Next.js

Please see this changelog for more information about this security patch.

Core Changes

• Improve agents-md prompt to force doc retrieval: #88997
• [Reapply] Add useEffectEvent to disallowed React APIs in Server Components: #88985

Misc Changes

• [Turbopack] Use a presized scratch buffer for task encoding: #88924

Credits

Huge thanks to @gaojude, @lukesandberg, and @dango0812 for helping!

Core Changes

• feat(next-codemod): add agents-md command for AI coding agents: #88961
• Update font data: #88975

Misc Changes

• docs: Update Partytown URLs and package reference: #88928

Credits

Huge thanks to @gaojude, @vercel-release-bot, and @hanzala-sohrab for helping!

Core Changes

• [turbopack] add task type infromation to the print_cache_item_size feature: #88925
• Upgrade React from b546603b-20260121 to 24d8716e-20260123: #88963
• Turbopack: add ?dpl= to all asset urls returned by Turbopack: #88828

Misc Changes

• docs: Server functions rename: #86827
• Update Rspack production test manifest: #88930
• Update Rspack development test manifest: #88931
• Improve performance and token usage of /ci-failures command: #88960

Credits

Huge thanks to @icyJoseph, @lukesandberg, @vercel-release-bot, and @sokra for helping!

Core Changes

• [devtool] Add hydration diff indicator for diff lines: #88919
• Revert "[prebuilt-skew-protection] feat: adding in automatic deploymentId": #88942

Misc Changes

• remove gt workflow from agents.md: #88918
• Turbopack: refactor data storage to avoid reverse task cache: #88492
• Turbopack: change invalidator and immutable to data category: #88889
• Turbopack: reduce cache size: #88929
• fix typo: #88934
• Turbopack: improve module type error message: #88815
• Turbopack: improve selective read support to allow Equivalent keys: #88760
• Turbopack: add indirection layer for better caching during resolving: #80062
• Docs: Add Next.js Glossary: #88811
• Add Graphite workflow Cursor command: #88939

Credits

Huge thanks to @huozhi, @sokra, @eps1lon, @delbaoliveira, and @timneutkens for helping!

Core Changes

• [prebuilt-skew-protection] feat: adding in automatic deploymentId: #88496

Misc Changes

• [test] Skip failing deploy test in searchparams-reuse-loading.test.ts: #88821
• [test] Skip flaky prefetch-runtime tests for deploy tests: #88826

Credits

Huge thanks to @eps1lon and @brookemosby for helping!

Core Changes

• Remove deploymentId from App Router RenderOptsPartial: #88866
• feat: implement LRU cache with invocation ID scoping for minimal mode response cache: #88509

Misc Changes

• Update Rspack production test manifest: #88882

Credits

Huge thanks to @mischnic, @vercel-release-bot, and @wyattjoh for helping!

Core Changes

• stabilize browser log forward options: #88857
• [devtools] Wrap long file names of stack frames in the error overlay: #88886
• [devtools] Fix notch coloring of error overlay in forced colors mode: #88892

Misc Changes

• Turbopack: Make the priority_runner testcase deterministic: #88651
• Turbopack: Various cleanup for turbo-tasks-fs, mostly retry logic and string formatting: #88668
• Turbopack: Tweak retry loop for link creation to try to fix os error 80 on Windows: #88669
• feat: Replace InnerStorage with the generated TaskStorage struct: #88355
• Turbopack: Use webpki-root-certs in addition to rustls-platform-verifier on Linux for bare-bones Linux images without root CA stores: #88869
• refactor: migrate to typed accessors and remove CachedDataItem adapter: #88397
• docs: add skill for updating Next.js documentation: #88656
• Turbopack: [chore] Fix Rust check warnings: #88871
• Turbopack: query conditions in rules follow-ups: #88801
• Create-next-app update message: #88706
• Turbopack: Fix next/font preloading for page.mdx: #88848

Credits

Huge thanks to @mmastrac, @bgw, @lukesandberg, @wyattjoh, @huozhi, @eps1lon, @jwueller, @sokra, and @timneutkens for helping!

Core Changes

• fix: preserve cache behavior for PPR fallback shells with root params: #88556
• Upgrade React from d2908752-20260119 to b546603b-20260121: #88860

Misc Changes

• Turbopack: Use a real file entrypoint for Workers (and SharedWorkers): #88602
• Turbopack: Add file write invalidation tracking to filesystem watcher fuzzing: #88665
• Turbopack: Move fuzzer for fs watcher into a separate file/module: #88666
• Turbopack: Add a stress test / fuzzer that tries creating many symlinks in a tight loop: #88667

Credits

Huge thanks to @ztanner, @mmastrac, and @bgw for helping!

Core Changes

• Reuse bfcache data during Full prefetches: #88606
• Embed static sibling info in route tree: #88692
• Fix revalidatePath with params and trailing slash when deployed: #88623

Misc Changes

• Update deterministic-build assertion: #88820
• Turbopack: shrink amortized: #88619
• Fix deployment test due to data-dpl-id attribute: #88846
• [ci] Fix Rspack/Turbopack test manifest generation: #88845
• Turbopack: show compressed size for print_cache_item_size: #88850
• [test] Fix deploy test of cache-components.server-action.test.ts: #88854

Credits

Huge thanks to @acdlite, @unstubbable, @mischnic, and @sokra for helping!

