Update dependency next to v16.3.8 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	16.2.12 → 16.3.8

---

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

CVE-2026-75604 / GHSA-p293-qw3h-jr36

More information

Details

Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

Severity

• CVSS Score: 9.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
• https://nvd.nist.gov/vuln/detail/CVE-2026-75604
• https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b
• https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3
• https://github.com/vercel/next.js/releases/tag/v15.5.24
• https://github.com/vercel/next.js/releases/tag/v16.3.3
• https://github.com/advisories/GHSA-p293-qw3h-jr36

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

GHSA-2xp9-vwfh-vxw4

More information

Details

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

Until a fix has propagated, optimization of AVIF files is disabled.

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
• https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4
• https://github.com/vercel/next.js/pull/97875
• https://github.com/vercel/next.js/pull/97931
• https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3
• https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2
• https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998
• https://github.com/vercel/next.js/releases/tag/v15.5.24
• https://github.com/vercel/next.js/releases/tag/v16.3.3
• https://github.com/advisories/GHSA-2xp9-vwfh-vxw4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Remote Code Execution in next/og ImageResponse

GHSA-vcvr-r3jv-pc5j

More information

Details

Impact

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution.

Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:

import { ImageResponse } from 'next/og'

export async function GET(request: Request) {
  const value = new URL(request.url).searchParams.get('value') ?? ''

  return new ImageResponse(
    <svg width="1200" height="630">
      <title>{value}</title>
    </svg>
  )
}

Applications using the Edge ImageResponse implementation, or applications that do not pass attacker-controlled values into SVG content, attributes, or styles, are not affected.

Workaround

If upgrading is not immediately possible, do not pass attacker-controlled values into SVG content, attributes, or styles rendered by the Node.js ImageResponse implementation from next/og.

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j
• https://github.com/vercel/satori/security/advisories/GHSA-wx4j-mvgx-mqwp
• https://github.com/vercel/next.js/commit/868fad38690d72088868f299fa2bef339b26838e
• https://github.com/vercel/next.js/releases/tag/v16.3.6
• https://github.com/advisories/GHSA-vcvr-r3jv-pc5j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js has Server-Side Request Forgery in Image Optimization

CVE-2026-94483 / GHSA-cjq9-62q9-8jv4

More information

Details

Impact

An attacker-controlled, allow-listed remote URL can lead to server-side request forgery (e.g. to private IPs) during Image Optimization.

Workaround

Audit allow-listed remote URLs in images.remotePatterns (see https://nextjs.org/docs/app/getting-started/images#remote-images) for hosts that may not be trusted with their DNS entries. If no images.remotePatterns are configured, your app is not affected.

Severity

• CVSS Score: 8.3 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-cjq9-62q9-8jv4
• https://nvd.nist.gov/vuln/detail/CVE-2026-94483
• https://github.com/vercel/next.js/commit/e002ad68bd676bb0ed0c87bb22e3590304763e0b
• https://github.com/vercel/next.js/releases/tag/v16.3.8
• https://github.com/advisories/GHSA-cjq9-62q9-8jv4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service

CVE-2026-94484 / GHSA-mcj8-r9mp-w47p

More information

Details

Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-mcj8-r9mp-w47p
• https://nvd.nist.gov/vuln/detail/CVE-2026-94484
• https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8
• https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
• https://github.com/vercel/next.js/releases/tag/v15.5.27
• https://github.com/vercel/next.js/releases/tag/v16.3.8
• https://github.com/advisories/GHSA-mcj8-r9mp-w47p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass

CVE-2026-94485 / GHSA-f87g-xv8r-7p7x

More information

Details

In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams().

