next

Misc Changes

• Replace next-ppr-optimizer with next-cache-components-optimizer: #94035
• [Skills] next-dev-loop: persist login state across loops: #94105
• Fix errors.json merge driver to handle gaps in error codes: #93829

Credits

Huge thanks to @gaojude and @sokra for helping!

Misc Changes

• [Skills] Mark backport-pr and create-pr as internal: #94076

Credits

Huge thanks to @gaojude for helping!

Misc Changes

• Add next-dev-loop and next-ppr-optimizer skills: #93943
• test: migrate webdriver callers to next.browser: #93941
• Revert "Include PPR routes in dynamicRoutes regardless of revalidate time": #94032
• Fix pr-status job pagination: #94049
• Prerender static metadata under dynamic segments to canonical pathname: #93873
• Instant navs devtools revamp: #94027
• Add Chromium-only Playwright image publisher: #94051

Credits

Huge thanks to @gaojude, @timneutkens, @gnoff, and @samselikoff for helping!

Misc Changes

• [ci] Add an TURBO_TASKS_AVAILABLE_PARALLELISM environment variable that overrides std::thread::available_parallelism callsites: #93995
• Make --debug-build-paths work with src/ directory projects: #94016
• ci: run Linux Playwright jobs in prebuilt Microsoft container: #93794
• Revert "Prerender HTTP access fallbacks with Cache Components semantics": #94018
• Respond to App Shell prefetches on the server: #93998
• [turbopack] Disable ctor under RA: #94022
• Upgrade rustc to nightly-2026-05-15: #94021
• Turbopack: don't crash the dev server when node_modules/next is briefly unresolvable: #93877
• Include PPR routes in dynamicRoutes regardless of revalidate time: #94025
• Enable experimental.varyParams by default: #94010
• Enable experimental.optimisticRouting by default: #94011
• Enable experimental.cachedNavigations by default with cacheComponents: #94012
• Update font data: #94006
• [ci] Set TURBO_TASKS_AVAILABLE_PARALLELISM to 4 in most e2e tests: #93996

Credits

Huge thanks to @bgw, @unstubbable, @timneutkens, @acdlite, @lukesandberg, @mischnic, @gnoff, and @vercel-release-bot for helping!

Misc Changes

• Enable mimalloc in benchmarks: #93388
• Turbopack: fix subpath imports pointing to external packages: #93308
• Turbopack: fix error reporting with crashing webpack loaders: #93926
• docs: instrumentationClientInject: #93913
• Fix Yarn berry tests: #93962
• Polish instant fix cards and validation messages: #93894
• Add deployable tarballs to pack-next: #93963
• fix(devtools): detect VS Code renamed macOS binary in launch-editor: #93971
• turbo-tasks: task-storage memory wins: #93720
• Add backport PR skill: #93973
• Turbopack: respect the module-sync export condition: #93970
• use the action cache for passing tests: #93954
• devlow-bench: percentile-based comparison and run retries: #93950
• @vercel/devlow-bench: 0.3.5 → 0.4.0: #93951
• [test] Prerendering HTTP access fallback pages with Cache Components: #93987
• Prerender HTTP access fallbacks with Cache Components semantics: #93988
• Add experimental.appShells feature flag: #93997

Credits

Huge thanks to @lukesandberg, @mischnic, @aurorascharff, @timneutkens, @wbinnssmith, @unstubbable, and @acdlite for helping!

Core Changes

• Add nextConfig.instrumentationClientInject: #93785
• Add MCP compile_route tool: #93337
• [turbopack-trace-server] Add memory samples to the mcp tool results: #93338

Misc Changes

• docs: update agent test guidance: #93924
• Add create PR skill: #93937
• Use node streams for server inserted HTML: #93934
• Remove vercel approvers: #93921
• [otel] honor traceparent for verbose mode spans: #93874
• Fix cross-param leak with prefetch={true} and cachedNavigations: #93940
• Enable rootParams by default: #93863
• devlow: add run sampling snapshots and comparison reports: #93833
• Allow inspecting prerender worker again: #93947
• make rcstrs on the heap/static slightly smaller: #93805
• Stop pinning compiled chunk source on EcmascriptBuildNodeChunkVersion. : #93807
• [turbopack] Add trace metadata about the persist size: #93339

Credits

Huge thanks to @timneutkens, @mischnic, @gnoff, @kakadiadarpan, @unstubbable, @wbinnssmith, and @lukesandberg for helping!

Core Changes

• [Turbopack] Add graph-based CSS chunking algorithm behind experimental.cssChunking: "graph": #93606

Misc Changes

• Convert more tests from createNext -> nextTestSetup: #93799
• turbopack: emit assets before duplicate check in emit_assets: #93875
• [test] split og-api test suite into default and standalone variants: #93915
• Pass projectDir to adapter modifyConfig: #93916
• Distinguish in-navigation errors in the instant error overlay: #93843
• Eval next.config export functions in the try catch: #93884
• Rename TaskExecutionReason::Initial to Root: #93922

Credits

Huge thanks to @timneutkens, @sokra, @unstubbable, @mischnic, @aurorascharff, and @lukesandberg for helping!

