fix(deps): update dependency next to v16.1.7 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	15.3.8 → 16.1.7
next (source)	16.0.10 → 16.1.7
next (source)	16.1.6 → 16.1.7
next (source)	15.4.10 → 16.1.7
next (source)	15.5.9 → 16.1.7

---

Next.js Improper Middleware Redirect Handling Leads to SSRF

CVE-2025-57822 / GHSA-4342-x723-ch2f

More information

Details

A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.

All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.

More details at Vercel Changelog

Severity

• CVSS Score: 6.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-4342-x723-ch2f
• https://github.com/vercel/next.js/commit/9c9aaed5bb9338ef31b0517ccf0ab4414f2093d8
• https://vercel.com/changelog/cve-2025-57822
• https://nvd.nist.gov/vuln/detail/CVE-2025-57822
• https://github.com/advisories/GHSA-4342-x723-ch2f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Content Injection Vulnerability for Image Optimization

CVE-2025-55173 / GHSA-xv57-4mr9-wg8v

More information

Details

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery.

All users relying on images.domains or images.remotePatterns are encouraged to upgrade and verify that external image sources are strictly validated.

More details at Vercel Changelog

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-xv57-4mr9-wg8v
• https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
• http://vercel.com/changelog/cve-2025-55173
• https://nvd.nist.gov/vuln/detail/CVE-2025-55173
• https://vercel.com/changelog/cve-2025-55173
• https://github.com/advisories/GHSA-xv57-4mr9-wg8v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

CVE-2025-57752 / GHSA-g5qg-72qw-gw5v

More information

Details

A vulnerability in Next.js Image Optimization has been fixed in v15.4.5 and v14.2.31. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug.

All users are encouraged to upgrade if they use API routes to serve images that depend on request headers and have image optimization enabled.

More details at Vercel Changelog

Severity

• CVSS Score: 6.2 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-g5qg-72qw-gw5v
• https://github.com/vercel/next.js/pull/82114
• https://github.com/vercel/next.js/commit/6b12c60c61ee80cb0443ccd20de82ca9b4422ddd
• https://vercel.com/changelog/cve-2025-57752
• https://nvd.nist.gov/vuln/detail/CVE-2025-57752
• https://github.com/advisories/GHSA-g5qg-72qw-gw5v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration

CVE-2025-59471 / GHSA-9g9p-9gw9-jx7f

More information

Details

A DoS vulnerability exists in self-hosted Next.js applications that have remotePatterns configured for the Image Optimizer. The image optimization endpoint (/_next/image) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that remotePatterns is configured to allow image optimization from external domains and that the attacker can serve or control a large image on an allowed domain.

Strongly consider upgrading to 15.5.10 and 16.1.5 to reduce risk and prevent availability issues in Next applications.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-9g9p-9gw9-jx7f
• https://nvd.nist.gov/vuln/detail/CVE-2025-59471
• https://github.com/vercel/next.js/commit/500ec83743639addceaede95e95913398975156c
• https://github.com/vercel/next.js/commit/e5b834d208fe0edf64aa26b5d76dcf6a176500ec
• https://github.com/vercel/next.js/releases/tag/v15.5.10
• https://github.com/vercel/next.js/releases/tag/v16.1.5
• https://github.com/advisories/GHSA-9g9p-9gw9-jx7f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

GHSA-h25m-26qc-wcjf

More information

Details

A vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23864.

A specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-memory exceptions, or server crashes. This can result in denial of service in unpatched environments.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg
• https://github.com/vercel/next.js/security/advisories/GHSA-h25m-26qc-wcjf
• https://nvd.nist.gov/vuln/detail/CVE-2026-23864
• https://vercel.com/changelog/summary-of-cve-2026-23864
• https://github.com/advisories/GHSA-h25m-26qc-wcjf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: HTTP request smuggling in rewrites

CVE-2026-29057 / GHSA-ggv3-7p47-pfv8

More information

Details

Summary

When Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes.

Impact

An attacker could smuggle a second request to unintended backend routes (for example, internal/admin endpoints), bypassing assumptions that only the configured rewrite destination/path is reachable. This does not impact applications hosted on providers that handle rewrites at the CDN level, such as Vercel.

Patches

The vulnerability originated in an upstream library vendored by Next.js. It is fixed by updating that dependency’s behavior so content-length: 0 is added only when both content-length and transfer-encoding are absent, and transfer-encoding is no longer removed in that code path.

