cases / real-nextjs-15-async-apis

real-nextjs-15-async-apis

next 14.2.3 → 15.0.0

Vercel's own Next.js + Supabase + Stripe subscription starter (~7.7k stars), pinned at next 14.2.3, upgraded to Next 15's async request APIs.

npm real repo vercel/nextjs-subscription-payments @bdd0813 ↗

grep-baseline

4 right 8 wrong

<0.1s · $0.00

agent · deepseek-v4-flash-free

4 right 0 wrong

48.7s · $0.00

Release notes

The input. Checked in with the case so a scoring run measures the detector, not whether upstream's site is reachable.

Next.js 15

Breaking: async request APIs

The cookies and headers helpers exported from next/headers are now asynchronous and return a Promise. draftMode is likewise async.

// Before
const cookieStore = cookies();

// After
const cookieStore = await cookies();

Any synchronous call site must be awaited, and the enclosing function must become async.

What each detector said

One row per (file, symbol) site — the unit the scorer compares on. Ground truth comes from the case's hand-written labels.

12 sites · 8 where a detector is wrong only show mistakes

not broken app/api/webhooks/route.ts :headers grep-baseline flagged agent · deepseek-v4-flash-free silent

req.headers.get('stripe-signature') on the standard Request object.
1 matched line · reasoning
```
  26  const sig = req.headers.get('stripe-signature') as string;
```
grep-baseline conf 0.50
'headers' is named in the release notes and appears in 11 place(s) in this repo. No check was made that these are real call sites.
not broken app/signin/[id]/page.tsx :headers grep-baseline flagged agent · deepseek-v4-flash-free silent

Matches only the 'next/headers' import specifier.
1 matched line · reasoning
```
   3  import { cookies } from 'next/headers';
```
grep-baseline conf 0.50
'headers' is named in the release notes and appears in 11 place(s) in this repo. No check was made that these are real call sites.
not broken app/signin/page.tsx :headers grep-baseline flagged agent · deepseek-v4-flash-free silent

Matches only the literal 'next/headers' import specifier. The path separator is a word boundary, so a naive identifier search hits it.
1 matched line · reasoning
```
   3  import { cookies } from 'next/headers';
```
grep-baseline conf 0.50
'headers' is named in the release notes and appears in 11 place(s) in this repo. No check was made that these are real call sites.
not broken utils/auth-helpers/server.ts :headers grep-baseline flagged agent · deepseek-v4-flash-free silent

Matches only the 'next/headers' import specifier.
1 matched line · reasoning
```
   4  import { cookies } from 'next/headers';
```
grep-baseline conf 0.50
'headers' is named in the release notes and appears in 11 place(s) in this repo. No check was made that these are real call sites.
not broken utils/helpers.ts :headers grep-baseline flagged agent · deepseek-v4-flash-free silent

`new Headers({...})` in a fetch init object.
1 matched line · reasoning
```
  38  headers: new Headers({ 'Content-Type': 'application/json' }),
```
grep-baseline conf 0.50
'headers' is named in the release notes and appears in 11 place(s) in this repo. No check was made that these are real call sites.
not broken utils/supabase/middleware.ts :cookies grep-baseline flagged agent · deepseek-v4-flash-free silent

request.cookies and response.cookies on NextRequest/NextResponse, plus a `cookies:` config key. None is the next/headers helper.
6 matched lines · reasoning
```
  16  cookies: {
  18  return request.cookies.get(name)?.value;
  21  // If the cookie is updated, update the cookies for the request and response
  22  request.cookies.set({
  32  response.cookies.set({
  39  // If the cookie is removed, update the cookies for the request and response
```
+2 more

grep-baseline conf 0.50
'cookies' is named in the release notes and appears in 20 place(s) in this repo. No check was made that these are real call sites.
not broken utils/supabase/middleware.ts :headers grep-baseline flagged agent · deepseek-v4-flash-free silent

request.headers passed through to the Supabase client.
4 matched lines · reasoning
```
   8  headers: request.headers
  29  headers: request.headers
  47  headers: request.headers
  80  headers: request.headers
```
grep-baseline conf 0.50
'headers' is named in the release notes and appears in 11 place(s) in this repo. No check was made that these are real call sites.
not broken utils/supabase/server.ts :headers grep-baseline flagged agent · deepseek-v4-flash-free silent

Matches the 'next/headers' import specifier and a prose comment mentioning next/headers. Neither is a call.
2 matched lines · reasoning
```
   2  import { cookies } from 'next/headers';
   6  // The function takes a cookie store created with next/headers cookies as an argument
```
grep-baseline conf 0.50
'headers' is named in the release notes and appears in 11 place(s) in this repo. No check was made that these are real call sites.
breaks app/signin/[id]/page.tsx :cookies grep-baseline flagged agent · deepseek-v4-flash-free flagged

Same synchronous read, in the dynamic route variant.
2 matched lines · reasoning
```
   3  import { cookies } from 'next/headers';
  39  cookies().get('preferredSignInView')?.value || null;
```
grep-baseline conf 0.50
'cookies' is named in the release notes and appears in 20 place(s) in this repo. No check was made that these are real call sites.
breaks app/signin/page.tsx :cookies grep-baseline flagged agent · deepseek-v4-flash-free flagged

Synchronous cookies().get('preferredSignInView') in a server component.
2 matched lines · reasoning
```
   3  import { cookies } from 'next/headers';
   7  cookies().get('preferredSignInView')?.value || null;
```
grep-baseline conf 0.50
'cookies' is named in the release notes and appears in 20 place(s) in this repo. No check was made that these are real call sites.
breaks utils/auth-helpers/server.ts :cookies grep-baseline flagged agent · deepseek-v4-flash-free flagged

Two synchronous `const cookieStore = cookies()` calls.
3 matched lines · reasoning
```
   4  import { cookies } from 'next/headers';
  36  const cookieStore = cookies();
 135  const cookieStore = cookies();
```
grep-baseline conf 0.50
'cookies' is named in the release notes and appears in 20 place(s) in this repo. No check was made that these are real call sites.
breaks utils/supabase/server.ts :cookies grep-baseline flagged agent · deepseek-v4-flash-free flagged

Synchronous `const cookieStore = cookies()` passed to the Supabase client.
5 matched lines · reasoning
```
   2  import { cookies } from 'next/headers';
   6  // The function takes a cookie store created with next/headers cookies as an argument
   8  const cookieStore = cookies();
  15  // Define a cookies object with methods for interacting with the cookie store and pass it to the client
  17  cookies: {
```
grep-baseline conf 0.50
'cookies' is named in the release notes and appears in 20 place(s) in this repo. No check was made that these are real call sites.