nextjs-upgrade-audit

Audits a Next.js repo's config and app tree against the 16.2/16.3 feature matrix and reports ranked findings.

Updated Aug 2, 2026
One-click install
npx skills add https://github.com/leonardoacosta/skills --skill nextjs-upgrade-audit-leonardoacosta
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: nextjs-upgrade-audit
Source: https://github.com/leonardoacosta/skills/tree/main/web-frontend-kit/skills/nextjs-upgrade-audit
Command: npx skills add https://github.com/leonardoacosta/skills --skill nextjs-upgrade-audit-leonardoacosta

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? After upgrading to Next.js 16.2 or 16.3, teams often leave new capabilities unclaimed, keep stale or superseded config flags, and miss silent correctness or security regressions that bundled framework documentation cannot surface for their specific repository. ## Core Features & Use Cases - Tiered repo-state audit: Inspects package.json, next.config.*, turbo.json, CI config, and the app tree, then reports findings ranked across four tiers: correctness/security, stale config, available wins, and test coverage. - Concrete predicates with fixes: Each check pairs a grep/read predicate with severity, a concrete fix, and an explicit confidence caveat when repo state alone cannot prove the finding (e.g., CSP set at the edge). - Vendor-tool routing: Detects when first-party tooling (Instant Insights, @next/playwright's instant() helper, Vercel's Cache Components migration skill) should be used instead of reimplementing it. - Use Case: After bumping a monorepo to Next.js 16.3, run the audit to discover a leftover --webpack flag forfeiting Turbopack, an inert cachedNavigations flag missing its cacheComponents dependency, and a missing .next/** entry in turbo.json build outputs. ## Quick Start Audit this repository for unclaimed Next.js 16.3 features, stale config flags, and correctness issues, then report ranked findings with fixes.

Frequently Asked Questions about nextjs-upgrade-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Next.js app after upgrading to 16.3?

Read every package.json to anchor the next version first, then check next.config.*, turbo.json, CI config, and the app tree tier by tier: correctness and security issues, stale config, unclaimed wins, and test-coverage gaps. Report findings ranked by severity with a fix for each.

What Next.js 16.3 config flags are stale or superseded?

experimental.prefetchInlining is superseded by an automatic size-based heuristic, unstable_catchError and unstable_retry stabilized as catchError and retry, and middleware.ts was renamed to proxy.ts in Next.js 16. Committed turbopackMemoryEviction: false also silently forfeits the memory-usage win.

Does the --webpack flag matter on Next.js 16.3?

Yes. Turbopack is the default bundler since Next.js 16, so passing --webpack in dev or build scripts opts out of the entire 16.3 line, including filesystem caches, memory eviction, and import.meta.glob. Drop the flag unless a documented incompatibility requires it.

Can a repo audit detect a missing Content-Security-Policy?

Only partially. A grep miss for Content-Security-Policy means no CSP is configured in the repo, but CSP is often set at the edge or CDN where a repo search cannot see it. Report such findings as low confidence, phrased as no CSP found in-repo.

When should I use Vercel's Cache Components migration skill instead?

Use the first-party migration skill to actually perform a cacheComponents adoption. This audit only detects whether cacheComponents and partialPrefetching are available and unclaimed; it deliberately routes migration, Instant Insights diagnosis, and instant() test authoring to vendor tooling.