Next.js 16, React 19.3, ESLint 10 (1.51.5)

- Next 16 (Turbopack dev and build), React 19.3; tsconfig jsx react-jsx; images remotePatterns.
- ESLint 10 with eslint-config-next 16 flat configs; npm run lint = eslint src. React
  Compiler-era react-hooks rules set to warn (181 existing places) until screens move to v2.
- Removed the empty pass-through middleware.ts.
- e2e: wait for the palette to be ready before Ctrl+K on the staff dashboard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ls1vMdg2GYqbnKZmPaX1ot

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.51.5] - 2026-10-29
+
+### Changed
+
+- **Next.js 16** (from 15.5) and **React 19.3**. Builds and dev use Turbopack (Next 16's default);
+  `tsconfig.json` `jsx` is `react-jsx` (required by Next 16); `images.domains` → `remotePatterns`.
+- **ESLint 10** (ESLint 9 is out of support) with Next 16's own flat configs
+  (`eslint-config-next/core-web-vitals` and `/typescript`, no more FlatCompat). `npm run lint` is
+  `eslint src` (`next lint` was removed). Next 16's React Compiler-era rules
+  (`react-hooks/set-state-in-effect`, `purity`, `immutability`, `static-components`, `refs`) are
+  warnings for now — 181 places, mostly loading data in `useEffect`.
+- Removed the empty `middleware.ts` (a pass-through that did nothing; Next 16 renames middleware to
+  "proxy"), which also drops its 117 kB bundle.
+
 ## [1.51.4] - 2026-10-29
 
 ### Security

WHATS-NEW.md

@@ -12,6 +12,11 @@ Write for church admins, not developers: no environment variables, endpoints or
 developer log is CHANGELOG.md. A tagged version without a section here shows "No details given".
 -->
 
+## 1.51.5
+
+- **Updated framework.** The site now runs on the latest version of its web framework. Nothing
+  changes in how it works.
+
 ## 1.51.4 — security
 
 - **Security updates** to the parts the site is built on, including a critical fix in the web

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.51.4",
+  "version": "1.51.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.51.4",
+      "version": "1.51.5",
       "hasInstallScript": true,
       "dependencies": {
         "@prisma/adapter-pg": "^7.10.1",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.51.4",
+  "version": "1.51.5",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

docs/HANDOVER.md

@@ -1,6 +1,6 @@
 # Handover — where things stand and how to carry on
 
-Last updated: 2026-10-29, after **1.51.4** (and Hub 1.5.0). The plan itself is in
+Last updated: 2026-10-29, after **1.51.5** (and Hub 1.5.0). The plan itself is in
 [ROADMAP-v2.md](./ROADMAP-v2.md) (decisions table at the end); the previous round of
 features is in [FEATURES-ROUND-1.md](./FEATURES-ROUND-1.md).
 
@@ -65,7 +65,7 @@ encrypted settings unreadable or break existing installs.
 Hub 1.1.0 is deployed with update requests rolled out, and `scripts/install.sh` has been tried on
 a test server (both done 2026-10-28).
 
-1. **1.51.5 — Next.js 16 and ESLint 10**, then **1.51.6 – 1.51.11: every endpoint onto v2**, one area
+1. **1.51.6 – 1.51.11: every endpoint onto v2**, one area
    per release (roadmap build order, row 11b): services in TS, screens on `apiV2`, v1 routes into
    `SUCCESSORS`. Then **2.0.0** — AI helpers and v1 removed. Inbound provider webhooks and links
    already sent in emails stay as permanent aliases.
@@ -87,7 +87,7 @@ a test server (both done 2026-10-28).
   or serious fix) → `git merge --no-ff`
   into `main` → `git tag vX.Y.Z` → `git push origin main <branch> vX.Y.Z`. One minor
   version per feature.
-- **Before tagging:** run `npx eslint src` in `frontend` over the **whole** app (the deploy runs `next build`, which fails on any lint error, e.g. an unescaped ' or " in JSX text). If a dev server is running, a full check build needs its own folder: `NEXT_DIST_DIR=.next-buildcheck npx next build` (then delete it and `git checkout frontend/tsconfig.json`).
+- **Before tagging:** run `npx eslint src` in `frontend` over the **whole** app (since Next 16 `next build` no longer lints — it still fails on TypeScript errors — so lint errors only show up if you run it; keep it at 0 errors). If a dev server is running, a full check build needs its own folder: `NEXT_DIST_DIR=.next-buildcheck npx next build` (then delete it and `git checkout frontend/tsconfig.json`).
 - **Changelog:** add entries to `[Unreleased]` as you go, in plain language. CHANGELOG.md is the
   full log; WHATS-NEW.md is what churches see before updating (the Hub reads it from main every
   15 minutes, for tagged versions only and sets the latest version from the tags — nothing to do in the Hub).
@@ -462,6 +462,16 @@ a test server (both done 2026-10-28).
   `fetchAllUsers` (Payments, Email/WhatsApp attendees, Forms, Manual) — a server-side search
   picker would replace them; the coupons list; `GET /api/registrations` without `page` (other callers still use the plain array).
 