Misc Changes

• turbo-tasks: prioritize recomputed tasks with Recomputation priority: #93876

Credits

Huge thanks to @sokra for helping!

Core Changes

• Redesign dev overlay: cleaner shell + instant fix-card guidance: #93755

Misc Changes

• Trace middleware/proxy source files in webpack NFT pipeline: #93871

Credits

Huge thanks to @unstubbable and @yavorpunchev for helping!

Core Changes

• [turbopack] fix feature usage telemetry: #93100
• Add an info panel for the existing "Cache disabled" indicator: #93756
• Convert test/integration to isolated tests: #93247
• Extend instant error overlay to metadata, viewport, and sync IO errors: #93287
• Turbopack: expose hashes of source files to adapters: #93539
• bfcacheId: Opt out of state preservation: #93633
• Honor Suspense-above-body opt-in for dynamic generateViewport: #93759
• Add next internal static-routes-info CLI command: #93399
• Craigandrews/ensure isr lru is written if requests collapsed: #93766
• Fix catch-all router.query corruption with basePath + rewrites: #93294
• Surface invalid dynamic usage errors via Flight in dev: #93706
• Upgrade React from dd453071-20260506 to d5736f09-20260507: #93702
• Show inner "use cache" as cause of nested-dynamic cache error: #93707
• Fix server action forwarding loop with middleware rewrites: #93792
• Instant Insights: When unable to complete validation provide a filename for the unvalidated boundary: #93770

Example Changes

• [examples] migrate cloudinary to vercel-blob: #93762

Misc Changes

• Turbopack: don't generate next-server.js.nft.json with adapters: #93684
• Repo: Add gh stack skill: #93705
• Fix React 18 tests: #93763
• docs: clarify cacheTag limit - it is per call: #93768
• docs: devIndicators with usage example: #93784
• Convert tests using createNext -> nextTestSetup: #93767
• Turbopack: fix lock-order inversion between Storage::map and Storage::snapshots: #93788
• [turbopack] Enforce root attribute for strongly consistent reads and collectibles: #93114
• Fix Turbopack worker_threads URL resolution: #93432
• docs: less aggressive AI agent hint for an experimental API: #93811
• docs: fix typos and links: #92541
• docs: less aggressive AI agent hint for an experimental API: #93814
• Patch playwright-core to resolve _finishedPromise on requestFailed: #93802
• Revert "[test] Skip flaky cached-navigations tests": #93798
• fix: GNU xargs warns about incompatible --replace/--max-args: #93821
• fix: renumber non-sequential errors in errors.json: #93824
• simplify session dependent tasks (#91729): #93227
• fetch: respect HTTP Cache-Control headers with TTL-based invalidation (#91729): #93228
• [CC] fix: cachedNavigations missing asyncApiPromises in resumes: #93827
• Fix Date.now() cause shadowing in sync IO error overlay: #93857
• Mark .agents/skills as internal so external npx skills add hides them: #93856
• Instant Insights: only report non-validatable if dev render is error free: #93858
• Remove partialFallbacks config flag: #93859
• Fix warning in new apps caused by incorrect image dimensions: #93826

Credits

Huge thanks to @lukesandberg, @mischnic, @unstubbable, @timneutkens, @aurorascharff, @icyJoseph, @acdlite, @christopherkindl, @sokra, @gnoff, @publictheta, @gaojude, @unclebay143, @lubieowoce, @vercel-release-bot, and @samselikoff for helping!

Misc Changes

• Proof of concept: task eviction after snapshot for turbo-tasks-backend: #91790

Credits

Huge thanks to @lukesandberg for helping!

Core Changes

• Remove redundant instant navigation prefetch header: #93713
• Instant Insights: Favor reporting errors from all potential navigations over reporting a failed attempt to validate when a slot is missing: #93714

Misc Changes

• CI speed improvements: #93411

Credits

Huge thanks to @acdlite, @gnoff, and @timneutkens for helping!

Core Changes

• Stabilize unstable_io: #93621
• Use Next.js version as Turbopack persistent cache versioning key: #93605
• feat(turbopack): add chunkLoadingGlobal config option: #93488
• fix(devtools): render nested error messages with HotlinkedText: #93620
• Fix: Improved rewrite detection during optimistic routing: #93619
• Fix "type: module" in project dir when using standalone or adapters: #93612
• Instant Insights: favor reported errors over missing slots: #93709

Misc Changes

• Trace-server: Fix bottom up, and reduce allocations in turbopack-trace-server bottom-up grouping: #93460
• turbopack: reschedule stale tasks with correct invalidation priority: #92897
• [ci] Also pin first-party GH actions: #93609
• Remove ineffective turbo-tasks: #91341

Credits

Huge thanks to @gnoff, @sokra, @tim123abc, @aurorascharff, @acdlite, @timneutkens, @bgw, and @lukesandberg for helping!

