Next.js

Misc Changes

• Revert "Revert "[turbopack] Track re-exports in import_usage inside of compute_import_usage"": #96315
• [turbopack] Remove loader calls for dropped dynamic imports: #96284
• docs: add guide and references for experimental.useOffline: #93218

Credits

Huge thanks to @sampoder and @icyJoseph for helping!

Misc Changes

• Turbopack server hmr: avoid complete clear on graph changes: #95546
• Turbopack HMR: extract deferring build messages and use it in server hmr: #95795
• Turbopack: extract chunk list version/update into turbopack-ecmascript: #95661
• Turbopack: aggregate server HMR into one subscription: #94948

Credits

Huge thanks to @wbinnssmith for helping!

Misc Changes

• Improve root detection to handle worktrees, more workspaces & stray lockfiles: #96159
• Revert "[turbopack] Track re-exports in import_usage inside of compute_import_usage": #96311
• Return 200 for client-handled Server Action redirects: #96310
• docs(interactive-apps): update prefetching for unified runtime prefetching: #96302
• docs: clarify instrumentation-client polyfill loading and hydration timing: #95988
• [cd] Send Slack notification if publish fails: #96304
• [ci] Install Node.js from the official tarball in the native-builder image: #96298
• Upgrade React from 756fdd47-20260727 to 96fcba90-20260728: #96306
• Fix Turbopack worker URL context lookup: #96307
• [turbopack] Treat Object.defineProperty(exports, …, { value: … }) as side-effect free: #96273
• Classify Instant Insights as internal in Request Insights: #96147
• Persist Request Insights display settings: #96277
• Add Instant Insights pipeline spans: #95961
• Isolate local Request Insights spans from OpenTelemetry: #96276
• Add local Request Insights span tracing: #96275
• fix(next/image): improve test coverage for unsupported image types: #96301
• doc: typegen for typedRoutes: #96296
• feat(turbopack): support import.meta.env: #96225
• Add option to control dev memory threshold restarts: #96144
• Restore canary version 16.3.0-canary.99 after v16.3.0-preview.10 preview release
• Unify allow-runtime with Partial Prefetching: #96106
• Attempt static prefetch before resorting to runtime: #96095

Credits

Huge thanks to @sampoder, @ztanner, @aurorascharff, @icyJoseph, @eps1lon, @vercel-release-bot, @DavidIlie, @timneutkens, @styfle, and @acdlite for helping!

