{"id":"prod_JoRuQm6EnVccYeDh_NTEz","name":"Next.js","slug":"nextjs","orgId":"org_qsyZSlC_PRGFDYIGsMfzp","url":"https://nextjs.org","description":"React framework for production","category":"framework","kind":"sdk","avatarUrl":null,"createdAt":"2026-04-02T14:33:43.832Z","embeddedAt":"2026-04-15T16:19:39.821Z","deletedAt":null,"sources":[{"id":"src_U4D8mfwIxWDEaM4qDm3Lq","slug":"next-js","name":"Next.js","type":"github","url":"https://github.com/vercel/next.js","metadata":"{\"changelogDetectedAt\":\"2026-03-31T14:04:16.909Z\",\"wellKnownSweptAt\":\"2026-07-08T06:00:52.047Z\",\"sourceActor\":{\"nextAlarmAt\":\"2026-07-12T04:27:11.937Z\",\"lastAlarmAt\":\"2026-07-12T00:27:14.200Z\",\"managed\":true}}","kind":"sdk"}],"tags":["react","ssr"],"aliases":[],"notice":null,"releases":[{"id":"rel_sGsdpGPJWLK-m_fdvmw0V","version":"v15.5.20","type":"feature","title":"v15.5.20","summary":"Contains no changes except publishing `@next/swc-wasm-web` which was accidentally not published since 15.5.15.","titleGenerated":"Next.js v15.5.20 restores @next/swc-wasm-web publishing","titleShort":null,"breaking":"none","importance":null,"content":"Contains no changes except publishing `@next/swc-wasm-web` which was accidentally not published since 15.5.15.","publishedAt":"2026-07-01T21:07:51.000Z","url":"https://github.com/vercel/next.js/releases/tag/v15.5.20","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":110,"contentTokens":27,"composition":null},{"id":"rel_Pf3RYys0GJ4f9afCiTbSx","version":"v16.2.10","type":"feature","title":"v16.2.10","summary":"Contains no changes except publishing `@next/swc-wasm-web` which was accidentally not published since 16.2.4.","titleGenerated":"Next.js v16.2.10 restores @next/swc-wasm-web publishing","titleShort":null,"breaking":"none","importance":null,"content":"Contains no changes except publishing `@next/swc-wasm-web` which was accidentally not published since 16.2.4.","publishedAt":"2026-07-01T20:13:48.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.10","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":109,"contentTokens":27,"composition":null},{"id":"rel_Vpvlcs4dy3EwjlB--mN8W","version":"v16.2.9","type":"feature","title":"v16.2.9","summary":"Empty release to ensure `next@latest` points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM ...","titleGenerated":"Next.js v16.2.9 dependency update","titleShort":null,"breaking":"unknown","importance":null,"content":"Empty release to ensure `next@latest` points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.","publishedAt":"2026-06-10T12:30:06.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.9","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":254,"contentTokens":52,"composition":null},{"id":"rel_oxarhePQ3Hg2NhGOAVbaT","version":"v16.2.8","type":"feature","title":"v16.2.8","summary":"A release to correct the npm latest tag, which was incorrectly pointing to a prerelease version.","titleGenerated":"Next.js v16.2.8 fixes latest tag pointing to prerelease","titleShort":"Latest tag corrected to stable version","breaking":"unknown","importance":null,"content":"Release with no changes in an attempt to fix `next@latest` pointing at a prerelease version.","publishedAt":"2026-06-10T12:28:17.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.8","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":92,"contentTokens":21,"composition":{"bugs":1,"features":0,"enhancements":0}},{"id":"rel_wYzGs3YAhrIdYpTvW6Sk5","version":"v15.5.19","type":"feature","title":"15.5.19","summary":"Fixed a bug where FormData entries were being dropped.","titleGenerated":"Next.js v15.5.19 fixes FormData entry loss","titleShort":"FormData entries no longer dropped","breaking":"unknown","importance":null,"content":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n\r\n- [15.5.x] Don't drop `FormData` entries (#94244)\r\n\r\n### Other\r\n\r\n- [15.5.x] Fix CI (#94281)\r\n\r\n### Credits\r\n\r\nHuge thanks to @eps1lon for helping!\r\n","publishedAt":"2026-06-01T20:09:02.000Z","url":"https://github.com/vercel/next.js/releases/tag/v15.5.19","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":288,"contentTokens":82,"composition":{"bugs":1,"features":0,"enhancements":0}},{"id":"rel_uF78CfsWgCtTv-rHtVNbI","version":"v16.2.7","type":"feature","title":"v16.2.7","summary":"Fixed a dev mode hydration failure when pages are served from HTTP cache, catch-all router.query corruption with basePath and rewrites, and server action forwarding loops with middleware rewrites. Also fixed FormData entry dropping, playwright-core promise resolution, non-ASCII cache tag encoding, and type module support in standalone/adapter deployments.","titleGenerated":"Next.js v16.2.7 fixes hydration, router.query, and server action forwarding","titleShort":"Dev mode hydration fixed; router.query corruption resolved","breaking":"unknown","importance":null,"content":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n\r\n- Backport documentation fixes for v16.2 (#93804)\r\n- [backport] Patch `playwright-core` to resolve `_finishedPromise` on `requestFailed` (#93920)\r\n- [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)\r\n- [backport] Fix catch-all `router.query` corruption with `basePath` + `rewrites` (#93917)\r\n- [backport] Encode non-ASCII characters in cache tags at construction (#93918)\r\n- [backport] Fix server action forwarding loop with middleware rewrites (#93919)\r\n- [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)\r\n- [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)\r\n- [backport] Fix \"type: module\" in project dir when using standalone or adapters (#94050)\r\n- [backport] Propagate adapter preferred regions (#94200)\r\n- [16.2.x] Don't drop `FormData` entries (#94240)\r\n- [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)\r\n\r\n### Credits\r\n\r\nHuge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!\r\n","publishedAt":"2026-06-01T19:53:29.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.7","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":1215,"contentTokens":332,"composition":{"bugs":9,"features":0,"enhancements":2}},{"id":"rel_UTc0qrP0xbCO3xCI7rkBS","version":"v15.5.18","type":"feature","title":"v15.5.18","summary":"This release contains security fixes for the following advisories:\r\n\r\nHigh:\r\n- [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https:/...