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-f87g-xv8r-7p7x
• https://nvd.nist.gov/vuln/detail/CVE-2026-94485
• https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476
• https://github.com/vercel/next.js/releases/tag/v16.3.8
• https://github.com/advisories/GHSA-f87g-xv8r-7p7x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js has information disclosure in development server's Model Context Protocol endpoint

CVE-2026-94486 / GHSA-39w2-rjm5-chcv

More information

Details

The Next.js development server (next dev) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs. Only applications run with next dev are affected. Production deployments do not serve this endpoint.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-39w2-rjm5-chcv
• https://nvd.nist.gov/vuln/detail/CVE-2026-94486
• https://github.com/vercel/next.js/commit/2d9f50a409312696145b82b3157aadb6b1fef476
• https://github.com/vercel/next.js/releases/tag/v16.3.8
• https://github.com/advisories/GHSA-39w2-rjm5-chcv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

CVE-2026-94543 / GHSA-4jqv-mc3x-m676

More information

Details

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676
• https://nvd.nist.gov/vuln/detail/CVE-2026-94543
• https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311b8
• https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a52
• https://github.com/vercel/next.js/releases/tag/v15.5.27
• https://github.com/vercel/next.js/releases/tag/v16.3.8
• https://github.com/advisories/GHSA-4jqv-mc3x-m676

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v16.3.8

Compare Source

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#​98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

Compare Source

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

Compare Source

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#​98185)
• next/image: Reject empty images when reading/writing to the disk cache (#​98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#​98167)
• Add CSP nonce to script tags of loading and template files (#​98403)
• Fix use cache prerender signal retention (#​98448)

v16.3.4

Compare Source

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#​97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#​97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#​97997)
• Fix unset crossOrigin in Turbopack manifests (#​97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#​97357)
• [backport] Fix catch-all index page being served for every other slug (#​97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#​97353) (#​97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#​97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#​97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#​97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

Compare Source

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in #​96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in #​96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in #​96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in #​96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in #​96900
• [backport] Bump @​swc/helpers by @​mischnic in #​96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in #​97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in #​97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in #​97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in #​97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in #​97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in #​97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in #​97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in #​97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in #​97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in #​97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in #​97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in #​97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in #​97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#​94905) by @​gaojude in #​97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.0

