Run agent-assisted Next.js security upgrades

[devjiwonchoi]

Stacked on #98565.

Why?

Fixing a vulnerable Next.js app can require application-specific migration work beyond installing a patched version. The upgrade command needs to select a safe target and give a coding agent the evidence and guidance needed to complete that work.

How?

Add next upgrade --experimental-agent for apps that enable experimental.agenticAutoUpgrade: 'security'. Check the selected app and its installed version, fetch reviewed GitHub advisories with npm fallback, select a supported safe stable release, and verify its Node.js requirement. Disabled, unaffected or blocked apps exit before agent handoff.

Prepare an exact codemod command with --yes --skip-adoption. Retain the resolved inputs, advisory evidence, bundled workflow instructions and relevant migration guides outside app dependencies so they survive the upgrade. Canonical guides come from GitHub canary; the bundled workflow matches the installed CLI.

Continue in an existing Codex or Claude session, or let a terminal user select an installed agent and launch it in the background. New sessions use Luna for Codex and Haiku for Claude. Receipts provide session, log, stop and continuation information; Codex resume requires its background process to finish or stop. Existing sessions retain their model and permissions.

The workflow directs the agent to check for existing upgrade PRs, run codemods, complete contextual repairs, verify behavior and create commits. --experimental-agent-dry-run, used with --experimental-agent, stops at local commits without pushing or opening a PR. Publication otherwise follows the session's existing permissions.

Preserve the caller's environment for child commands, support Windows process launching, and exclude upgrade tooling from production traces. Include focused unit coverage for security-target selection.

[github-actions]

Failing test suites

Commit: 167d186 | About building and testing Next.js

pnpm test-dev test/development/app-dir/instant-navs-devtools/instant-navs-devtools.test.ts (job)

• instant-nav-panel > SPA captures > should capture when CookieStore writes are not reflected in document.cookie (DD)

Expand output

● instant-nav-panel › SPA captures › should capture when CookieStore writes are not reflected in document.cookie

locator.waitFor: Timeout 60000ms exceeded.
Call log:
  - waiting for locator('[data-testid="dynamic-skeleton"]') to be visible

  278 |     await browser
  279 |       .locator('[data-testid="dynamic-skeleton"]')
> 280 |       .waitFor({ state: 'visible' })
      |        ^
  281 |     await browser
  282 |       .locator('[data-testid="param-skeleton"]')
  283 |       .waitFor({ state: 'visible' })

  at waitFor (development/app-dir/instant-navs-devtools/instant-navs-devtools.test.ts:280:8)
  at Object.expectTargetPageSpaShell (development/app-dir/instant-navs-devtools/instant-navs-devtools.test.ts:607:13)

pnpm test-dev test/e2e/app-dir/instant-validation/suspense-boundaries.test.ts (job)

• instant validation > dev - client navigation > invalid - loading.js covers page, but not layout at the same level (DD)

Expand output

● instant validation › dev - client navigation › invalid - loading.js covers page, but not layout at the same level

expect(received).toMatchInlineSnapshot(snapshot)

Snapshot name: `instant validation dev - client navigation invalid - loading.js covers page, but not layout at the same level 1`

- Snapshot  - 24
+ Received  +  1

- {
-   "cause": [
-     {
-       "label": "Caused by: Instant Validation",
-       "source": "app/suspense-in-root/static/invalid-dynamic-layout-with-loading/layout.tsx (4:24) @ instant
- > 4 | export const instant = { level: 'experimental-error' }
-     |                        ^",
-       "stack": [
-         "instant app/suspense-in-root/static/invalid-dynamic-layout-with-loading/layout.tsx (4:24)",
-         "Set.forEach <anonymous>",
-       ],
-     },
-   ],
-   "description": "Next.js encountered uncached data during a navigation.",
-   "environmentLabel": "Server",
-   "label": "Instant",
-   "source": "app/suspense-in-root/static/invalid-dynamic-layout-with-loading/layout.tsx (24:19) @ Dynamic
- > 24 |   await connection()
-      |                   ^",
-   "stack": [
-     "Dynamic app/suspense-in-root/static/invalid-dynamic-layout-with-loading/layout.tsx (24:19)",
-     "Layout app/suspense-in-root/static/invalid-dynamic-layout-with-loading/layout.tsx (15:9)",
-   ],
- }
+ "Redbox did not open."

  1130 |         '/suspense-in-root/static/invalid-dynamic-layout-with-loading'
  1131 |       )
> 1132 |       await expect(browser).toDisplayCollapsedRedbox(`
       |                             ^
  1133 |        {
  1134 |          "cause": [
  1135 |            {

  at Object.toDisplayCollapsedRedbox (e2e/app-dir/instant-validation/suspense-boundaries.util.ts:1132:29)

pnpm test-start-turbo test/production/next-server-nft/next-server-nft.test.ts (turbopack) (job)

• next-server-nft > with output:standalone > should not trace too many files in next-server.js.nft.json (DD)

Expand output

● next-server-nft › with output:standalone › should not trace too many files in next-server.js.nft.json

expect(received).toMatchInlineSnapshot(snapshot)

Snapshot name: `next-server-nft with output:standalone should not trace too many files in next-server.js.nft.json 1`

- Snapshot  - 0
+ Received  + 2

@@ -227,10 +227,12 @@
    "/node_modules/next/dist/lib/typescript/runTypeCheckCli.js",
    "/node_modules/next/dist/lib/typescript/runTypeScriptCli.js",
    "/node_modules/next/dist/lib/typescript/type-paths.js",
    "/node_modules/next/dist/lib/typescript/writeAppTypeDeclarations.js",
    "/node_modules/next/dist/lib/typescript/writeConfigurationDefaults.js",
+   "/node_modules/next/dist/lib/upgrade/harness.js",
+   "/node_modules/next/dist/lib/upgrade/models.js",
    "/node_modules/next/dist/lib/url.js",
    "/node_modules/next/dist/lib/verify-partytown-setup.js",
    "/node_modules/next/dist/lib/verify-root-layout.js",
    "/node_modules/next/dist/lib/verify-typescript-setup.js",
    "/node_modules/next/dist/lib/wait.js",

  130 |         ]
  131 |
> 132 |         expect(traceGrouped).toMatchInlineSnapshot(`
      |                              ^
  133 |          [
  134 |            "/node_modules/@img/colour/*",
  135 |            "/node_modules/@img/sharp-<PLATFORM>-<ARCH>/*",

  at Object.toMatchInlineSnapshot (production/next-server-nft/next-server-nft.test.ts:132:30)

Other failing CI jobs

• lint / build

[vercel-security-reviewer]

Security review details