nextjs-testing — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited nextjs-testing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Next.js blurs the line between frontend and backend. Relying on unit tests alone is insufficient — E2E tests are essential for catching bugs at the client/server intersection.
Test the boundary: The most dangerous bugs in Next.js hide where Server Components meet Client Components, where cached data meets fresh data, and where middleware meets Route Handlers. Prioritize E2E tests that exercise these intersections.
| Tool | Use For | Strengths |
|---|---|---|
| Vitest | Unit/component tests — functions, hooks, simple Client Components | Fast, Jest-compatible, native ESM |
| Cypress | E2E — complex client-side state, time-travel debugging | cy.intercept(), window access, visual debugging |
| Playwright | E2E — speed, parallelization, cross-browser, multi-tab | Native parallel execution, heavily server-rendered apps |
Next.js behaves differently in dev vs. production (caching, static generation, hydration). Always run E2E tests against npm run build && npm run start. This catches build-time errors, missing env vars, hydration mismatches, and caching issues invisible in dev mode.
Use start-server-and-test (Cypress) or the built-in webServer config (Playwright) to automatically start, wait for, and tear down the server. See references/testing-setup-patterns.md for complete configuration templates.
baseUrl (http://localhost:3000) — use relative paths in all tests.cy.exec() or cy.task() — causes port conflicts and strips log access.Async Server Components are not fully supported by component testing tools. Use E2E tests (Cypress or Playwright) to validate RSC behavior.
E2E runners cannot access server-side code. Test the rendered HTML DOM, not how the component fetches data internally.
For streaming RSCs wrapped in <Suspense>, rely on the test runner's automatic retry:
Test endpoints directly with cy.request() or Playwright's request API. Faster and more isolated than clicking through UI.
Use cy.intercept() (Cypress) or page.route() (Playwright) to mock API responses during UI tests. Enables testing edge cases (500 errors, empty states, slow responses) reliably.
data-testid AttributesNever target elements by CSS classes, IDs, or tag names — they are brittle and tied to styling. Use dedicated test attributes:
<button data-testid="submit-order">Place Order</button>// Cypress
cy.get('[data-testid="submit-order"]').click();
// Playwright
page.getByTestId('submit-order').click();Clean up state in before or beforeEach, not afterEach. If a test fails mid-execution, afterEach won't run, leaving dangling state that breaks subsequent tests. Every test must pass independently with .only.
Never use cy.wait(5000). Instead:
Never type credentials via UI for every test. Use programmatic authentication:
cy.session() caches cookies and localStorage across tests.storageState persists and reuses auth state across specs.See references/testing-setup-patterns.md for complete auth setup templates for both frameworks.
Never navigate to Google, GitHub, or Auth0 login screens in tests. These providers detect automation and block with CAPTCHAs. Mock the OAuth callback or use a test provider instead.
cypress-parallel or Cypress Cloud).--headless flag).For complete configuration examples and setup templates:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.