Next.js

Core Changes

• Turbopack: switch from immutable token to path prefix: #92164
• [build info]: distinguish between PPR and fully static routes in gSP: #92518
• [build info]: omit symbol from top level gSP route: #92525

Misc Changes

• CI: Fix issue with conflicting 'engines.pnpm' field in next-stats-action: #92533
• Exclude use tests from react18 testing: #92542
• Fix React18 tests for unstable_io: #92543

Credits

Huge thanks to @bgw, @mischnic, @gnoff, and @ztanner for helping!

Core Changes

• fix: mention params and searchParams in blocking-route error messages: #92360
• CPU prof: Write profiles to .next-profiles instead of .next/cpu-profiles: #92078
• feat: generate root params types: #91019
• fix: resolve function configs in unstable_getResponseFromNextConfig: #92501
• Bundle skills/ directory into next/dist/skills: #92493
• Node.js streams: Fork points: #92252
• fix: replace docs/canary links with stable docs paths in error messages: #92528

Misc Changes

• CI: Remove unused dependencies from next-stats-action dockerfile: #92485
• docs: add note on React canary version to View transitions guide: #92315
• docs: note PPR default in cacheComponents reference: #92378
• Upgrade swc_core 57 -> 58, swc_sourcemap 9 -> 10, swc_plugin_runner 24 -> 25: #91532
• docs: instant-navs draft, samples for build validation: #91850
• docs: add middleware.mdx deprecation stub for discoverability: #92281
• docs: improve blocking-route error page for params discoverability: #92359
• docs: clarify cacheLife() cannot be called at module scope: #92326
• perf: use whole_app_module_graph for get_compilation_issues MCP tool: #92473
• Turbopack: Write trace file to .next-profiles: #92189
• Update Rspack development test manifest: #92502
• Update Rspack production test manifest: #92503
• CI: Use pnpm lockfile for next-stats-action: #92488
• docs: add note on installing server-only in data security guide: #92445
• CI: Use minimumReleaseAge in pnpm workspace files: #92480

Credits

Huge thanks to @bgw, @aurorascharff, @lukesandberg, @icyJoseph, @timneutkens, @sokra, @vercel-release-bot, @abhishekmardiya, @bgub, @TooTallNate, and @gaojude for helping!

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

• Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)
• Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)
• Deduplicate output assets and detect content conflicts on emit (#92292)
• Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
• turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Credits

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

Core Changes

• next-routing: middleware matching and app request URL normalization: #91859
• docs: clarify serverless runtime behavior for use cache: #92232

Misc Changes

• Adding more system info to the 'initialize project' trace: #92427
• CI: Update and cleanup next-stats-action, force using pnpm 10.33.0: #92475
• turbo-persistence: Use AtomicBool for is_empty() to avoid lock contention: #92481

Credits

Huge thanks to @ijjk, @andrewimm, @bgw, @wwenrr, and @lukesandberg for helping!

Core Changes

• Include more context in macOS Rosetta 2 warning message: #92436
• change the process name of builds: #92411
• Fix styled-jsx race condition: styles lost due to concurrent rendering: #92459
• turbo-tasks: fix hashed cell mode crash on task error (re-land #91576): #92108
• Optimize how we track data for persistence: #89370
• Route Handlers: Fix devRequestTimingInternalsEnd and Turbopack server HMR: #92271

Misc Changes

• turbo-persistence: skip BlockCache for uncompressed (mmap-backed) blocks: #92390
• docs: clarify that proxy/middleware matches static assets by default: #92441
• turbo-persistence: pin referenced BlockCache entries to prevent eviction: #92361
• [test] Skip flaky client-cache.parallel-routes in production and deploy: #92195
• Fix sst inspect tool to respect CURRENT and stale sst files: #92414
• [turbopack] add family name to many spans: #92415
• scripts/pr-status: add reply-and-resolve-thread command: #92450
• [test] Regenerate checked-in tsconfig.json files: #92455

Credits

Huge thanks to @sokra, @bgw, @lukesandberg, @icyJoseph, @eps1lon, and @wbinnssmith for helping!

Core Changes

• chore: Upgrade to pnpm 10.x: #92283
• fix(server-hmr): metadata routes overwrite page runtime HMR handler: #92273
• Turbopack: Add a check for node version before allowing workerThreads: #91614

Misc Changes

• turbo-persistence: optimize file syncing: #90542
• Bump turborepo from 2.8.11 to 2.9.4: #92425
• Turbopack: Remove turbo_tasks::apply_effects, use Effects::apply instead: #91858

Credits

Huge thanks to @bgw, @wbinnssmith, and @lukesandberg for helping!

