Misc Changes Followup from #99249 remove some redundant tests and enable missing assertions all the time: #99605 Simplify turbo-tasks-backend guards and execution contexts: #99599 Add allocation and memory data to the trace-server MCP protocol: #98546 turbo-tasks-backend: check access in track_modification and only track Data on serialization invalidation: #99581 Fix CI break caused by #98932: #99…
Misc Changes Optimize esm exports by shifting the protocol burden to getters: #98932 fix: fix pnpm builds in Docker examples: #97352 Assert transient task references are not serialized: #99300 Reorganize bundle analyzer toolbar: #98920 Show async module scope in bundle analyzer: #98918 Show bundle changes in compare treemap: #98837 improve disk read semantics around MustExist and AllowMissing: #99…
Misc Changes Resolve React dependency warnings from the target app: #99536 Move upgrade workflows out of public docs: #99546 Use Agent terminology throughout upgrades: #99545 Turbopack: Commit updated generated-native file: #99561 test: enable Relay multi-project deployment coverage: #99403 test: migrate independent App Router deploy exclusions to force gates: #99431 test: migrate mode-specific de…
Misc Changes Measure AI upgrade nudges, handoffs, and completion: #99465 turbo-persistence: 32 bit fingerprints for the used keys AMQFs: #99333 Remove suspend during operations: #99383 test: migrate runtime deploy exclusions to force gates: #98159 test: migrate asset deploy exclusions to force gates: #98158 test: migrate Pages Router deploy exclusions to force gates: #98157 fix: stale usages of un…
Misc Changes Always use generateBuildId if set explicitly: #99147 Set tracer library version: #98262 fix: propagate repeated tag revalidation from after(): #99499 Stabilize ensureStatic: #99513 Turbopack: Enable experimental.turbopackSharedRuntime by default: #99504 Credits Huge thanks to @mischnic, @lukahartwig, @uaoa, @lubieowoce, and @bgw for helping!
Misc Changes Scope response cache keys to their source route: #99482 Match Next data paths case-sensitively: #99481 Fix MCP middleware DNS rebinding: #99480 Fix draft mode leaks through cross-request 'use cache' deduplication: #99479 [webpack] Ensure dynamicParams is respected in opengraph-image.ts: #99478 fix(next/image): Pin DNS resolution when fetching external images : #99477 turbo-persistence…
This release contains security fixes for the following advisories: High: Server-Side Request Forgery in Image Optimization Medium: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass Cache poisoning of SSG and ISR pages in self-hosted Next.js applications Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent den…
This release contains security fixes for the following advisories: Medium: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass Cache poisoning of SSG and ISR pages in self-hosted Next.js applications Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
Misc Changes [create-next-app] Enable Cache Components by default in create-next-app: #99436 Include async module evaluation in client loading metrics: #99427 turbo-tasks-backend: fix leaf distance tracing compilation: #99443 Enable proxy export tests in deploy mode: #99400 docs: record API stabilization across Next.js 16 releases: #99420 test: migrate and explain custom server deploy exclusions:…
NoteThis release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931) Credits Huge thanks to @lukesandberg for helping!
Misc Changes [test] Stabilize middleware revalidation test: #99378 test: scope loader build dependency update to Turbopack: #99380 Remove CLAUDE.md symlinks in favor of AGENTS.md: #98910 Align ExecuteContext task accessor names: #99258 [test] Stabilize responsive dev overlay header layout test: #99376 Turbopack: skip trimmed side-effect imports in SideEffectsModule: #95781 Turbopack: preserve impo…
Misc Changes Show security upgrade insights in DevTools: #99002 Use focused npm advisories and nudge only for ready upgrades: #99222 Credits Huge thanks to @devjiwonchoi for helping!
Misc Changes Explain prerelease security upgrade limits: #99230 Support latest agentic upgrades on prerelease channels: #99223 Allow agentic upgrades without Git: #99217 Credits Huge thanks to @devjiwonchoi for helping!
Misc Changes Avoid facade splits solely for export mangling: #99285 test: forward __NEXT_PARTIAL_PREFETCHING to test-deploy: #99275 Turbopack: Allow webpack loaders to cross filesystem roots when reading dependencies: #99202 Credits Huge thanks to @lukesandberg, @lubieowoce, and @bgw for helping!
Misc Changes Hoist resolved pathname into app page route match: #99259 docs: papercuts in image API reference: #99256 test: run the TypeScript version warning suites in deploy: #99195 test: drop skipDeployment where another gate already excludes deploy: #99194 bundle-analyzer: suspend while loading analyzer data: #98535 Fix Server Actions hanging after navigation to PPR pages: #99252 Fix blurry bu…
Misc Changes Prepare 'use cache' for static root-param tracking: #99239 [test] Adjust the prerender-encoding open fallback gate for non-adapter deploys: #99240 Turbopack: avoid project-wide traces from package directories: #99238 Credits Huge thanks to @unstubbable, @eps1lon, and @sokra for helping!
