deps(dashboard): Next 16, and the four things it broke

[blitzcrieg1]

Next 16 was declined three times today because it kept arriving attached to an unrelated advisory: sharp in #85, postcss in #91, and as a dependency of TypeScript 7 in #66. Done deliberately here instead.

It closes the four remaining postcss alerts, which were the last ones in the queue.

Four things broke, each needing a decision

1. next lint is gone

It does not warn. It parses the word lint as a project directory:

Invalid project directory provided, no such directory: .../apps/dashboard/lint

package.json now calls eslint . directly, and .eslintrc.json becomes eslint.config.mjs — eslint-config-next@16 requires eslint 9 and exports a flat config array rather than something extends can consume.

2. Turbopack resolves CSS differently

Turbopack is the default build engine in 16. Both @import "tw-animate-css" and @import "shadcn/tailwind.css" failed with Module not found. Both packages expose CSS through an exports → style condition that webpack honoured and Turbopack does not, and their exports maps do not permit the deep path either.

Imports are now relative into node_modules. Ugly, and the file says why. next build --webpack exists and was not taken: opting out of the default engine to keep a prettier import is the wrong trade when the fallback will eventually go away.

3. My own override from earlier today was wrong, and this found it

The brace-expansion: ^5 override I added in #94 broke eslint:

TypeError: expand is not a function
    at Minimatch.braceExpand

eslint 9 pulls minimatch@3, which needs the v1 callable export. next lint had masked this by using Next's vendored copy, so it passed CI at the time and only surfaced once lint went through the eslint CLI.

Override removed. npm now resolves 1.1.18 and 5.0.9 side by side, per consumer, which satisfies the advisory without forcing anything. That is the better fix and I should have scoped it that way originally.

4. A new rule lands on 12 existing effects

react-hooks/set-state-in-effect, new in eslint-config-next@16. Downgraded to warn with the reasoning in the config and tracked in #95.

The shape it flags most often is the hydration guard next-themes documents (useEffect(() => setMounted(true), [])), which exists to avoid a server/client mismatch and has no direct replacement. Twelve behaviour-adjacent refactors inside a framework migration would make this unreviewable.

Verified past the build

A build passing is not a working UI, so I served the dev server against a live orchestrator:

• CSS resolves: 3 stylesheets, 703 rules, dark theme applied (rgb(9,9,11) ground)
• Live feed renders: 128 events, filters, MITRE columns, source list
• Zero console errors

Plus: tsc --noEmit clean, eslint . 0 errors (12 warnings, all #95), 99 tests, static export produces both routes.

🤖 Generated with Claude Code