Misc Changes

• Unify allow-runtime with Partial Prefetching: #96106
• Attempt static prefetch before resorting to runtime: #96095
• Block prefetch task until sufficient response is received: #96017
• Use a safe clock for Request Insights bookkeeping: #96274
• Count key length in remaining byte-budgeted LRUs: #96231
• Serve cached misses from the filesystem route cache: #96230
• Count URL key length in the filesystem route cache LRU: #96229
• Turbopack: Only extend the watcher's batch window for unfiltered events: #96186
• Turbopack: Store watcher batch state with bitflags instead of 4 different sets: #96114
• docs: document query-only href resolution and fix with-vercel-blob : #96280
• Micro-optimization for string format: #95774
• Upgrade React from 28cd4bb0-20260723 to 756fdd47-20260727: #96270
• [test] Unflake more tests: #96081
• [test] Run the navigation e2e suite under cacheComponents: #95877
• [test] Run more test suites under cacheComponents flag, again: #96196
• [test] Unflake a prefetch-related race: #96222
• docs(ai-agents): restructure as steps and close 16.2/16.3 coverage gaps: #96247
• Replace vendored http-proxy with httpxy: #96060
• Update vendored @mswjs/interceptors to 0.41.9: #96059
• Track whether runtime data is accessed during prefetch: #95964
• Add Instant Insights request timing: #95958
• [turbopack] Tree-shake module.exports = {...} (CJS): #95996
• [turbopack] Fix de-opt in getChunkRelativeUrl(): #96183
• Add shell offset to static segment prefetches: #95963
• Turbopack: support import.meta.glob caseSensitive option: #96226
• fix(sandbox): release one-shot timeout ids after they run: #96161
• Fix dev overlay symbolication for project paths needing percent-encoding: #96221
• [internal] Add a skill for benching changes in a sandbox: #95943
• Run dev validation in process when using Webpack: #96219
• Read chunk source maps from disk in the dev validation worker: #96218
• Retry the source map lookup with a plain path: #96215
• Pass fallback params to the dev validation worker as maps: #96210
• [sourcemaps] Reuse source map payloads and consumers across stack frames: #96198
• fix: release compression stream when client disconnects mid-response: #96173
• Run Cache Components dev validation on a worker thread: #96153
• Add a benchmark for dev Cache Components validation on a worker thread: #96152
• [test] Unflake the enabled-features-trace test suite: #96175
• [refactor] Prepare dev validation for running on a worker thread: #96151
• Add the experimental.devValidationWorker config flag: #96150
• [refactor] Model dev validation render outputs as a discriminated union: #96149
• Forward dev invalid dynamic usage errors from the render, not validation: #96148
• Optimize implicit cache tag derivation: #96120
• Avoid quadratic HMR queue shifts: #96137
• [sourcemaps] Use file: sourcemaps for Turbopack to improve dev performance: #95946
• Give RouteCacheEntry a single hidden class across its lifecycle: #96164
• Keep optimistic-route param handling monomorphic: #96169
• Store RouteTree slots in a Map to keep slot access monomorphic: #96168
• Make reifyRouteTree object literals match the canonical RouteTree key order: #96162
• Keep VaryPath monomorphic by making isRootParam required: #96122
• docs: expand and modernize the Single-Page Applications guide: #95860
• docs: navigation interrupts after streaming has started (notFound, forbidden, unauthorized): #95851
• docs: reframe prefetching around automatic vs. controllable behavior: #95896
• docs(view-transitions): fix the skill install command: #96142
• Include additional prerender metadata about build-time routes: #96080
• Optimize app page entry analysis: #96058
• [ts-plugin] Preserve TypeScript quick info metadata: #95863
• [turbopack] Import Webpack's tests for tree-shaking: #95811
• [turbopack] Drop dead require() calls: #95718
• [turbopack] Track usage of modules imported with require(): #95717
• Return plain text 404 for non-document requests to unknown paths: #95930
• [RSC HMR] Fix a flurry of refetches when a editing component imported from many routes: #96102
• [turbopack] Track re-exports in import_usage inside of compute_import_usage: #95989
• Turbopack: Very minor improvements for watcher loop: #96103
• Turbopack: Refactor watcher event handling and batching logic: #96087
• fix: remove deprecated url.parse() from custom-server example: #96105
• Upgrade React from 711c445b-20260722 to 28cd4bb0-20260723: #96100
• Throw for empty or incomplete generateStaticParams results with output: export: #95969
• Throw when generateStaticParams returns invalid values: #95968
• Remove inert experimental.viewTransition flag: #96098
• Restore partial fallback shell upgrade coverage: #96096
• fix(next/font/google): bound Google Fonts fetch timeout on Turbopack: #95981
• Rewrite edge server source map sources in Rust, drop JS fallback: #95980
• docs: view transitions guide — skill section, source-audit fixes, flag-removal docs: #96097
• Restore canary version 16.3.0-canary.94 after v16.3.0-preview.9 preview release

Credits

Huge thanks to @acdlite, @DavidIlie, @gaearon, @bgw, @icyJoseph, @jimmyhmiller, @vercel-release-bot, @aurorascharff, @eps1lon, @timneutkens, @sampoder, @petehunt, @unstubbable, @marcoshernanz, @gnoff, @devjiwonchoi, @wasim-builds, and @lukesandberg for helping!

Initial release

Misc Changes

• fix(sandbox): release one-shot timeout ids after they run: #96161
• Fix dev overlay symbolication for project paths needing percent-encoding: #96221
• [internal] Add a skill for benching changes in a sandbox: #95943
• Run dev validation in process when using Webpack: #96219
• Read chunk source maps from disk in the dev validation worker: #96218
• Retry the source map lookup with a plain path: #96215
• Pass fallback params to the dev validation worker as maps: #96210
• [sourcemaps] Reuse source map payloads and consumers across stack frames: #96198
• fix: release compression stream when client disconnects mid-response: #96173
• Run Cache Components dev validation on a worker thread: #96153
• Add a benchmark for dev Cache Components validation on a worker thread: #96152
• [test] Unflake the enabled-features-trace test suite: #96175
• [refactor] Prepare dev validation for running on a worker thread: #96151
• Add the experimental.devValidationWorker config flag: #96150
• [refactor] Model dev validation render outputs as a discriminated union: #96149
• Forward dev invalid dynamic usage errors from the render, not validation: #96148
• Optimize implicit cache tag derivation: #96120
• Avoid quadratic HMR queue shifts: #96137

Credits

Huge thanks to @petehunt, @gaearon, @unstubbable, and @marcoshernanz for helping!