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"This release contains security fixes for the following advisories:\r\n\r\nHigh:\r\n- [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj)\r\n- [GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)\r\n- [GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up](https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6)\r\n- [GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx)\r\n- [GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv)\r\n- [GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r)\r\n- [GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5)\r\n\r\nModerate:\r\n- [GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q)\r\n- [GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h)\r\n- [GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh)\r\n- [GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7)\r\n\r\nLow:\r\n- [GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949)\r\n- [GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq)","publishedAt":"2026-05-07T20:18:27.000Z","url":"https://github.com/vercel/next.js/releases/tag/v15.5.18","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_Vwfyzuh36yWITvNxJ8cZ9","version":"v16.2.6","type":"feature","title":"v16.2.6","summary":"This release contains security fixes for the following advisories:\r\n\r\nHigh:\r\n- [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https:/...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"This release contains security fixes for the following advisories:\r\n\r\nHigh:\r\n- [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj)\r\n- [GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)\r\n- [GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up](https://github.com/vercel/next.js/security/advisories/GHSA-26hh-7cqf-hhc6)\r\n- [GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx)\r\n- [GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv)\r\n- [GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r)\r\n- [GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5)\r\n\r\nModerate:\r\n- [GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q)\r\n- [GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h)\r\n- [GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh)\r\n- [GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7)\r\n\r\nLow:\r\n- [GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949)\r\n- [GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq)","publishedAt":"2026-05-07T20:16:51.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.6","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_1QpKqJ0E7JCIgHxkl2DGS","version":"v16.2.5","type":"feature","title":"v16.2.5","summary":"This release contains security fixes for the following advisories:\r\n\r\nHigh:\r\n- [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https:/...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"This release contains security fixes for the following advisories:\r\n\r\nHigh:\r\n- [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj)\r\n- [GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)\r\n- [GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx)\r\n- [GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv)\r\n- [GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r)\r\n- [GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5)\r\n\r\nModerate:\r\n- [GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q)\r\n- [GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h)\r\n- [GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh)\r\n- [GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7)\r\n\r\nLow:\r\n- [GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949)\r\n- [GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq)","publishedAt":"2026-05-06T18:54:20.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.5","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_d4PWk_Ortx62L0pzR_DYf","version":"v15.5.16","type":"feature","title":"v15.5.16","summary":"This release contains security fixes for the following advisories:\r\n\r\nHigh:\r\n- [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https:/...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"This release contains security fixes for the following advisories:\r\n\r\nHigh:\r\n- [GHSA-8h8q-6873-q5fj: Denial of Service with Server Components](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj)\r\n- [GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f)\r\n- [GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx)\r\n- [GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv)\r\n- [GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r)\r\n- [GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5)\r\n\r\nModerate:\r\n- [GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q)\r\n- [GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h)\r\n- [GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh)\r\n- [GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7)\r\n\r\nLow:\r\n- [GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949)\r\n- [GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq)","publishedAt":"2026-05-06T18:53:12.000Z","url":"https://github.com/vercel/next.js/releases/tag/v15.5.16","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_pmXNM3b2NffMDOegFAII3","version":"v16.2.4","type":"feature","title":"v16.2.4","summary":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n\r\n- chore: Bu...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n\r\n- chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713)\r\n- Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#92631)\r\n- Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#92580)\r\n- Compiler: Support boolean and number primtives in next.config defines (#92731)\r\n- turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#92725)\r\n- Turbopack: shorter error for ChunkGroupInfo::get_index_of (#92814)\r\n- Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#92828)\r\n- Adding more system info to the 'initialize project' trace (#92427)\r\n\r\n### Credits\r\n\r\nHuge thanks to @Badbird5907, @lukesandberg, @andrewimm, @sokra, and @mischnic for helping!","publishedAt":"2026-04-15T22:35:38.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.4","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_gqM648N4RdYtd43JxaOLD","version":"v15.5.15","type":"feature","title":"v15.5.15","summary":"Please refer the following changelogs for more information about this security release:\r\n\r\nhttps://vercel.com/changelog/summary-of-cve-2026-23869","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"Please refer the following changelogs for more information about this security release:\r\n\r\nhttps://vercel.com/changelog/summary-of-cve-2026-23869","publishedAt":"2026-04-08T19:07:31.000Z","url":"https://github.com/vercel/next.js/releases/tag/v15.5.15","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_sxf0R7qCYBoVeaCqzG3QB","version":"v16.2.3","type":"feature","title":"v16.2.3","summary":"> [!NOTE]\r\n> This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://verce...