Misc Changes Revert "Add experimental custom webpack support": #99227 test: stabilize lazy dynamic import error overlay: #98730 turbo-tasks-gc: tear down reverse edges when collecting a task: #99145 Sequence CI for branch-based PR stacks: #99086 Prefetch scheduler mirrors the navigation's tree walk: #98975 Separate route structure comparison from param comparison: #98974 Store the head as its own…
Misc Changes [test] Fix new deploy suites: #99162 Provide only the relevant context for agent upgrade: #99189 Turbopack: Add support for additionalRoots to deployment adapters: #99015 Use Sonnet 5 with 1M context for AI upgrade handoff: #99183 docs: font per-call preload scope and the declarations font-family override: #99167 Credits Huge thanks to @eps1lon, @devjiwonchoi, @bgw, and @icyJoseph for…
Misc Changes Turbopack: chunk each layout segment once in production: #99100 bundle-analyzer: exclude traces from output types: #98536 turbo-tasks-gc: Defer most aggregation graph management until after GC has settled: #98591 Skip ESLint migration when scripts do not use next lint: #99103 Turbopack: pass RcStr to AnalyzeIssue: #99166 Use graph-backed codegen for client proxies and WASM loaders: #9…
Misc Changes Tune Node server chunking for require overhead: #99120 Turbopack: fix another "ModuleId not found for ident" regression: #99102 test: enable deploy coverage for TypeScript config errors: #98849 test: enable deploy coverage for routing build errors: #98848 test: enable deploy coverage for cache build errors: #98847 Credits Huge thanks to @sokra, @mischnic, and @jamiboym for helping!
Misc Changes [ci] Skip preview tarball upload when the artifact is missing: #98713 [cd] Retry preview tarball uploads with backoff and richer diagnostics: #99060 Promote next analyze command: #99074 [ai-upgrade] Remind the agent to report the nudge: #99127 Credits Huge thanks to @eps1lon, @wbinnssmith, and @devjiwonchoi for helping!
Misc Changes Add experimental custom webpack support: #98862 Default agentic upgrades to a separate worktree: #99111 Improve agent upgrade failure message for missing app: #99117 Preserve error boundaries in on-demand partial prerenders: #99051 Preserve error boundaries during on-demand prerendering: #99037 docs: clarify Turbopack ModulePart export examples: #99104 Add some more verification and s…
Misc Changes Keep cached root parameters out of generic fallback shells: #98950 Fix missing content in Cached Navigations: #98767 [turbopack] Track members across namespace re-exports: #96396 [PPF] Implement unstable_ensureStatic = "shell" | "prefetch": #98191 [PPF] Validate unstable_ensureStatic nesting: #98357 Replace lerna task-runner usage with pnpm: #99040 [cd] Fix release branch gate and dro…
Misc Changes [PPF] Scaffold unstable_ensureStatic segment config: #98190 [agent-feedback] Respect CI and telemetry opt-out: #99062 Fix prefetch loop when a predicted route redirects: #98998 Fix dev overlay header layout on small screens: #99049 [PPF] Separate tracking of runtime data accesses for shells and prefetches: #98129 Harden next/og SVG serialization: #99061 test: clarify dev-only intent o…
This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026
This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse
Core Changes feat(turbopack): support false values for resolveAlias config: #93331 Misc Changes Enable AI upgrade for canary: #99001 fix(turbo-persistence): preserve write errors on writer drop: #98840 Skip slow valued tombstone test under Miri: #98992 Improve the agent feedback review flow: #98937 Run AI upgrades with the latest official canary: #98870 test: move whole development-only suites out…
Misc Changes Preserve closed-parameter restrictions in client route prediction: #98889 [test] Fix deployment tests that relied on implicit startup: #98935 Turbopack: Add support for specifying additional roots: #98003 Turbopack: Add symlinks and additional roots to NFT metadata: #98469 Credits Huge thanks to @gnoff, @unstubbable, and @bgw for helping!
Misc Changes Persist resurrected tasks as new tasks: #98729 Rspack: Remove bincode dependency from rspack by way of turbo-unix-path: #98855 Pin tasks across restore waiter handoff: #98728 test: honor skipStart for Vercel deployments: #98776 Use internal prefix for Turbopack shutdown env: #98747 test: retry waiting for ISR fallback in prefetch-static-shell: #98884 Fix generated Turbopack GC option…
Misc Changes Nudge the agents for future defaults adoption: #98721 Add future defaults upgrade coverage for next upgrade --ai: #98643 Nudge the agents for latest version upgrade: #98640 Add "latest" upgrade coverage for next upgrade --ai: #98633 Nudge the agents for security vulnerable version upgrade: #98637 Add next upgrade --ai and security vulnerability coverage: #98562 agents: Add a --comment…