Core Changes

• Allow for parsing app route strings with and without slot names.: #92327

Misc Changes

• use sorted inserts to improve builder performance: #91553
• [tests]: remove unnecessary skipDeployment flags: #92423

Credits

Huge thanks to @lukesandberg, @ztanner, and @gnoff for helping!

Core Changes

• Handle edge runtime in places that import node:stream: #92354
• fix: add AGENTS.md at package root for agent discovery: #92376
• Fix fallback route params case in app-page handler: #91737

Credits

Huge thanks to @timneutkens, @aurorascharff, and @ijjk for helping!

Misc Changes

• next-core: deduplicate output assets and detect content conflicts on emit: #92292
• docs: add deploy tests documentation to contributing guide: #92388

Credits

Huge thanks to @sokra and @ztanner for helping!

Core Changes

• Improve existing dev server error message to suggest using it: #92317
• Restart the next dev server if .next is deleted: #92135
• feat: add experimental.swcEnvOptions for SWC preset-env configuration: #92272

Misc Changes

• Update Rust toolchain to nightly-2026-04-02: #92288
• docs: Ask AI agents to self-identify themselves in PR descriptions: #92235
• Turbopack: Remove FileSystemPath::value_to_string in favor of ValueToStringRef::to_string_ref: #92284
• [turbopack] use zero copy qfilter deserialization: #90574
• Turbopack: Dedupe our two filesystempath extension/extension_ref functions: #92048
• turbo-tasks: replace async resolve fns with custom Future types (ResolveRawVcFuture, ResolveVcFuture, ToResolvedVcFuture): #91554

Credits

Huge thanks to @feedthejim, @bgw, @wbinnssmith, @lukesandberg, @banchichen, and @sokra for helping!

Core Changes

• Add MCP get_compilation_issues tool and NAPI method: #92062
• Ensure app-page reports stale ISR revalidation errors via onRequestError: #92282
• Move streamToUint8Array back to node-web-streams-helper.ts: #92263
• fix: add @deprecated annotation to experimental.useCache: #92316

Misc Changes

• turbo-tasks-backend: stability fixes for task cancellation and error handling: #92254
• Add view transitions eval (agent-043): #92260
• [turbopack] optimize RcStr parsing: #91773
• ci: fix stats action: #92325
• Revert "simplify session dependent tasks and add TTL support (#91729)": #92320
• ci: remove deploy examples workflow from build-and-deploy: #92324

Credits

Huge thanks to @sokra, @aurorascharff, @lukesandberg, @ztanner, and @timneutkens for helping!

Core Changes

• Add telemetry for adapterPath config usage: #92228
• Node.js streams: First pass: #90500
• fix: preserve HTTP access fallbacks during prerender recovery: #92231
• Remove unnecessary ALS re-exports from entry-base.ts: #91527
• Allow multi-level .localhost subdomains in dev origin check: #92262

Misc Changes

• remove the loop from StaticSortedFile::lookup: #91688
• Fix pr-status.js: retry on API errors and report timed-out jobs: #92205
• docs: vt demo guide: #92249

Credits

Huge thanks to @lukesandberg, @ijjk, @timneutkens, @sokra, @ztanner, @icyJoseph, @unstubbable, and @ctate for helping!

Core Changes

• Improve revalidateTag JSDoc to include guidance about required second parameter: #92176
• partial fallbacks: adapter support for intermediate shells: #91902
• docs: clarify id, filePath, and pathname in STATIC_FILE adapter output: #92227
• feat: add NEXT_HASH_SALT env var for content-hash filename salting: #91871
• Generate a CLI warning if using Rosetta 2 on Apple Silicon: #92220

Misc Changes

• simplify session dependent tasks and add TTL support: #91729
• disable bmi2 in qfilter: #92177
• fix: pin 19 actions to commit SHA, extract 7 expressions to env vars: #92016
• [test] Skip flaky cached-navigations tests: #92199
• [test] Skip flaky prefetch-layout-sharing suite: #92198
• Add internal header security guideline to AGENTS.md: #92128
• docs: local images referenced by remote source: #92178
• Update Rspack production test manifest: #92143
• [test] Deflake allowed-dev-origins: #92211
• Reapply "ci: add node-stream test coverage workflow (#89861)": #91664
• Turbopack: trace fs.readdir calls: #92148
• Fix DashMap read-write self-deadlock in task_cache causing hangs: #92210
• [turbopack] use a single query parameter for cache busting: #92214
• Docs/adapters review: #92223

Credits

Huge thanks to @lukesandberg, @aurorascharff, @dagecko, @eps1lon, @gaojude, @icyJoseph, @ztanner, @vercel-release-bot, @ijjk, @feedthejim, @mischnic, @sokra, and @bgw for helping!