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"> [!NOTE]\r\n> This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n\r\n- Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)\r\n- Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)\r\n- Deduplicate output assets and detect content conflicts on emit (#92292)\r\n- Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)\r\n- turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)\r\n\r\n### Credits\r\n\r\nHuge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!\r\n","publishedAt":"2026-04-08T18:53:10.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.3","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_wmV1VcA-BMk275ZySXOjv","version":"v16.2.2","type":"feature","title":"v16.2.2","summary":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n\r\n- backport:...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n\r\n- backport: Move expanded adapters docs to API reference (#92115) (#92129)\r\n- Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#92130)\r\n- [create-next-app] Skip interactive prompts when CLI flags are provided (#91840)\r\n- next.config.js: Accept an option for serverFastRefresh (#91968)\r\n- Turbopack: enable server HMR for app route handlers (#91466)\r\n- Turbopack: exclude metadata routes from server HMR (#92034)\r\n- Fix CI for glibc linux builds\r\n- Backport: disable bmi2 in qfilter #92177\r\n- [backport] Fix CSS HMR on Safari (#92174)\r\n\r\n### Credits\r\n\r\nHuge thanks to @nextjs-bot, @icyJoseph, @ijjk, @gaojude, @wbinnssmith, @lukesandberg, and @bgw for helping!\r\n","publishedAt":"2026-04-01T00:19:33.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.2","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_XJPWBmtkkqKsEZGvboK6d","version":"v16.2.1","type":"feature","title":"v16.2.1","summary":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n- docs: post ...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n- docs: post release amends (#91715)\r\n- docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698)\r\n- Fix adapter outputs for dynamic metadata routes (#91680)\r\n- Turbopack: fix webpack loader runner layer (#91727)\r\n- Fix server actions in standalone mode with `cacheComponents` (#91711)\r\n- turbo-persistence: remove Unmergeable mmap advice (#91713)\r\n- Fix layout segment optimization: move app-page imports to server-utility transition (#91701)\r\n- Turbopack: lazy require metadata and handle TLA (#91705)\r\n- [turbopack] Respect `{eval:true}` in worker_threads constructors (#91666)\r\n\r\n### Credits\r\n\r\nHuge thanks to @icyJoseph, @abhishekmardiya, @ijjk, @mischnic, @unstubbable, @sokra, and @lukesandberg for helping!","publishedAt":"2026-03-20T23:32:16.000Z","url":"https://github.com/vercel/next.js/releases/tag/v16.2.1","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_X3WejvoilKWlEcszq4e1o","version":"v15.5.14","type":"feature","title":"v15.5.14","summary":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n- feat(next/i...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"> [!NOTE]\r\n> This release is backporting bug fixes. It does **not** include all pending features/changes on canary.\r\n\r\n### Core Changes\r\n- feat(next/image): add lru disk cache and images.maximumDiskCacheSize (#91660)\r\n- Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses (#90304)\r\n\r\n### Credits\r\n\r\nHuge thanks to @styfle and @lllomh for helping!","publishedAt":"2026-03-19T18:17:00.000Z","url":"https://github.com/vercel/next.js/releases/tag/v15.5.14","media":[],"prerelease":false,"source":{"slug":"next-js","name":"Next.js","type":"github"},"product":{"slug":"nextjs","name":"Next.js"},"groupSlug":"nextjs","groupName":"Next.js","coverageCount":0,"contentChars":null,"contentTokens":null,"composition":null},{"id":"rel_1ihmer0dFYaPfZi_OeoPL","version":"v16.2.0","type":"feature","title":"v16.2.0","summary":"> [!TIP] \r\n> **Check out our Next v16.2 [Blog Post](https://nextjs.org/blog/next-16-2) to learn more about this release.**\r\n\r\n### Core Changes\r\n\r\n- U...","titleGenerated":null,"titleShort":null,"breaking":"unknown","importance":null,"content":"> [!TIP] \r\n> **Check out our Next v16.2 [Blog Post](https://nextjs.org/blog/next-16-2) to learn more about this release.**\r\n\r\n### Core Changes\r\n\r\n- Upgrade React from `f93b9fd4-20251217` to `65eec428-20251218`: #87323\r\n- Turbopack: Create junction points instead of symlinks on Windows: #87606\r\n- Turbopack: Symlink handling follow-up: #87637\r\n- Add experimental routing package for resolving adapter routes: #86404\r\n- Ensure outputs are correct with cache components in deployment adapters: #87018\r\n- Move off of deprecated url.parse: #87257\r\n- [strict-route-types] Add `experimental.strictRouteTypes` config: #87378\r\n- misc: fix type check log for CI envs: #87838\r\n- fix: revalidateTag with profile should not trigger client cache invalidation: #88069\r\n- chore: warn when running tests against stale build: #88001\r\n- Redesign default error pages with cleaner, more user-friendly UI: #87988\r\n- dx: avoid next-env.d.ts change in dev: #88103\r\n- prevent browser cache from using stale RSC responses from previous builds: #86554\r\n- [strict-route-types] Typecheck App Router page props: #87386\r\n- [strict-route-types] Enforce common React Component return types in App Router: #87389\r\n- [strict-route-types] Switch to `satisfies` when validating page and route modules: #87398\r\n- [strict-route-types] Don't reject `number` in `config.api.bodyParser.sizeLimit` when validating route: #87633\r\n- Revert \"dx: avoid next-env.d.ts change in dev\": #88153\r\n- [strict-route-types] Typecheck pages router routes in absence of App Router: #87628\r\n- [strict-route-types] Ensure cache profiles and routes are type-checked even if .next is excluded: #87768\r\n- add compilation error for taint when not enabled: #88173\r\n- feat(next/image)!: add `images.maximumResponseBody` config: #88183\r\n- Add maximum size limit for postponed body parsing: #88175\r\n- metadata: use fixed segment in dynamic routes with static metadata files: #88113\r\n- feat: add --experimental-cpu-prof flag for dev, build, and start: #87946\r\n- Add experimental option to use no-cache instead of no-store in dev: #88182\r\n- fix overlay frames cannot be opened sometimes: #88210\r\n- Handle pnpm-workspace.yaml while searching for monorepo root: #74818\r\n- Add more debug logs to `'use cache'` wrapper: #88219\r\n- Omit unused arguments from `'use cache'` function calls: #86920\r\n- Only log `pending revalidates...