Core Changes

• Hold cacheSignal across unstable_cache foreground revalidation: #93617
• Encode non-ASCII characters in cache tags at construction: #93601

Credits

Huge thanks to @unstubbable for helping!

Core Changes

• [devtools] Force ANSI colors on overlay code frames regardless of TTY: #93550
• Turbopack: Match proxy matchers with webpack implementation: #93594
• Track searchParams access through a Proxy to catch missing-key reads: #93549
• Cherry-pick ghsa commits to canary: #93614

Misc Changes

• docs: escape literal triple-backticks in contribution guide: #93584
• [test] Pin package manager to patch versions: #93592
• turbo-rcstr: replace rcstr! macro_rules with proc macro: #93551
• Turbopack: Fix middleware matcher suffix: #93590
• Turbopack: Change DynEffect::dyn_value to DynEffect::value_hash, a simple u128: #93552
• [ci] Ensure graphite_ci_optimizer fails open even if github fails to fetch the action: #93615

Credits

Huge thanks to @aurorascharff, @icyJoseph, @eps1lon, @lukesandberg, @timneutkens, @unstubbable, and @bgw for helping!

Misc Changes

• perf(ecmascript): shrink JsValue 64→32 bytes: #93106
• Order loader tree imports by tree depth: #93537
• Turbopack: more strict vergen setup: #93541

Credits

Huge thanks to @mmastrac, @sokra, and @mischnic for helping!

Core Changes

• Disable instant validations in draft mode: #93472

Misc Changes

• Drop ReferencedAsset::from_resolve_result as a turbotask: #93297
• Turbopack: Cache effect errors, replace the write_lock Mutex with a lazily created Notify instance: #93476

Credits

Huge thanks to @samselikoff, @lukesandberg, and @bgw for helping!

Core Changes

• Refactor: Decouple request store creation from req / res: #93499
• Detect 'use cache' module-scope deadlocks early in dev: #93500
• Bundle the 'use cache' deadlock probe worker: #93538
• Support configuring a default instant validation level : #93301
• Upgrade React from f4e0d4ed-20260429 to dd453071-20260506: #93547

Misc Changes

• [turbopack] shrink the size of futures: #93474
• [turbopack] Simplify local task tracking: #93478
• [turbopack] correct a fencepost error in our inline string descision: #93524
• Turbopack: make rcstr! macro expansion const: #93516
• Turbopack: lazy aggregation optimize via persistent pending flag: #93454
• docs: remove unreachable forms and mutations: #93509
• docs: broken link from usePathname compat call out: #93528
• Turbopack: really fix MAX_INLINE_LEN: #93531
• [ci] Clarify new preview build flow: #93540
• Turbopack: simplify asset ident constructors: #93213

Credits

Huge thanks to @lukesandberg, @unstubbable, @mischnic, @sokra, @icyJoseph, @eps1lon, @gnoff, and @vercel-release-bot for helping!

Core Changes

• Fix dev mode reload and error on back navigation between Next.js pages: #93486
• Fix double-encoding of URL pathname parts in client param parsing: #93491
• Don't suppress usage of deprecated TypeScript compilerOptions: #93377

Misc Changes

• [ci] Move Turbopack, Rspack and font data workflows off of RELEASE_BOT_GITHUB_TOKEN: #93455
• [ci] Migrate React sync off of RELEASE_BOT_GITHUB_TOKEN: #93456
• [ci] Create unique preview build versions for canary previews: #93490
• docs: clarify proxy runtime history: #93467
• Turbopack: fix import_usage for functions behind member expressions: #93504
• [ci] Ensure pnpm store cache is only filled when pnpm install runs: #93508
• Update unstable_prefetch and unstable_instant docs to reflect current API shape: #93514
• [ci] Remove unused setup-nextjs-build.yml workflow: #93512

Credits

Huge thanks to @eps1lon, @unstubbable, @armando-andre, @mischnic, and @gnoff for helping!

Core Changes

• Upgrade React from da9325b5-20260417 to f4e0d4ed-20260429: #93457
• Bump @vercel/ncc: #93459
• Include deployment id in cacheHandlers keys: #93453
• fix(next/image): Improve error message for private IP (SSRF) rejections: #91686

Misc Changes

• Upgrade to swc 65: #93325
• [test] Ensure target page is compiled before navigation in instant-navs-devtools: #93365
• [ci] Allow configuring the base URL for preview builds: #93464
• turbo-tasks-backend: fix snapshot coordination races + extract SnapshotCoordinator: #93416

Credits

Huge thanks to @mischnic, @vercel-release-bot, @eps1lon, @rishishanbhag, and @lukesandberg for helping!

Misc Changes

• Drop once_cell from all direct crate deps: #93095
• Replace Lazy<FxHashMap> static lookups with phf::Map: #93096

Credits

Huge thanks to @mmastrac for helping!

