Upgrade to React 19 and Next.js 16

[devin-ai-integration]

Summary

Upgrades the Next.js app from React 17 / Next 12 to React 19 / Next 16. Next 12 cannot run React 19; Next was first moved to 15, then to 16 to clear the remaining Snyk-flagged DoS advisories.

Dependency changes in package.json:

• react / react-dom: 17.0.2 → ^19.0.0
• next: 12.1.0 → ^16.2.7
• eslint: 8.13.0 → ^9.39.4; eslint-config-next: 12.1.4 → ^16.2.7
• react-icons ^4.3.1 → ^5.4.0, react-hot-toast ^2.2.0 → ^2.5.2 (React 19 peers)
• Removed next-sanity-image (unused) and the @babel/* deps + .babelrc (only the redundant JSX preset, which forced Babel and disabled SWC)
• Added overrides.postcss: ^8.5.10
• Standardized on npm: removed yarn.lock, regenerated package-lock.json

Code/config changes required by the upgrade:

• Lint migration: next lint was removed in Next 16. Switched the lint script to eslint . and replaced .eslintrc.json with a flat-config eslint.config.mjs that consumes eslint-config-next/core-web-vitals (eslint 9 requires flat config).
• context/StateContext.js: the new react-hooks/immutability rule (default in eslint-config-next 16) flagged foundProduct/index — component-scoped lets reassigned inside callbacks. Made foundProduct a function-local const in onRemove/toggleCartItemQuanitity and removed the unused index. No behavior change.

No other source changes were needed — no ReactDOM.render, forwardRef, defaultProps, PropTypes, next/image, or <Link><a> patterns exist. next.config.js only sets reactStrictMode (still valid). The separate sanity_ecommerce/ Studio v2 project is left untouched.

Verification

• npm run build → compiles successfully; all 8 pages (SSG /product/[slug], SSR /) generate.
• npm run lint → 0 errors (only pre-existing <img>/alt-text/exhaustive-deps warnings).
• npx snyk test → no vulnerable paths found (was 25 issues incl. 2 Critical / 9 High on main).
• Ran in the browser: homepage, product pages, and cart all work with a clean console (no React 19 hydration errors).

Link to Devin session: https://app.devin.ai/sessions/6df126faa4e8482a90640bc529b589dd
Requested by: @davidbean-hash

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

End-to-end test results — React 19.2.7 + Next 16.2.7

Tested the running production build (npm run build + npm start) through the browser, focused on context/StateContext.js (the only runtime source changed by this PR).

Result: cart add / increment / decrement / remove all correct with a clean console; storefront SSR + SSG render fine on the new stack. One item could not be fully exercised due to a pre-existing bug unrelated to this upgrade (details below).

Cart + storefront (the changed code) — PASS

Check	Result
SSR homepage + SSG product page render, no React errors/hydration warnings	✅
Add Speaker ($56) qty 2 → badge 2, Subtotal $112	✅
Decrement → qty 1, $56 (toggleCartItemQuanitity 'dec')	✅
Increment ×2 → qty 3, $168 (toggleCartItemQuanitity 'inc')	✅
Remove → empty cart, badge 0 (onRemove)	✅

Checkout `/api/stripe` — route works under Next 16; hosted page blocked by pre-existing bug

"Pay with Stripe" invokes POST /api/stripe, which runs server-side under Next 16 and relays Stripe's error. The Stripe-hosted page is not reached because of a hardcoded invalid shipping rate in pages/api/stripe.js (untouched by this PR, identical on main):

shipping_rate: 'shr_1Kn3IaEnylLNWUqj5rqhg9oV'
→ Stripe 400: "No such shipping rate: 'shr_1Kn3IaEnylLNWUqj5rqhg9oV'"

This is not a regression from the React 19 / Next 16 upgrade — it's a Stripe account/config issue. Outbound network to Stripe from the box works (checkout.stripe.com 301). The fact that the route reaches Stripe and returns Stripe's exact error confirms Next 16 API routes function correctly.

CI at test time

• security/snyk: PASS (0 vulnerable paths; down from 25 issues on main).
• license/snyk: FAIL — LGPL-3.0 via Next 16's optional sharp dep (unused here; app uses plain <img>). Compliance matter, not runtime.

Tested by Devin — session: https://app.devin.ai/sessions/6df126faa4e8482a90640bc529b589dd

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.