` debug log if applicable: #88221\r\n- fix(next/image): bump sharp@0.34.5: #88238\r\n- Disallow javascript urls in router methods and redirects: #88185\r\n- Fix relative same host redirects in node middleware: #88253\r\n- Remove loadConfig from main development process, pass value from child process: #88230\r\n- Update deploy adapters outputs and handler interfaces for node and edge: #88247\r\n- Move Ready in time before handler initialization: #88235\r\n- next/image: support custom cache handlers: #88248\r\n- feat: add Claude Code plugin marketplace with Cache Components skill: #87993\r\n- refactor: consolidate PPR into cacheComponents architecture: #88243\r\n- Turbopack: include fewer traced files for standalone: #88322\r\n- feat(turbopack): add resolve plugin condition variant of Always and Never: #88190\r\n- perf: use length = 0 to clear the logging array: #88244\r\n- Time logs: Show full millisecond instead of 1 decimal: #88313\r\n- [turbopack] Enable inferring module side effects by default: #87216\r\n- Track search string as part of \"refresh state\": #87203\r\n- Pass RouteTree into navigation function: #87256\r\n- Read from segment cache unknown routes: #87293\r\n- Pass loading boundary as part of RSC data: #87825\r\n- Revert \"refactor: consolidate PPR into cacheComponents architecture (#88243)\": #88421\r\n- fix: support TypeScript `noUncheckedSideEffectImports` for CSS imports: #88199\r\n- Don't import typescript at runtime: #88321\r\n- fix: use RDC for server action requests: #88129\r\n- Warn when overriding Cache-Control header on `/_next/` routes: #88353\r\n- [prebuilt-skew-protection] feat: adding in automatic deploymentId: #88012\r\n- Revert \"[prebuilt-skew-protection] feat: adding in automatic deploymentId\": #88449\r\n- Turbopack: Update reqwest, remove experimental system TLS feature: #88290\r\n- Revert \"prevent browser cache from using stale RSC responses from pre…: #88457\r\n- Turbopack: retain loader tree order for metadata: #88487\r\n- Turbopack: more dead code: #88505\r\n- fix(build): prevent route handler manifests from inheriting unrelated client components: #88419\r\n- Upgrade React from `65eec428-20251218` to `3e1abcc8-20260113`: #88530\r\n- Better typesafety for `interopDefault`: #88486\r\n- keep next-env.d.s unchanged between dev and build: #88428\r\n- Remove sibling caches from CacheNode tree: #87991\r\n- Upgrade React from `3e1abcc8-20260113` to `4a3d993e-20260114`: #88547\r\n- Finish deleting Mutable from router implementation: #88046\r\n- fetch(next/image): reduce maximumResponseBody from 300MB to 50MB: #88588\r\n- [CC] Fix dev validation error from server action bound args: #88600\r\n- Fix incorrect 'Ready in' time for next start: #88589\r\n- feat: server action logging: #88277\r\n- Log browser error and warnings in terminal: #88352\r\n- Upgrade React from `4a3d993e-20260114` to `bef88f7c-20260116`: #88649\r\n- fix: make RedirectType constant properties literal types: #88653\r\n- Turbopack: add support for matching loaders on resource queries: #88644\r\n- fix: capture promisified setImmediate separately: #88346\r\n- fix: setImmediate[util.promisify.custom] access fails in edge runtime: #88685\r\n- Fix `--debug-build-paths` bracket escaping for glob patterns: #88660\r\n- Add negation pattern support to `--debug-build-paths`: #88654\r\n- Only filter next config if experimental flag is enabled: #88733\r\n- [Devtool Indicator] Fix cross alignment: #88664\r\n- Turbopack: don't use build id for pages router client-side manifests: #88641\r\n- Allow inspecting server with `next start --inspect`: #88744\r\n- Turbopack: Add `--debug-build-paths` support to filter routes: #88655\r\n- Upgrade React from `bef88f7c-20260116` to `41b3e9a6-20260119`: #88756\r\n- Use rewritten pathname for implicit cache tags: #88732\r\n- Upgrade React from `41b3e9a6-20260119` to `d2908752-20260119`: #88774\r\n- Add experimental_gesturePush to App Router: #88776\r\n- Rename `rewroteURL` to `rewrittenPathname` in request metadata: #88751\r\n- Simplify `getImplicitTags` to accept pathname instead of url object: #88753\r\n- Add `NEXT_DEPLOYMENT_ID` global: #86738\r\n- Turbopack: remove deployment id suffix from client reference manifest chunks: #88741\r\n- Inject `` and don't inline it into JS anymore: #88761\r\n- [metadata] match the Metadata and ResolvedMetadata type: #88739\r\n- Reuse bfcache data during Full prefetches: #88606\r\n- Embed static sibling info in route tree: #88692\r\n- Fix `revalidatePath` with params and trailing slash when deployed: #88623\r\n- fix: preserve cache behavior for PPR fallback shells with root params: #88556\r\n- Upgrade React from `d2908752-20260119` to `b546603b-20260121`: #88860\r\n- stabilize browser log forward options: #88857\r\n- [devtools] Wrap long file names of stack frames in the error overlay: #88886\r\n- [devtools] Fix notch coloring of error overlay in forced colors mode: #88892\r\n- Remove `deploymentId` from App Router `RenderOptsPartial`: #88866\r\n- feat: implement LRU cache with invocation ID scoping for minimal mode response cache: #88509\r\n- [prebuilt-skew-protection] feat: adding in automatic deploymentId: #88496\r\n- [devtool] Add hydration diff indicator for diff lines: #88919\r\n- Revert \"[prebuilt-skew-protection] feat: adding in automatic deploymentId\": #88942\r\n- [turbopack] add task type infromation to the print_cache_item_size feature: #88925\r\n- Upgrade React from `b546603b-20260121` to `24d8716e-20260123`: #88963\r\n- Turbopack: add `?dpl=` to all asset urls returned by Turbopack: #88828\r\n- feat(next-codemod): add agents-md command for AI coding agents: #88961\r\n- Update font data: #88975\r\n- Improve agents-md prompt to force doc retrieval: #88997\r\n- [Reapply] Add `useEffectEvent` to disallowed React APIs in Server Components: #88985\r\n- Apply fixes for onBuildComplete and route module: #88831\r\n- Rename `renderOpts.nextExport` to `isBuildTimePrerendering`: #88951\r\n- docs: fix typos in `README.md`s: #89022\r\n- refactor: consume global-error from loader tree: #88437\r\n- Fix chunk loading when using `__turbopack_load_by_url__` with query: #88899\r\n- [mcp] change the mcp endpoint response to JSON: #88911\r\n- Reapply \"[turbopack] Add bundling support for worker_threads\" (#88725): #88967\r\n- fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth: #89040\r\n- Upgrade React from `24d8716e-20260123` to `8c34556c-20260126`: #89066\r\n- Use null-prototype objects in server actions manifests: #89069\r\n- Re-enable types-and-precompiled: #89070\r\n- Apply segment changes to adapters outputs: #89072\r\n- Improve no response route handler error: #89036\r\n- Limit number of server action arguments to 1000: #89068\r\n- [prebuilt-skew-protection] feat: adding in automatic deploymentId: #88958\r\n- Decouple route stale time from segment-level data: #88834\r\n- Decouple route and segment cache lifecycles: #88989\r\n- [ci] Silence `baseline-browser-mapping` warnings: #89175\r\n- [Cache Components] Prevent streaming fetch calls from hanging in dev: #89171\r\n- React types update: #89110\r\n- [nextjs] feat: removing length requirement: #89173\r\n- add GPTBot to matcher for known bots: #89188\r\n- Ensure `.md` licenses are included in vendored packages: #89201\r\n- Switch development log item format as JSON: #89168\r\n- IsolatedDevBuild flag removal: #89167\r\n- fix: coerce HEAD to GET for internal images: #84180\r\n- Upgrade React from `10680271-20260126` to `230772f9-20260128`: #89250\r\n- Upgrade `tar` used to extract SWC binary : #89158\r\n- Sort prerender manifest routes: #89246\r\n- Track vary params for segments without server-side param access: #88998\r\n- Optimistic routing: client-side route prediction: #88965\r\n- Keep pages/404.js to be able to dynamically render it anyway: #89263\r\n- fix: fully static pages should emit & serve static rsc payloads: #89202\r\n- fix: CSRF origin matching should be case-insensitive: #89127\r\n- fix(build): format runAfterProductionCompile duration as human-readable time: #89232\r\n- fix(router): support BigInt in query parameters: #89213\r\n- Update font data: #89200\r\n- Update font data: #89272\r\n- Turbopack: add support for contentType condition for webpack loaders: #89156\r\n- Revert \"fix(router): support BigInt in query parameters\": #89283\r\n- Track vary params during static prerendering: #89267\r\n- Improve lock dir error message: #89119\r\n- Ensures `browserslist` doesn't issue outdated warnings for `baseline-browser-mapping`: #89287\r\n- Replace build id in Pages data routes with deployment id: #88959\r\n- Upgrade React from `230772f9-20260128` to `da641178-20260129`: #89301\r\n- Inline handler dependencies instead of tracing: #89269\r\n- Turbopack: add `rules.*.type` config to allow changing the type of a module: #88788\r\n- Add experimental.varyParams feature flag: #89307\r\n- Fix/zlib mem node: #89099\r\n- Revert \"Replace build id in Pages data routes with deployment id (#88959)\": #89323\r\n- Turbopack: Rename crates/napi to crates/next-napi-bindings and update crate name: #89314\r\n- feat: detect @typescript/native-preview as alternative TypeScript compiler: #89149\r\n- Revert \"Fix/zlib mem node\": #89322\r\n- Turbopack: FreeVarReference::ReportUsage: #89302\r\n- Make Server Function logging opt-in via `logging.serverFunctions`: #89321\r\n- Restore default-enabled Server Function logging: #89407\r\n- Re-add build-complete traces for webpack: #89402\r\n- Skip Server Function logging for `'use cache'` functions: #89408\r\n- Replace flight navigation build id field with header: #88855\r\n- Upgrade React from `da641178-20260129` to `ed4bd540-20260202`: #89401\r\n- Upgrade React from `ed4bd540-20260202` to `b1533b03-20260203`: #89444\r\n- Upgrade React from `b1533b03-20260203` to `3e00319b-20260203`: #89449\r\n- Rename CACHE_ONE_YEAR for clarity and fix usage: #89450\r\n- [Codemod] Fix agents-md on Windows: #89319\r\n- Experimental deferred entries handling: #88347\r\n- Add `experimental.reportSystemEnvInlining` for Turbopack: #89304\r\n- fix: use signal-based exit codes to prevent inspector blocking exit: #89351\r\n- Add Instant Navigation Testing API: #89465\r\n- Support MPA navigations in `instant()`: #89469\r\n- Handle Pages data route skew with deployment id header, take 2: #89325\r\n- Include owner stack for forwarded errors if available: #89493\r\n- [CC] Rename \"unstable_prefetch\" to \"unstable_instant\": #89448\r\n- Ensure module contexts are always included in adapter traces: #89508\r\n- Don't insert build id comment in HTML: #89478\r\n- Clarify type checking error message: #89525\r\n- Require explicit `cacheLife` on outer `\"use cache\"` when nesting short-lived caches: #89481\r\n- [Instant] Instant validation in Dev: #89077\r\n- Upgrade React from `3e00319b-20260203` to `95ffd6cd-20260205`: #89550\r\n- Turbpopack: fix is_persistent_caching_enabled: #89533\r\n- Fix a small doc typo: #89553\r\n- Ensure _middleware is consistent in adapter for name/id: #89559\r\n- Ensure Errors with deep causal chains respect inspect depth: #89594\r\n- refactor: extract route discovery into unified `discoverRoutes()` API: #88971\r\n- Ensure static metadata are static outputs for adapters: #89574\r\n- Resolve local variable references in error code SWC plugin: #89596\r\n- Turbopack: Add --experimental-server-fast-refresh CLI flag: #89274\r\n- Fix deployment id header when proxying: #89593\r\n- fix: deprecated util._extend: #89614\r\n- Fix missing non-deferred turbopack build items: #89616\r\n- Revert \"Ensure _middleware is consistent in adapter for name/id\": #89624\r\n- Omit unused arguments for server actions: #89651\r\n- Upgrade React from `95ffd6cd-20260205` to `2dd9b7cf-20260208`: #89681\r\n- Include `AggregateError.errors` in terminal output: #88999\r\n- fix(image): findClosestQuality returns 0 for low quality values: #89621\r\n- Upgrade React from `2dd9b7cf-20260208` to `272441a9-20260209`: #89722\r\n- Avoid using unclosing prefetch streams in the browser: #89610\r\n- Pass shouldCache to all manifest loading calls: #89713\r\n- Add 2nd cloned body to FinalizationRegistry. Only used RuntimeStyles component for webpack: #88577\r\n- Tracing: trace render times as render-path: #89763\r\n- Turbopack: Server HMR infrastructure: #88870\r\n- Turbopack: Reorganize runtime files into shared/runtime directory: #89461\r\n- [Instant] Validation on client navs: #89777\r\n- Turbopack: extract core hmr client logic into shared runtime: #88912\r\n- Turbopack: Fix slow filesystem benchmark warning for `next dev`: #89798\r\n- Add turbopackIgnoreIssue config to suppress Turbopack warnings: #89682\r\n- Add support for with `type: \"text\"` under a new experimental flag, following what webpack did: #89560\r\n- Remove unused devtools code handling React without `use`: #89793\r\n- [devtools] Wrap overlay in Activity: #89818\r\n- Add CSS URL deployment ID suffix support: #89771\r\n- Fix cascading LRU eviction during prefetch batches: #89766\r\n- Refactor prerenderManifest passing: #89765\r\n- [AI] Ship bundled docs in next and generate AGENTS.md in create-next-app: #89850\r\n- Turbopack: Implement server hmr in nodejs dev runtime: #89130\r\n- Allow sitemap.ts and sitemap/page.tsx to coexist in Turbopack: #89789\r\n- [fragment-scroll] Cleanup scroll and focus restoration in layout router: #83110\r\n- [fragment-scroll] Add `experimental.appNewScrollHandler`: #83107\r\n- [Instant] Fix crash with search params: #89922\r\n- Fix memory leak in dev mode caused by fast-set-immediate: #89779\r\n- Trace upload: include experimental flag