Next.js

Turbo-persistence now prefetches multi-page SST blocks using MADV_WILLNEED.

Backports Turbopack Pages Router dev module graph chaining, snapshot consistency fixes, and two GC paths that left half-torn-down dependency edges. Also fixes lazy dynamic-import chunk-list collisions, realpath errors during module resolution, and next-code-frame windows snapping to character boundaries.

Fixes two critical unauthenticated remote code execution flaws — in use cache functions returning typed arrays and in the Image Optimization API when SVG files are used — plus a high-severity denial of service in App Router using Server Actions.

Fixes a critical unauthenticated remote code execution vulnerability in the Image Optimization API when SVG files are used, plus a high-severity denial of service in App Router using Server Actions.

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity…

Stabilization of forbidden() and unauthorized() is reverted, and configured output directories are now preserved during static export. Also documents next analyze export in the package bundling guide and renames the skill to next-bundle-optimizer.

Static route error guidance is improved, and agent upgrade prompts now show choices while keeping dev and build running. Also includes Turbopack invalidator fixes, turbo-tasks-backend changes around GC-collected tasks, and new Bundle Analyzer Agent Skill features.

The forbidden() and unauthorized() APIs are now stable, and eslint-config-next adds support for ESLint 10. Also reverts the ESM exports protocol-burden optimization, plus Turbopack path caching and 'use cache' build-time param dependency work.

The bundle analyzer now uses unified colors for deltas.

Client params no longer suspend on shallow URL updates, preventing an unnecessary Suspense fallback from being triggered. Also adds a React Compiler memoization preservation option and allocation and memory data to the trace-server MCP protocol.

This canary shifts the Turbopack module cache into a Map, switches the disk file system map to a FrozenMap, and adds a bundle analyzer route summary. Also upgrades React to 278794d7-20261002, warns when Partial Prefetching is unconfigured, and updates the MCP guide for next-devtools-mcp 0.4.

Misc Changes

Turbopack export name mangling is now enabled by default for builds, and a new unstable parameter matching API is available. Other changes include preferring the declared package manager during upgrades, allowing React and ESLint upgrades to be skipped, and passing App Page HMR state through a dev render context.

Turbopack now enables experimental.turbopackSharedRuntime by default. Also fixed repeated tag revalidation propagation from after() and stabilized ensureStatic.

Draft mode no longer leaks through cross-request "use cache" deduplication, and an MCP middleware DNS rebinding issue is fixed. Also scopes response cache keys to their source route, matches Next data paths case-sensitively, pins DNS resolution when fetching external images, and keeps ISR cache lifetimes across instances and restarts.

Patches a high-severity server-side request forgery in Image Optimization and five medium-severity issues including cache poisoning of SSG and ISR pages, cross-user content substitution, Draft Mode content leaking into persisted pages via a pending use cache fill, and a cache leak across root param values in nested use cache functions. Also fixes a low-severity information disclosure in the development server's Model Context Protocol endpoint.

create-next-app now enables Cache Components by default, a default-behavior change for new projects scaffolded with the canary. Also fixes HTTP status codes being dropped during prerendering and a bundle analyzer route selector bug.

A backport release fixing a turbo-tasks-backend issue where a strongly consistent read would hang on a canceled task. The release contains only this fix and does not include pending canary features or changes.

The unstable_ prefix is removed from navigation() and prefetch(), a breaking rename for anyone using those APIs. Also fixes custom cache handlers missing on initial requests, allows Draft Mode on unlisted closed routes in adapter deployments, and lands several Turbopack correctness fixes for tree-shaking and split_module.

DevTools now surfaces security upgrade insights, using focused npm advisories and nudging only for ready upgrades.