# Upgrade Atelier brief

Generated 2026-09-26T00:03:56.062Z

## next 15.5.7 → 16.3.6

- **Band:** REVIEW (70/100)
- **Status:** watching
- **Source:** fallback
- **Seal:** `db04f8666b85f1a6be21ad15e7257cf8d81ab5a179a33ccf5d1db91c9dc0ad4f4a2ea120f7754e28cfcac4ef617df33a`

next 16.3.6 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.

### Evidence
- **Version distance:** major boundary — A major release can change public contracts and runtime assumptions.
- **Release cooldown:** published today — Recent releases receive a short observation window before a production recommendation.
- **Maintenance signal:** 8 maintainers — Maintainer and repository signals help identify provenance risk.
- **Package surface:** 28.4 MB unpacked — A larger package has more install-time and transitive review surface.
- **Metadata quality:** MIT license — Complete license and description metadata makes a release easier to review.

### Migration notes
- Read the upstream release note and confirm the intended version exists in npm.
- Pin the candidate in a branch and run the focused test suite before the full build.
- Search the codebase for removed or renamed APIs before merging.
- Deploy behind a canary or feature flag with a documented rollback command.

---

## react 18.3.1 → 19.2.8

- **Band:** REVIEW (60/100)
- **Status:** ready
- **Source:** fallback
- **Seal:** `3a0e6a84b07e3f88f0d9b969ce3bed5b5dd4087dd50bba4775e54c0f7f81339f2b4fe1d02e7720e38179d8bf9b6d6f7b`

react 19.2.8 crosses a meaningful change boundary. Compare APIs, run focused tests, and make the rollback path explicit.

### Evidence
- **Version distance:** major boundary — A major release can change public contracts and runtime assumptions.
- **Release cooldown:** 3 days old — Recent releases receive a short observation window before a production recommendation.
- **Maintenance signal:** 5 maintainers — Maintainer and repository signals help identify provenance risk.
- **Package surface:** 0.4 MB unpacked — A larger package has more install-time and transitive review surface.
- **Metadata quality:** MIT license — Complete license and description metadata makes a release easier to review.

### Migration notes
- Read the upstream release note and confirm the intended version exists in npm.
- Pin the candidate in a branch and run the focused test suite before the full build.
- Search the codebase for removed or renamed APIs before merging.
- Deploy behind a canary or feature flag with a documented rollback command.

---

## typescript 5.8.3 → 5.9.3

- **Band:** WATCH (34/100)
- **Status:** paused
- **Source:** fallback
- **Seal:** `6d2724cccec1dcc5a432051f1cfb8312677bc4493c98aa908a3b3ed9ad97233805d7d4e0c06c5afa72f85abc3fa2a612`

typescript 5.9.3 is worth trying, but the release is recent enough to earn a short observation window before production.

### Evidence
- **Version distance:** minor boundary — The distance between the installed and latest versions is measured directly.
- **Release cooldown:** 19 days old — Recent releases receive a short observation window before a production recommendation.
- **Maintenance signal:** 4 maintainers — Maintainer and repository signals help identify provenance risk.
- **Package surface:** 21.0 MB unpacked — A larger package has more install-time and transitive review surface.
- **Metadata quality:** Apache-2.0 license — Complete license and description metadata makes a release easier to review.

### Migration notes
- Read the upstream release note and confirm the intended version exists in npm.
- Pin the candidate in a branch and run the focused test suite before the full build.
- Run the application smoke path and watch runtime errors for one release window.