[norberia]

Problem and result

Upgrade the repository's three frontend applications and MCP SDK to Next.js 15.5.28, addressing framework security issues and moving off the unsupported 13/14 release lines. Keep React/React DOM 18.3.1, Pages Router, Webpack, and existing business behavior.

Refs #7432. Depends on #7433 (Node 26); review and merge that prerequisite first. This branch starts from fab78d7b35762011cc74775f6e7d6f244561a4c9. Because the Node branch is in a personal fork, this PR targets upstream main and initially includes the prerequisite Node commit. Recheck the final diff after the Node PR is merged.

Next-only comparison: Node branch → Next branch. This PR remains a draft for the maintainer's final review; neither PR has been merged and neither issue has been closed.

Changes

• Pin Next.js to 15.5.28 in desktop, costcenter, license, and mcp-sdk, with matching eslint-config-next versions in the three applications.
• Update ESLint 8.33/8.36/8.38 to 8.57.1. The older versions caused a reproduced build failure when the new Next.js rules read the missing context.cwd property. Stay on ESLint 8.
• Move outputFileTracingRoot to the stable configuration and remove the obsolete swcMinify and instrumentationHook options. Preserve standalone output, internationalization, and the license application's SVG Webpack loader.
• Fix shadcn subpath exports. Existing UI components are ui/*.tsx, but the old exports array first selected nonexistent .ts paths, causing the new resolver to fail. Preserve public import paths and add an explicit table-layout export.
• Add Next.js 15.5.28 as a GTM development dependency so its optional peer does not retain a locked Next.js 14 instance. Preserve the public >=13.5.11 peer range. Generated output retains the external next/script import and does not bundle the Next.js runtime.
• Remove the unused license @next/font dependency. Desktop's next-env.d.ts is generated by Next.js 15; a clean rebuild after deleting .next also passed.

Validation

Independent review, coordinator acceptance, and an independent simplification pass with actual revalidation are complete. No unnecessary business abstractions, duplicate state, fallback branches, or tests were introduced.

Executed with Node 26.13.0 / pnpm 8.9.0:

• Frozen installation, including all four Prisma client generations; production builds for all three applications; and a clean desktop rebuild after deleting .next: exit 0.
• Desktop unit tests: 339 passed / 51 skipped / 2 todo. Costcenter unit tests: 17 passed. GTM: 9 passed. Health checks: 6 passed.
• Desktop Browser Mode with pinned Chromium 1217: 3 files, 27 tests passed.
• All three standalone applications returned 200 for GET/HEAD /healthz. Costcenter ran the real instrumentation/schema validation and returned the expected client configuration API response. English/Chinese SSR locales, static JavaScript, and public SVGs passed; desktop cache-control and locale-cookie checks passed.
• Local standalone tests use a temporary filesystem path mapping to model the /app/data/config.yaml configuration volume. They run the real application validators and do not stub database or business responses. This is not evidence of Linux container or real database validation.
• Controlled proxy-behavior comparison: for the same abnormal absolute-form Upgrade request, Next.js 14.2.35 made an outbound connection to localhost:80 and reached the canary once, receiving a real HTTP 403. Next.js 15.5.28 made no outbound connection, did not reach the canary, and closed the socket. Both versions returned healthy responses before and after the probe. Because the host cannot bind port 80, both versions use the same test-only TCP mapping from localhost:80 to a temporary loopback canary. This validates the behavior for that request, not a complete production ingress or CVE penetration test.
• The complete lockfile graph contains only Next.js 15.5.28. The production dependency audit returned no Next.js advisories. Other libraries still have High/Critical advisories; this PR does not claim to clear the entire dependency tree.

CI

For commit a3da7261f5fb42bb93bd7268d7142dc84df779bf:

• Build Frontends Image: success; all six desktop/costcenter/license linux/amd64 and linux/arm64 image builds passed.
• Check-Coverage: success.
• Check-Semgrep: success.
• Check-License: success.
• Multi-node E2E workflows were skipped according to scope. Image publishing and cluster deployment steps were skipped; nothing was published or deployed.

Remaining validation and rollback

• The local Docker daemon was unavailable. CI validates Linux amd64/arm64 image builds; final Linux container startup and real database checks remain unverified.
• No real PostgreSQL/CockroachDB service was available. The 51 skipped integration tests do not establish successful real queries, transactions, OAuth, or billing flows.
• The costcenter/shared/shadcn-ui component projects currently have no matching test files and are not counted as passing tests.
• Remaining advisories in the direct sharp dependency, Next.js's internal PostCSS dependency, and other libraries are left for subsequent dependency work rather than unrelated major upgrades.
• Next.js 15 security maintenance currently ends on 2027-01-31. Version 15.5.28 was confirmed as the latest stable 15.x release during implementation on 2026-11-02; subsequent security patches still need to be tracked.
• There are no database schema, JWT-format, or public business API migrations. Roll back the Next.js application images while retaining the prerequisite Node upgrade. Production has not been deployed.