chore(deps): upgrade next to 16.3.1, its optimizer no longer deletes live code (#6777)

* chore(deps): upgrade next to 16.3.1, its optimizer no longer deletes live code

16.3.0 was reverted in #6242 because its Turbopack optimizer modelled a bare
`return <asyncCall>()` tail call inside an async function as returning the
promise object, propagated that always-truthy fact through the caller's `await`,
and deleted everything after the resulting `if`. That shipped two dead code
paths to production: the whole `POST /api/credentials` create path, and the
insert inside `upsertAsyncToolCall`.

We reported it as vercel/next.js#96595. The fix — "[turbopack] Collapse nested
promises in the analyzer" (vercel/next.js#96601) — folds `Promise<Promise<T>>`
to `Promise<T>` in the analyzer, and was backported as #96675 and released in
16.3.1.

Verified before taking the bump:

- The minimal reproduction from the issue no longer reproduces on 16.3.1. All
  four routes keep their code; on 16.3.0 `/api/broken` lost everything after
  the `if`.
- A production build of `apps/sim` on 16.3.1 still emits the markers whose
  disappearance was the original signal: `credential_connected` (43 files),
  `acquireOrganizationUserMutationLocks` (28), and the `upsertAsyncToolCall`
  insert-path warning (10).

The `return await` hardening added to both sites in the revert stays as is, and
so does the TypeScript toolchain configuration.

16.3.1 published 2026-08-13, so it is inside the 7-day `minimumReleaseAge`
supply-chain window until 2026-08-20 and needs an exclusion to install. The
alternative is sitting on 16.2.12, whose successor we already reverted once, so
the entries go in dated and come out on the next touch of the file. The mermaid
and js-yaml exclusions aged out on 2026-08-11 and 2026-08-07 and are dropped
here per that same rule.

* fix(deps): keep the musl and win32 SWC binaries in the lockfile

The release-age exclusion only listed the four @next/swc platforms that
package.json pins, but next declares all eight as its own optionalDependencies,
so all eight are normally resolved into bun.lock. A gated optional dependency
does not fail the install — bun drops it silently — so the first install
stripped both musl variants and both win32 variants from the lockfile.

That left the Alpine devcontainer and any Windows machine with no SWC binary to
resolve. Adding the remaining four to the exclusion list restores all eight
entries at 16.3.1.

Worth knowing for the next time this happens: bun.lock is sticky here. Once an
optional dependency has been dropped, re-running the install — even with
--force, even with the age gate switched off entirely — does not bring it back,
because the resolution is not reattempted. The lockfile has to be regenerated
from a base that still contains the entries, which is why this restores
bun.lock from staging before re-applying the bump.

Author: waleedlatif1

apps/docs/package.json

@@ -27,7 +27,7 @@
     "fumadocs-mdx": "14.3.2",
     "fumadocs-openapi": "10.8.1",
     "fumadocs-ui": "16.8.5",
-    "next": "16.2.12",
+    "next": "16.3.1",
     "next-themes": "^0.4.6",
     "react": "19.2.4",
     "react-dom": "19.2.4",

apps/sim/next.config.ts

@@ -218,16 +218,15 @@ const nextConfig: NextConfig = {
      * it lives. Restoring across commits is separately undocumented-as-supported
      * (vercel/next.js#87283 reports stale HTML from a cache built elsewhere).
      *
-     * Keep the explicit pin even while we sit on 16.2.12: 16.3.0 flips this
-     * default to true for stable (vercel/next.js#94616), so dropping it would
-     * silently re-enable the slower cache the next time we take that bump.
+     * The explicit pin is load-bearing: 16.3.0 flipped this default to true for
+     * stable (vercel/next.js#94616), so dropping it re-enables the slower cache.
      */
     turbopackFileSystemCacheForBuild: false,
     /**
      * TypeScript 7 ships no JavaScript compiler API until 7.1, so Next's default
      * checker cannot load it — this shells out to the project-local `tsc` instead.
      * Pinned because the failure mode is not slower type checking but none at all:
-     * without it 16.2.12 skips the stage silently in 138ms.
+     * 16.2.12 skipped the stage silently in 138ms.
      */
     useTypeScriptCli: true,
     preloadEntriesOnStart: false,