Core Changes

• Revert "Revert "Node.js streams: Add forkpoint for prerenderToStream"": #93376
• Fix streaming in draft mode for cache components: #93417

Misc Changes

• trace-server: shrink_to_fit LazySortedVec after sorting: #93361
• feat(metadata): support non-standard directives in robots.ts via other: #93206
• [turbo-trace-server] optimize loading even more: #93332

Credits

Huge thanks to @sokra, @timneutkens, @lukesandberg, and @samselikoff for helping!

Misc Changes

• [test] Preserve Playwright traces on every failure: #93366
• [ci] Add support for private preview builds: #93375
• Fix deploy tests crashing under AI coding assistants: #93394
• Remove leftover Turbopack manifests: #93398
• [ci]: remove PR creation from deploy test workflow: #93400

Credits

Huge thanks to @eps1lon, @unstubbable, @timneutkens, and @ztanner for helping!

Core Changes

• Honor the route-level expire value with blocking revalidation: #93211
• Turbopack: add experimental.turbopackWorkerAssetPrefix to keep Workers same-origin when assetPrefix is a CDN: #93271
• chore: bump postcss to 8.5.10: #93288
• Enable server HMR for metadata routes (manifest.ts, robots.ts, etc.): #93110
• [next/image] Only fire onError once: #93209
• fix: handling of falsey values in error boundaries: #93134
• Update upload trace url: #93350
• enable validateRSCRequestHeaders by default: #93367
• Deprecate edge runtime: #93369
• Only log partytown setup error once: #93378

Misc Changes

• turbo-tasks: precompute trait-impl vtables at compile time: #93092
• Report OS memory pressure in TurboMalloc and trace samples: #93333
• Speed up native postinstall script: #93312
• Turbopack: remove unused module references: #93335
• Turbopack: remove ModuleResolveResultItem::OutputAsset: #93349
• [test] Suppress build when preparing next for cache hits: #93355
• [test] Fix broken terminal output: #93357
• Turbopack: delete unused turbo-static crate: #93324
• fix a snapshot encoding error that could happen under concurrent mutation and snapshotting: #92658
• Update 05-server-and-client-components.mdx: #93374
• docs: clarify rendering flow in Server/Client interleaving example: #93381
• [test] Stop building fresh packages for every test: #93380

Credits

Huge thanks to @mmastrac, @unstubbable, @GuinsooRocky, @sokra, @eps1lon, @mischnic, @maximecolin, @lukesandberg, @wbinnssmith, @lubieowoce, @timneutkens, @ztanner, @zana-abdi2002, and @icyJoseph for helping!

Core Changes

• Apply sourcemaps by default during prerender in next build: #93280
• Fix route handler SWR blocking on Node runtime: #93189
• [ci]: fix release script to not strip newlines: #93302
• Forward invalid dynamic usage errors on client-side navigations: #93184
• HMR: debounce status indicator transitions to prevent flicker during bursts of changes: #93229
• ci: Fix caching of test-cargo-unit: #93327
• Turbopack: pull in updated vercel/nft tests: #93321

Misc Changes

• Turbopack: compute exports without full analysis: #92823
• Turbopack: cheaper check in map_next_dynamic: #93283
• [turbo-tasks-backend] Single-item optimization for lost follower operations: #93200
• Fix export * as X from './self' in scope-hoisted modules: #93192
• [ci]: Use macOS arm runner for intel builds: #93330
• Turbopack: only compute module ids for included modules: #93276
• Turbopack: iter_reachable_modules: #93315
• Turbopack: add failing test for cross-module side-effect inference: #93323
• Turbopack: also add edge count to trace: #93314
• [turbopack-trace-server] optimize loading: #93264
• [rust-deps] Update tokio: #93195

Credits

Huge thanks to @eps1lon, @mischnic, @unstubbable, @ztanner, @sokra, @wbinnssmith, and @lukesandberg for helping!

Core Changes

• Preserve __NEXT_ERROR_CODE across the /_error page handoff: #93183

Misc Changes

• Reduce allocations in the next_debug_instant_stack transform: #93222

Credits

Huge thanks to @unstubbable and @lukesandberg for helping!

Core Changes

• New ESLint rule: no-location-assign-relative-destination: #92900
• Upgrade React from fef12a01-20260413 to da9325b5-20260417: #92945
• Auto-generate AGENTS.md / CLAUDE.md in next dev: #92910
• Strengthen _rsc cache-busting param: #92755
• rage-restart followup: #92591
• fix(use-cache): remove awaiting revalidation: #92636
• Revert "Adopt pnpm catalogs for devDependencies": #93226
• instant(): Block out-of-band client fetches: #93099
• [next/image] Stop using deprecated url.parse: #93208
• Suspend dynamic route params in dev instant shell: #93108
• Turbopack: import.meta.glob docs + edge case support: #92729

