Core Changes feat(next/image): add internal image redirects (to match existing external image redirects): #98271 Turbopack: show the source-mapped file in issue headers: #101161 Add Request Insights filters and pause controls: #96924 Avoid instrumenting Next.js telemetry requests: #97182 Classify framework request activity: #96914 Move optional lockfile parameters into options object: #101132 Reco…
Core Changes Add instrumentationInject for adapter-supplied instrumentation: #100658 test(codemod): fix flaky agents-md e2e cascade on slow GitHub clones: #101122 perf(build): use nft's cached readlink when collecting build traces: #99678 [experiment] support App Router route.go handlers: #100130 Misc Changes server actions: read cache kinds lazily: #101071 turbo-tasks-backend: fix lost idle wakeu…
Core Changes Strip internal middleware cookie headers from edge responses: #101109 Fix stale compressed framing for forwarded fetch responses: #101108 [use cache] Fix cache key when binary args are used: #101107 Fix shared shell poisoning from request-supplied placeholder params: #101106 [next/image] Fix false-positive AVIF/HEIC detection: #101105 Fix unstable_cache leaking cold 'use cache' fills…
This release contains security fixes for the following advisories: Moderate Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache Cache leak across root param values in nested 'use cache' functions (follow-up) Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params Cross-user cache disclosure and…
This release contains security fixes for the following advisories: Moderate Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses SVG rejection bypass in Next.js image optimization HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes
Core Changes Fix blocking revalidation for fetch and unstable_cache: #101077 Misc Changes Turbopack: avoid invalidating per-module analysis when the encryption key changes: #100950 turbo-tasks: add cancelable cell reads via Vc::lazy_reader(): #101008 Turbopack: use simd-utf16-len for source position column counting: #100973 Fix layout client chunk leakage across async server imports: #101040 Pin T…
Core Changes Add router.experimental_prepare(): #101050 Handle registries not serving JSON when checking the version: #95062 Fix navigations rerendering fully static ISR pages in next start: #100854 [refactor] Remove obsolete RDC and PPR feature guards: #100827 [no-unsafe-inline] Carry the Flight payload as data instead of inline scripts: #97573 [no-unsafe-inline] Add an experimental flag for Reac…
NoteThis release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow. Core Changes [lts-active] test: disable the reads fallback params after a client navigation deployment test (#100668) [lts-active] Reload on missed Turbopack startup CSS updates (#100619) [lts-active] Revert "Optimize strict…
Core Changes Upgrade React from a703ca64-20261030 to e84e1492-20261031: #100999 Upgrade React from dc9aed36-20261027 to a703ca64-20261030: #100965 Misc Changes Turbopack: resolve per-module data once during module graph construction: #94842 Credits Huge thanks to @lukesandberg for helping!
Core Changes Handle cancellation errors during response clone cleanup: #100961 Revert "Revert "Fix App Router locale path matching with Pages i18n"": #98726 Fix prerendering of caught 'use cache' errors: #100956 Misc Changes docs: clarify blocking route response status: #100191 docs: note per-route cost of boundary files, cached Route Handler checks, and per-instance rate limits: #100985 docs: cla…
Misc Changes fix(turbopack): fix canary build after chunk_groups became a Vec: #100949 Reland "perf(turbopack): canonicalize async loader availability": #100947 fix(turbopack): avoid panics from transient chunk group indices: #100928 Credits Huge thanks to @sokra and @mischnic for helping!
Core Changes Stop patching error inspection if source maps are disabled: #93364 Misc Changes Turbopack: store ChunkGroupInfo::chunk_groups as a Vec: #100935 [test] Fix flaky file-system-cache-clock tests: #100946 [ci] Fix test axis fixtures never running their off state in CI: #100912 Define the review agent's team as the owners in review/OWNERS: #100927 Credits Huge thanks to @lukesandberg, @unst…
Core Changes Fix hangs and crashes for 204 responses from route handlers and deduped fetches: #100159 fix(adapter): preserve revalidation for metadata prerenders: #100861 next-custom-transforms: Optimize server-reference transform output: #100637 Show dev overlay errors before the indicator state is known: #100629 Update font data: #100863 Misc Changes Improve common errors in turbo-trace-server:…
Core Changes perf(build): lazily require page-data helpers in build/utils: #100822 Misc Changes perf(turbopack): canonicalize async loader availability: #100705 Credits Huge thanks to @sokra for helping!
