fix(nextjs-turbopack): document proxy.ts as the correct Next.js 16 middleware filename

[t0kubetsu]

Problem

The nextjs-turbopack skill says nothing about middleware file naming. Other ECC skills reference middleware.ts throughout, which causes a false-positive security finding when reviewing a Next.js 16 + Turbopack codebase that correctly uses proxy.ts.

This was discovered during a real code review: Claude flagged a working proxy.ts auth middleware as a critical security issue ("the auth gate was silently bypassed") and opened a PR to rename it to middleware.ts. The project maintainer correctly closed it as "Won't fix" pointing to the Next.js docs.

Root Cause

Next.js 16 introduced proxy.ts as the middleware filename for Turbopack mode:
https://nextjs.org/docs/app/getting-started/proxy

ECC has no record of this convention change, so any security or code review skill operating on a Next.js 16 + Turbopack project will misidentify proxy.ts as an incorrectly named file.

Fix

Add a Middleware File Naming section to skills/nextjs-turbopack/SKILL.md with:

• A table mapping Turbopack vs webpack mode to the correct filename
• An explicit warning not to flag proxy.ts during reviews
• A link to the official Next.js proxy docs

Closes #2032

---

Summary by cubic

Document proxy.ts as the correct middleware filename for Next.js 16 in skills/nextjs-turbopack/SKILL.md to stop false-positive security flags (closes #2032). Clarifies the filename is version-based (16+: proxy.ts, pre-16: middleware.ts), adds a “do not flag proxy.ts” warning, and links to the official docs.

^{Written for commit e91109d. Summary will update on new commits. Review in cubic}

Summary by CodeRabbit

• Documentation
  • Clarified middleware file naming conventions for Next.js 16+ and Turbopack, added guidance on which filename/location to use for different deployment modes, and included an explicit warning that renaming or relocating the middleware file will prevent middleware from running.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a867df7c-8b77-456b-a4c8-25bed6069093

📥 Commits

Reviewing files that changed from the base of the PR and between 4d3056d and e91109d.

📒 Files selected for processing (1)

• skills/nextjs-turbopack/SKILL.md

---

📝 Walkthrough

Walkthrough

Adds a "Middleware File Naming" section to Next.js Turbopack docs: Next.js 16+ expects proxy.ts at the project root; pre-Next.js 16 uses middleware.ts. Includes an explicit warning not to rename proxy.ts and a link to Next.js documentation.

Changes

Middleware File Naming Documentation

Layer / File(s)	Summary
Middleware file naming conventions skills/nextjs-turbopack/SKILL.md	Documents the correct middleware filename (proxy.ts) for Next.js 16+, contrasts it with legacy middleware.ts, specifies the file must be at the project root, warns against renaming proxy.ts, and references Next.js docs.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 I hopped through docs with eager paws,

proxy.ts now leads applause.
Keep it root, don't give it a new name,
Let Turbopack's middleware do its game.
🥕✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately reflects the main change: adding documentation about proxy.ts as the correct Next.js 16 middleware filename to the SKILL.md file.
Linked Issues check	✅ Passed	The pull request addresses all objectives from #2032: documents that proxy.ts is correct for Next.js 16, notes middleware.ts as legacy, specifies project root location, and prevents false-positive findings.
Out of Scope Changes check	✅ Passed	All changes are within scope—only modifications to skills/nextjs-turbopack/SKILL.md documentation section for middleware file naming, directly aligned with linked issue #2032.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

1 issue found across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>