Misc Changes

• chore: Prune list of users in labeler json: #92984
• [test] Deflake shallow-routing: #93006
• Use existing commitId for tarball URL in stats action: #92899
• docs: link Activity guide from Cache Components migration guide: #92571
• docs: add guide for displaying dates without hydration flash: #92786
• chore: remote apps/docs: #93041
• [ci]: remove unused workflow: #93064
• [ci]: remove publish token in favor of OIDC: #93065
• Update Rspack development test manifest: #92959
• [ci] Temporary disable of sccache: #93074
• Use OIDC for CodSpeed: #93059
• Restore dev-mode cache-fill timeout for 'use cache': #93055
• [ci]: add environment to publishRelease flow: #93093
• Adopt pnpm catalogs for devDependencies: #93071
• Make 'use cache' fill timeout configurable: #93070
• turbo-tasks: drop once_cell, const-init TRAIT_METHOD, ctor WORKER_TASKS: #93090
• Patch setHeader for direct route handlers: #93101
• [turbopack] Persistent last_successful_parse: #92852
• [turbopack] Unify Cell Storage: #92974
• Collapse pnpm test scripts into a single helper invocation: #93097
• [tests]: fix cache-components.test.ts type error: #93113
• [ci]: cleanup labeler: #93135
• Docs: add signed commit guidance: #93155
• [ci]: switch to GitHub runners: #93164
• [ci]: pin rust-musl-cross: #93176
• [turbopack] Fix max_level_hint to return most verbose per-target level: #93128
• feat(turbopack): add NEXT_TURBOPACK_TRACING_PATH to control trace output location: #93084
• Turbopack: move import_usage computation into ImportMap: #92891
• [rust-deps] Update serde: #93196
• [rust-deps] Update tracing: #93194
• Turbopack: unify ModuleGraph constructors: #93203
• [ci] replace next-labeler-webhook with in-repo GitHub Action: #93080
• example: remove with-supertokens: #93212
• Turbopack: move get_inner_asset into ecmascript module: #93191
• [ci] Fix auto-label workflow: #93215
• [test] Remove dead symlink: #93217
• [ci] Populate GITHUB_TOKEN for auto-labeler: #93219
• [ci]: move stats & CI status comment to workflow: #93220
• [ci] Upload preview builds directly to Vercel Blob: #93207
• [ci]: fix permissions on comment workflow: #93225
• [turbopack] drop TransientState: #92853
• [ci] Handle namespaced packages in preview builds: #93241
• [ci] Create test summary comment if job immediately passes: #93236
• [ci] Automatically start React sync when new react@experimental is available: #93235
• [rust-deps] Update bytes, crc32fast, memchr, pin-project-lite, quote, rand, regex, ringmap, roaring: #93197
• Recognize super(...) messages in Error subclass constructors: #93182
• docs: remove broken error-handling overlay screenshot: #93279
• [ci]: app-based release workflow: #93245
• [turbopack-trace-server] Performance improvements for span event handling: #93179
• [ci]: trigger signed release commit via API: #93285

Credits

Huge thanks to @bgw, @eps1lon, @SukkaW, @nextjs-bot, @devjiwonchoi, @aurorascharff, @feedthejim, @icyJoseph, @ztanner, @vercel-release-bot, @mmastrac, @mischnic, @gaojude, @unstubbable, @lukesandberg, @ijjk, @wbinnssmith, @awo00, @sokra, @acdlite, and @christopherkindl for helping!

Misc Changes

• Improve "make root node" trace attributes: #92941
• CI: Track SWC native binary size in PR stats comment: #92938

Credits

Huge thanks to @sokra for helping!

Core Changes

• Support more prefetch configuration options: #92859
• Improve deduping of concurrent 'use cache' invocations: #91830
• [partial fallbacks]: include prefetch requests in shell upgrade handling: #92894
• Redesign blocking route dev overlay and build errors: #92638
• Switch to cargo-binstall and pre-built sccache binaries: #92911
• Remove prefetch from instant config: #92761

Misc Changes

• Fix flake in rewrites-manual-href-as test: #92948
• docs: amends to preserving-ui-state guide: #92270

Credits

Huge thanks to @gnoff, @unstubbable, @ztanner, @aurorascharff, @mmastrac, and @icyJoseph for helping!

Core Changes

• fix(next/image): ensure images.maximumResponseBody applies to local images too: #92920
• Refactor trace server sort to SortMode enum (execution order / value / name): #92873
• Perf: Simplify static metadata handling: #92630
• remove flag guarding unstable_io: #92923

Misc Changes

• [ci] Cache passing test results so CI retries skip them: #92832
• fix accidental test duplication: #92922
• rename MagicAny: #92918
• turbopack: reduce EffectStateStorage memory by storing u128 content hashes: #92902
• turbo-trace-server: reduce allocation overhead when loading large trace files: #92896
• Turbopack: optimize SelfTimeTree performance, memory usage, and fix range query boundaries: #92931
• [ci]: fix backport sync script: #92942

Credits

Huge thanks to @styfle, @mmastrac, @ztanner, @lukesandberg, @sokra, @timneutkens, and @gnoff for helping!

