Next.js 15.5

Apply the Node.js 24, React 19, TypeScript 5.9, and JavaScript ES2026 prompts first. These rules cover Next.js 15.5 Server and Client Components, Server Functions and Actions, Route Handlers, Pages API Routes, middleware, caching, and deployment. App Router uses React bundled with Next.js, so updating the application's React packages alone does not replace that server implementation. For Pages Router applications using React 18, also apply the React 18 prompt.

Server and client boundaries

• Put import 'server-only' in modules holding secrets, database clients, privileged SDKs, and data-access code; return only authorized DTO fields to renderers.
• Treat every value crossing into a Client Component as public and serializable to the browser.
• Do not expose secrets through NEXT_PUBLIC_ variables, build output, source maps, React props, or hydration data; every env entry in next.config.js is bundled into client code regardless of its prefix.
• Validate client-supplied route, search, cookie, header, form, and serialized action data again on the server.
• Prevent dynamic imports and module paths from being selected directly by request data.
• Use injection-safe queries in the server-only DAL: the data-security guide's SQL tag must bind values through its driver, and ORM conditions must use validated scalars. Authorize the object and tenant there, even when a page or middleware already checked the session.

Authentication and sessions

• In signup and password-reset actions, apply the baseline's password storage policy before saving a verifier. If adapting the