fix(web-ui): upgrade next to 16.3 to clear four high-severity advisories (#1124)

web-ui/next-env.d.ts

@@ -1,6 +1,7 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
 import "./.next/types/routes.d.ts";
+import "./.next/types/root-params.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

web-ui/package.json

@@ -30,7 +30,7 @@
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.1.0",
     "date-fns": "^4.4.0",
-    "next": "^16.2.12",
+    "next": "^16.3.0",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "react-markdown": "^10.1.0",

web-ui/src/__tests__/app/page.test.tsx

@@ -87,8 +87,8 @@ describe('WorkspacePage', () => {
       // Set workspace path in localStorage
       localStorageMock.setItem('codeframe_workspace_path', '/home/user/my-app');
 
-      mockUseSWR.mockImplementation((key: string | null) => {
-        if (key && key.includes('/api/v2/workspaces/current')) {
+      mockUseSWR.mockImplementation(((key: unknown) => {
+        if (typeof key === 'string' && key.includes('/api/v2/workspaces/current')) {
           return {
             data: {
               id: 'ws-123',
@@ -100,9 +100,9 @@ describe('WorkspacePage', () => {
             error: undefined,
             isLoading: false,
             mutate: jest.fn(),
-          } as any;
+          } as never;
         }
-        if (key && key.includes('/api/v2/tasks')) {
+        if (typeof key === 'string' && key.includes('/api/v2/tasks')) {
           return {
             data: {
               tasks: [],
@@ -119,10 +119,10 @@ describe('WorkspacePage', () => {
             error: undefined,
             isLoading: false,
             mutate: jest.fn(),
-          } as any;
+          } as never;
         }
-        return { data: undefined, error: undefined, isLoading: false, mutate: jest.fn() } as any;
-      });
+        return { data: undefined, error: undefined, isLoading: false, mutate: jest.fn() } as never;
+      }) as never);
     });
 
     it('renders workspace header with path', async () => {

web-ui/src/__tests__/app/review/page.test.tsx

@@ -18,7 +18,6 @@ jest.mock('@/lib/api', () => ({
     getDiff: jest.fn(),
     getPatch: jest.fn(),
     generateCommitMessage: jest.fn(),
-    getFileDiff: jest.fn(),
   },
   gatesApi: { run: jest.fn() },
   gitApi: { commit: jest.fn(), getStatus: jest.fn() },
@@ -98,7 +97,6 @@ beforeEach(() => {
   jest.clearAllMocks();
   (gitApi.getStatus as jest.Mock).mockResolvedValue({ branch: 'main' });
   (prApi.list as jest.Mock).mockResolvedValue({ pull_requests: [] });
-  (reviewApi.getFileDiff as jest.Mock).mockResolvedValue({ diff: '' });
   // The page auto-generates a commit message once the diff loads; without a
   // resolved promise here every test dies on `.then of undefined`.
   mockGenerate.mockResolvedValue({ message: '' });

web-ui/src/__tests__/components/blockers/ResolvedBlockersSection.test.tsx

@@ -15,6 +15,7 @@ function makeBlocker(overrides: Partial<Blocker> = {}): Blocker {
     status: 'RESOLVED',
     created_at: '2026-02-19T10:00:00Z',
     answered_at: '2026-02-19T10:05:00Z',
+    created_by: 'agent',
     ...overrides,
   };
 }

web-ui/src/__tests__/components/prd/PrdPage.test.tsx

@@ -90,11 +90,14 @@ const fakePrd = {
 };
 
 function setupSWR() {
+  // Deliberately partial SWR responses: the component reads data/error/
+  // isLoading/mutate only, and SWRResponse gained members in next 16.3's
+  // bundled typings that no test here exercises.
   mockUseSWR.mockImplementation((key) => {
     if (typeof key === 'string' && key.includes('prd')) {
-      return { data: fakePrd, error: undefined, isLoading: false, mutate: jest.fn() } as ReturnType<typeof useSWR>;
+      return { data: fakePrd, error: undefined, isLoading: false, mutate: jest.fn() } as unknown as ReturnType<typeof useSWR>;
     }
-    return { data: { tasks: [], by_status: {} }, error: undefined, isLoading: false, mutate: jest.fn() } as ReturnType<typeof useSWR>;
+    return { data: { tasks: [], by_status: {} }, error: undefined, isLoading: false, mutate: jest.fn() } as unknown as ReturnType<typeof useSWR>;
   });
 }
 

web-ui/src/__tests__/components/proof/CaptureGlitchModal.test.tsx

@@ -41,6 +41,7 @@ const MOCK_REQ: ProofRequirement = {
   created_by: 'human',
   source_issue: null,
   related_reqs: [],
+  scope: null,
 };
 
 function setup(props = DEFAULT_PROPS) {

web-ui/src/__tests__/components/proof/ProofPage.test.tsx

@@ -77,6 +77,7 @@ function makeReq(overrides: Partial<{
     created_by: 'user',
     source_issue: null,
     related_reqs: [],
+    scope: null,
   };
 }
 

web-ui/src/__tests__/components/sessions/SessionDetailPage.test.tsx

@@ -110,7 +110,7 @@ function setupRouter() {
     forward: jest.fn(),
     refresh: jest.fn(),
     prefetch: jest.fn(),
-  } as ReturnType<typeof useRouter>);
+  } as unknown as ReturnType<typeof useRouter>);
 }
 
