#436 chore: support Next.js 16.4.4

Summary

Build, scaffold and test against Next.js 16.4.4 (b175f52b).

• Catalog and fixtures. next and @next/routing move to 16.4.4, with the ordinary integration fixtures, the scaffolder (^16.4.4), the website and the deploy-suite default and nightly release. next-twoslash and next-large-prerender-bodies stay on their recorded 16.4.2. next-native stays on 16.4.3 (see below).
• Preview-data stub. Next.js 16.4.4 compiles next/dist/compiled/fast-jwt where it compiled next/dist/compiled/jsonwebtoken (#100885). A build without a Pages Router route now stubs either, so its Functions don't carry the 131 KB fast-jwt bundle. The reasoning is unchanged:
  • In all twelve 16.4.4 server runtimes, the verifier is still required only inside tryGetPreviewData's try.
  • The signer (setPreviewData) is only in the Pages API runtime.
• Native Node path. This path still qualifies exact next@16.4.3 bytes.
  • The adapter and runtime get a next-16-4-3 (npm:next@16.4.3) dev dependency.
  • The suites that copy Next.js files to prove that path now read from the alias, not from the catalog's Next.js.
  • Accepting 16.4.4 on this path is a separate PR stacked on this one.
• Deploy tests.
  • The upstream directories of the eight deploy-mode copies have the same Git trees at v16.4.4 as at v16.4.3, so the copies are held to v16.4.4.
  • The test-install security profile is byte-identical between the two tags (test/lib/pnpm-security-settings.js and the root pnpm-workspace.yaml).
  • Every 16.4.3 reading is read again at 16.4.4, except Node.js 26's preview mode, which fast-jwt removes the cause of (REVIEWED.md, src/reviewed.ts). Of the suites read, 16.4.4 changed only that reading's three. The judge still holds each case to its recorded failure. On node under Node.js 24, every failure of the whole manifest at 16.4.4 before these readings (run 41466624903) was a case already read for that lane, and the run after them passes.

What 16.4.4 changes

• #100885: fast-jwt replaces jsonwebtoken. compiled/jsonwebtoken and lib/semver-noop are gone.
• #100866: reverts the Turbopack "strict module factory chunks" optimization.
• #100907: the PPR resume emits the Turbopack shared-runtime bootstrap with the request's CSP nonce. 16.4.4 still reads the nonce from the request's content-security-policy (getScriptNonceFromHeaders), which is where the edge hands it to Next.js for the resume. With the bootstrap now in the continuation, the edge stamps only the shell, as before.
• #100619 (dev CSS HMR) and #100974 (next build --analyze).
• #100886: the deploy harness now writes engines.node: "22.x" into each fixture. pnpm 12.16.1 still installs and runs such a project under Node 24, which I checked locally.
• The other differences in dist are the embedded version string.

Checks run locally

• pnpm check:patches: 17 patches, 71 files and 95 edits on 16.4.4.
• pnpm check:agent-rules: matches byte for byte.
• pnpm check:vocabulary and pnpm knip pass.
• The middleware matcher's generator (build/analysis/get-page-static-info.js, shared/lib/router/utils/route-regex.js) is identical between the two releases.
• Tests:
  • loader-hooks (both libraries), build-middleware-budget.
  • The native suites that read Next.js files: they now read the alias. The one remaining failure is native-encoder-files, which fails only on macOS because sharp's libvips can't be loaded there.
  • The Worker-path suites that read the installed Next.js: websocket-response, use-cache-cross-request, external-pages-api-dist, d1-observation, native-edge-web, native-graph.
  • create-upwind, and deploy-tests population and workflow-security.
• tsc --noEmit on adapter, runtime, core, create-upwind and deploy-tests. ESLint and oxfmt on every changed file.

Review notes

• Native publication on the node lane at 16.4.4: not changed here. All 64 node shards pass at 16.4.4 (run 41469464179), prerender-native-module among them, and no build in run 41466624903 was refused with "refusing native publication". The native Node path's own 16.4.4 support is the stacked follow-up.
• License-compliance alert on next-16-4-3: the alias is npm:next@16.4.3, which is MIT like the catalog's next. The scanner does not resolve npm aliases, so this is a false positive.

Summary by CodeRabbit

• New Features
  • Added support for Next.js 16.4.4 in project scaffolding and deployment test profiles.
  • Updated the adapter to handle preview-data signing with either jsonwebtoken or fast-jwt.
• Bug Fixes
  • Builds without a Pages Router now correctly account for both preview-data libraries.
• Documentation
  • Updated setup instructions, version examples, and deployment test guidance for Next.js 16.4.4.