Jiwon Choi

Expose App Router runtime errors over HMR (#98438) Ported from #98040 by @marcoshernanz. > [!TIP] > Best reviewed commit by commit. ### Why? External development tools need browser runtime-error state, not just build errors, to display application failures. Reporting remains opt-in so applications that do not need it avoid client serialization, HMR transport, server formatting, buffering, and rebroadcast overhead. ### How? Add `experimental.exposeRuntimeErrorsToHMR` for App Router development with Webpack and Turbopack. Internal integrations can also enable the same behavior without changing `next.config` by setting `__NEXT_EXPOSE_RUNTIME_ERRORS_TO_HMR` to any non-empty value. When enabled, the HMR WebSocket emits `runtimeErrors` snapshots containing: - The current pathname and browser client/document identifiers. - Error types, names, messages, and source-mapped stacks. - Fatality and optional catching-boundary details (`default-global`, `custom-global`, or `custom`). Snapshots update as errors and navigation change. New or reconnected observers receive the current state, and disconnecting a browser clears its reported errors. An empty snapshot means there are no currently reported errors; it does not guarantee application recovery. Reporting is disabled by default. Pages Router, MCP `get_errors`, and production behavior are unchanged. <!-- NEXT_JS_LLM --> Co-authored-by: Marcos Hernanz <96699542+marcoshernanz@users.noreply.github.com>

Add `next upgrade --ai` and security vulnerability coverage (#98562) > [!TIP] > Recommended to review commit by commit. This PR adds `next upgrade --experimental-ai="security"` flag (alias `--ai`), which is targeted to help users leverage agents to upgrade their app to the safe major version when their app's Next.js version has any security advisories. Once the command is ran from the user, Next.js will detect the installed agent harness in user's device, currently limited to Codex and Claude, and will proceed with starting an agent session once approved. If it is called within an agent session, the work will continue off within that agent. `next upgrade --ai` simply does two things: - prepare the relevant context to temporary dir - print hand off prompt, guiding to read those context The context will guide the agent to run relevant codemods and migration checklist to proceed. This PR is a base core of the workflow, and will have wrappers of entry point around this. Also, will add "latest" and "future" as follow up, which will cover the app to be always latest, and adopt the future defaults like Cache Components. This PR also sets up the evals infra and adds evals.

Add future defaults upgrade coverage for `next upgrade --ai` (#98643) Stacked on #98640. This PR adds `next upgrade --ai="future"` flag, which is targeted to help users leverage agents to upgrade their app to adopt the future defaults when available. Just like latest version upgrade, it covers running codemods and a migration checklist for major-to-major upgrades to support breaking changes more reliably. This PR currently covers Cache Components only for the future default.

Replace CSRBailout error with `ReactDOM.browser` behind a flag (#96826) CSRBailout error is the use case for `ReactDOM.browser()`. Replace behind an experimental flag. This PR replaces the bailout error used in next/dynamic ssr: false.

Nudge security upgrades for manual `next dev|build` (#98872) Counter part of agent nudge. Prompt user when runs `next dev` or `next build` based on `experimental.agenticAutoUpgrade` value. This PR covers `security`.

Show security upgrade insights in DevTools (#99002) Stacked on #99222. ### Why? Developers running `next dev` with `agenticAutoUpgrade` enabled need a browser reminder when their installed Next.js version is affected by a security advisory. ### How? Assess upgrades once during dev startup and share the result with the CLI nudge. The existing HMR `SYNC` message carries the security advisory to DevTools, which shows a Vulnerability Insight in the existing Insights overlay with a copyable upgrade prompt. The Insight applies to the `security`, `latest`, and `future` policies when the assessment finds an affected version and a safe target. A private test override previews the UI without a vulnerable fixture or live advisory data. ### Screenshots These show the badge and overlay layout. The current copied prompt runs `next upgrade --ai=security` from the app directory. **DevTools badge**  | Light | Dark | | --- | --- | |  |  | <!-- NEXT_JS_LLM --> Closes NAR-939

Nudge the agents for security vulnerable version upgrade (#98637) Stacked on #98562. > [!TIP] > Recommended to review commit by commit. This PR adds `experimental.agenticAutoUpgrade = 'security'` config which enables nudging the agents to notify the user when the app's Next.js version has any security advisories. The nudge will include guiding to upgrade via `next upgrade --ai` (run "security" by detecting config). The method of nudging leverages the agents behavior where they tend to listen to messages from fatal errors that blocks the process compared to general error/warning logs. Whenever the agents run `next dev` or `next build`, Next.js will detect the condition and nudge the agent using this method. Afterwards it's up to the user whether to proceed the upgrade or not, it's 100% up to the user how to run it e.g. subagent, background agent, etc. and the process should not enforce any that affects user's workflow.