Workarounds

If upgrade is not immediately possible:

• Block chunked DELETE/OPTIONS requests on rewritten routes at your edge/proxy.
• Enforce authentication/authorization on backend routes per our security guidance.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-ggv3-7p47-pfv8
• https://github.com/vercel/next.js/commit/dc98c04f376c6a1df76ec3e0a2d07edf4abdabd6
• https://github.com/vercel/next.js/releases/tag/v15.5.13
• https://github.com/vercel/next.js/releases/tag/v16.1.7
• https://nvd.nist.gov/vuln/detail/CVE-2026-29057
• https://github.com/advisories/GHSA-ggv3-7p47-pfv8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Unbounded next/image disk cache growth can exhaust storage

CVE-2026-27980 / GHSA-3x4c-7xq6-9pq8

More information

Details

Summary

The default Next.js image optimization disk cache (/_next/image) did not have a configurable upper bound, allowing unbounded cache growth.

Impact

An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. Note that this does not impact platforms that have their own image optimization capabilities, such as Vercel.

Patches

Fixed by adding an LRU-backed disk cache with images.maximumDiskCacheSize, including eviction of least-recently-used entries when the limit is exceeded. Setting maximumDiskCacheSize: 0 disables disk caching.

Workarounds

If upgrade is not immediately possible:

• Periodically clean .next/cache/images.
• Reduce variant cardinality (e.g., tighten values for images.localPatterns, images.remotePatterns, and images.qualities)

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-3x4c-7xq6-9pq8
• https://github.com/vercel/next.js/commit/39eb8e0ac498b48855a0430fbf4c22276a73b4bd
• https://github.com/vercel/next.js/releases/tag/v16.1.7
• https://nvd.nist.gov/vuln/detail/CVE-2026-27980
• https://github.com/advisories/GHSA-3x4c-7xq6-9pq8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js has Unbounded Memory Consumption via PPR Resume Endpoint

CVE-2025-59472 / GHSA-5f7q-jpqc-wp7h

More information

Details

A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:

1. Unbounded request body buffering: The server buffers the entire POST request body into memory using Buffer.concat() without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.

2. Unbounded decompression (zipbomb): The resume data cache is decompressed using inflateSync() without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.

Both attack vectors result in a fatal V8 out-of-memory error (FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.

To be affected, an application must run with experimental.ppr: true or cacheComponents: true configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.

Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-5f7q-jpqc-wp7h
• https://nvd.nist.gov/vuln/detail/CVE-2025-59472
• https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
• https://github.com/advisories/GHSA-5f7q-jpqc-wp7h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: null origin can bypass dev HMR websocket CSRF checks

CVE-2026-27977 / GHSA-jcc7-9wpm-mj36

More information

Details

Summary

In next dev, cross-site protections for internal development endpoints could treat Origin: null as a bypass case even when allowedDevOrigins is configured. This could allow privacy-sensitive or opaque browser contexts, such as sandboxed documents, to access privileged internal dev-server functionality unexpectedly.

Impact

If a developer visits attacker-controlled content while running an affected next dev server with allowedDevOrigins configured, attacker-controlled browser code may be able to connect to internal development endpoints and interact with sensitive dev-server functionality that should have remained blocked.

This issue affects development mode only. It does not affect next start, and it does not expose internal debugging functionality to the network by default.

Patches

Fixed by validating Origin: null through the same cross-site origin-allowance checks used for other origins on internal development endpoints.

Workarounds

If upgrade is not immediately possible:

• Do not expose next dev to untrusted networks.
• If you use allowedDevOrigins, reject requests and websocket upgrades with Origin: null for internal dev endpoints at your proxy.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-jcc7-9wpm-mj36
• https://github.com/vercel/next.js/commit/862f9b9bb41d235e0d8cf44aa811e7fd118cee2a
• https://github.com/vercel/next.js/releases/tag/v16.1.7
• https://nvd.nist.gov/vuln/detail/CVE-2026-27977
• https://github.com/advisories/GHSA-jcc7-9wpm-mj36

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: null origin can bypass Server Actions CSRF checks

CVE-2026-27978 / GHSA-mq59-m269-xvcx

More information

Details

Summary

origin: null was treated as a "missing" origin during Server Action CSRF validation. As a result, requests from opaque contexts (such as sandboxed iframes) could bypass origin verification instead of being validated as cross-origin requests.

Impact

An attacker could induce a victim browser to submit Server Actions from a sandboxed context, potentially executing state-changing actions with victim credentials (CSRF).

Patches

Fixed by treating 'null' as an explicit origin value and enforcing host/origin checks unless 'null' is explicitly allowlisted in experimental.serverActions.allowedOrigins.

