[barryollama]

Why

The observer dashboard is the only Next.js app in the repo. It pins next@14.2.35, which is affected by CVE-2026-44578 / GHSA-c4j6-fc7j-m34r (SSRF via WebSocket upgrades). Next 14 has no fix. The hosted dashboard runs on Cloudflare rather than the built-in Node server, so it was likely not exploitable in production, but the dependency scanner flags it and next dev/next start were exposed.

Staying on Next 15 wasn't an option either: the deploy used @cloudflare/next-on-pages, which is deprecated and only supports up to Next 15.5.2.

What

• Next 16.4.3 + React 19. Next 16 builds with Turbopack by default.
  • The catch-all page now awaits its async params.
  • Updated React 19 ref types (RefObject<HTMLDivElement | null>).
  • Next rewrote tsconfig.json and next-env.d.ts itself.
• Edge runtime removed. OpenNext runs routes on the Node.js runtime, so export const runtime = 'edge' is gone from the page and the three auth routes.
• OpenNext Cloudflare adapter. Replaces next-on-pages. Adds open-next.config.ts, wrangler.jsonc and the build:worker / preview / deploy scripts.
• Worker instead of Pages. The dashboard deploys as the relaycast-observer Worker with workers_dev/preview_urls turned off. relaycast-observer-router now reaches it through an OBSERVER service binding instead of proxying to relaycast-observer.pages.dev. The observer-host headers are unchanged.
• CI. The deploy action shrinks to npm run -w @relaycast/observer-dashboard deploy. That removes the Pages project setup, the compat-flag PATCH and the peer-dependency workaround. The job is renamed deploy-observer-dashboard and still runs before the router.
• @relaycast/react dev deps on React 19. The workspace now resolves a single React and @types/react. The published peer range (^18 || ^19) is unchanged.

Testing

• turbo build test lint for the dashboard, @relaycast/react, sdk and types: all green (dashboard 73 tests, react 40).
• OpenNext Worker build, then the router and dashboard run together in local wrangler dev sessions through the service binding:
  • /observer/login, /observer, /observer/connect and /observer/channels/* return 200.
  • /_next chunks and public/ assets are served.
  • The session, login and logout routes behave correctly. Through the router, login resolves the hosted engine for observer.relaycast.dev.
  • Login and connect pages render with no console errors.
• wrangler deploy --dry-run passes for both Workers (dashboard is about 1 MB gzipped).

Rollout

• Merging deploys the dashboard Worker first, then the router. If the dashboard deploy fails, the router job is skipped and keeps serving the old Pages origin.
• Once the Worker is confirmed live, delete the old relaycast-observer Pages project manually.
• The CI Cloudflare token needs Workers Scripts edit, which the router deploy already uses.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f5bfa010-618e-4123-9f06-edc7db882b98

Commits

Reviewing files that changed from the base of the PR and between 752d660 and 5e98da3.

Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

Files selected for processing: 18

• .github/actions/deploy-observer-dashboard/action.yml
• .github/workflows/deploy.yml
• .gitignore
• README.md
• packages/observer-dashboard/next-env.d.ts
• packages/observer-dashboard/open-next.config.ts
• packages/observer-dashboard/package.json
• packages/observer-dashboard/src/app/[[...slug]]/page.tsx
• packages/observer-dashboard/src/app/api/auth/login/route.ts
• packages/observer-dashboard/src/app/api/auth/logout/route.ts
• packages/observer-dashboard/src/app/api/auth/session/route.ts
• packages/observer-dashboard/src/components/ChatFeed.tsx
• packages/observer-dashboard/src/hooks/use-follow-latest.ts
• packages/observer-dashboard/tsconfig.json
• packages/observer-dashboard/wrangler.jsonc
• packages/observer-router/src/worker.ts
• packages/react/package.json
• wrangler.observer-router.toml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable regression was found.

Summary

Upgrades the observer dashboard to Next 16 and React 19, and moves its Cloudflare deployment from Pages to an OpenNext Worker.

• The observer router sends dashboard traffic to a Cloudflare Worker.
• The dashboard runs on Next 16 and React 19.

No actionable issues were found. This review checked code and configuration; it did not run builds or tests.

Diagram

sequenceDiagram
  participant CI
  participant Browser
  participant Router as Observer router
  participant Dashboard as OpenNext dashboard Worker
  participant Engine as Hosted engine
  CI->>Dashboard: Build and deploy
  CI->>Router: Deploy after dashboard succeeds
  Browser->>Router: Observer request
  Router->>Dashboard: OBSERVER.fetch with observer-host headers
  Dashboard->>Engine: Check credentials for auth requests
  Engine-->>Dashboard: Auth result
  Dashboard-->>Browser: Page, asset, or auth response

Loading

_{Reviews (1) · Last reviewed commit: "chore(observer): upgrade to Next 16 and ..." · Reviewed by Greptile}