What's Changed

• Backport/docs fixes 16.2 - July round by @icyJoseph in https://github.com/vercel/next.js/pull/96031
• [Backport] Fixes to support TypeScript 7 by @lukesandberg in https://github.com/vercel/next.js/pull/95831

Full Changelog: https://github.com/vercel/next.js/compare/v16.2.11...v16.2.12

What's Changed

• [15.5] Reject TypeScript >= 7.0 with an actionable error by @lukesandberg in https://github.com/vercel/next.js/pull/96110

Full Changelog: https://github.com/vercel/next.js/compare/v15.5.21...v15.5.22

Misc Changes

• [sourcemaps] Use file: sourcemaps for Turbopack to improve dev performance: #95946
• Give RouteCacheEntry a single hidden class across its lifecycle: #96164
• Keep optimistic-route param handling monomorphic: #96169
• Store RouteTree slots in a Map to keep slot access monomorphic: #96168
• Make reifyRouteTree object literals match the canonical RouteTree key order: #96162
• Keep VaryPath monomorphic by making isRootParam required: #96122
• docs: expand and modernize the Single-Page Applications guide: #95860
• docs: navigation interrupts after streaming has started (notFound, forbidden, unauthorized): #95851
• docs: reframe prefetching around automatic vs. controllable behavior: #95896
• docs(view-transitions): fix the skill install command: #96142
• Include additional prerender metadata about build-time routes: #96080
• Optimize app page entry analysis: #96058
• [ts-plugin] Preserve TypeScript quick info metadata: #95863
• [turbopack] Import Webpack's tests for tree-shaking: #95811
• [turbopack] Drop dead require() calls: #95718
• [turbopack] Track usage of modules imported with require(): #95717
• Return plain text 404 for non-document requests to unknown paths: #95930
• [RSC HMR] Fix a flurry of refetches when a editing component imported from many routes: #96102
• [turbopack] Track re-exports in import_usage inside of compute_import_usage: #95989

Credits

Huge thanks to @gaearon, @acdlite, @aurorascharff, @gnoff, @timneutkens, @devjiwonchoi, and @sampoder for helping!

Misc Changes

• Turbopack: Very minor improvements for watcher loop: #96103
• Turbopack: Refactor watcher event handling and batching logic: #96087
• fix: remove deprecated url.parse() from custom-server example: #96105
• Upgrade React from 711c445b-20260722 to 28cd4bb0-20260723: #96100
• Throw for empty or incomplete generateStaticParams results with output: export: #95969
• Throw when generateStaticParams returns invalid values: #95968
• Remove inert experimental.viewTransition flag: #96098
• Restore partial fallback shell upgrade coverage: #96096
• fix(next/font/google): bound Google Fonts fetch timeout on Turbopack: #95981
• Rewrite edge server source map sources in Rust, drop JS fallback: #95980
• docs: view transitions guide — skill section, source-audit fixes, flag-removal docs: #96097
• Restore canary version 16.3.0-canary.94 after v16.3.0-preview.9 preview release
• [Bench] Add client-trace attribution pass and document metrics to render-pipeline: #95828
• Turbopack: Split up turbo-tasks-fs/src/lib.rs into smaller modules: #96030
• Turbopack: Use Arc and Box to make InvalidatorMap slightly more efficient: #95987
• Turbopack: Use swc_core::ecma::utils::prop_name_eq for a couple of the next-custom-transforms: #96035

Credits

Huge thanks to @bgw, @wasim-builds, @vercel-release-bot, @devjiwonchoi, @aurorascharff, @lukesandberg, and @gaearon for helping!

