✨ feat: upgrade to Next 16 (#9851)

* upgrade next 16

* try to fix

* try to fix

* upgrade

* fix sitemap build

* try to fix build

* try to fix build with next 16

* fix docker permission

* 🔒 fix(ci): fix code injection vulnerability and permissions in docker workflow

- Add pull-requests: write permission to allow PR comments
- Fix code injection vulnerability by using env variables instead of direct interpolation
- Prevent potential security risks from malicious branch names in pull_request_target events

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* 🔧 chore(ci): change desktop pr build to use pull_request_target

- Change from pull_request to pull_request_target to access secrets and write permissions
- Update permissions from read-all to specific write permissions for contents and pull-requests
- This allows PR builds to create releases and comment on PRs from forks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* add comment

* fix on

---------

Co-authored-by: Claude <noreply@anthropic.com>

apps/desktop/src/main/utils/next-electron-rsc.ts

@@ -1,6 +1,6 @@
 // copy from https://github.com/kirill-konshin/next-electron-rsc
 import { serialize as serializeCookie } from 'cookie';
-import { type Protocol, type Session, protocol } from 'electron';
+import { type Protocol, type Session } from 'electron';
 import type { NextConfig } from 'next';
 import type NextNodeServer from 'next/dist/server/next-server';
 import assert from 'node:assert';
@@ -202,6 +202,11 @@ export function createHandler({
 
   if (!isDev) {
     logger.info('Initializing Next.js app for production');
+
+    // https://github.com/lobehub/lobe-chat/pull/9851
+    // @ts-expect-error
+    // noinspection JSConstantReassignment
+    process.env.NODE_ENV = 'production';
     const next = require(resolve.sync('next', { basedir: standaloneDir }));
 
     // @see https://github.com/vercel/next.js/issues/64031#issuecomment-2078708340
@@ -209,10 +214,7 @@ export function createHandler({
       .config as NextConfig;
     process.env.__NEXT_PRIVATE_STANDALONE_CONFIG = JSON.stringify(config);
 
-    app = next({
-      dev: false,
-      dir: standaloneDir,
-    }) as NextNodeServer;
+    app = next({ dir: standaloneDir }) as NextNodeServer;
 
     handler = app.getRequestHandler();
     preparePromise = app.prepare();