Workarounds

If upgrade is not immediately possible:

• Add CSRF tokens for sensitive Server Actions.
• Prefer SameSite=Strict on sensitive auth cookies.
• Do not allow 'null' in serverActions.allowedOrigins unless intentionally required and additionally protected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-mq59-m269-xvcx
• https://github.com/vercel/next.js/commit/a27a11d78e748a8c7ccfd14b7759ad2b9bf097d8
• https://github.com/vercel/next.js/releases/tag/v16.1.7
• https://nvd.nist.gov/vuln/detail/CVE-2026-27978
• https://github.com/advisories/GHSA-mq59-m269-xvcx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Unbounded postponed resume buffering can lead to DoS

CVE-2026-27979 / GHSA-h27x-g6w4-24gq

More information

Details

Summary

A request containing the next-resume: 1 header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing maxPostponedStateSize in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior.

Impact

In applications using the App Router with Partial Prerendering capability enabled (via experimental.ppr or cacheComponents), an attacker could send oversized next-resume POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service.

Patches

Fixed by enforcing size limits across all postponed-body buffering paths and erroring when limits are exceeded.

Workarounds

If upgrade is not immediately possible:

• Block requests containing the next-resume header, as this is never valid to be sent from an untrusted client.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-h27x-g6w4-24gq
• https://github.com/vercel/next.js/commit/c885d4825f800dd1e49ead37274dcd08cdd6f3f1
• https://github.com/vercel/next.js/releases/tag/v16.1.7
• https://nvd.nist.gov/vuln/detail/CVE-2026-27979
• https://github.com/advisories/GHSA-h27x-g6w4-24gq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v16.1.7

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [Cache Components] Prevent streaming fetch calls from hanging in dev (#​89194)
• Apply server actions transform to node_modules in route handlers (#​89380)
• ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
• Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
• Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​unstubbable, @​styfle, @​eps1lon, and @​ztanner for helping!

v16.1.6

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Upgrade to swc 54 (#​88207)
• implement LRU cache with invocation ID scoping for minimal mode response cache (#​88509)
• tweak LRU sentinel key (#​89123)

Credits

Huge thanks to @​mischnic, @​wyattjoh, and @​ztanner for helping!

v16.1.5

Compare Source

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472
https://vercel.com/changelog/summary-of-cve-2026-23864

v16.1.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Only filter next config if experimental flag is enabled (#​88733)

Credits

Huge thanks to @​mischnic for helping!

v16.1.3

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix linked list bug in LRU deleteFromLru (#​88652)
• Fix relative same host redirects in node middleware (#​88253)

Credits

Huge thanks to @​acdlite and @​ijjk for helping!

v16.1.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Turbopack: Update to swc_core v50.2.3 (#​87841) (#​88296)
  • Fixes a crash when processing mdx files with multibyte characters. (#​87713)
• Turbopack: mimalloc upgrade and enabling it on musl (#​88503) (#​87815) (#​88426)
  • Fixes a significant performance issue on musl-based Linux distributions (e.g. Alpine in Docker) related to musl's allocator.
  • Other platforms have always used mimalloc, but we previously did not use mimalloc on musl because of compilation issues that have since been resolved.

Credits

Huge thanks to @​mischnic for helping!

v16.1.1

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Turbopack: Create junction points instead of symlinks on Windows (#​87606)

Credits

Huge thanks to @​sokra and @​ztanner for helping!

v16.1.0

Compare Source

[!TIP]
Check out our Next v16.1 Blog Post to learn more about this release.