What's Changed

• Backport/docs fixes 16.2 - July round by @icyJoseph in https://github.com/vercel/next.js/pull/96031
• [Backport] Fixes to support TypeScript 7 by @lukesandberg in https://github.com/vercel/next.js/pull/95831

Full Changelog: https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
• [backport] Propagate adapter preferred regions (#94200)
• [16.2.x] Don't drop FormData entries (#94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#92231)
• Fix fallback route params case in app-page handler (#91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
• Patch setHeader for direct route handlers (#93101)
• Include deployment id in cacheHandlers keys (#93453)
• Fix double-encoding of URL pathname parts in client param parsing (#93491)

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#92231)
• Fix fallback route params case in app-page handler (#91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
• Patch setHeader for direct route handlers (#93101)
• Include deployment id in cacheHandlers keys (#93453)
• Fix double-encoding of URL pathname parts in client param parsing (#93491)

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713)
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#92631)
• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)
• Compiler: Support boolean and number primtives in next.config defines (#92731)
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#92725)
• Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)
• Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92828)
• Adding more system info to the 'initialize project' trace (#92427)

Credits

Huge thanks to @Badbird5907, @lukesandberg, @andrewimm, @sokra, and @mischnic for helping!

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

• Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)
• Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)
• Deduplicate output assets and detect content conflicts on emit (#92292)
• Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
• turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• backport: Move expanded adapters docs to API reference (#92115) (#92129)
• Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)
• [create-next-app] Skip interactive prompts when CLI flags are provided (#91840)
• next.config.js: Accept an option for serverFastRefresh (#91968)
• Turbopack: enable server HMR for app route handlers (#91466)
• Turbopack: exclude metadata routes from server HMR (#92034)
• Fix CI for glibc linux builds
• Backport: disable bmi2 in qfilter #92177
• [backport] Fix CSS HMR on Safari (#92174)

Credits

Huge thanks to @nextjs-bot, @icyJoseph, @ijjk, @gaojude, @wbinnssmith, @lukesandberg, and @bgw for helping!

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• docs: post release amends (#91715)
• docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698)
• Fix adapter outputs for dynamic metadata routes (#91680)
• Turbopack: fix webpack loader runner layer (#91727)
• Fix server actions in standalone mode with cacheComponents (#91711)
• turbo-persistence: remove Unmergeable mmap advice (#91713)
• Fix layout segment optimization: move app-page imports to server-utility transition (#91701)
• Turbopack: lazy require metadata and handle TLA (#91705)
• [turbopack] Respect {eval:true} in worker_threads constructors (#91666)

Credits

Huge thanks to @icyJoseph, @abhishekmardiya, @ijjk, @mischnic, @unstubbable, @sokra, and @lukesandberg for helping!

Core Changes

• Support type cast expressions in page static info extractor: #92837
• Fix dev mode hydration failure when page is served from HTTP cache: #92892
• [devtools] Preserve full code frames in browser overlay: #92621
• Enable prefetchInlining by default: #92863
• Replace deprecated moduleResolution: "node": #92654

Misc Changes

• turbo-tasks: add info_span for blocking waits during task restore: #92878
• Turbopack: Use an async lock in the filesystem watcher: #92906
• [ci] Skip Playwright system deps install on subsequent self-hosted runs: #92893
• turbo-tasks: Reduce allocations on cache hits: #92756
• CI: Remove dead yarn support from next-stats-action: #92587

Credits

Huge thanks to @mischnic, @sokra, @unstubbable, @aurorascharff, @acdlite, @bgw, @mmastrac, @eps1lon, and @lukesandberg for helping!

Core Changes

• Allow overriding outputHashSalt in modifyConfig: #92856

Misc Changes

• Turbopack: Use lld again on ARM64 glibc Linux: #92860
• [ci]: add workflow to bump canary after backport: #92801
• turbopack: cache TransformPlugin in narrow-scoped turbo-tasks functions: #92842

Credits

Huge thanks to @bgw, @ztanner, @sokra, and @mischnic for helping!

Core Changes

• fix(trace-server): default MCP port to --port + 1 to avoid conflicts: #92831
• Revert "Node.js streams: Add forkpoint for prerenderToStream": #92845
• Warn for non-deterministic "use cache" args during final prerender: #92820

Misc Changes

• Share native binaries via GitHub artifacts: #92758
• Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index: #92828
• Turbopack: refactor export analysis: #92781
• [ci] Skip sccache on Windows runners: #92847
• Turbopack: remove StarImportAnalyzer: #92830
• Turbopack: analyzer improvement followups: #92834
• Update Rspack production test manifest: #92674
• Update Rspack development test manifest: #92673
• Turbopack: move assignment_scopes computation into ImportMap: #92835
• docs: restructure instant nav guide for clarity: #92684
• docs: add documentation for no-typos ESLint rule: #92809

Credits

Huge thanks to @mmastrac, @sokra, @mischnic, @timneutkens, @vercel-release-bot, @unstubbable, @icyJoseph, and @MukundaKatta for helping!