+## Next.js 16 (1.51.5)
+
+- Turbopack for dev and build (the default). Lint with `npm run lint` / `npx eslint src` (`next lint`
+  is gone). There's no middleware/proxy file — add `src/proxy.ts` (Next 16's name) only if needed.
+- **React Compiler lint rules are warnings, not errors** (`eslint.config.mjs`): 181 existing places,
+  mostly `useEffect(() => { load(); }, [...])`. Fix them in a screen when it's moved onto v2
+  (1.51.6 – 1.51.11), then turn the rules back to errors. Don't add new ones.
+- `eslint-config-next` 16's bundled plugins (react, import, jsx-a11y) don't list ESLint 10 as a peer
+  yet; they work, and npm notes the override. Revisit when they publish ESLint 10 support.
+
 ## TypeScript and API v2 (1.51.0)
 
 - **Starting the backend:** PM2 runs `src/index.js`, a launcher. With plain Node it runs

docs/ROADMAP-v2.md

@@ -40,7 +40,8 @@ shipped; 1.49.1 **bulk actions** and 1.49.2 **saved filters** shipped — §9 is
 (Afrikaans) are removed from scope (2026-10-28), so everything after moves up by one. 1.50.0 **accessibility
 pass** shipped. 1.50.1 **pagination and search on long lists** and 1.50.2 **event picker and webhook guide** shipped. 1.51.0 **TypeScript backend and `/api/v2`
 foundations**, 1.51.1 **v2 registrations and payments**, 1.51.2 **v2 accounts and check-in** and 1.51.3 **Express 5,
-scanner on v2, v1 deprecation headers** shipped. **Next: 1.51.4 – 1.51.11 (dependencies, Next.js 16, then every endpoint onto v2), then 2.0.0.**
+scanner on v2, v1 deprecation headers** shipped. 1.51.4 **security and dependency updates** and 1.51.5 **Next.js 16** shipped. **Next: 1.51.6 – 1.51.11
+(every endpoint onto v2), then 2.0.0.**
 
