# Next.js 16 App Router

`nextjs/next-16` · Skill · v1.0.0

Next.js 16 as it behaves today - Cache Components, the right invalidation call, proxy.ts, safe server actions and 15 to 16 upgrades.

Teaches an agent the Next.js 16 App Router as measured on next 16.4.3 with next build and next start. It concentrates on what agents trained on Next 13-15 get wrong: the Cache Components model (cacheComponents with partialPrefetching, 'use cache', cacheLife, cacheTag, Suspense and the prerender build errors, removed segment configs), choosing updateTag, revalidateTag with a profile, revalidatePath or refresh by what the next request must show (revalidateTag 'max' serves one stale response, updateTag throws outside Server Actions), the 15 to 16 changes that build but misbehave (sync params, sitemap ids as Promises, images.qualities defaulting to 75, revalidateTag semantics), middleware renamed to a Node-only proxy.ts, and server actions as public endpoints whose .bind() arguments are client-controlled.

## Verdict

- level: **submitted** — In the catalog, not yet checked for this digest.
- uplift: **untested** — No runs exist for this digest.
- digest: `sha256:3a69bb53d38f8a7888e65ca5761fd375a3783370a77c3a6dec9ec23f621ba63b`

## Uplift runs

None for this digest. Untested is not the same as useless: nobody has measured it yet.

## Security

No checks recorded for this digest.

## Compatibility

| agent | targeted | compiled | evaluated |
| --- | --- | --- | --- |
| Claude Code | yes | no record | no record |
| Codex | yes | no record | no record |
| Cursor | yes | no record | no record |
| GitHub Copilot | yes | no record | no record |
| Gemini CLI | yes | no record | no record |
| OpenCode | yes | no record | no record |

## Permissions

- network: none
- shell: npm ls, npm run, npm start, rg
- filesystem: write
- env: none

## Files

- `SKILL.md` 17803 B sha256:e4a9180fa59e3de32e969eb1a87a3dbd1b49e18d1f32225c23336cc18bea5bf8
- `references/cache-components.md` 7124 B sha256:d6f53953c63e2e04c1118f1138631c940eeebf94e7730ae9d361080d9b474c9b
- `references/server-actions-security.md` 6787 B sha256:c156147a21ae7ea3fb8260a83986de1932e062079eb201716db5ea6867d464fa
- `references/sources.md` 4279 B sha256:1ae1cdb060be8beea8ba4ada7e846dcbc8e27461bfc30639240718ab6b75f516
- `references/upgrade-15-to-16.md` 7967 B sha256:eda99922611d1ebd4ca041c71be19251ac41e29616f29d3a42158c8f5b88e58a

## Limitations

- Written and verified against next 16.4.3 with React 19.3. A security release was announced for 2026-11-03 and later 16.x minors may change defaults; the docs in node_modules/next/dist/docs win when they disagree.
- App Router only. The Pages Router, custom servers, static export and the Edge runtime are not covered beyond noting that middleware.ts is the way to keep Edge.
- Cache behaviour was measured with the default in-memory cache handler on a single next start process. Serverless platforms, 'use cache remote' handlers and multi-instance deployments behave differently for runtime caching.
- The proof suite drives pages and server actions over HTTP without a browser, so client-side router cache behaviour (stale times, prefetching, Activity state) is taught but not scored.
- Partial Prefetching, Instant Navigations, ensureStatic and adapters are summarised, not taught in depth.

## Install

```sh
npx sigil add nextjs/next-16 --agent claude-code,codex,cursor
```

Source: https://github.com/dgesteves/sigil/tree/5cb851d5b2f2f14446ddf631ef5e91bf9d3263dd/catalog/skills/nextjs/next-16