 // ── Tests ────────────────────────────────────────────────────────────────

web-ui/src/__tests__/components/tasks/TaskBoardView.test.tsx

@@ -2,7 +2,12 @@ import { render, screen, act, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { TaskBoardView } from '@/components/tasks/TaskBoardView';
 import { tasksApi } from '@/lib/api';
+
 import type { Task, TaskListResponse } from '@/types';
+// jest.mocked keeps the real signatures while exposing the mock API, so the
+// toHaveBeenCalledWith assertions below still type-check against the true
+// argument shapes rather than being cast to any.
+const mockedTasksApi = jest.mocked(tasksApi);
 
 // ─── Mocks ──────────────────────────────────────────────────────────
 
@@ -241,7 +246,7 @@ describe('TaskBoardView', () => {
   });
 
   it('calls stopExecution and mutates when Stop is clicked', async () => {
-tasksApi.stopExecution.mockResolvedValue(undefined);
+    mockedTasksApi.stopExecution.mockResolvedValue(undefined);
     mockMutate.mockResolvedValue(undefined);
 
     const user = userEvent.setup({ advanceTimers: jest.advanceTimersByTime });
@@ -255,7 +260,9 @@ tasksApi.stopExecution.mockResolvedValue(undefined);
   });
 
   it('calls updateStatus(READY) and mutates when Reset is clicked', async () => {
-tasksApi.updateStatus.mockResolvedValue({});
+    mockedTasksApi.updateStatus.mockResolvedValue(
+      makeTask({ id: 't6', title: 'Deploy v1', status: 'READY' })
+    );
     mockMutate.mockResolvedValue(undefined);
 
     const user = userEvent.setup({ advanceTimers: jest.advanceTimersByTime });
@@ -269,7 +276,7 @@ tasksApi.updateStatus.mockResolvedValue({});
   });
 
   it('shows error banner when stop fails', async () => {
-tasksApi.stopExecution.mockRejectedValue({ detail: 'Task not running' });
+    mockedTasksApi.stopExecution.mockRejectedValue({ detail: 'Task not running' });
 
     const user = userEvent.setup({ advanceTimers: jest.advanceTimersByTime });
     render(<TaskBoardView workspacePath="/test" />);
@@ -319,7 +326,7 @@ tasksApi.stopExecution.mockRejectedValue({ detail: 'Task not running' });
   });
 
   it('executes batch stop after confirming', async () => {
-tasksApi.stopExecution.mockResolvedValue(undefined);
+    mockedTasksApi.stopExecution.mockResolvedValue(undefined);
     mockMutate.mockResolvedValue(undefined);
 
     const user = userEvent.setup({ advanceTimers: jest.advanceTimersByTime });
@@ -360,7 +367,9 @@ tasksApi.stopExecution.mockResolvedValue(undefined);
   });
 
   it('executes batch reset after confirming', async () => {
-tasksApi.updateStatus.mockResolvedValue({});
+    mockedTasksApi.updateStatus.mockResolvedValue(
+      makeTask({ id: 't6', title: 'Deploy v1', status: 'READY' })
+    );
     mockMutate.mockResolvedValue(undefined);
 
     const user = userEvent.setup({ advanceTimers: jest.advanceTimersByTime });
@@ -385,7 +394,7 @@ tasksApi.updateStatus.mockResolvedValue({});
   });
 
   it('shows error message when batch stop partially fails', async () => {
-tasksApi.stopExecution.mockRejectedValue({ detail: 'Task not running' });
+    mockedTasksApi.stopExecution.mockRejectedValue({ detail: 'Task not running' });
     mockMutate.mockResolvedValue(undefined);
 
     const user = userEvent.setup({ advanceTimers: jest.advanceTimersByTime });

web-ui/src/__tests__/components/workspace/WorkspaceSelector.test.tsx

@@ -305,7 +305,9 @@ describe('WorkspaceSelector', () => {
         />
       );
 