Misc Changes

• [Bench] Add client-trace attribution pass and document metrics to render-pipeline: #95828
• Turbopack: Split up turbo-tasks-fs/src/lib.rs into smaller modules: #96030
• Turbopack: Use Arc and Box to make InvalidatorMap slightly more efficient: #95987
• Turbopack: Use swc_core::ecma::utils::prop_name_eq for a couple of the next-custom-transforms: #96035
• [Cache Components] Exclude dynamic params from prerenders when no generateStaticParams values is provided: #95872
• Gate partialFallback behavior behind partialPrefetching flag: #96074
• [turbopack] Fix deployment skew protection for component chunks: #96079
• Turbopack: stop copying sourcesContent into every serialized source map: #95934
• Upgrade React from 81e442ea-20260721 to 711c445b-20260722: #96066
• fix: cache miss in App Shell for cached pages with gSP: #95665
• skill(cc-adoption): add dev-only validation sweep reference: #96057
• Refine Cache Components and Partial Prefetching adoption skills: #95817
• [test] Move the dev-only use cache test suite to test/development: #96023
• Fix stale dev 'use cache' for cookieless requests and route handlers: #96022
• [test] Add failing tests for stale route handler and page cached data: #96021
• Add a dedicated HMR message for static params changes: #96020
• Emit the static paths HMR update after updating the cache: #96019
• [test] Add source-mapping coverage of React's fake stack frame scripts in use cache: #95945
• Fix basePath fallback parameter parsing: #95966
• Restore canary version 16.3.0-canary.93 after v16.3.0-preview.8 preview release

Credits

Huge thanks to @gaearon, @bgw, @gnoff, @acdlite, @sampoder, @vercel-release-bot, @lubieowoce, @aurorascharff, @unstubbable, and @timneutkens for helping!

Misc Changes

• [Cache Components] Exclude dynamic params from prerenders when no generateStaticParams values is provided: #95872
• Gate partialFallback behavior behind partialPrefetching flag: #96074
• [turbopack] Fix deployment skew protection for component chunks: #96079
• Turbopack: stop copying sourcesContent into every serialized source map: #95934
• Upgrade React from 81e442ea-20260721 to 711c445b-20260722: #96066
• fix: cache miss in App Shell for cached pages with gSP: #95665
• skill(cc-adoption): add dev-only validation sweep reference: #96057
• Refine Cache Components and Partial Prefetching adoption skills: #95817
• [test] Move the dev-only use cache test suite to test/development: #96023
• Fix stale dev 'use cache' for cookieless requests and route handlers: #96022
• [test] Add failing tests for stale route handler and page cached data: #96021
• Add a dedicated HMR message for static params changes: #96020
• Emit the static paths HMR update after updating the cache: #96019
• [test] Add source-mapping coverage of React's fake stack frame scripts in use cache: #95945
• Fix basePath fallback parameter parsing: #95966
• Restore canary version 16.3.0-canary.93 after v16.3.0-preview.8 preview release
• Always consult npm_config_user_agent first: #95879
• Rewrite next-cache-components-optimizer around a test-driven instant() loop: #94721

Credits

Huge thanks to @gnoff, @acdlite, @sampoder, @gaearon, @vercel-release-bot, @lubieowoce, @aurorascharff, @unstubbable, @timneutkens, @eps1lon, and @gaojude for helping!

Misc Changes

• Always consult npm_config_user_agent first: #95879
• Rewrite next-cache-components-optimizer around a test-driven instant() loop: #94721
• docs: attribute App Shell prefetch to Partial Prefetching: #96003
• Turbopack: Remove chunk group id from value of chunk groups map: #95142
• [ci] Enforce minimumReleaseAge in e2e tests that install external dependencies: #95628
• Turbopack: Fix missing canonicalization of paths and always use verbatim paths internally for Windows: #95668
• Revert "[turbopack] Don't SSR on pages only navigated to through a soft nav (#95539)": #96028
• Turbopack: Use Arc<PathBuf> for keys in turbo-task-fs's per-path MutexMap: #95951
• chore(deps): bump sharp@0.35.3: #95507
• [turbopack] Tree-shake CJS exports that use the Object.defineProperty syntax: #95994
• Restore canary version 16.3.0-canary.92 after v16.3.0-preview.7 preview release

Credits

Huge thanks to @eps1lon, @gaojude, @icyJoseph, @bgw, @sampoder, and @styfle for helping!

Misc Changes

• docs: attribute App Shell prefetch to Partial Prefetching: #96003
• Turbopack: Remove chunk group id from value of chunk groups map: #95142
• [ci] Enforce minimumReleaseAge in e2e tests that install external dependencies: #95628
• Turbopack: Fix missing canonicalization of paths and always use verbatim paths internally for Windows: #95668
• Revert "[turbopack] Don't SSR on pages only navigated to through a soft nav (#95539)": #96028
• Turbopack: Use Arc<PathBuf> for keys in turbo-task-fs's per-path MutexMap: #95951
• chore(deps): bump sharp@0.35.3: #95507
• [turbopack] Tree-shake CJS exports that use the Object.defineProperty syntax: #95994
• Restore canary version 16.3.0-canary.92 after v16.3.0-preview.7 preview release

Credits

Huge thanks to @icyJoseph, @bgw, @sampoder, and @styfle for helping!