Core Changes Ignore expected upgrade nudges in Agent Feedback: #100840 Add model metadata to Agent Feedback: #100806 Use fast-jwt instead of jsonwebtoken: #100818 Update font data: #100813 Turbopack: wait for trace file changes after format errors: #99847 Add a CLI for reviewing agent feedback: #100739 Misc Changes Add criteria for Vercel Agent code review: #100846 Add experimental.hydrationChange…
NoteThis release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes [lts-active] Fix extensionless Google font URLs in both bundlers (#100277) [lts-active] Don't load the app-page runtime in proxy.ts (#100423) [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438) [lts-active][cd] Gate release bot credentials behind GitHub env…
Core Changes Create cache directory before persisting Chrome DevTools workspace UUID: #100802 Upgrade React from ab0d927f-20261020 to dc9aed36-20261027: #100791 [testmode] Fix compressed HTTP responses with test proxy: #100805 chore(deps): bump sharp@0.35.5: #99714 Turbopack: Auto-detect pnpm GVS and configure an additional root for it: #99758 Persist storage cache in Docker environments: #100790…
Core Changes Fix draft mode rendering with Cache Components: #100728 Render complete HTML documents after MPA Server Actions: #100740 Turbopack: add minServerChunkSize and maxMergeServerChunkSize options: #100712 test: read isNextDev/isNextDeploy/isNextStart from e2e-utils: #100419 perf(build): avoid O(pages²) original app path scan in static check: #100615 [PPF] Fix hanging HTML response after a…
Core Changes Build the inline Flight script from React's strings instead of re-encoding them: #100142 Fix dist dir lockfile on filesystems with no or limited lockfile implementations (e.g. NFS): #100684 Misc Changes perf(turbopack): look up chunk group indices through a keyed cell: #99050 Turbopack: track availability by chunk group: #98685 refactor(turbopack): chunk chunk groups by key: #99750 Tu…
Core Changes Turbopack: bump trace format header to TRACEv1: #99781 Pass staged fallback params directly to adapter renders: #100456 Fix navigation from global-not-found to app routes: #100592 End the cache-signal read when encryptActionBoundArgs hits the RDC: #100622 Ignore flaky turbo-tasks-fs watcher tests in CI: #100627 Misc Changes test: enable build-error suites in deploy mode: #100482 test:…
Misc Changes Revert "More parity for webpack loader build dependencies (#99549)": #100634 Cache bundle analysis per output file: #100475 Credits Huge thanks to @mischnic and @wbinnssmith for helping!
Core Changes Cap bot user-agent matching at 1KB: #100604 Pass lazy response lifecycle capabilities into App rendering: #100395 Upgrade testmode interceptors to 0.45.9: #100585 Defer React loading until fetch dedupe construction: #100401 Avoid loading standalone React by separating render validation: #100467 Misc Changes fix(turbopack): evaluate pure constructor callees: #100588 Add webpack utils:…
Core Changes Upgrade React from a6792708-20261019 to ab0d927f-20261020: #100527 Preserve deferred middleware instrumentation spans when the adapter throws: #100552 Fix cache revalidation queued during streaming: #100448 Remove unnecessary as any casts: #100418 Update font data: #100490 Turbopack: preserve chunk load promise identity: #100421 Emit instrumentation lifecycle spans in the request that…
v16.5.0-canary.22
Core Changes Defer app router HMR refresh until the router is initialized: #100113 Misc Changes test: extend webpack timeout for dynamic-params-retained-cache: #100382 Credits Huge thanks to @sokra for helping!
Core Changes Upgrade React from ba39b32a-20261019 to a6792708-20261019: #100459 Pass request headers explicitly into App request stores: #100333 Remove request from App page prerender entry point: #100331 Use render lifecycle callback for fetch metrics cleanup: #100323 Upgrade React from 99c106c4-20261014 to ba39b32a-20261019: #100403 Pass interception capability into App rendering: #100409 Misc C…
Core Changes Show compiling status alongside DevTools issues: #100178 Pass staged fallback params into App rendering: #100408 Capture initial HMR version in dev render context: #100407 Credits Huge thanks to @aurorascharff and @kassens for helping!
Core Changes Revert "Turbopack: loader change invalidation (#95732)": #100414 Add : #99871 remove Static render stage: #100388 Don't load the app-page runtime in proxy.ts: #100384 Format all READMEs with Prettier: #100310 Fix Pages Router HMR crash when the ISR manifest arrives before the router: #100095 Use os.availableParallelism() instead of os.cpus().length: #100258 Misc Changes test: fix flak…
Misc Changes turbo-persistence: prefetch multi-page SST blocks with MADV_WILLNEED: #100283 Credits Huge thanks to @lukesandberg for helping!
Core Changes Refactor fetchStrategy -> stage and completeness: #99706 Remove dead NextNodeServer.renderHTML: #100284 Pass Server Action request metadata into App rendering: #100274 Revert "Keep requests through middleware in a single OpenTelemetry trace": #100302 Respect release age when pinning the upgrade CLI: #100256 Misc Changes test: remove stale deploy gate on cold RSC navigation param cachi…