states: #89845\r\n- Upgrade React from `272441a9-20260209` to `6066c782-20260212`: #89923\r\n- Add a better error message for when turbopack cannot be loaded: #89633\r\n- fix: support multiple icon formats with same base name (icon.png + icon.svg): #89504\r\n- Turbopack: Move turbopackIgnoreIssue from experimental to turbopack.ignoreIssue: #89817\r\n- Build with dev runtimes when `--debug-prerender` is set: #89834\r\n- Append deployment id query string for next-font: #89960\r\n- Fix parallel routes with deferred entries: #89967\r\n- Rename node extension utils for clarity: #89970\r\n- Model abandoning by signal: #89971\r\n- Fix missing incremental cache in middleware unstable_cache: #89980\r\n- Run fast immediates during prerender abort to fix flaky I/O stack traces: #89969\r\n- [fragment-scroll] Ensure hoisted elements don't break scroll-to-top on page navigations: #83108\r\n- dx: Include path count in export error message: #89333\r\n- fix(agents-md): use `require.resolve()` to get the installed `next` version: #89166\r\n- docs: agent skills, pr-status script, and AGENTS.md updates (1/8): #89857\r\n- Ignore `prefetch={true}` on Links to routes with `instant`: #90061\r\n- Expand deferred entries test suite and fix turbopack build: #90057\r\n- Use StageController for runtime prerendering: #89972\r\n- Improve task pipelining: #90065\r\n- fix(next/legacy/image): add deployment id (dpl) query string support: #89956\r\n- Cache expected missing manifest read: #89908\r\n- Use for...in instead of Object.keys for parallelRouteKey traversal: #89905\r\n- [Instant] allow non-blocking dynamic holes and errors in shared parents: #89875\r\n- Move prefetch hints from CacheNodeSeedData to FlightRouterState: #90066\r\n- [Instant] Don't block on client APIs that wouldn't block in the browser: #89924\r\n- [devtools] Add support for error causes in the dev overlay: #90108\r\n- Unify runInSequentialTasks across all sequential task work: #89978\r\n- Cleanup all stage promises on abort: #89984\r\n- segment cache: fix segment cache normalizer: #90111\r\n- Handle null history.state in client-side router popstate handler: #90083\r\n- Don't parse default postponedsizelimit: #89906\r\n- Turbopack: handle invalid RSC imports via importmap: #88146\r\n- [create-next-app] Improve AGENTS.md prompt wording: #90118\r\n- ensure maxPostponedStateSize is always respected: #90060\r\n- Upgrade React from `6066c782-20260212` to `4842fbea-20260217`: #90144\r\n- [fragment-scroll] Stop focusing the first focusable host descendant: #89903\r\n- fix: normalize loopback only in hostname: #90158\r\n- Only error for sync IO after runtime in segments that would be runtime prefetched: #89979\r\n- [refactor] Replace runtime prefetch sentinel transform stream: #90160\r\n- fix: use Buffer.indexOf in uint8array helpers for faster byte scanning (3/8): #89864\r\n- Automatically build and clear native build when running `pnpm build`: #89819\r\n- fix(cache): DCE to avoid pulling server internals into browser bundles (4/8): #89865\r\n- Attach active src route to next global: #90171\r\n- Fix OTEL propagation and add direct entrypoint e2e coverage: #90181\r\n- Use cookie as sole protocol for instant navigation testing: #89871\r\n- Simplify metadata tag rendering to flat imperative style: #90209\r\n- Prevent unhandled rejection filter from being bundled into the server runtime: #90205\r\n- [Instant] speed up test instant-validation suite: #90214\r\n- Turbopack: fix static asset skew protection for edge and prerenders: #90238\r\n- Remove workStore from params/searchParams/pathname function signatures: #90215\r\n- Remove workStore from metadata resolution chain: #90217\r\n- [Instant] export \"Instant\" config type: #90257\r\n- Replace getDynamicParamFromSegment closure with interpolatedParams in metadata: #90249\r\n- [Instant] Dev Tools toggle for Instant Navigation Mode: #90222\r\n- [instant] Include declaration location of instant config in validation errors: #90169\r\n- Turbopack: rename ServerPaths to AssetPaths: #90234\r\n- feat(next/image): add lru disk cache and `images.maximumDiskCacheSize`: #89963\r\n- Revert \"Handle null history.state in client-side router popstate handler\": #90268\r\n- [devtools] Omit empty looking error messages: #90256\r\n- Fix runtime prefetch `isPartial` byte stripping when deployed: #90272\r\n- Upgrade React from `2ba30655-20260219` to `ab18f33d-20260220`: #90279\r\n- validate sync IO in generateMetadata according to Page's prefetchable status: #90164\r\n- Turbopack: support Subresource Integrity\r\n: #90152\r\n- segment cache: add test for passing unawaited promise to context provider: #89339\r\n- Fix route.replace crash with --debug-build-paths: #90312\r\n- refactor(app-render): extract stream-ops and debug-channel modules (5/8): #89858\r\n- [turbopack] Consider `ignoreList` of 3rd party sourcemaps in Redbox: #90317\r\n- [turbopack] Remove obsolete is_internal field : #90329\r\n- Fix: Image component ignores images.qualities in Jest environment: #89536\r\n- Revert \"keep next-env.d.s unchanged between dev and build\": #90384\r\n- Fix route cache keying for unprefetched navigations: #90400\r\n- Add support for Next.js error telemetry for `AggregateError`: #90391\r\n- Fix `config.reactProductionProfiling` for Webpack: #90430\r\n- next-image: fix deployment id handling for unoptimized: #90416\r\n- [ci] Fix input cache keys for tasks referencing `rust-toolchain`: #90442\r\n- next-image: fix dpl handling with unicode: #90420\r\n- Upgrade React from `ab18f33d-20260220` to `c0060cf2-20260224`: #90452\r\n- [ci] Stop using Turbopack tests in native binary build cache keys: #90449\r\n- [Instant] Validate blocking head: #89539\r\n- Turbopack: Fix experimental server hmr for pages router: #90398\r\n- Fix params leaking into instant navigation shell in dev: #90455\r\n- Limit build workers to pages+1: #90475\r\n- fix: sanitize worker args for worker_threads compatibility: #90506\r\n- Fix varyParams tracking for optional catch-all params with no value: #90496\r\n- Don't start worker for Typescript when only doing config validation: #90504\r\n- [Instant] Fix loading.js not being counted as a suspense boundary: #90292\r\n- [ci] Crash if next-swc could not be loaded when `NEXT_TEST_NATIVE_DIR` is specified: #90387\r\n- Fix: server-patch retry preserves push/replace intent of suspended transitions: #90533\r\n- Cached Navigations: Serve cached segments instantly on repeat visits: #90223\r\n- Throw when `unstable_instant` is used in Client Component: #90396\r\n- [test] Fix jest-haste-map warnings: #82995\r\n- Don't require collect-build-traces with Turbopack: #90586\r\n- Enable `experimental.reactDebugChannel` by default: #90310\r\n- Less dynamic pages manifest