Compare Source

Core Changes

• Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #​91558
• Fix invalid HTML response for route-level RSC requests in deployment adapter: #​91541
• Normalize encoded dynamic placeholders in app routes: #​91603
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #​90304
• Update tokio from 1.43.0 to 1.47.3: #​90945
• [turbopack] Simplify snapshotting logic: #​91178
• Turbopack: enable server HMR for app route handlers: #​91466
• turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #​91497
• [turbopack] Use bail! instead of panic! for duplicate module ident error: #​91636
• Skip loadBindings() Lightning CSS check during next start: #​91538
• turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #​91461
• Turbopack: Add importModule() support to webpack loaders: #​89630
• turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #​91640
• turbopack-css: demote recoverable CSS parse warnings to Warning severity: #​91524
• feat(node-streams): add config flag, define-env, and env precedence test: #​90427
• Rename /_next/webpack-hmr to /_next/hmr: #​91415
• Add per-slot error attribution for instant validation using slot markers and config depth preference: #​91610
• Handle encoded params further: #​91627
• [turbopack] Respect {eval:true} in worker_threads constructors: #​91666
• Fix missing route in otel spans without base-server: #​91665
• [turbopack] Optimize compaction cpu usage: #​91468
• Fix layout segment optimization: move app-page imports to server-utility transition: #​91701
• Fix server actions in standalone mode with cacheComponents: #​91711
• turbo-persistence: remove Unmergeable mmap advice: #​91713
• turbopack: move "compact database" tracing span to backend layer: #​91693
• Turbopack: lazy require metadata and handle TLA: #​91705
• Fix adapter outputs for dynamic metadata routes: #​91680
• Turbopack: fix webpack loader runner layer: #​91727
• [turbopack] Remove incorrect debug_assert in try_read_task_cell: #​91699
• Add module count field to module graph tracing spans: #​91697
• turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #​91657
• Turbopack: pull in updated vercel/nft tests: #​91651
• [turbopack] Improve regressed build speed on cross-compiled MUSL: #​91477
• [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #​91320
• [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #​91438
• Avoid deprecated TS node10 moduleResolution defaults: #​91847
• [turbopack] Rebuild the docker build scripts: #​91799
• Fix TS6 baseUrl deprecation for extended tsconfig: #​91855
• Add next internal post-build CLI command for Turbopack database compaction: #​91336
• Turbopack: Define Effect as a trait instead of a closure: #​89080
• Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #​89133
• turbo-tasks-backend: improve print_cache_item_size instrumentation: #​91742
• Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #​91832
• Use charCodeAt for normalizePathTrailingSlash: #​91380
• Turbopack: Only patch lockfile when bindings fails to load: #​91379
• [create-next-app] Skip interactive prompts when CLI flags are provided: #​91840
• [devtools] Make instant navs panel draggable: #​91914
• [Segment Bundling] Bundle static prefetches based on size: #​91439
• turbo-tasks-backend: assert non-transient task_ids in track_modification: #​91924
• fix(turbopack): preserve resolveExtensions priority in read_matches fast path: #​91856
• turbopack: Remove Vc::resolve(), migrate all callsites to Vc::to_resolved(): #​91725
• turbo-tasks: add hashed cell mode for hash-based change detection without cell data: #​91576
• [cna] Upgrade to Biome 2.4 with Tailwind support: #​86065
• [devtools] Show AggregateError.errors in the error overlay: #​91835
• Narrow the opengraph-image function return type: #​91893
• [experiment] Add useOffline flag with offline retry behavior: #​92011
• adapters: remove unused suffix code: #​91997
• [experiment] Add useOffline hook to expose offline state to userland: #​92012
• [turbopack] Don't use turborepo to build the docker image: #​92029
• Use RcStr directly in napi(object) structs instead of converting to String: #​92014
• Rename SingleModuleReference::asset to SingleModuleReference::module: #​92028
• Revert "turbo-tasks: add hashed cell mode for hash-based change detection without cell data": #​92103
• [ftl] Include cause of route types: #​92056
• fix: handle file:// URLs from import.meta.resolve in cache handler path (fixes #​73796): #​90370
• Turbopack: exclude metadata routes from server HMR: #​92034
• next.config.js: Accept an option for serverFastRefresh: #​91968
• TURBOPACK: support parse windows absolute path with single slash: #​92076
• Enable varyParams tracking for Cached Navigations: #​92113
• telemetry: set turboFlag correctly: #​92149
• Instant Validation: Allow unconfigured slots to render optionally: #​92126
• Turbopack: statically evaluate path.sep: #​92150
• Turbopack: use same hash for immutable-static-hashes.json: #​92157
• [turbopack] replace regex with indexof: #​92023
• Turbopack: createRequire(new URL("...", import.meta.url)): #​92153