 **Repositories:**
 
@@ -1009,7 +1010,7 @@ income justify the hardware:
 | 9 | 1.47.0 ✅ – 1.47.3 ✅, 1.48.0 ✅ | Event series & cloning (1.47.0 clone, 1.47.1 series, 1.47.2 year-on-year reports, 1.47.3 season pass), Outbound webhooks (Wallet passes removed from scope) | Smaller, independent wins |
 | 10 | 1.49.0 ✅ – 1.49.2 ✅, 1.50.0 ✅, 1.50.1 ✅, 1.50.2 ✅ | Admin dashboard/Ctrl+K/bulk actions/saved filters, Accessibility pass, pagination and search on long lists, event picker and webhook guide (Afrikaans removed from scope) | Polish before the big release |
 | 11 | 1.51.0 ✅, 1.51.1 ✅, 1.51.2 ✅, 1.51.3 ✅ | TypeScript backend + OpenAPI + `/api/v2` alongside v1: 1.51.0 foundations (build, launcher, route declarations, errors, paging, OpenAPI at `/docs/v2`, first read endpoints); 1.51.1 registrations and payments as TS services, typed frontend calls; 1.51.2 check-in and accounts; 1.51.3 Express 5, the scanner on v2, v1 deprecation headers, v2-shaped shared middleware | The breaking-change groundwork |
-| 11b | 1.51.4 – 1.51.11 | **Every endpoint on v2 before 2.0** (decided 2026-10-29): 1.51.4 dependency audit and Node 24 LTS; 1.51.5 Next.js 16 and ESLint 10 (ESLint 9 is out of support); 1.51.6 events and event set-up (events, sections, costs, uploads, series, season passes, bundles, coupons, campuses); 1.51.7 registrations and money, staff side (manage registrations, payments, cashup, provider transactions, waitlist, sponsorship, consent, forms, feedback); 1.51.8 tickets and attendance, staff side (tickets, scan locks, attendance, allocations); 1.51.9 kids check-in and volunteer rosters; 1.51.10 people and messaging (users, WhatsApp, broadcasts, scheduled emails, automations, banner, saved filters, dashboard, stats, analytics, reports); 1.51.11 privacy and admin (privacy, admin, settings, setup, Hub, outbound webhooks, backups). Each moves its area's logic into TS services, its screens onto `apiV2`, and its v1 routes into `SUCCESSORS` | 2.0 can then remove v1 |
+| 11b | 1.51.4 ✅, 1.51.5 ✅, 1.51.6 – 1.51.11 | **Every endpoint on v2 before 2.0** (decided 2026-10-29): 1.51.4 dependency audit and Node 24 LTS; 1.51.5 Next.js 16 and ESLint 10 (ESLint 9 is out of support); 1.51.6 events and event set-up (events, sections, costs, uploads, series, season passes, bundles, coupons, campuses); 1.51.7 registrations and money, staff side (manage registrations, payments, cashup, provider transactions, waitlist, sponsorship, consent, forms, feedback); 1.51.8 tickets and attendance, staff side (tickets, scan locks, attendance, allocations); 1.51.9 kids check-in and volunteer rosters; 1.51.10 people and messaging (users, WhatsApp, broadcasts, scheduled emails, automations, banner, saved filters, dashboard, stats, analytics, reports); 1.51.11 privacy and admin (privacy, admin, settings, setup, Hub, outbound webhooks, backups). Each moves its area's logic into TS services, its screens onto `apiV2`, and its v1 routes into `SUCCESSORS` | 2.0 can then remove v1 |
 | 12 | **2.0.0** | **AI helpers** (§15 — headline feature: draft an event, summarise reports and feedback, draft messages, improve text; through the Hub with a rand cap per licence), v1 removed (all of it is on v2 by then; inbound provider webhooks and links already sent in emails stay as permanent aliases), migration guide, marketing site/docs for selling | The release. AI needs the Hub (phase 6) for the key, metering and caps |
 
 Each phase should add matching help content (`frontend/src/content/help/`),

e2e/dashboard.spec.ts

@@ -39,6 +39,8 @@ test.describe("dashboard and command palette", () => {
     // Staff don't get admin pages.
     await loginAs(page, "staff");
     await page.goto("/dashboard/staff");
+    // The shortcut listens once the signed-in user has loaded (the search button shows then).
+    await expect(page.getByRole("button", { name: /Search or jump to/ })).toBeVisible();
     await page.keyboard.press("Control+k");
     const staffDialog = page.getByRole("dialog", { name: "Go to or search" });
     await staffDialog.getByRole("combobox", { name: "Search" }).fill("users");

frontend/AGENTS.md

@@ -0,0 +1,9 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+## This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

frontend/eslint.config.mjs

@@ -1,16 +1,26 @@
-import { dirname } from "path";
-import { fileURLToPath } from "url";
-import { FlatCompat } from "@eslint/eslintrc";
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextVitals from "eslint-config-next/core-web-vitals";
+import nextTs from "eslint-config-next/typescript";
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-});
-
-const eslintConfig = [
-  ...compat.extends("next/core-web-vitals", "next/typescript"),
-];
+// Next.js 16's own flat configs (no more FlatCompat / eslintrc). Run with `npm run lint`
+// (`next lint` was removed in Next 16).
+const eslintConfig = defineConfig([
+  ...nextVitals,
+  ...nextTs,
+  {
+    // React Compiler-era rules that eslint-plugin-react-hooks 7 (with Next 16) turns on as
+    // errors. They flag patterns the app uses on purpose and that work (mostly loading data in
+    // useEffect), so they're warnings while the code is moved off them screen by screen —
+    // see HANDOVER, "Next.js 16". New code should follow them.
+    rules: {
+      "react-hooks/set-state-in-effect": "warn",
+      "react-hooks/purity": "warn",
+      "react-hooks/immutability": "warn",
+      "react-hooks/static-components": "warn",
+      "react-hooks/refs": "warn",
+    },
+  },
+  globalIgnores([".next/**", ".next-*/**", "out/**", "build/**", "next-env.d.ts", "src/lib/api-v2/schema.d.ts"]),
+]);
 