Example Changes

• fix: error handling and loading states in with-apollo-and-redux example: #91457

Misc Changes

• Upgrade React from 172742b4-20260716 to 81e442ea-20260721: #96016
• Fix Turbopack middleware matcher with i18n single locale: #96014
• Improve performance of validating MPA form submissions: #96013
• Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime: #96012
• Set correct origin for internal redirects in custom server: #96011
• Ensure exotic rewrite param values are properly encoded: #96010
• fix(fetch-cache): key fetch(Request, init) by the effective request: #96009
• fix(incremental-cache): byte-exact fetch cache key for binary bodies: #96008
• Validate server reference IDs during manifest lookup: #96007
• fix(next/image): improve performance of detectContentType() : #96006
• Preserve basePath in redirect destinations: #95608
• [ci] Skip passed-tests cache steps for jobs that never run tests: #96001
• docs: add upgrade section to installation and expand AI agents guide: #95861
• docs: fix unstable_cache syntax error: #96002
• Insights: use a single Learn more link in console errors: #95967
• Refine development validation signal handling: #95998
• Include examples of static export tools & GitHub Pages template: #95929
• docs: note the :has() scaling limit in the Interactive apps guide: #95925
• Prevent unhandled rejections when a "use cache" cache handler errors: #95985
• [test] Add coverage for throwing custom "use cache" cache handler: #95984
• docs: clarify layout.js nesting behavior in route groups: #95720
• Fix instant validation blocking navigations: #95939
• [ci] Share a single browser instance across all test suites in a single job: #95589
• [turbopack] Rename turbopackTreeShaking to turbopackModuleFragments: #95978
• cna: use LayoutProps helper in TS layout templates: #95675
• [turbopack] Skip redundant top-level root updates: #95903
• [turbopack] Drop unused exports from a CJS module: #95716
• Turbopack: Simplify parent directory creation retry loop logic: #95835
• Run Rust doctests in CI: #95911
• docs: add 'Set up your editor' to the installation guide: #95928
• fix(cms-contentful): await draftMode() and use Promise<> params type: #95631
• Move outputHashSalt out of experimental: #95840
• Move immutable static assets config option out of experimental: #95351
• [instant] Let dev-server requests bypass the fetch lock: #95761
• Upgrade React from 7023f501-20260714 to 172742b4-20260716: #95901
• Fix Rust doctest failures: #95909
• [turbopack] Clean up server_chunking_context: #95908
• [turbopack] Don't SSR on pages only navigated to through a soft nav: #95539
• Package skills/ as a Claude Code plugin: #95907
• [ci] Avoid apt-get in the next-stats-action Docker image: #95847
• Back/forward set the Nav Inspector back to pending: #95865
• fix(agent-rules): pad managed AGENTS.md block with blank lines: #95892
• Revert "Run more test suites under cacheComponents flag": #95884
• Fix repeated navigations while the Instant Navigation lock is held: #95864
• Run more test suites under cacheComponents flag: #95878
• Unify appShells flag with Partial Prefetching: #95415
• Fix Request Insights span collection: #95818
• Revert "Replay same-document traversals that happen before hydration": #95853
• [ci] Allow running all deploy tests with builds from a private registry: #95784
• [turbopack] Only ship pages-router routes in the client chunk-group bootstrap manifest: #94671
• [turbopack] Inline the chunk group bootstrap in Next.js to drop the per-route runtime: #94666
• [turbopack] Add chunk_group_bootstrap_params and the chunk-loading global to the build manifest: #94663
• [turbopack] Add registerEntry() to handle inline bootstrapping: #94664
• [turbopack] Add inline_chunk_group_bootstrap to BrowserChunkingContext and chunk_group_bootstrap_params to ChunkGroupResult: #94661
• [turbopack] Create a chunk_group_bootstrap_params() function: #94631
• [turbopack] Create a shared asset with browser runtime code: #94586
• Turbopack: trace externals imported only by server actions: #95824
• [turbopack] Generate component chunks for each merged group to increase cache hits: #95261
• Exclude stale under 5 minutes from app shells: #95833
• docs: remove experimental @next/routing note: #94903
• [turbopack] Tell agents not to mention next.config.js options: #95825
• chore: Remove stale build warning: #95813
• Replay same-document traversals that happen before hydration: #95682
• docs: cssChunking graph option: #95693
• [Bench] Extend bench app to have realistic client chunk counts: #95814
• Add more realistic bench fixtures: #95807
• Fix Request Insights subscription initialization: #95794
• Model async userland loading in app routes as a state machine: #95791
• Preserve init errors from async route modules: #95799
• Fix cache warming and static params for metadata images with top-level await: #95790
• Only track pending imports for real promises: #95789
• Support metadata routes in --debug-build-paths: #95788
• Respect NEXT_HASH_SALT for server side assetsHashes: #95738
• telemetry: add agentName to anonymous metadata: #95586
• [turbopack] Optimize the implementation of AutoMap/AutoSet : #95694
• Better support the CLI spinner when running the TSC CLI: #95753
• Upgrade React from 5123b063-20260708 to 7023f501-20260714: #95782
• docs: add route-side URL data audit to the Partial Prefetching adoption guide: #95389
• docs: revalidateTag with expire zero, for route handlers: #95760
• request insights: add DevTools request panel (5/5): #93978
• docs: Improve immutable static docs: #95752
• Add React sync development skill: #95620
• docs: useSearchParams example stray link: #95759
• Improve the NFT error message and ignore comment handling: #95144
• Upgrade to swc 73: #95731
• [turbopack] Switch make_production_chunks to use floats: #95749
• Fix termination handling: #95692
• Restore canary version 16.3.0-canary.84 after v16.3.0-preview.6 preview release

