fix(nextjs): ignore response header mutations in GET handlers

[aqilaziz]

Summary

• ignore outbound response header mutations like response.headers.set() in GET route side-effect detection
• ignore request-scoped Headers/Map mutations created inside the handler
• add regression coverage for issue False positive: nextjs-no-side-effect-in-get-handler flags Response.headers.set() and similar Headers API calls #206 using a temporary Next.js route fixture

Fixes #206.

Testing

• pnpm exec vp test run tests/regressions/nextjs-side-effects.test.ts
• pnpm exec tsc --noEmit from packages/react-doctor
• pnpm exec vp lint
• git diff --check

[reactreview]

Note

No issues found

[vercel]

@aqilaziz is attempting to deploy a commit to the Million Team on Vercel.

A member of the Team first needs to authorize it.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1ed2336. Configure here.}

[cursor]

Shared findSideEffect suppresses headers() detection across frameworks

Medium Severity

isHeadersFunctionMutationCall matches headers().set/append/delete(...) and silently suppresses it before the existing isCookiesOrHeadersCall(child, "headers") check can flag it. Since findSideEffect is shared with the TanStack Start rule (tanstack-start.ts line 562), this suppression also applies there — where headers() is not the Next.js read-only accessor and could be a user-defined function returning a mutable object. The headers() branch of isCookiesOrHeadersCall is now effectively dead code for all real Headers API methods. The function also has zero test coverage — the test fixture only exercises isHeadersApiMutationCall and isRequestScopedMutationCall.

Additional Locations (2)

• packages/react-doctor/src/plugin/helpers.ts#L425-L428
• packages/react-doctor/src/plugin/helpers.ts#L434-L437

 

^{Reviewed by Cursor Bugbot for commit 1ed2336. Configure here.}