React Server Components in production: the inventory of rakes.

Next.js 13 shipped the App Router in October 2022. By late 2024 it is the default for new Next projects and the assumed stack in most frontend roles. After migrating three production codebases and auditing five more, here is the list of things nobody mentions in the getting-started guides.

1. "use client" is sticky. Once a module is marked client, everything it imports becomes a client module. One innocent import { Button } from "./ui" from a server component will pull the entire client runtime for Button's dependency tree. Audit with @next/bundle-analyzer.

2. Streaming and loading.tsx are not optional. The default behaviour when a server component suspends is to block the whole route segment. If your product list fetches from three APIs, you either stream with Suspense boundaries or you show a white screen for 800ms.

3. Route-level caching is aggressive. fetch() calls inside server components cache by default. In Next 14 it was fully cached by default; Next 15 flipped to no-cache default. Both defaults will surprise someone. Always set cache explicitly.

4. Third-party scripts need next/script. Adding a GTM tag in a layout with a raw <script> tag gets hydrated and re-run on every navigation. next/script with strategy="afterInteractive" is the correct primitive.

5. Error boundaries do not catch server component errors. You need error.tsx files at the route segment level. A top-level ErrorBoundary does nothing here.

6. Form actions bypass your existing CSRF. Server actions use a POST with a content-type the framework generates. If you had middleware validating CSRF tokens via a custom header, it will not fire. Audit middleware against server action routes.

7. Revalidation is manual. revalidatePath and revalidateTag need to be called explicitly from mutations. The number of bugs we have seen that trace back to "I updated the DB but the cached page still showed old data" is too many. Wire this up in your mutation layer.

8. Vercel's build output analyser is not optional. Run it before and after every significant change. Client bundle creep is insidious and you will not notice until someone on a 3G connection complains.

9. Cold start on Cloud Run or Lambda is real. Vercel hides this; self-hosted Next on AWS does not. Cold start can be 2 to 4 seconds for a first request to an idle container. Either keep-warm or use Vercel's infrastructure.

Sources: Next.js docs (App Router); Vercel's migration guide; production migration postmortems, 2023-2024.