Upgrade example app to Next.js 16, React 19, and AuthKit v4 (AUTH-6473)

[Rmole57]

Summary

Upgrades the example app from Next.js 14.1.4 to 16.2.12, which pulls React 19 and
majors of both WorkOS SDKs along with it. All required migrations are applied here.

Dependencies

Package	From	To
next	14.1.4	16.2.12
react / react-dom	^18	^19.2.0
@workos-inc/authkit-nextjs	0.4.2	^4.3.0
@workos-inc/node	^6.7.0	^10.8.0
eslint	^8	^9
eslint-config-next	14.1.4	16.2.12
@types/react / @types/react-dom	^18	^19

Breaking changes handled

Next.js 16

• src/middleware.ts → src/proxy.ts, authkitMiddleware → authkitProxy. Next 16 errors (E900) if both files exist.
• Async request APIs are no longer available synchronously: searchParams is now Promise<…> in 7 pages, and cookies() is awaited in with-session/auth.ts. reset-password/page.tsx is a Client Component, so it unwraps via use(searchParams).
• next lint was removed: .eslintrc.json → eslint.config.mjs (flat config), lint script is now plain eslint.
• tsconfig: target es5 → ES2017; Next's build also requires jsx: react-jsx and adds .next/dev/types.

React 19

• useFormState (react-dom) → useActionState (react) across 8 components.

authkit-nextjs v4

• getUser() → withAuth(); added the now-required AuthKitProvider to the root layout.
• Renamed WORKOS_REDIRECT_URI → NEXT_PUBLIC_WORKOS_REDIRECT_URI in .env.local.example and in using-hosted-authkit/README.md. v4 reads only the prefixed name.
• getSignInUrl() writes a PKCE cookie, so Next 16 forbids calling it during render. The with-nextjs example now signs in via a POST Server Action instead of an <a href>.

@workos-inc/node v10

• workos.mfa → workos.multiFactorAuth; userManagement.enrollAuthFactor → multiFactorAuth.createUserAuthFactor; sendMagicAuthCode → createMagicAuth.

Behavior change worth a look

sendPasswordResetEmail is gone. Its replacement, createPasswordReset, dropped the passwordResetUrl input and no longer sends an email — it mints the token and returns it, so delivery is now the application's responsibility. The example renders a labelled link to keep the flow clickable, and comments on why a real app must email the token instead. This is the one place where the example demonstrates something different than before, so it may warrant a product call rather than just a mechanical migration.

Also in this PR

• Switched to npm as the single package manager: yarn.lock removed, package-lock.json added, README install step updated. The committed yarn.lock was in Yarn Berry format while Yarn 1 is what most environments resolve, so installs had been rewriting it inconsistently.
• Added JWT_SECRET_KEY to .env.local.example — the with-session example already required it but it was undocumented.

Upgrading an existing local checkout

Only one step isn't covered by this PR, because the file is gitignored: rename WORKOS_REDIRECT_URI to NEXT_PUBLIC_WORKOS_REDIRECT_URI in your own .env.local (the value is unchanged). The old name is silently ignored, so auth fails with no clear error.

Testing

• tsc --noEmit clean
• eslint clean
• next build green — 29/29 routes, proxy.ts detected
• Dev smoke test: routes return 200; the reset-password flow renders correctly with and without a token

Closes AUTH-6473

[linear-code]

AUTH-6473

AUTH-6743

[greptile-apps]

Greptile Summary

This PR upgrades the example application to Next.js 16, React 19, and current WorkOS SDKs.

• Migrates middleware, asynchronous request APIs, authentication helpers, and React form actions to their new interfaces.
• Updates password-reset handling so reset capabilities are no longer returned to the requesting browser and development logging is environment-gated.
• Replaces the Yarn lockfile with an npm lockfile and updates ESLint, TypeScript, documentation, and environment-variable examples.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the unauthenticated reset request no longer receives the reset token, and reset-token logging is now confined to development as requested.

Important Files Changed

Filename	Overview
src/app/using-your-own-ui/reset-password/page.tsx	The reset-request response no longer renders or serializes the newly minted reset token to the unauthenticated requester.
src/app/using-your-own-ui/reset-password/reset-password.ts	Password-reset creation now returns only submission status, and local reset-link logging is restricted to development.
src/app/layout.tsx	Adds the AuthKit provider required by the upgraded AuthKit Next.js integration.
src/proxy.ts	Migrates the AuthKit middleware entry point to the proxy convention required by Next.js 16.
package.json	Upgrades Next.js, React, WorkOS SDK, ESLint, and related type dependencies while switching project scripts to npm-compatible tooling.
package-lock.json	Introduces the npm dependency lockfile corresponding to the upgraded package manifest.

_{Reviews (4): Last reviewed commit: "Fix Magic Auth code leak and correct the..." | Re-trigger Greptile}

[Rmole57]

@greptileai update

[Rmole57]

@greptileai update

[Rmole57]

@greptileai update