chore(deps): Next 15.5.23 + React 19 — POST-HACKATHON, do not merge before 2026-08-14 - #30
Draft
edycutjong wants to merge 1 commit into
Draft
chore(deps): Next 15.5.23 + React 19 — POST-HACKATHON, do not merge before 2026-08-14#30edycutjong wants to merge 1 commit into
edycutjong wants to merge 1 commit into
Conversation
POST-HACKATHON BRANCH. Do not merge before the 2026-08-14 submission deadline: this is a two-major framework upgrade on a live judge-facing deploy, and the whole point of staging it here is to keep it away from main until the submission is locked. - next 14.2.35 -> 15.5.23 (all 21 open Dependabot next alerts require at most >=15.5.21, so 15.5.23 clears every one) - react / react-dom 18.3.1 -> 19.2.8 (required by the Next 15 App Router) - @types/react(-dom) -> 19.x, eslint-config-next -> 15.5.23 - wagmi ^2.12.17 -> ^2.19.5 and rainbowkit ^2.1.7 -> ^2.2.11 for React 19 peer compatibility; both stay on their current major Migration surface turned out to be near-zero for this app: no async request APIs (cookies/headers/draftMode), no params/searchParams, no route handlers, no real fetch() calls, and all five routes remain statically prerendered. No application code changed — only manifests and the generated next-env.d.ts. Verified locally: tsc clean, 34 Vitest, 34 Playwright, eslint clean, production build green with all 5 routes still static. Two things a reviewer must weigh before merging: - Bundle grew: shared JS 87.3 -> 103 kB, landing 150 -> 162 kB (React 19). The Lighthouse gate may move; check the Web Performance job. - Next 15 pulls sharp@0.34.5 (optional) which carries its own high libvips advisories, patched only in >=0.35.0 via next 16. So this trades 21 next alerts for a smaller number of sharp ones rather than clearing the board.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
⛔ Do not merge before the submission deadline (2026-08-14)
Staged deliberately so it stays away from
mainand the live judge-facing deploy until the hackathon submission is locked. Draft on purpose.What it does
Clears all 21 open
nextDependabot advisories — every one requires at most>=15.5.21, and this lands 15.5.23.wagmi and rainbowkit stay on their current major — bumped only for React 19 peer compatibility.
Migration surface was near-zero
Checked against the actual code: no async request APIs (
cookies/headers/draftMode), noparams/searchParams, no route handlers, no realfetch()calls, and all five routes remain statically prerendered. No application code changed — only manifests plus the generatednext-env.d.ts.Verified locally
tsc clean · 34 Vitest · 34 Playwright · eslint clean · production build green, 5/5 routes static.
Two things to weigh before merging
sharp@0.34.5(optional dep) carrying its own high libvips advisories, patched only in>=0.35.0via next 16. So this trades 21 next alerts for a smaller number of sharp ones — a big net win, not a clean sweep.Separately worth doing
@rainbow-me/rainbowkitis declared but never imported — it appears only in comments and docs. Removing it would prune a large slice of the@wagmi/connectorstransitive tree (the source of the axios/hono/ws alerts). Left out of this PR to keep the upgrade reviewable in isolation.