnerabilities [4][9].

Citations:

• 1: https://versionlog.com/nextjs/16/
• 2: https://nextjs.org/blog/next-16
• 3: https://github.com/vercel/next.js/releases/tag/v16.2.6
• 4: https://vercel.com/changelog/next-js-may-2026-security-release
• 5: https://nextjs.org/docs/app/guides/upgrading/version-16
• 6: https://dev.to/lazarv/a-framework-is-not-a-platform-33ef
• 7: https://nextjs.im/blog/next-16/
• 8: https://dev.to/shubhradev/i-built-a-free-debugger-because-nextjs-16-use-cache-was-completely-invisible-during-development-4a8
• 9: https://cybersecuritynews.com/next-js-react-server-vulnerabilities/

---

Review and update code for Next.js 16 breaking changes.

Next.js 16.2.6 introduces several breaking changes requiring code updates:

• Async Request APIs: params and searchParams must be awaited; cookies(), headers(), and draftMode() are now strictly asynchronous
• Caching: The new 'use cache' directive replaces legacy route-segment configurations; revalidateTag() now requires a second argument (e.g., revalidateTag(tag, 'max'))
• Next/Image: images.domains is deprecated in favor of images.remotePatterns; local images with query strings need updated configuration
• Infrastructure: Rename middleware.ts to proxy.ts; minimum Node.js is 20.9.0+; minimum TypeScript is 5.1.0+

Additionally, versions 16.2.5 and older contain critical security vulnerabilities. Use the official Next.js upgrade codemod to assist with migration, and review data-fetching patterns for manual updates.

Also applies to: 110-110

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/web/package.json` at line 76, Update the app to be compatible with
Next.js 16: audit all server/route handlers and change uses of params and
searchParams to await the async values, and update any calls to cookies(),
headers(), and draftMode() to await their promises; replace legacy caching
config with the new 'use cache' directive and update revalidateTag(tag) calls to
include the second arg (e.g., revalidateTag(tag, 'max')); migrate next/image
config from images.domains to images.remotePatterns and adjust handling of local
images with query strings; rename middleware.ts to proxy.ts and ensure Node.js
>=20.9.0 and TypeScript >=5.1.0 in project tooling; run the official Next.js
upgrade codemod and manually review data-fetching patterns for any additional
breaking-change fixes.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49c20188fe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Force webpack builds while next-pwa remains configured

Upgrading next to 16.2.6 makes Turbopack the default for next build, but this app still relies on next-pwa, which integrates via webpack plugins/hooks. Because Turbopack does not apply webpack plugin pipelines, production builds can silently stop generating the PWA service worker/offline assets after this version bump unless you explicitly use next build --webpack (or migrate away from webpack-dependent PWA tooling).

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Run Next type generation before ignoring next-env.d.ts

This change ignores/removes next-env.d.ts, but the web typecheck flow still uses plain tsc --noEmit without a preceding next typegen. On a clean checkout (where neither next dev nor next build has run yet), Next-generated declarations may be missing, which can break CI/local typechecks or drop framework-specific type coverage.

Useful? React with 👍 / 👎.

[MohamedBassem]

@codex review
@greptile review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1766d7eb65

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Leave allowedDevOrigins undefined when env var is unset

This line always produces an array (at minimum ['']), so allowedDevOrigins is never undefined. In Next.js 16, undefined has different behavior from a defined array: it keeps cross-origin dev checks in warn mode, while a defined value switches to blocking mode. With ALLOWED_DEV_ORIGINS unset, this can unexpectedly block proxied/cross-origin dev requests that previously only warned. Gate this assignment so the field is omitted/undefined when no env value is provided.

Useful? React with 👍 / 👎.