path: #90581\r\n- Upgrade React from `c0060cf2-20260224` to `98ce535f-20260226`: #90605\r\n- Turbopack: Add Next.js version to \"initialize project\" trace span: #90545\r\n- [devtools] Stop sending codeframes for ignored frames: #90577\r\n- Allow `reset()` from user's global-error: #89684\r\n- Fix per-segment prefetching for initial loads with Cache Components: #90610\r\n- Add `unstable_retry()` to error.js: #89685\r\n- Fix edge index page _next/data route: #90611\r\n- Turbopack server hmr: Implement `restart` event: #90550\r\n- Turbopack: Panic if a top-level task attempts an eventually consistent read: #89735\r\n- Fix middleware case with adapters: #90624\r\n- refactor(turbopack-node): support execution by napi and worker_threads: #86266\r\n- [instant] Allow providing user feedback for blocking route errors: #90498\r\n- Allow Node.js' experimental inspector flags in `next dev` and `next build`: #90603\r\n- tests: Assert dpl query string in all tests for Turbopack: #90592\r\n- [instant] Don't add debug stack to random `unstable_instant` exports: #90273\r\n- Adapter: STATIC_FILE.immutableHash: #90045\r\n- Turbopack: experimental.immutableAssetToken: #88607\r\n- remove runInContext callbacks from stream-ops: #90609\r\n- Turbopack: restrict server HMR to app pages: #90663\r\n- Turbopack: Allow turbopack-node backend to be swapped at runtime using an experimental config option: #90671\r\n- Turbopack: Revert default loader runtime backend to child processes: #90675\r\n- [devtools] Stop blocking overlay on error details copy: #90698\r\n- feat: provide nextVersion to modifyConfig adapter hook: #90735\r\n- experimental.prefetchInlining: bundle segment prefetches into a single response: #90555\r\n- instant(): fix cookie handling for fresh page loads: #90613\r\n- fix(turbopack): use posix.join for client URL manifest paths on Windows: #90700\r\n- Turbopack: improve cell order lint rule for ReadRef::cell: #88500\r\n- Change names of logged times: #90688\r\n- [devtools] Bump React Compiler version to latest experimental: #90763\r\n- Skip writeToBfCache without window: #90771\r\n- docs: error component `unstable_retry()`: #89732\r\n- Stub adapterPath with experimental.runtimeServerDeploymentId: #90790\r\n- Conditionally load uncommon paths: #90514\r\n- Refactor extractExportedConstValue to return { value } | null instead of throwing: #90510\r\n- Reimplement code frame rendering in native code: #85592\r\n- [devtools] Bundle for same target as Next.js browser runtime: #90762\r\n- Upgrade React from `98ce535f-20260226` to `4cc5b7a9-20260303`: #90827\r\n- Add `transitionTypes` prop to `next/link`: #90701\r\n- [otel] fix missing http.route attribute: #90832\r\n- [otel] set parent span name: #90840\r\n- Update default error pages: #90469\r\n- Replace PPR config helpers with cacheComponents checks: #90704\r\n- Cached Navigations: Cache visited fully static pages in the segment cache: #90306\r\n- Remove `isRoutePPREnabled` from render options and delete dead PPR branch: #90713\r\n- Use page extensions in next-swc transforms applying to pages: #90650\r\n- Cached Navigations: Cache static stage of partially static initial HTML: #90539\r\n- Remove `PrerenderStorePPR` type and all `prerender-ppr` switch cases: #90721\r\n- Clean up legacy PPR references in test fixtures: #90725\r\n- Cached Navigations: Cache runtime stage data from navigation requests: #90666\r\n- Remove legacy PPR postpone cluster: #90726\r\n- partial fallbacks: add adapter flag: #90395\r\n- Address review feedback: extract modules, clean up imports: #90813\r\n- Add trace spans for turbopack persistence in .next/trace: #90397\r\n- Upgrade React from `4cc5b7a9-20260303` to `3bc2d414-20260304`: #90876\r\n- Fix prefetch inlining build failure with dynamic routes: #90899\r\n- Update `@vercel/og` and `satori` vendors: #90933\r\n- Batch require cache deletion to avoid quadratic scanning: #90625\r\n- Revert legacy PPR removal: #90948\r\n- Rewrite instant validation to use depth-based URL boundary discovery: #90905\r\n- Add `experimental.cachedNavigations` feature flag: #90928\r\n- preserve allowQuery for partial fallback shells: #90887\r\n- Cache runtime data for partially static pages on initial load (resume): #90888\r\n- re-introduce partial fallback -> route upgrading: #89063\r\n- fix: Don't fall through to catch-all when static child subtree doesn't match: #90957\r\n- Bump Node heap limit for lint-no-typescript to avoid OOM in CI: #90996\r\n- Upgrade React from `3bc2d414-20260304` to `46103596-20260305`: #90989\r\n- fix: trigger MPA navigation for server action redirects with build ID mismatch: #89946\r\n- Improve webpack loader error messages and handling: #89698\r\n- Turbopack: implement module.hot.accept(deps, cb) and module.hot.decline(deps): #90443\r\n- partial fallbacks: gate behind experimental flag: #91123\r\n- fix: app-page URL normalization: #91121\r\n- Updates to Instant Navs devtools functionality: #91005\r\n- Trace upload: add git and environment info: #91124\r\n- fix(css): rewrite MiniCssExtractPlugin insert function to ES5 to support legacy browsers: #90556\r\n- Revert \"Address review feedback: extract modules, clean up imports\": #91159\r\n- [turbopack] Render code frames on the turbopack side: #90534\r\n- Add experimental.lightningCssFeatures config option: #90901\r\n- fix: correct appPaths sort order for parallel routes with route groups: #91160\r\n- Tracing: tag spans as failed if their runner fn fails: #91206\r\n- Adds a Start button to the Instant Navs panel to initiate inspection …: #91216\r\n- Preserve RSC metadata in Proxy request with skipProxyUrlNormalize: #91213\r\n- [cna] Bump `picocolors` to 1.1.1: #91252\r\n- [Instant] Build-time validation: #90964\r\n- [Instant] fix instant config suggested by editor plugin: #91262\r\n- chore(deps): Bump tar from 7.5.7 to 7.5.11 in /packages/next: #91233\r\n- Upgrade React from `46103596-20260305` to `5e9eedb5-20260312`: #91272\r\n- feat(server): expose requestMeta router helpers and merge fallback context: #91235\r\n- [Instant] Show owner stack for validation-blocking errors: #91277\r\n- Hydrate page loads during instant navigation testing: #91207\r\n- perf: use Buffer.from for base64 encoding of binary Flight data: #91221\r\n- Skip dimming when `--inspect` is used: #91271\r\n- Respect `generateStaticParams` in instant navigation shell: #91316\r\n- [Prefetch Inlining] Generate size-based hints on server: #90891\r\n- Wire cache handlers in edge paths and add e2e regression coverage: #91236\r\n- Expose edge runtime fields in build-complete: #91239\r\n- [turbopack] Remove `turbo_tasks::function` from ModuleReference getters: #91229\r\n- [Turbopack] write route bundle stats to .next/diagnostics/route-bundle-stats.json: #90949\r\n- partial fallbacks: only upgrade shells with remaining prerenderable params: #91158\r\n- partial fallbacks: complete generic shells into more specific shells: #91231\r\n- Add eval and docs for unstable_instant: #91334\r\n- Simplify scroll restoration with shared ScrollRef on CacheNode: #91348\r\n- fix: test-cargo-unit CI job timing out since LTO was enabled: #91424\r\n- fix(build): don't block SSG on telemetry flush, add persistence spans to trace-build: #91335\r\n- Ready in X - prints wrong timing on dev server restart: #90874\r\n- Show generated code from loaders in parse error messages: #89898\r\n- Remove unused layer from server actions manifest: #91425\r\n- Support accessing root params in `generateStaticParams`: #91189\r\n- Avoid `undefined` outer work unit store in `\"use cache\"`: #91190\r\n- Add `unstable_dynamicStaleTime` route segment config: #91437\r\n- [next-playwright] Use unique cookie values for instant navigation testing lock: #91250\r\n- Add `unstable_catchError()` API for component-level error recovery: #89688\r\n- docs(turbopack): Fix all warnings in `cargo doc --no-deps --workspace`, and run rustdoc as part of our CI checks: #91339\r\n- Patch improvements into `http-proxy` lib: #91480\r\n- Disallow Server Action submissions from privacy-sensitive contexts: #91478\r\n- Fix startup warmup for empty-shell app route cache: #91470\r\n- Fix `unstable_catchError` type inference for fallback props: #91485\r\n- Support accessing root params in `\"use cache\"` functions: #91191\r\n- Fix inconsistent cache life/tags propagation for cache handler hits: #91454\r\n- Upgrade React from `5e9eedb5-20260312` to `c80a0750-20260312`: #91324\r\n- Error when accessing undefined root params in `generateStaticParams`: #91519\r\n- Buffer prefetch response before passing to Flight client: #91487\r\n- [Segment Cache] Always upsert on prefetch completion: #91488\r\n- Track vary params during runtime prefetches: #89297\r\n- [react-sync] Allow locking in manual sync: #91509\r\n- Remove devCacheControlNoCache experimental option (hard-code no-cache): #91503\r\n- fix allowedDevOrigins for no-cors requests: #91506\r\n- Remove webpack stats generation from Turbopack: #91515\r\n- Upgrade React from `c80a0750-20260312` to `3f0b9e61-20260317`: #91522\r\n- Move adapterPath from experimental to stable top-level config: #91535\r\n- block disallowed dev origins by default: #91507\r\n- Turbopack: Merge release-with-assertions-no-lto profile into release-with-assertions: #91530\r\n- improve allowedDevOrigins error: #91521\r\n- Add group depth tracking to instant validation boundary discovery: #91208\r\n\r\n### Documentation Changes\r\n\r\n- docs: next experimental-analyze: #87272\r\n- docs: use cache private redo: #87111\r\n- docs: fix highlight in 05-server-and-client-components.mdx: #87347\r\n- Guide: Update `Optimizing Package Bundling` to include new Bundle Analyzer: #87246\r\n- docs: generateMetadata and generateViewport w/ CC: #87218\r\n- docs: tweaks/fixes to papercuts: #87445\r\n- docs: fix typos and clarify examples in Cache Components guide: #87530\r\n- [docs] add get_routes in mcp available tools: #88181\r\n- Update generateMetadata in client component error: #88172\r\n- docs: fix CSP example to only include unsafe-eval in development: #88407\r\n- docs: add useSearchParams and useParams documentation for Pages Router: #88429\r\n- docs: fix Pages Router fonts documentation showing App Router examples: #88326\r\n- doc: add details of mcp client integration: #88543\r\n- Turbopack: query conditions in rules follow-ups: #88801\r\n- Docs: Add Next.js Glossary: #88811\r\n- docs: Server functions rename: #86827\r\n- docs: Update Partytown URLs and package reference: #88928\r\n- docs: improve clarity in cache components and server/client docs: #88946\r\n- docs: revalidatePath w/ rewrites and trailing slash: #88956\r\n- Cache Component Guide: Building public, _mostly_ static pages: #87248\r\n- Turbopack: Add postcss.config.ts support: #89049\r\n- CC Guide: Fix filenames, reduce line breaks: #89065\r\n- docs: fix code highlight in 07-fetching-data.mdx: #88727\r\n- [docs] Always include `unsafe-eval` in dev `Content-Security-Policy`: #89163\r\n- Turbopack: add support for turbopackOptional: true: #89227\r\n- docs: Rename Error component to ErrorPage: #89284\r\n- docs: replace 'can not' with 'cannot': #89354\r\n- docs: Fix custom server code snippets: #89400\r\n- Snippet multi package syntax: #89381\r\n- Fix indentation of types of tests in docs: #89409\r\n- docs: Fix syntax in proxy example code: #89395\r\n- docs: fix ISR guide link to res.revalidate: #89342\r\n- Fix spelling in robots.mdx documentation: #89565\r\n- Remove more examples: #89709\r\n- clarify unstable_cache replacement with use cache: #89435\r\n- docs: correct use term: #89438\r\n- [docs] Add `RedirectType` usage example to `permanentRedirect`: #89833\r\n- Next CLI flags documentation: #89750\r\n- docs: adapt lead to source path patterns: #89392\r\n- docs: Papercuts Feb26: #89484\r\n- After() docs requests API: #89837\r\n- docs: Move browserToTerminal into logging: #88901\r\n- Update documentation to explain behavior in a Catch-all route: #89742\r\n- docs: add deploymentId config and clarify encryption key for self-hosting: #89795\r\n- docs: adapterPath amends: #89930\r\n- docs: improve next/image localPatterns error page: #89914\r\n- docs: inline-css dev-action oriented: #89064\r\n- docs: document cacheLife expire omission behavior and fix default preset value: #89913\r\n- docs: Activity boundary guide: #89126\r\n- Turbopack: Add inline loader configuration via import attributes: #89644\r\n- docs: fix broken blockquote formatting in API Routes page: #89966\r\n- docs: clarify async instrumentation register request : #90039\r\n- Add AGENTS.md and bundled docs guide: #89973\r\n- In-Depth Explanation of React Version Handling Doc: #89426\r\n- Next.js sticky scroll standards: #90197\r\n- docs: fixes typo in manifest.mdx regarding Route Handler note: #90394\r\n- docs: improve form guide consistency and validation examples: #90361\r\n- docs: rework version staleness: #90192\r\n- docs: clarify that next upgrade is for 16.1.x+: #90435\r\n- Add not-found.js / notFound() links to Status Codes section: #88332\r\n- docs: update with more patterns and decision based: #90203\r\n- docs: add Docker Standalone and Docker Export examples to Deploying page: #90386\r\n- feat: Join guides and frame around UI preservation: #90595\r\n- docs(deploying): add Hostinger Web Apps Hosting to Node.js deployment options: #90246\r\n- docs: fix navigationType value and variable name in useReportWebVitals: #90599\r\n- Accept header content negotiation: #90607\r\n- docs: clarify native