apps/sim/package.json

@@ -195,7 +195,7 @@
     "mssql": "12.7.0",
     "mysql2": "3.14.3",
     "neo4j-driver": "6.0.1",
-    "next": "16.2.12",
+    "next": "16.3.1",
     "next-mdx-remote": "^6.0.0",
     "next-runtime-env": "3.3.0",
     "next-themes": "^0.4.6",

bun.lock

@@ -5,16 +5,34 @@ exact = true
 minimumReleaseAge = 604800
 # @typescript/native-preview stays excluded permanently: it only publishes nightly
 # dev builds, so every version is structurally younger than any age gate.
-# mermaid 11.16.1 (published 2026-08-04) clears five open Dependabot advisories that
-# 11.15.0 carries: architecture-diagram and config-API prototype pollution, radar and
-# XY-chart DoS, and CSS injection into siblings of the diagram. It is inside the 7-day
-# window and cannot be installed without an exception; it ages out on 2026-08-11 — drop
-# the entry then, and re-date this note on any further bump rather than deleting the entry
-# early, because removing it while the pinned version is still inside the window blocks the
-# bump outright. js-yaml 4.3.1 (published 2026-07-31) carries the CVE-2026-59870 !!omap
-# quadratic-CPU fix, which was never backported to the 4.3.0 line; it ages out on 2026-08-07,
-# so that entry can go on the next touch of this file.
-minimumReleaseAgeExcludes = ["@typescript/native-preview", "mermaid", "js-yaml"]
+# next 16.3.1 (published 2026-08-13) carries the Turbopack fix for vercel/next.js#96595,
+# the dead-code elimination bug that deleted the POST /api/credentials create path in
+# production and forced the 16.3.0 revert (#6242). Sitting on 16.2.12 to wait out the
+# window means knowingly staying on a release whose successor we already reverted once,
+# so the bump takes an exception instead. It ages out on 2026-08-20 — drop these entries
+# then, and re-date this note on any further bump rather than deleting them early, because
+# removing an entry while its pinned version is still inside the window blocks the bump
+# outright. The mermaid and js-yaml entries aged out on 2026-08-11 and 2026-08-07 and are
+# dropped here per that rule.
+# All eight @next/swc platform packages are listed even though package.json pins only four:
+# next declares all eight as its own optionalDependencies, so every one of them is resolved
+# into bun.lock regardless of which host runs the install. A gated optional dependency does
+# not fail the install — bun drops it silently — so omitting the musl and win32 entries here
+# would quietly strip them from the lockfile, and the Alpine devcontainer and any Windows
+# machine would then have no SWC binary to resolve.
+minimumReleaseAgeExcludes = [
+  "@typescript/native-preview",
+  "next",
+  "@next/env",
+  "@next/swc-darwin-arm64",
+  "@next/swc-darwin-x64",
+  "@next/swc-linux-arm64-gnu",
+  "@next/swc-linux-arm64-musl",
+  "@next/swc-linux-x64-gnu",
+  "@next/swc-linux-x64-musl",
+  "@next/swc-win32-arm64-msvc",
+  "@next/swc-win32-x64-msvc",
+]
 
 [run]
 env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }

bunfig.toml

@@ -97,8 +97,8 @@
   "overrides": {
     "react": "19.2.4",
     "react-dom": "19.2.4",
-    "next": "16.2.12",
-    "@next/env": "16.2.12",
+    "next": "16.3.1",
+    "@next/env": "16.3.1",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.5",
     "minimatch": "^10.2.5",
@@ -107,10 +107,10 @@
     "e2b": "^2.36.1"
   },
   "optionalDependencies": {
-    "@next/swc-darwin-arm64": "16.2.12",
-    "@next/swc-darwin-x64": "16.2.12",
-    "@next/swc-linux-arm64-gnu": "16.2.12",
-    "@next/swc-linux-x64-gnu": "16.2.12"
+    "@next/swc-darwin-arm64": "16.3.1",
+    "@next/swc-darwin-x64": "16.3.1",
+    "@next/swc-linux-arm64-gnu": "16.3.1",
+    "@next/swc-linux-x64-gnu": "16.3.1"
   },
   "devDependencies": {
     "@babel/parser": "7.29.2",

package.json

@@ -82,7 +82,7 @@
     "class-variance-authority": "^0.7.1",
     "framer-motion": "^12.5.0",
     "input-otp": "^1.4.2",
-    "next": "16.2.12",
+    "next": "16.3.1",
     "prismjs": "^1.30.0",
     "react": "19.2.4",
     "react-dom": "19.2.4",