Core Changes

• Rename rewroteURL to rewrittenPathname in request metadata: #88751
• Simplify getImplicitTags to accept pathname instead of url object: #88753
• Add NEXT_DEPLOYMENT_ID global: #86738
• Turbopack: remove deployment id suffix from client reference manifest chunks: #88741
• Inject <html data-dpl-id> and don't inline it into JS anymore: #88761
• [metadata] match the Metadata and ResolvedMetadata type: #88739

Example Changes

• Update with-mysql example to Next.js 15, Tailwind 4, Prisma 7: #88475

Misc Changes

• [ci] Ensure Turbo Remote Cache can be written to: #88794
• perf(turbopack): optimize resolve plugin handling: #88639
• Fix buildManifest.js deployment tests: #88806
• [ci] Merge Cache Components and deploy tests manifests when running CC deploy tests: #88824
• Turbopack: Extend filesystem watcher fuzzing to cover symlinks and junction points: #88192
• [test]: add ability to run test-deploy with pre-existing deployment: #88829

Credits

Huge thanks to @eps1lon, @SimeonGriggs, @unstubbable, @xusd320, @mischnic, @sokra, @huozhi, @bgw, and @ztanner for helping!

Core Changes

• Upgrade React from 41b3e9a6-20260119 to d2908752-20260119: #88774
• Add experimental_gesturePush to App Router: #88776

Credits

Huge thanks to @acdlite for helping!

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Only filter next config if experimental flag is enabled (#88733)

Credits

Huge thanks to @mischnic for helping!

Core Changes

• Add negation pattern support to --debug-build-paths: #88654
• Only filter next config if experimental flag is enabled: #88733
• [Devtool Indicator] Fix cross alignment: #88664
• Turbopack: don't use build id for pages router client-side manifests: #88641
• Allow inspecting server with next start --inspect: #88744
• Turbopack: Add --debug-build-paths support to filter routes: #88655
• Upgrade React from bef88f7c-20260116 to 41b3e9a6-20260119: #88756
• Use rewritten pathname for implicit cache tags: #88732

Misc Changes

• [ci] Enable Turborepo remote caching in e2e release deploy tests: #88746
• [test] Deflake test/development/app-dir/browser-log-forwarding/fixtures/verbose-level/verbose-level.test.ts: #88754
• Fix Build Commands section in AGENTS.md: #88757
• [test] Deflake test/development/app-dir/hydration-error-count/hydration-error-count.test.ts: #88749
• [ci] Exclude test/production from deploy tests: #88763
• Apply buildArgs also for deploy tests (via package.json): #88731

Credits

Huge thanks to @unstubbable, @mischnic, @williambout, and @eps1lon for helping!

Misc Changes

• Revert "[turbopack] Add bundling support for worker_threads": #88725

Credits

Huge thanks to @sokra for helping!

Core Changes

• fix: setImmediate[util.promisify.custom] access fails in edge runtime: #88685
• Fix --debug-build-paths bracket escaping for glob patterns: #88660

Misc Changes

• [turbopack] Add bundling support for worker_threads: #87746
• [cna] Ensure created app is not considered the workspace root in pnpm: #88647

Credits

Huge thanks to @lukesandberg, @eps1lon, @lubieowoce, and @unstubbable for helping!

Core Changes

• Upgrade React from 4a3d993e-20260114 to bef88f7c-20260116: #88649
• fix: make RedirectType constant properties literal types: #88653
• Turbopack: add support for matching loaders on resource queries: #88644
• fix: capture promisified setImmediate separately: #88346

Misc Changes

• Turbopack: use bugs.nextjs.org for Turbopack panic error reports: #88356
• Turbopack: docs: condition.query will ship in 16.2.0, not 16.1.1: #88663

Credits

Huge thanks to @naaa760, @sokra, @wbinnssmith, @jgeschwendt, and @bgw for helping!

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix linked list bug in LRU deleteFromLru (#88652)
• Fix relative same host redirects in node middleware (#88253)

Credits

Huge thanks to @acdlite and @ijjk for helping!

Core Changes

• Fix incorrect 'Ready in' time for next start: #88589
• feat: server action logging: #88277
• Log browser error and warnings in terminal: #88352

Misc Changes

• Turbopack: avoid removing cells for erroring tasks: #88305
• [ci] Use native concurrency feature in build-and-test: #87287
• doc: add details of mcp client integration: #88543
• Turbopack: unflake unit test: #88620
• Turbopack: snapshot the ModuleGraph to avoid (eventual) inconsistent graphs: #88340
• Turbopack: Consistency for compute_async_module_info: #88409
• Turbopack: follow tracing spans through aggregation update queue: #88410
• Turbopack: avoid chunk_item_id task and use selective cell access instead: #88411
• Turbopack: MappedReadRef should be Send and Sync: #88558
• Turbopack: selective read for module_chunk_groups in ChunkGroupInfo: #88559
• Turbopack: use selective reads for merged modules: #88560
• Turbopack: add caching to chunking: #88561

Credits

Huge thanks to @sokra, @eps1lon, @timneutkens, and @huozhi for helping!

Core Changes

• fetch(next/image): reduce maximumResponseBody from 300MB to 50MB: #88588
• [CC] Fix dev validation error from server action bound args: #88600

Misc Changes

• feat: add TaskStorage derive macro and schema infrastructure: #88338
• docs: fix Pages Router fonts documentation showing App Router examples: #88326
• [ci] Don't retry/notify for failed deploy tests with custom tarball URLs: #88576
• fix(turbopack): Collect declare global {} in VarDeclWithTsDeclareCollector: #88568
• Update labeler.json: #88591
• Fix optional parent_task_id compile failure w/tokio_tracing enabled: #88598
• Turbopack: support disabling tsconfig lookup: #88529
• Turbopack: run tasks with priority based on distance to leaf: #87662

Credits

Huge thanks to @lukesandberg, @timneutkens, @unstubbable, @kdy1, @mischnic, @mmastrac, @sokra, @styfle, and @lubieowoce for helping!