Credits

Huge thanks to @vercel-release-bot, @eps1lon, @ZaforAbdullah, @gaojude, @aurorascharff, @icyJoseph, @timneutkens, @WildChargerTV, @ankurdotio, @bgw, @sampoder, @marcoshernanz, @manoraj, @mischnic, @acdlite, @gaearon, @gnoff, @andrewimm, @lukesandberg, and @feedthejim for helping!

Example Changes

• fix: error handling and loading states in with-apollo-and-redux example: #91457

Misc Changes

• Upgrade React from 172742b4-20260716 to 81e442ea-20260721: #96016
• Fix Turbopack middleware matcher with i18n single locale: #96014
• Improve performance of validating MPA form submissions: #96013
• Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime: #96012
• Set correct origin for internal redirects in custom server: #96011
• Ensure exotic rewrite param values are properly encoded: #96010
• fix(fetch-cache): key fetch(Request, init) by the effective request: #96009
• fix(incremental-cache): byte-exact fetch cache key for binary bodies: #96008
• Validate server reference IDs during manifest lookup: #96007
• fix(next/image): improve performance of detectContentType() : #96006
• Preserve basePath in redirect destinations: #95608
• [ci] Skip passed-tests cache steps for jobs that never run tests: #96001
• docs: add upgrade section to installation and expand AI agents guide: #95861
• docs: fix unstable_cache syntax error: #96002
• Insights: use a single Learn more link in console errors: #95967
• Refine development validation signal handling: #95998
• Include examples of static export tools & GitHub Pages template: #95929
• docs: note the :has() scaling limit in the Interactive apps guide: #95925
• Prevent unhandled rejections when a "use cache" cache handler errors: #95985
• [test] Add coverage for throwing custom "use cache" cache handler: #95984
• docs: clarify layout.js nesting behavior in route groups: #95720
• Fix instant validation blocking navigations: #95939
• [ci] Share a single browser instance across all test suites in a single job: #95589
• [turbopack] Rename turbopackTreeShaking to turbopackModuleFragments: #95978
• cna: use LayoutProps helper in TS layout templates: #95675

Credits

Huge thanks to @vercel-release-bot, @eps1lon, @ZaforAbdullah, @gaojude, @aurorascharff, @icyJoseph, @timneutkens, @WildChargerTV, @ankurdotio, @bgw, and @sampoder for helping!

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

Misc Changes

• [turbopack] Skip redundant top-level root updates: #95903
• [turbopack] Drop unused exports from a CJS module: #95716
• Turbopack: Simplify parent directory creation retry loop logic: #95835
• Run Rust doctests in CI: #95911
• docs: add 'Set up your editor' to the installation guide: #95928
• fix(cms-contentful): await draftMode() and use Promise<> params type: #95631
• Move outputHashSalt out of experimental: #95840
• Move immutable static assets config option out of experimental: #95351
• [instant] Let dev-server requests bypass the fetch lock: #95761

Credits

Huge thanks to @marcoshernanz, @sampoder, @bgw, @aurorascharff, @manoraj, @mischnic, and @eps1lon for helping!