chore(deps): upgrade next to 16.3.1, its optimizer no longer deletes live code - #6777
Conversation
…live code 16.3.0 was reverted in #6242 because its Turbopack optimizer modelled a bare `return <asyncCall>()` tail call inside an async function as returning the promise object, propagated that always-truthy fact through the caller's `await`, and deleted everything after the resulting `if`. That shipped two dead code paths to production: the whole `POST /api/credentials` create path, and the insert inside `upsertAsyncToolCall`. We reported it as vercel/next.js#96595. The fix — "[turbopack] Collapse nested promises in the analyzer" (vercel/next.js#96601) — folds `Promise<Promise<T>>` to `Promise<T>` in the analyzer, and was backported as #96675 and released in 16.3.1. Verified before taking the bump: - The minimal reproduction from the issue no longer reproduces on 16.3.1. All four routes keep their code; on 16.3.0 `/api/broken` lost everything after the `if`. - A production build of `apps/sim` on 16.3.1 still emits the markers whose disappearance was the original signal: `credential_connected` (43 files), `acquireOrganizationUserMutationLocks` (28), and the `upsertAsyncToolCall` insert-path warning (10). The `return await` hardening added to both sites in the revert stays as is, and so does the TypeScript toolchain configuration. 16.3.1 published 2026-08-13, so it is inside the 7-day `minimumReleaseAge` supply-chain window until 2026-08-20 and needs an exclusion to install. The alternative is sitting on 16.2.12, whose successor we already reverted once, so the entries go in dated and come out on the next touch of the file. The mermaid and js-yaml exclusions aged out on 2026-08-11 and 2026-08-07 and are dropped here per that same rule.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
PR SummaryMedium Risk Overview The upgrade targets the Turbopack dead-code elimination fix for vercel/next.js#96595 (shipped in 16.3.1 after the 16.3.0 revert in #6242), which had removed live production paths such as
Reviewed by Cursor Bugbot for commit 5ef8a06. Configure here. |
Greptile SummaryThe PR upgrades Next.js and associated packages to 16.3.1, which includes the Turbopack optimizer correction, and updates release-age handling for the newly published packages.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| bunfig.toml | The follow-up fix now exempts all eight SWC platform packages, covering the Alpine and Windows variants identified in the previous review. |
| bun.lock | The lockfile contains all eight SWC 16.3.1 binaries and retains the existing sharp 0.35.3 platform packages. |
| package.json | Root Next.js, environment, and directly pinned SWC versions are consistently upgraded to 16.3.1. |
| apps/sim/package.json | The Sim application updates its direct Next.js dependency to 16.3.1. |
| apps/docs/package.json | The documentation application updates its direct Next.js dependency to 16.3.1. |
| packages/emcn/package.json | The EMCN package updates its Next.js dependency consistently with the workspace override. |
| apps/sim/next.config.ts | Comments are updated to reflect the upgraded Next.js version while preserving the existing cache and TypeScript CLI settings. |
Reviews (2): Last reviewed commit: "fix(deps): keep the musl and win32 SWC b..." | Re-trigger Greptile
The release-age exclusion only listed the four @next/swc platforms that package.json pins, but next declares all eight as its own optionalDependencies, so all eight are normally resolved into bun.lock. A gated optional dependency does not fail the install — bun drops it silently — so the first install stripped both musl variants and both win32 variants from the lockfile. That left the Alpine devcontainer and any Windows machine with no SWC binary to resolve. Adding the remaining four to the exclusion list restores all eight entries at 16.3.1. Worth knowing for the next time this happens: bun.lock is sticky here. Once an optional dependency has been dropped, re-running the install — even with --force, even with the age gate switched off entirely — does not bring it back, because the resolution is not reattempted. The lockfile has to be regenerated from a base that still contains the entries, which is why this restores bun.lock from staging before re-applying the bump.
|
@cursor review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 5ef8a06. Configure here.
Summary
next16.2.12 -> 16.3.1 across the root overrides, the@next/swc-*optional deps,apps/sim,apps/docs, andpackages/emcn.return <asyncCall>()tail call inside anasyncfunction as returning the promise object, carried that always-truthy fact through the caller'sawait, and deleted everything after the resultingif. That shipped two dead paths to production: the entirePOST /api/credentialscreate path, and the insert insideupsertAsyncToolCall.Promise<Promise<T>>toPromise<T>in the analyzer. It was backported as #96675 and shipped in 16.3.1.next.config.tscomments that were reworded to describe sitting on 16.2.12.Verification
Confirmed the fix before taking the bump, two independent ways:
/api/brokenlost everything after theif.apps/simon 16.3.1 still emits the marker strings whose disappearance was the original signal:credential_connected(43 files under.next/server),acquireOrganizationUserMutationLocks(28), and theupsertAsyncToolCallinsert-path warning (10).The
return awaithardening added to both sites in the revert stays as is, and so does the TypeScript toolchain configuration.Supply-chain gate
16.3.1 published 2026-08-13, so it sits inside the 7-day
minimumReleaseAgewindow until 2026-08-20 and cannot install without an exclusion. The alternative is staying on 16.2.12 — a release whose successor we already reverted once — so the entries go in dated, with a note to drop them on the next touch of the file. Themermaidandjs-yamlexclusions aged out on 2026-08-11 and 2026-08-07 and are dropped here per that same rule; both still resolve to their pinned versions.Type of Change
Testing
apps/simproduction build passes on 16.3.1 (compile 87s, TypeScript 4.4s, all routes emitted).bun run check:audits— 29/29 pass.bun run lintclean; block-registry audit passes.Checklist