• Add PPR evals and fix env loading for agent-eval 0.9.5: #​92063
• Turbopack: support targeting even older browsers: #​91563
• Add rust-fingerprint task and SCCACHE passthrough env: #​92167
• Improve error message for deprecated experimental.dynamicIO config: #​92081
• [turbopack] Fix CSS HMR on Safari: #​92123
• simplify session dependent tasks and add TTL support: #​91729
• disable bmi2 in qfilter: #​92177
• Improve revalidateTag JSDoc to include guidance about required second parameter: #​92176
• fix: pin 19 actions to commit SHA, extract 7 expressions to env vars: #​92016
• partial fallbacks: adapter support for intermediate shells: #​91902
• Turbopack: trace fs.readdir calls: #​92148
• feat: add NEXT_HASH_SALT env var for content-hash filename salting: #​91871
• Fix DashMap read-write self-deadlock in task_cache causing hangs: #​92210
• [turbopack] use a single query parameter for cache busting: #​92214
• Generate a CLI warning if using Rosetta 2 on Apple Silicon: #​92220
• remove the loop from StaticSortedFile::lookup: #​91688
• Add telemetry for adapterPath config usage: #​92228
• Node.js streams: First pass: #​90500
• fix: preserve HTTP access fallbacks during prerender recovery: #​92231
• Remove unnecessary ALS re-exports from entry-base.ts: #​91527
• Allow multi-level .localhost subdomains in dev origin check: #​92262
• turbo-tasks-backend: stability fixes for task cancellation and error handling: #​92254
• Add MCP get_compilation_issues tool and NAPI method: #​92062
• Add view transitions eval (agent-043): #​92260
• [turbopack] optimize RcStr parsing: #​91773
• Ensure app-page reports stale ISR revalidation errors via onRequestError: #​92282
• Move streamToUint8Array back to node-web-streams-helper.ts: #​92263
• Revert "simplify session dependent tasks and add TTL support (#​91729)": #​92320
• fix: add @​deprecated annotation to experimental.useCache: #​92316
• Improve existing dev server error message to suggest using it: #​92317
• Restart the next dev server if .next is deleted: #​92135
• Update Rust toolchain to nightly-2026-04-02: #​92288
• Turbopack: Remove FileSystemPath::value_to_string in favor of ValueToStringRef::to_string_ref: #​92284
• [turbopack] use zero copy qfilter deserialization: #​90574
• feat: add experimental.swcEnvOptions for SWC preset-env configuration: #​92272
• Turbopack: Dedupe our two filesystempath extension/extension_ref functions: #​92048
• turbo-tasks: replace async resolve fns with custom Future types (ResolveRawVcFuture, ResolveVcFuture, ToResolvedVcFuture): #​91554
• next-core: deduplicate output assets and detect content conflicts on emit: #​92292
• Handle edge runtime in places that import node:stream: #​92354
• Fix fallback route params case in app-page handler: #​91737
• use sorted inserts to improve builder performance: #​91553
• Allow for parsing app route strings with and without slot names.: #​92327
• fix(server-hmr): metadata routes overwrite page runtime HMR handler: #​92273
• turbo-persistence: optimize file syncing: #​90542
• Turbopack: Remove turbo_tasks::apply_effects, use Effects::apply instead: #​91858
• Turbopack: Add a check for node version before allowing workerThreads: #​91614
• turbo-persistence: skip BlockCache for uncompressed (mmap-backed) blocks: #​92390
• Include more context in macOS Rosetta 2 warning message: #​92436
• change the process name of builds: #​92411
• turbo-persistence: pin referenced BlockCache entries to prevent eviction: #​92361
• Fix styled-jsx race condition: styles lost due to concurrent rendering: #​92459
• turbo-tasks: fix hashed cell mode crash on task error (re-land #​91576): #​92108
• Fix sst inspect tool to respect CURRENT and stale sst files: #​92414
• Optimize how we track data for persistence: #​89370
• [turbopack] add family name to many spans: #​92415
• Route Handlers: Fix devRequestTimingInternalsEnd and Turbopack server HMR: #​92271
• next-routing: middleware matching and app request URL normalization: #​91859
• turbo-persistence: Use AtomicBool for is_empty() to avoid lock contention: #​92481
• fix: mention params and searchParams in blocking-route error messages: #​92360
• CPU prof: Write profiles to .next-profiles instead of .next/cpu-profiles: #​92078
• Turbopack: Write trace file to .next-profiles: #​92189
• feat: generate root params types: #​91019
• fix: resolve function configs in unstable_getResponseFromNextConfig: #​92501
• Node.js streams: Fork points: #​92252
• Turbopack: Add --internal-trace cli flag: #​92190
• Fix minimumReleaseAgeExclude for React and friends: #​92535
• Add experimental unstable_io() API behind experimental.unstableIO flag: #​92521
• Update React from 74568e86-20260328 to 404b38c7-20260408: #​92536
• Turbopack: switch from immutable token to path prefix: #​92164
• [build info]: distinguish between PPR and fully static routes in gSP: #​92518
• [build info]: omit symbol from top level gSP route: #​92525
• turbo-tasks-backend: prevent duplicate task restores with restoring bits: #​92389
• Add next internal upload-trace: #​92191