-      const projectA = screen.getByText('project-a').closest('[role="button"]');
+      const projectA = screen
+        .getByText('project-a')
+        .closest<HTMLElement>('[role="button"]');
       await userEvent.click(projectA!);
 
       expect(mockOnSelectWorkspace).toHaveBeenCalledWith(
@@ -322,7 +324,9 @@ describe('WorkspaceSelector', () => {
         />
       );
 
-      const projectA = screen.getByText('project-a').closest('[role="button"]');
+      const projectA = screen
+        .getByText('project-a')
+        .closest<HTMLElement>('[role="button"]');
       projectA?.focus();
       fireEvent.keyDown(projectA!, { key: 'Enter' });
 
@@ -342,7 +346,9 @@ describe('WorkspaceSelector', () => {
         />
       );
 
-      const projectA = screen.getByText('project-a').closest('[role="button"]');
+      const projectA = screen
+        .getByText('project-a')
+        .closest<HTMLElement>('[role="button"]');
       projectA?.focus();
       fireEvent.keyDown(projectA!, { key: ' ' });
 
@@ -408,7 +414,9 @@ describe('WorkspaceSelector', () => {
         />
       );
 
-      const projectA = screen.getByText('project-a').closest('[role="button"]');
+      const projectA = screen
+        .getByText('project-a')
+        .closest<HTMLElement>('[role="button"]');
       expect(projectA).toHaveAttribute('aria-disabled', 'true');
 
       await userEvent.click(projectA!);

web-ui/src/__tests__/hooks/useTerminalSocket.test.ts

@@ -24,7 +24,7 @@ class MockWebSocket {
 
   onopen: (() => void) | null = null;
   onmessage: ((event: { data: string | ArrayBuffer }) => void) | null = null;
-  onclose: (() => void) | null = null;
+  onclose: ((event: { code: number }) => void) | null = null;
   onerror: (() => void) | null = null;
 
   static instances: MockWebSocket[] = [];
@@ -49,7 +49,7 @@ class MockWebSocket {
     this.onopen?.();
   }
 
-  simulateBinaryMessage(bytes: Uint8Array) {
+  simulateBinaryMessage(bytes: Uint8Array<ArrayBuffer>) {
     this.onmessage?.({ data: bytes.buffer });
   }
 

web-ui/src/__tests__/lib/api.auth.test.ts

@@ -27,15 +27,16 @@ const mockRedirectTo = redirectTo as jest.MockedFunction<typeof redirectTo>;
 
 // Pull the registered handlers off the axios instance interceptor stacks.
 function getRequestHandler() {
-  // @ts-expect-error - axios keeps handlers on a private `.handlers` array
+  // axios keeps these on a `.handlers` array that is not in its public
+  // surface; the cast below documents the shape we rely on.
   const handlers = api.interceptors.request.handlers as Array<{
     fulfilled: (c: InternalAxiosRequestConfig) => InternalAxiosRequestConfig;
   }>;
   return handlers.find((h) => h && h.fulfilled)!.fulfilled;
 }
 
 function getResponseRejectHandler() {
-  // @ts-expect-error - private handlers array
+  // Same private `.handlers` array as above.
   const handlers = api.interceptors.response.handlers as Array<{
     rejected: (e: AxiosError) => Promise<never>;
   }>;

web-ui/src/__tests__/lib/auth.test.ts

@@ -89,7 +89,7 @@ describe('login', () => {
     mockedAxios.post.mockRejectedValueOnce({
       response: { status: 400, data: { detail: 'LOGIN_BAD_CREDENTIALS' } },
     });
-    mockedAxios.isAxiosError = jest.fn(() => true) as unknown as typeof axios.isAxiosError;
+    mockedAxios.isAxiosError.mockReturnValue(true);
 
     await expect(login('user@example.com', 'wrong')).rejects.toThrow(
       /invalid email or password/i
@@ -143,7 +143,7 @@ describe('register', () => {
         data: { detail: 'Set CODEFRAME_BOOTSTRAP_TOKEN on the server.' },
       },
     });
-    mockedAxios.isAxiosError = jest.fn(() => true) as unknown as typeof axios.isAxiosError;
+    mockedAxios.isAxiosError.mockReturnValue(true);
 
     await expect(register('second@example.com', 'pw')).rejects.toThrow(
       /CODEFRAME_BOOTSTRAP_TOKEN/
@@ -154,7 +154,7 @@ describe('register', () => {
     mockedAxios.post.mockRejectedValueOnce({
       response: { status: 403, data: {} },
     });
-    mockedAxios.isAxiosError = jest.fn(() => true) as unknown as typeof axios.isAxiosError;
+    mockedAxios.isAxiosError.mockReturnValue(true);
 
     await expect(register('second@example.com', 'pw')).rejects.toThrow(
       /registration is closed/i