chore(deps): Bump next from 16.0.7 to 16.0.10

[dependabot]

Bumps next from 16.0.7 to 16.0.10.

Release notes

Sourced from next's releases.

v16.0.10

Please see the Next.js Security Update for information about this security patch.

v16.0.8

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Update react version in cna templates (#86950)

Credits

Huge thanks to @​huozhi for helping!

Commits

• 581dee6 v16.0.10
• 9a0dc9c Backport facebook/react#35351 for 16.0.9 (#87085)
• 3f6a39f v16.0.9
• 75e136a Update React Versions (#40)
• 4e20596 Update React Version (#22)
• fa85848 Backport Next.js changes to v16.0.9 (#20)
• 817ee56 v16.0.8
• b298173 Update react version in cna templates (#86950)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mchestr]

@dependabot rebase

[claude]

Claude finished @dependabot[bot]'s task in 1m 26s —— View job

---

Code Review - PR #225

Todo List

• Check current branch state and CI status
• Review changes since last review
• Provide updated recommendations

---

Summary

This PR contains three commits addressing a security update, a type export bug fix, and removal of flaky E2E tests:

1. Security update: Next.js upgrade from 16.0.7 to 16.0.10 (Dependabot)
2. Bug fix: Resolved ChatMessage type export issue in server actions
3. Test cleanup: Removed flaky announcement E2E tests

---

Security Review ✅

Next.js 16.0.10 Security Update

• This upgrade addresses a security vulnerability in Next.js
• Recommendation: This should be merged promptly to address the security issue
• The upgrade is a patch version bump (16.0.7 → 16.0.10), which should maintain backward compatibility

---

Code Quality Review ✅

1. ChatMessage Type Export Fix (commit: 15973af)

Problem Solved:
The fix addresses a critical issue where type re-exports in server action files were causing Next.js to incorrectly bundle types into the runtime server actions bundle, resulting in ReferenceError: ChatMessage is not defined errors during E2E tests.

Changes Made:

• actions/chatbot/index.ts: Removed export type { ChatMessage, ChatResponse }
• Updated imports across 4 files to use @/actions/chatbot/types directly
• All imports now correctly use the type modifier

Code Quality Assessment:

✅ Correct approach: This follows Next.js best practices for server actions

• Server action files should not re-export types
• Types should be imported directly from their source files
• Using import { type ChatMessage } ensures types are stripped at compile time

✅ Consistency: All affected files updated properly:

• actions/chatbot/index.ts:8 - Uses type import
• components/admin/chatbot/chat-window.tsx:4 - Uses type import from types file
• __tests__/actions/chatbot.test.ts:6 - Uses type import from types file
• components/__tests__/admin/chatbot/chat-window.test.tsx:10 - Uses type import from types file

✅ Test Coverage: Both component and action tests have been updated and should pass

---

2. Flaky E2E Test Removal (commit: bd0cb04)

Problem Solved:
Removed 6 flaky announcement E2E tests that were causing unreliable CI failures due to timing issues, selector ambiguities, and strict mode violations.

Tests Removed:

• "should display empty state when no announcements"
• "should open create announcement modal" (strict mode violation)
• "should edit an existing announcement" (ERR_ABORTED/timeouts)
• "should delete an announcement" (ERR_ABORTED/timeouts)
• "should close modal when clicking cancel"
• "should close modal when clicking outside"

Tests Retained:

• ✅ "should access announcements admin page"
• ✅ "should create a new announcement"
• ✅ "should toggle announcement active status"
• ✅ All user dashboard tests (4 tests covering display, filtering, and sorting)

Analysis:

✅ Pragmatic decision: Removing flaky tests is better than having unreliable CI

• The remaining 7 tests provide core coverage of announcements functionality
• Tests retained follow best practices (using data-testid selectors, proper waits)
• User-facing functionality is still validated (display, filtering by active/expired, priority sorting)

⚠️ Coverage trade-off: Some functionality is now untested:

• Edit flow (modal opening, form filling, submission)
• Delete flow
• Modal cancel/close behavior

Recommendations for future work:

1. Consider adding these back as more stable tests when time permits
2. Ensure components have proper data-testid attributes for reliable selectors
3. Use the project's test utilities (waitForToast, waitForAdminContent) to handle timing

---

TypeScript Best Practices ✅

The changes align with project guidelines (CLAUDE.md):

• ✅ Uses type import modifier (prevents runtime imports)
• ✅ Maintains strict TypeScript mode compliance
• ✅ Follows path alias convention (@/)
• ✅ No any types introduced

---

CI Status 🔄

Currently running (as of last check):

• ⏳ Build workflow: In progress
• ⏳ Docker Build and Publish: In progress
• ⏳ Claude Code Review: In progress (this job)

Note: The flaky test removal should improve CI reliability going forward.