Core Changes

• webpack: fix swcPlugins with relative paths: #92770
• Node.js streams: Add forkpoint for logMessagesAndSendErrorsToBrowser: #92510
• Node.js streams: Add forkpoint for createCombinedPayloadStream: #92511
• Node.js streams: Add forkpoint for renderWithRestartOnCacheMissInValidation: #92512
• Node.js streams: Add forkpoint for prerenderToStream: #92513
• Perf: Fast path for trace() when opentelemetry is not enabled: #92678

Misc Changes

• turbopack: gate ValueDebugFormat and ValueDebug behind debug_assertions: #92628
• Add TurboMalloc::thread_park() to flush and collect on thread park: #92804
• Stop using deprecated baseUrl: #92653
• Turbopack: Use FrozenMap for module export information: #92802
• pr-status: Show all participants in review thread overview: #92730
• docs: draftMode alignment: #92794
• Turbopack: remove webpack chunk detection: #92773
• Turbopack: refactor ESM codegen generation: #92777
• Fix monorepo @next/swc binary postinstall: #92813
• Turbopack: shorter error for ChunkGroupInfo::get_index_of: #92814
• Turbopack: properly set NODE_ENV for SWC plugins: #92579

Credits

Huge thanks to @sokra, @eps1lon, @bgw, @icyJoseph, @mischnic, and @timneutkens for helping!

Core Changes

• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router): #92580
• Enable wasm plugins on windows arm: #92544
• prefetchInlining: fix build crash on notFound() pages: #92806

Credits

Huge thanks to @lukesandberg and @acdlite for helping!

Misc Changes

• Fix devlow-bench: tsconfig rootDir mismatch with package.json bin: #92800

Credits

Huge thanks to @mmastrac for helping!

Core Changes

• feat(trace-server): add query CLI and MCP API to turbopack-trace-server: #92030
• Bump TypeScript to 6.0: #91257
• Improve error stacks for dynamic API usage in "use cache": #92736
• refactor: remove ClientFileLogger, consolidate file logging into handleLog: #92329
• Node.js streams: Add forkpoint for continueDynamicHTMLResume: #92471
• Node.js streams: Add forkpoint for generateDynamicFlightRenderResult: #92474
• Node.js streams: Add forkpoint for generateStagedDynamicFlightRenderResult: #92509
• Add unstable_prefetch route segment config and decouple runtime prefetching from unstable_instant: #92754
• Stop using deprecated downlevelIteration: #92652

Misc Changes

• chore: Use from_raw_parts for ResolvedVc::deref_vec and ResolvedVc::deref_slice: #92749
• Pin upload-artifact to v7.0.1 and download-artifact to v8.0.1: #92757
• Fix swc wasm test on canary: #92738
• test: Add tests for client reference side effects: #92774
• docs: add migration note for experimental cache flags to cacheComponents: #92318
• feat(turbo-tasks-backend): gate prepare_tasks_with_callback trace span behind feature flag: #92779
• Update next versions of internal apps: #92666
• turbo-persistence: stop background persisting after unrecoverable failure: #92106
• Disable build caches for production/staging/force-preview deploys: #92792
• Fix turbo cache flag: use --force: #92796

Credits

Huge thanks to @bgw, @mmastrac, @sokra, @timneutkens, @eps1lon, @unstubbable, @mischnic, @bgub, @aurorascharff, @gnoff, and @lukesandberg for helping!

Core Changes

• Ensure x-nextjs-data header is only set during resolve: #92752

Credits

Huge thanks to @ijjk for helping!

Core Changes

• Exclude trace files from directory deletion in builds: #92486
• Switch segment prefetch cache miss response from 204 to 404: #92751

Misc Changes

• Re-enable sccache: #92746

Credits

Huge thanks to @lukesandberg, @mmastrac, and @acdlite for helping!

Core Changes

• Fix prefetch hints not being loaded during revalidation: #92625

Credits

Huge thanks to @acdlite for helping!

Core Changes

• Update font data: #92704
• test: use Turborepo pack task for test isolation: #92575
• Compiler: Support boolean and number primtives in next.config defines: #92731
• Upgrade React from 404b38c7-20260408 to fef12a01-20260413: #92728
• Revert "refactor: write pages router export files directly to server/pages/": #92733

Misc Changes

• [test] Stop using baseUrl: #92469
• Turbopack: properly remove unused TS enums with scope hoisting: #88205
• bench: improve render pipeline benchmark reliability: #92715
• bench: add A/B branch comparison workflow to BENCHMARKING.md: #92721
• docs: fix broken bun.sh Nextjs documentation link: #92698
• fix(server-actions): skip type-only ExportNamed in pre-pass to prevent phantom registerServerReference: #92494
• Turbopack: Add import.meta.glob support (Vite compat): #92640
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation: #92725
• chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64): #92713
• TURBOPACK: support crsossOriginLoading: #92070

Credits

Huge thanks to @vercel-release-bot, @eps1lon, @mischnic, @timneutkens, @hamedniroomand, @sleitor, @sokra, @Badbird5907, @fireairforce, and @andrewimm for helping!