 export default eslintConfig;

frontend/next.config.ts

@@ -6,7 +6,8 @@ const nextConfig: NextConfig = {
   // from clashing with one already running.
   distDir: process.env.NEXT_DIST_DIR || ".next",
   images: {
-    domains: ['images.unsplash.com'],
+    // (images.domains is deprecated in Next 16.)
+    remotePatterns: [{ protocol: 'https', hostname: 'images.unsplash.com' }],
   },
   compiler: {
     removeConsole: process.env.NODE_ENV === 'production',

frontend/package.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.51.4",
+  "version": "1.51.5",
   "private": true,
   "scripts": {
-    "dev": "next dev --turbopack",
+    "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "eslint src",
     "api:types": "openapi-typescript src/lib/api-v2/openapi.json -o src/lib/api-v2/schema.d.ts"
   },
   "dependencies": {
@@ -36,11 +36,11 @@
     "date-fns": "^4.1.0",
     "idb": "^8.0.4",
     "lucide-react": "^0.536.0",
-    "next": "^15.5.28",
+    "next": "^16.4.3",
     "qrcode": "^1.5.4",
-    "react": "19.1.0",
+    "react": "^19.3.1",
     "react-day-picker": "^9.8.1",
-    "react-dom": "19.1.0",
+    "react-dom": "^19.3.1",
     "react-hook-form": "^7.62.0",
     "react-webcam": "^7.2.0",
     "tailwind-merge": "^3.3.1",
@@ -51,11 +51,11 @@
     "@eslint/eslintrc": "^3",
     "@types/node": "^20",
     "@types/qrcode": "^1.5.5",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "autoprefixer": "^10.4.21",
-    "eslint": "^9",
-    "eslint-config-next": "^15.5.28",
+    "eslint": "^10.13.0",
+    "eslint-config-next": "^16.4.3",
     "openapi-typescript": "^7.13.0",
     "postcss": "^8.5.6",
     "tailwindcss": "3.4",

frontend/src/instrumentation.ts

@@ -1,9 +1,7 @@
 // Next.js server instrumentation entry point. A no-op when NEXT_PUBLIC_SENTRY_DSN isn't
 // set — see instrumentation-client.ts for the browser-side counterpart.
 //
-// Node runtime only, deliberately — this app's middleware.ts (which runs in Next's edge
-// runtime) is a trivial pass-through with no real error surface, so an edge-runtime branch
-// here would only inflate that shared middleware bundle for no actual coverage benefit.
+// Node runtime only — the app has no middleware/proxy running in the edge runtime.
 export async function register() {
   if (!process.env.NEXT_PUBLIC_SENTRY_DSN) return;
   if (process.env.NEXT_RUNTIME !== "nodejs") return;

frontend/src/middleware.ts

@@ -1,6 +0,0 @@
-import { NextResponse } from "next/server";
-
-// Minimal pass-through middleware to satisfy Next.js requirements
-export function middleware() {
-  return NextResponse.next();
-}

frontend/tsconfig.json

@@ -11,7 +11,7 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "incremental": true,
     "plugins": [
       {
@@ -22,6 +22,6 @@
       "@/*": ["./src/*"]
     }
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts", ".next-e2e/types/**/*.ts"],
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts", ".next/dev/types/**/*.ts", ".next-e2e/types/**/*.ts", ".next-e2e/dev/types/**/*.ts"],
   "exclude": ["node_modules"]
 }

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.51.4",
+  "version": "1.51.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.51.4",
+      "version": "1.51.5",
       "license": "ISC",
       "devDependencies": {
         "@axe-core/playwright": "^4.14.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.51.4",
+  "version": "1.51.5",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",