• Request logging: Fix generate-params time being included in next.js time: #​91386
• fix: scope "Pages Router only" comment to default export in next/error: #​92566
• Turbopack Build: Remove dev fouc from production bundle: #​80935
• Turbopack: Improve unable to resolve next error: #​91394
• fix(hmr): reconnect WebSocket after sleep/wake: #​91416
• Handle target option in React Compiler for Pages + React 18: #​91500
• Replace wasmer with wasmtime for SWC plugin WASM engine: #​91533
• turbopack: fix incremental build when module factories are restored from persistent cache: #​92569
• [turbopack] Rust dependency caching via sccache: #​91873
• trace: detect rage restarts and deleted .next dirs: #​92489
• [turbopack] fix a debug_assert failure: #​92581
• Don't swallow strings thrown in Server Components: #​92592
• Fix NextFontIssue IssueStage: CodeGen → Resolve: #​92588
• Node.js streams: Add forkpoint for CacheComponents: #​92444
• Resolve compilerOptions.paths in tsconfigs without compilerOptions.baseUrl: #​92277
• Turbopack: extract inline base64 decode helper to shared @turbopack/base64 module: #​92549
• Add codemod command to middleware deprecation warning: #​92532
• turbopack: move CSS module composes validation from code generation to resolving: #​92582
• Drop turbo_tasks::function from ValueDebug trait items: #​92593
• [partial fallbacks]: enable by default: #​92627
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false): #​92631
• Turbopack: cut number of client references in half: #​92607
• Remove a ton of turbo task functions from Issue trait items: #​92623
• feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution: #​91338
• feat(turbopack): change DiskFileSystem root to Vc for portable cache: #​92603
• Turbopack: remove unused ChunkableModules struct: #​92606
• Fix segment explorer file pill accessibility: #​92608
• Disable sccache temporarily: #​92657
• Delete some dead turbo task functions: #​92596
• Node.js streams: Add forkpoint for error recovery: #​92457
• turbo-tasks: Drop output_dependent on immutable task completion: #​92683
• Turbopack: properly remove unused TS enums with scope hoisting: #​88205
• fix(server-actions): skip type-only ExportNamed in pre-pass to prevent phantom registerServerReference: #​92494
• Turbopack: Add import.meta.glob support (Vite compat): #​92640
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation: #​92725
• TURBOPACK: support crsossOriginLoading: #​92070
• Compiler: Support boolean and number primtives in next.config defines: #​92731
• Fix prefetch hints not being loaded during revalidation: #​92625
• Exclude trace files from directory deletion in builds: #​92486
• Switch segment prefetch cache miss response from 204 to 404: #​92751
• Ensure x-nextjs-data header is only set during resolve: #​92752
• feat(trace-server): add query CLI and MCP API to turbopack-trace-server: #​92030
• Improve error stacks for dynamic API usage in "use cache": #​92736
• Node.js streams: Add forkpoint for continueDynamicHTMLResume: #​92471
• Node.js streams: Add forkpoint for generateDynamicFlightRenderResult: #​92474
• Node.js streams: Add forkpoint for generateStagedDynamicFlightRenderResult: #​92509
• Add unstable_prefetch route segment config and decouple runtime prefetching from unstable_instant: #​92754
• feat(turbo-tasks-backend): gate prepare_tasks_with_callback trace span behind feature flag: #​92779
• Update next versions of internal apps: #​92666
• turbo-persistence: stop background persisting after unrecoverable failure: #​92106
• Stop using deprecated downlevelIteration: #​92652
• Disable build caches for production/staging/force-preview deploys: #​92792
• Fix turbo cache flag: use --force: #​92796
• Fix devlow-bench: tsconfig rootDir mismatch with package.json bin: #​92800
• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router): #​92580
• Enable wasm plugins on windows arm: #​92544
• prefetchInlining: fix build crash on notFound() pages: #​92806
• turbopack: gate ValueDebugFormat and ValueDebug behind debug_assertions: #​92628
• Add TurboMalloc::thread_park() to flush and collect on thread park: #​92804
• Stop using deprecated baseUrl: #​92653
• Turbopack: Use FrozenMap for module export information: #​92802
• Turbopack: remove webpack chunk detection: #​92773
• Turbopack: refactor ESM codegen generation: #​92777
• Fix monorepo @next/swc binary postinstall: #​92813
• webpack: fix swcPlugins with relative paths: #​92770
• Turbopack: shorter error for ChunkGroupInfo::get_index_of: [#​92814](https://redirect.github.co

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.41%. Comparing base (365c96a) to head (dc79763).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #887   +/-   ##
=======================================
  Coverage   43.41%   43.41%           
=======================================
  Files          25       25           
  Lines         258      258           
  Branches       46       46           
=======================================
  Hits          112      112           
  Misses        146      146           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.