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• backport: Move expanded adapters docs to API reference (#92115) (#92129)
• Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)
• [create-next-app] Skip interactive prompts when CLI flags are provided (#91840)
• next.config.js: Accept an option for serverFastRefresh (#91968)
• Turbopack: enable server HMR for app route handlers (#91466)
• Turbopack: exclude metadata routes from server HMR (#92034)
• Fix CI for glibc linux builds
• Backport: disable bmi2 in qfilter #92177
• [backport] Fix CSS HMR on Safari (#92174)

Credits

Huge thanks to @nextjs-bot, @icyJoseph, @ijjk, @gaojude, @wbinnssmith, @lukesandberg, and @bgw for helping!

Core Changes

• Add rust-fingerprint task and SCCACHE passthrough env: #92167
• Improve error message for deprecated experimental.dynamicIO config: #92081
• [turbopack] Fix CSS HMR on Safari: #92123

Misc Changes

• Update Rspack development test manifest: #92142

Credits

Huge thanks to @mmastrac, @aurorascharff, @lukesandberg, and @vercel-release-bot for helping!

Core Changes

• fix: handle file:// URLs from import.meta.resolve in cache handler path (fixes #73796): #90370
• Turbopack: exclude metadata routes from server HMR: #92034
• next.config.js: Accept an option for serverFastRefresh: #91968
• Enable varyParams tracking for Cached Navigations: #92113
• telemetry: set turboFlag correctly: #92149
• Instant Validation: Allow unconfigured slots to render optionally: #92126

Misc Changes

• TURBOPACK: support parse windows absolute path with single slash: #92076
• Turbopack: statically evaluate path.sep: #92150
• docs: add middleware bypass note to CDN caching guide: #92132
• Turbopack: use same hash for immutable-static-hashes.json: #92157
• [turbopack] replace regex with indexof: #92023
• [test] Skip unstable_dynamicStaleTime tests due to flakiness: #92162
• [test] Skip flaky segment-cache-refresh suite: #92163
• Turbopack: createRequire(new URL("...", import.meta.url)): #92153
• Add PPR evals and fix env loading for agent-eval 0.9.5: #92063
• docs: document revalidateTag's required second argument in upgrade guide: #92134
• Turbopack: support targeting even older browsers: #91563

Credits

Huge thanks to @VedantMadane, @wbinnssmith, @fireairforce, @unstubbable, @mischnic, @gnoff, @ijjk, @lukesandberg, @eps1lon, @gaojude, and @aurorascharff for helping!

Core Changes

• [ftl] Include cause of route types: #92056
• Upgrade React from 9627b5a1-20260327 to 74568e86-20260328: #92109

Misc Changes

• docs: clarify that use cache requires async functions: #92101
• Revert "turbo-tasks: add hashed cell mode for hash-based change detection without cell data": #92103
• Move expanded adapters docs to API reference: #92115
• ci: relax adapter results upload gate: #92127

Credits

Huge thanks to @aurorascharff, @unstubbable, @eps1lon, and @ijjk for helping!

Misc Changes

• docs: opengraph-image papercuts: #92018
• Update revalidateTag examples to use the new two-argument signature: #92065

Credits

Huge thanks to @icyJoseph and @aurorascharff for helping!

Core Changes

• Upgrade React from 3cb2c420-20260324 to 9627b5a1-20260327: #92015
• [experiment] Add useOffline flag with offline retry behavior: #92011
• adapters: remove unused suffix code: #91997
• [experiment] Add useOffline hook to expose offline state to userland: #92012
• [turbopack] Don't use turborepo to build the docker image: #92029

Misc Changes

• Use RcStr directly in napi(object) structs instead of converting to String: #92014
• Rename SingleModuleReference::asset to SingleModuleReference::module: #92028

Credits

Huge thanks to @acdlite, @ztanner, @mmastrac, @sokra, and @bgw for helping!