Next.js 16 Patterns Review

Comprehensive review for Next.js 16 compliance covering security vulnerabilities, caching patterns, breaking changes, and migration readiness.

Review Process

For comprehensive security review patterns, use the reviewing-security skill from the review plugin. For dependency auditing, use the reviewing-dependencies skill from the review plugin.

1. Security Audit

CVE-2025-29927 - Server Action Authentication

Check all Server Actions for proper authentication:

# Find all Server Actions
grep -r "use server" --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx"

For each Server Action verify:

• • Authentication check at function start
• • Authorization validation before data access
• • No reliance on client-side validation only
• • Proper error handling without leaking sensitive data

Middleware Security

# Find middleware files
find . -name "middleware.ts" -o -name "middleware.js"

Verify:

• • Authentication logic present in middleware
• • Protected routes defined in config.matcher
• • No authentication logic removed in Next.js 16 migration
• • Proper redirect handling for unauthorized access

Server Component Data Access

# Find async Server Components
grep -r "export default async function" app/

Check each Server Component:

• • Session validation before data queries
• • User context verified before personalized data
• • No direct database queries without auth checks
• • Proper error boundaries for auth failures

2. Caching Patterns

use cache Adoption

# Find fetch calls that should use cache
grep -r "fetch(" --include="*.ts" --include="*.tsx"
# Find functions that should be cached
grep -r "export async function" --include="*.ts"

Verify:

• • use cache directive for cacheable functions
• • Proper cache tags with cacheTag() for revalidation
• • Cache lifecycle control with cacheLife()
• • No unstable_cache in new code
• • fetch() caching replaced with use cache

Cache Lifecycle Configuration

Check for proper cache profiles:

• • cacheLife('seconds') for rapidly changing data
• • cacheLife('minutes') for moderate update frequency
• • cacheLife('hours') for stable content
• • cacheLife('days') for rarely changing data
• • cacheLife('weeks') for static content
• • Custom profiles defined in next.config.js if needed

Revalidation Strategy

# Find revalidation calls
grep -r "revalidateTag\|revalidatePath" --include="*.ts" --include="*.tsx"

Verify:

• • revalidateTag() matches cacheTag() definitions
• • revalidatePath() used for page-level invalidation
• • No orphaned cache tags
• • Proper error handling in revalidation

3. Breaking Changes

Async Request APIs

# Find synchronous API usage
grep -r "cookies()\|headers()\|params\|searchParams" --include="*.ts" --include="*.tsx"

Check for required async usage:

• • await cookies() in Server Components/Actions
• • await headers() in Server Components/Actions
• • await params in page/layout/route components
• • await searchParams in page components
• • React.use() wrapper in Client Components if needed

Middleware to Proxy Migration

# Check for removed middleware patterns
grep -r "NextResponse.rewrite\|NextResponse.redirect" middleware.ts

Verify migration:

• • Simple rewrites moved to next.config.js redirects/rewrites
• • Complex logic converted to Middleware Proxies
• • Authentication logic preserved
• • Header manipulation handled correctly

Route Handler Changes

# Find route handlers
find app -name "route.ts" -o -name "route.js"

Check each route handler:

• • Dynamic functions require dynamic = 'force-dynamic'
• • No synchronous cookies()/headers() calls
• • Proper TypeScript types for request/params
• • Error handling updated for new patterns

generateStaticParams Changes

# Find static param generation
grep -r "generateStaticParams" --include="*.ts" --include="*.tsx"

Verify:

• • Returns array of param objects (not nested)
• • Works with new async params
• • Proper TypeScript types
• • No deprecated patterns

4. Migration Verification

Dependency Updates

Check package.json:

• • next: ^16.0.0 or higher
• • react: ^19.0.0 or higher
• • react-dom: ^19.0.0 or higher
• • @types/react: ^19.0.0 (if using TypeScript)
• • @types/react-dom: ^19.0.0 (if using TypeScript)

Configuration Updates

Check next.config.js:

• • experimental.dynamicIO enabled if using dynamic APIs
• • staleTimes configured if controlling client-side cache
• • Custom cacheLife profiles defined if needed
• • TypeScript config updated for async params

Build Validation

Run and verify:

npm run build

• • No deprecation warnings
• • No type errors
• • No runtime errors in build
• • Static generation works correctly
• • Dynamic routes render properly

Runtime Testing

• • Authentication flows work correctly
• • Protected routes require login
• • Server Actions validate permissions
• • Cache invalidation triggers updates
• • Dynamic content updates appropriately
• • Static content serves from cache

Violation Severity

Critical

• •Missing authentication in Server Actions (CVE-2025-29927)
• •Synchronous cookies()/headers() calls
• •Security middleware removed or broken

High

• •Missing cache directives on expensive operations
• •Incorrect async params usage
• •Broken revalidation strategy

Medium

• •Using deprecated unstable_cache
• •Middleware patterns that should be proxies
• •Missing cache lifecycle configuration

Nitpick

• •Suboptimal cache profiles
• •Missing cache tags for fine-grained invalidation
• •Legacy fetch caching patterns

Best Practices

1. •Run security audit first - Critical vulnerabilities take priority
2. •Group related violations - Fix all async API issues together
3. •Test incrementally - Verify each category before moving on
4. •Document decisions - Record why certain patterns were chosen
5. •Update documentation - Keep project docs current with Next.js 16 patterns