Your team wrote middleware.ts carefully — Edge-safe imports only, jose instead of jsonwebtoken , no direct database calls — because that's what Edge middleware demanded. Then you upgraded to Next.js 16, skimmed the release notes, and moved on. Nothing broke. Which is exactly the problem: middleware.ts still runs, but it's now the deprecated way to do the one job every non-trivial app needs — checking a request before a single line of your app runs. The framework renamed the file, moved ...