Merge pull request #951 from jsonwebtoken/fix/next-security-upgrade

fix: NextJS security upgrade.

Author: jcmartinezdev

.eslintrc.json

@@ -7,6 +7,28 @@ on:
         branches: [master]
 
 jobs:
+    quality:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - name: Setup Node.js
+              uses: actions/setup-node@v4
+              with:
+                node-version: '22'
+
+            - name: Install dependencies
+              run: npm ci
+
+            - name: Run ESLint
+              run: npm run lint
+
+            - name: Check types
+              run: npm run typecheck
+
+            - name: Build
+              run: npm run build
+
     test:
         runs-on: ubuntu-latest
         steps:

.github/workflows/tests.yaml

@@ -37,6 +37,7 @@ yarn-error.log*
 
 .npmrc
 **/.npmrc
+.npmrc.oidc
 
 
 # Created by https://www.toptal.com/developers/gitignore/api/macos,windows,visualstudiocode,webstorm,intellij,node

.gitignore

@@ -0,0 +1,16 @@
+import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
+
+const config = [
+  ...nextCoreWebVitals,
+  {
+    // Both rules target the Pages Router; this is the App Router root layout,
+    // which renders <head> itself and loads the font stylesheet per-locale.
+    files: ["src/features/common/components/layout/page-layout/**"],
+    rules: {
+      "@next/next/no-head-element": "off",
+      "@next/next/no-css-tags": "off",
+    },
+  },
+];
+
+export default config;

eslint.config.mjs

@@ -1,5 +1,7 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+import "./.next/types/root-params.d.ts";
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/building-your-application/configuring/typescript for more information.
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

next-env.d.ts

@@ -2,6 +2,8 @@ import createMDX from "@next/mdx";
 
 /** @type {import('next').NextConfig} */
 const nextConfig = {
+  // Next 16 writes AGENTS.md/CLAUDE.md on `next dev`; keep them out of the tree.
+  agentRules: false,
   // Playwright runs both browser projects against one long-lived dev server.
   // Retain route entries so later Firefox tests do not reference evicted chunks.
   ...(process.env.CI
@@ -34,6 +36,23 @@ const nextConfig = {
       }
     );
 
+    // @next/mdx registers its loader without an App Router layer, so .mdx misses
+    // Next's React aliasing and dev crashes on "ReactCurrentDispatcher of undefined".
+    const mdxRule = config.module.rules.find(
+      (rule) => rule?.test?.toString() === /\.mdx$/.toString()
+    );
+
+    if (mdxRule) {
+      mdxRule.resolve = {
+        ...mdxRule.resolve,
+        alias: {
+          ...mdxRule.resolve?.alias,
+          "react/jsx-runtime": "next/dist/compiled/react/jsx-runtime",
+          "react/jsx-dev-runtime": "next/dist/compiled/react/jsx-dev-runtime",
+        },
+      };
+    }
+
     return config;
   },
   images: {