Core Changes

• Node.js streams: Add forkpoint for error recovery: #92457

Misc Changes

• Delete some dead turbo task functions: #92596
• docs(cli): clarify that --debug-build-paths requires route group folders in paths: #92618
• turbo-tasks: Drop output_dependent on immutable task completion: #92683

Credits

Huge thanks to @lukesandberg, @timneutkens, and @icyJoseph for helping!

Core Changes

• feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution: #91338
• Fix segment explorer file pill accessibility: #92608
• Perf: Only instrument clientComponentLoadTimes when used: #91385

Misc Changes

• Remove a ton of turbo task functions from Issue trait items: #92623
• feat(turbopack): change DiskFileSystem root to Vc<RcStr> for portable cache: #92603
• Turbopack: remove unused ChunkableModules struct: #92606
• Disable sccache temporarily: #92657

Credits

Huge thanks to @lukesandberg, @sokra, @mischnic, @timneutkens, and @mmastrac for helping!

Core Changes

• Node.js streams: Add forkpoint for CacheComponents: #92444
• Resolve compilerOptions.paths in tsconfigs without compilerOptions.baseUrl: #92277
• Add codemod command to middleware deprecation warning: #92532
• [partial fallbacks]: enable by default: #92627
• refactor: write pages router export files directly to server/pages/: #90018

Misc Changes

• Fix NextFontIssue IssueStage: CodeGen → Resolve: #92588
• test: reduce writeToDisk memory test iterations to fix CI timeout: #92586
• Refactor effects system: dedup/conflict detection, simplified Effect trait: #92300
• fix(ci): improve Docker image cache streaming throughput and arch-awareness: #92617
• Turbopack: extract inline base64 decode helper to shared @turbopack/base64 module: #92549
• docs: add Link transitionTypes version history: #92624
• CI: Download and run self-contained datadog-ci instead of using pnpm dlx or npx: #92546
• turbopack: move CSS module composes validation from code generation to resolving: #92582
• Drop turbo_tasks::function from ValueDebug trait items: #92593
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false): #92631
• Bump swc to 63.1.1: #92604
• chore(turbopack): upgrade qfiler to v0.3.0-alpha.4: #92558
• Turbopack: cut number of client references in half: #92607
• fix(ci): improve Docker image caching and native build skip optimization: #92633

Credits

Huge thanks to @sokra, @timneutkens, @hamidrezahanafi, @mmastrac, @lukesandberg, @aurorascharff, @bgw, @ztanner, @mischnic, @fireairforce, and @bgub for helping!

Core Changes

• Don't swallow strings thrown in Server Components: #92592

Credits

Huge thanks to @eps1lon for helping!

Core Changes

• Add next internal upload-trace: #92191
• Perf: Add fast path to isAbsoluteUrl: #91389
• Perf: Don't require watchpack in production: #91387
• Request logging: Fix generate-params time being included in next.js time: #91386
• Perf: Use charCodeAt in removeTrailingSlash: #91384
• Perf: Cache regex in shouldServeStreamingMetadata: #91388
• fix: scope "Pages Router only" comment to default export in next/error: #92566
• Turbopack Build: Remove dev fouc from production bundle: #80935
• fix(hmr): reconnect WebSocket after sleep/wake: #91416
• Handle target option in React Compiler for Pages + React 18: #91500
• [turbopack] Rust dependency caching via sccache: #91873
• trace: detect rage restarts and deleted .next dirs: #92489

Misc Changes

• turbo-tasks-backend: prevent duplicate task restores with restoring bits: #92389
• docs: update details about unstable_retry() behavior: #91827
• docs: link updateTag from cacheTag reference: #92379
• [test] Stop using deprecated target: "es5" TypeScript compiler option: #92458
• Docs: Instant docs updates: #92515
• Turbopack: Improve unable to resolve next error: #91394
• [test] Ensure incomplete minimum release age isn't propagated to fixture installs: #92568
• test: skip .next and other build artifacts in writeFiles filter: #92578
• Replace wasmer with wasmtime for SWC plugin WASM engine: #91533
• docs: native db drivers with sync queries: #92572
• turbopack: fix incremental build when module factories are restored from persistent cache: #92569
• CI: Another attempt to fix pnpm versions for next-stats-action on canary: #92550
• [turbopack] fix a debug_assert failure: #92581

Credits

Huge thanks to @sokra, @timneutkens, @devjiwonchoi, @aurorascharff, @eps1lon, @lukesandberg, @icyJoseph, @bgw, @mmastrac, and @wbinnssmith for helping!