[ts-plugin] Preserve TypeScript quick info metadata (#95863) ### Why? VS Code passes a maximum hover length and verbosity level to TypeScript's `getQuickInfoAtPosition` API when a user expands a hover. The Next.js TypeScript plugin intercepted that call and forwarded the file name and position, dropping the remaining arguments. The plugin also replaced TypeScript's `QuickInfo` object when it added config documentation, which discarded native fields such as `canIncreaseVerbosityLevel`. As a result, hovers for Next.js config exports could not expand and lost native type information. This supersedes #86290 with a narrower behavior change. The plugin preserves native `QuickInfo` when it adds documentation to valid config values and config identifiers. Invalid config values keep the existing synthesized override, and hovers inside function initializers retain TypeScript's existing behavior. x-ref: https://github.com/microsoft/vscode/issues/232685#issuecomment-3484167019 | Before | After | |--------|-------| | <img width="1656" height="390" alt="Config hover without expandable metadata" src="https://github.com/user-attachments/assets/ed39a851-7096-448b-bffe-55c5320c1713" /> | <img width="1668" height="384" alt="Config hover with expandable metadata" src="https://github.com/user-attachments/assets/0a3a0cbc-5c75-4b6f-90fc-bbcef028d06b" /> | ### How? The plugin forwards all QuickInfo arguments to TypeScript and passes the native result into the config hover rules. For valid config values and identifiers, those rules copy the native `QuickInfo` fields and append the Next.js documentation. They synthesize the existing fallback when TypeScript returns no QuickInfo. Focused tests cover argument forwarding, metadata preservation, missing native QuickInfo, invalid config values, and function config boundaries. ### Test plan Open a minimal Next.js app in Cursor with workspace TypeScript 6.0.2 and the package built from this PR. Hover `export const metadata: Metadata`, then select the expansion control. The hover expands from `Metadata` to its full property type while the Next.js config documentation and link remain visible. <!-- NEXT_JS_LLM -->

Enable AI upgrade for canary (#99001) > [!TIP] > Recommended to review commit by commit. ### Why? Support `canary` releases for agentic upgrade so the workflow is available for the dogfooders. Startup reminders also need to check target eligibility before offering an upgrade that the configured policy cannot perform. ### How? Enable latest and Future upgrades on the canary channel while keeping stable installations on stable releases. Security upgrades and advisory checks remain stable-only; canary version ordering is not used to infer security fixes. Share policy-aware advisory and target assessment between startup reminders and explicit upgrades, retaining security warnings when no eligible target is available and offering bare `--ai` only when the configured policy can proceed. Explicit stable `latest` upgrades also check target advisories, after treating strictly older targets as a no-op; equal affected targets remain blocked. Canary latest and Future upgrades skip advisory assessment. Version reminders keep their major/minor threshold, and Future Defaults retain their full-version availability checks. Assessment caching is left as a TODO. The agentic upgrade guide remains a bundled, agent-consumed workflow marked `version: draft`; public-facing documentation will be handled separately.

Nudge the agents for latest version upgrade (#98640) Stacked on #98633. This PR adds `experimental.agenticAutoUpgrade = 'latest'` config which enables nudging the agents to notify the user when there's new major/minor Next.js version available to upgrade. The nudge will include guiding to upgrade via `next upgrade --ai` (run "latest" by detecting config). The method of nudging leverages the agents behavior where they tend to listen to messages from fatal errors that blocks the process compared to general error/warning logs. Whenever the agents run `next dev` or `next build`, Next.js will detect the condition and nudge the agent using this method. Afterwards it's up to the user whether to proceed the upgrade or not, it's 100% up to the user how to run it e.g. subagent, background agent, etc. and the process should not enforce any that affects user's workflow. Enabling `experimental.agenticAutoUpgrade = 'latest'` also enables security check.