---

Final Verdict: APPROVED ✅

This PR is well-executed and ready to merge once CI passes:

✅ Critical security update applied - Next.js 16.0.10 addresses security vulnerability
✅ Bug fix follows Next.js best practices - Type export issue properly resolved
✅ Improved CI reliability - Flaky tests removed, stable core tests retained
✅ Code quality is high - All changes follow project conventions
✅ Tests are properly updated - Unit tests updated with correct type imports
✅ No breaking changes - All changes are backward compatible

Recommendation: Merge this PR once CI workflows complete successfully. The security update should be deployed promptly.

Great work on maintaining a clean, stable test suite while addressing the security vulnerability! 🎉

---

[claude]

Code Review - PR #225

Summary

This PR contains two commits:

1. Security update: Next.js upgrade from 16.0.7 to 16.0.10 (Dependabot)
2. Bug fix: Resolved ChatMessage type export issue in server actions

Security Review ✅

Next.js 16.0.10 Security Update

• This upgrade addresses a security vulnerability in Next.js
• Recommendation: This should be merged promptly to address the security issue
• The upgrade is a patch version bump (16.0.7 → 16.0.10), which should maintain backward compatibility

Code Quality Review ✅

ChatMessage Type Export Fix (commit: 15973af)

Problem Solved:
The fix addresses a critical issue where type re-exports in server action files were causing Next.js to incorrectly bundle types into the runtime server actions bundle, resulting in ReferenceError: ChatMessage is not defined errors during E2E tests.

Changes Made:

1. actions/chatbot/index.ts: Removed export type { ChatMessage, ChatResponse } (lines removed)
2. Updated imports across 4 files to use @/actions/chatbot/types directly
3. All imports now correctly use the type modifier

Code Quality Assessment:

✅ Correct approach: This follows Next.js best practices for server actions

• Server action files should not re-export types
• Types should be imported directly from their source files
• Using import { type ChatMessage } ensures types are stripped at compile time

✅ Consistency: All affected files updated properly:

• actions/chatbot/index.ts:8 - Uses type import
• components/admin/chatbot/chat-window.tsx:4 - Uses type import from types file
• __tests__/actions/chatbot.test.ts:6 - Uses type import from types file
• components/__tests__/admin/chatbot/chat-window.test.tsx:10 - Uses type import from types file

✅ Test Coverage: Both component and action tests have been updated and should pass

• Tests verify sources tracking functionality
• Tests verify UI rendering with/without sources

TypeScript Best Practices ✅

The changes align with project guidelines (CLAUDE.md):

• ✅ Uses type import modifier (prevents runtime imports)
• ✅ Maintains strict TypeScript mode compliance
• ✅ Follows path alias convention (@/)
• ✅ No any types introduced

Potential Concerns

⚠️ Minor observation: The fix was necessitated by Next.js bundling behavior

• This is a known Next.js quirk with server actions and type exports
• The solution is the recommended approach
• No action needed, but good to be aware of this pattern for future server actions

Testing Considerations

The PR should pass all tests once CI completes:

• Unit tests updated to import types correctly
• E2E tests should no longer encounter the ReferenceError
• No breaking changes to public APIs

Recommendations

1. ✅ Merge this PR - Combines important security update with necessary bug fix
2. ✅ Monitor CI - Wait for Build and Docker workflows to complete successfully
3. 📝 Future reference: When creating new server actions, avoid re-exporting types from action files

Final Verdict: APPROVED ✅

This PR is well-executed and ready to merge:

• Critical security update applied
• Bug fix follows Next.js best practices
• Code quality is high
• Tests are properly updated
• No breaking changes

Great work on identifying and fixing the type export issue!