Update to Next.js 16.

This commit resolves security vulnerabilities.

Author: EbodShojaei

.github/workflows/node.js.yml

@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 15
     strategy:
       matrix:
-        node-version: [18.x, 20.x, 22.x]
+        node-version: [20.x, 22.x]
 
     steps:
       - name: Checkout Repository

client/.depcheckrc

@@ -2,6 +2,7 @@
   "ignores": [
     "autoprefixer",
     "postcss",
-    "postcss-load-config"
+    "postcss-load-config",
+    "@tailwindcss/postcss"
   ]
 }

client/knip.config.js client/knip.config.mjsclient/knip.config.js renamed to client/knip.config.mjs

@@ -1,17 +1,15 @@
 export default {
   ignore: [
     'src/app/middleware.ts', // Explicitly ignore middleware file
+    'knip.config.mjs', // Config file
   ],
-  dependencies: {
-    include: [
-      'eslint-config-next', // Explicitly mark eslint-config-next as a dependency
-    ],
-  },
   ignorePatterns: [
     'node_modules/',
     'dist/',
     '.data',
     '**/.next/**',
   ],
   moduleResolution: 'node',
+  ignoreBinaries: ['autoprefixer', 'postcss-load-config'],
+  ignoreDependencies: ['autoprefixer', 'postcss-load-config'],
 };

client/next.config.ts

@@ -1,5 +1,7 @@
 import type { NextConfig } from "next";
 
+const isProduction = process.env.NODE_ENV === "production";
+
 const cspHeader = `
   default-src 'self';
   script-src 'self' 'unsafe-inline' https://cdnjs.buymeacoffee.com https://cdn.buymeacoffee.com https://www.googletagmanager.com https://www.google-analytics.com https://m.stripe.network;
@@ -12,7 +14,7 @@ const cspHeader = `
   base-uri 'self';
   form-action 'self';
   frame-ancestors 'none';
-  upgrade-insecure-requests;
+  ${isProduction ? "upgrade-insecure-requests;" : ""}
 `;
 
 const nextConfig: NextConfig = {

client/package.json

@@ -2,63 +2,65 @@
   "name": "boba-client",
   "version": "0.1.0",
   "private": true,
+  "type": "module",
   "scripts": {
     "dev": "next dev --turbopack",
     "build": "next build",
     "start": "next start",
-    "lint": "tsc --noEmit && eslint 'src/**/*.{ts,tsx}' && knip && depcheck",
-    "lint:fix": "tsc --noEmit && eslint 'src/**/*.{ts,tsx}' --fix && knip && depcheck",
+    "lint": "tsc --noEmit && eslint 'src/**/*.{ts,tsx}' && knip --exclude dependencies,files && depcheck",
+    "lint:fix": "tsc --noEmit && eslint 'src/**/*.{ts,tsx}' --fix && knip --exclude dependencies,files && depcheck",
     "format": "prettier --write \"src/**/*.ts\""
   },
   "dependencies": {
-    "@hookform/resolvers": "^3.10.0",
-    "@radix-ui/react-avatar": "^1.1.3",
-    "@radix-ui/react-dialog": "^1.1.6",
-    "@radix-ui/react-dropdown-menu": "^2.1.6",
-    "@radix-ui/react-label": "^2.1.2",
-    "@radix-ui/react-slot": "^1.1.2",
-    "@vercel/analytics": "^1.5.0",
+    "@hookform/resolvers": "^5.2.2",
+    "@radix-ui/react-avatar": "^1.1.11",
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-label": "^2.1.8",
+    "@radix-ui/react-slot": "^1.2.4",
+    "@vercel/analytics": "^1.6.1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "firebase-admin": "^13.2.0",
+    "firebase-admin": "^13.6.0",
     "js-cookie": "^3.0.5",
-    "lucide-react": "^0.473.0",
-    "next": "15.2.3",
+    "lucide-react": "^0.555.0",
+    "next": "16.0.7",
     "next-themes": "^0.4.6",
     "nextjs-google-analytics": "^2.3.7",
-    "nodemailer": "^6.10.0",
-    "react": "^19.1.0",
+    "nodemailer": "^7.0.11",
+    "react": "^19.2.1",
     "react-cookie-consent": "^9.0.0",
-    "react-dom": "^19.1.0",
-    "react-hook-form": "^7.55.0",
+    "react-dom": "^19.2.1",
+    "react-hook-form": "^7.68.0",
     "react-icons": "^5.5.0",
-    "tailwind-merge": "^2.6.0",
+    "tailwind-merge": "^3.4.0",
     "tailwindcss-animate": "^1.0.7",
-    "validator": "^13.15.0",
-    "zod": "^3.24.2"
+    "validator": "^13.15.23",
+    "zod": "^4.1.13"
   },
   "devDependencies": {
+    "@tailwindcss/postcss": "^4.1.17",
     "@types/js-cookie": "^3.0.6",
-    "@types/node": "^20.17.28",
-    "@types/nodemailer": "^6.4.17",
-    "@types/react": "^19.0.12",
-    "@types/react-dom": "^19.0.4",
-    "@types/validator": "^13.12.3",
-    "@typescript-eslint/eslint-plugin": "^8.28.0",
-    "@typescript-eslint/parser": "^8.28.0",
-    "autoprefixer": "^10.4.21",
+    "@types/node": "^24.10.1",
+    "@types/nodemailer": "^7.0.4",
+    "@types/react": "^19.2.7",
+    "@types/react-dom": "^19.2.3",
+    "@types/validator": "^13.15.10",
+    "@typescript-eslint/eslint-plugin": "^8.48.1",
+    "@typescript-eslint/parser": "^8.48.1",
+    "autoprefixer": "^10.4.22",
     "depcheck": "^1.4.7",
-    "eslint": "^9.23.0",
-    "eslint-config-prettier": "^10.1.1",
-    "eslint-plugin-prettier": "^5.2.5",
-    "eslint-plugin-react-hooks": "^5.2.0",
-    "eslint-plugin-unused-imports": "^4.1.4",
-    "knip": "^5.46.4",
-    "postcss": "^8.5.3",
+    "eslint": "^9.39.1",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.4",
+    "eslint-plugin-react-hooks": "^7.0.1",
+    "eslint-plugin-unused-imports": "^4.3.0",
+    "knip": "^5.71.0",
+    "postcss": "^8.5.6",
     "postcss-load-config": "^6.0.1",
-    "prettier": "^3.5.3",
-    "tailwindcss": "^3.4.17",
-    "typescript": "^5.8.2"
+    "prettier": "^3.7.4",
+    "tailwindcss": "^4.1.17",
+    "typescript": "^5.9.3"
   },
   "packageManager": "pnpm@9.15.4+sha512.b2dc20e2fc72b3e18848459b37359a32064663e5627a51e4c74b2c29dd8e8e0491483c3abb40789cfd578bf362fb6ba8261b05f0387d76792ed6e23ea3b1b6a0"
 }