Core Changes

• fix: Rspack throw error when using ForceCompleteRuntimePlugin: #​85221
• fix: build CLI output not displaying Proxy (Middleware) when nodejs runtime: #​85403
• fix: staleTimes.static should consistently enforce a 30s minimum: #​85479
• [turbopack] fix build of empty entries of pages: #​84873
• Cache the head separately from the route tree: #​84724
• Allow inspecting dev server on default port with next dev --inspect: #​85037
• Avoid proxying React modules through workUnitStore: #​85486
• fix: redirect should always return updated router state: #​85533
• Upgrade React from b4455a6e-20251027 to 4f931700-20251029: #​85518
• [turbopack] Move generation of cacheLife types out of the webpack plugin and into the dev bundler directly: #​85539
• Ensure user-space stack frame for 'use cache' in page/layout component: #​85519
• Update parallel routes in build-complete: #​85546
• fully remove clientSegmentCache flag: #​85541
• [turbopack] Support relative paths in turbopack source maps.: #​85146
• Release unnecessary memory on hydration finish: #​84967
• Preserve interception markers in parameter types: #​85526
• move segment cache entries to top level segment-cache dir: #​85542
• Upgrade React from 4f931700-20251029 to 561ee24d-20251101: #​85670
• [devtools] Remove title from preferences: #​85698
• Update font data: #​85708
• Don't invalidate hot reloader excessively during dev server boot: #​85732
• [codemod] fix: next-lint-to-eslint-cli did not handle 'next' plugin: #​85749
• Upgrade React from 561ee24d-20251101 to 67f7d47a-20251103: #​85762
• Tracing: Fix memory leak in span map: #​85529
• Fix documentation typo in refresh function: #​85696
• fix: eslint-config-next types was exporting to dist/src: #​85768
• Upgrade React from 67f7d47a-20251103 to f646e8ff-20251104: #​85772
• remove unused RSC payload property: #​85746
• [runtime prefetching]: fix runtime prefetching when deployed: #​85595
• Turbopack: next build --analyze: #​85197
• Build: Log amount of workers during static generation: #​85706
• Upgrade React from f646e8ff-20251104 to dd048c3b-20251105: #​85819
• Sync devFallbackParams when generateStaticParams change: #​85741
• chore: upgrade rspack 1.6.0: #​84210
• [mcp] get_routes mcp tool: #​85773
• Split each path param into a separate cache key : #​85758
• [turbopack] change server source maps in production to use relative paths: #​85576
• fix: skip collecting metadata for app-error in webpack: #​85892
• fix: support root span attributes with a custom server: #​85521
• fix isDynamicRSC condition when deployed: #​85919
• [turbopack] Make it possible to synchronously access native bindings: #​85787
• Upgrade React from dd048c3b-20251105 to fa50caf5-20251107: #​85906
• Fix telemetry event loss on build failures and server shutdown: #​85867
• Remove one stack frame from 'use cache' call stacks: #​85966
• Upgrade React from fa50caf5-20251107 to 52684925-20251110: #​85980
• Deployment adapter: fix metadata for "/" route: #​85820
• Enable React's default Transition indicator behind a flag: #​86000
• update routes-manifest to include whether app has pages routes: #​86051
• Fix 404 responses for interception routes with missing children slots: #​85779
• Build: Share StaticWorker between static check and static generation: #​85860
• [devtool] highlight all link in error message: #​86084
• fix(nodejs-middleware): await for body cloning to be properly finalized: #​85418
• Add build-time validation to detect ambiguous app routes: #​85834
• Don't use inspector frontend URLs from other processes: #​86082
• Upgrade React from 52684925-20251110 to 93fc5740-20251113: #​86103
• [next-upgrade] Force install of dev dependencies: #​86119
• Fix telemetry event race condition in webpack worker for @​vercel/og detection: #​86145
• Turbopack: Add bundle analyzer UI to next build --experimental-analyze: #​85788
• Upgrade React from 93fc5740-20251113 to fb2177c1-20251114: #​86155
• fix: cacheMaxMemorySize should not disable dev HMR cache: #​86164
• Fix streaming server actions: #​86148
• Allow attaching a debugger when next dev is already running: #​86083
• Introduce next analyze: a built-in bundle analyzer for Turbopack: #​85915
• Turbopack: add experimental.turbopackClient/ServerSideNestedAsyncChunking: #​85827
• next analyze: annotate polyfill modules in UI: #​86062
• Stop adding additional padding to Next.js logs: #​86139
• [next-upgrade] Add next upgrade: #​86120
• Fix prerendering of interception routes with generateStaticParams: #​85835
• [Segment Cache] Re-implement refresh reducer: #​84426
• Upgrade React from fb2177c1-20251114 to 0972e239-20251118: #​86263
• next analyze: Make ipv6 server links valid and normalize localhost: #​86219
• fix: prevent fetch abort errors propagating to user error boundaries: #​86277
• chore(turbopack-node): remove some outdated codes: #​86111
• [devtools] Ensure Chrome DevTools workspace can connect with proxy rewrites: #​86289
• Fix log log alignment in spinners: #​86298
• fix: Rename proxy.js to middleware.js in NFT file: #​86214
• Turbopack: allow trace level tracing: #​86255
• Allow SSR to finish microtasky work before flushing: #​86311
• Turbopack: fix passing project options from napi: #​86256
• [Cache Components] Atomic setTimeouts: #​86093
• Turbopack: add experimental.turbopackInputSourceMaps and respect serverSourceMaps: #​86340
• [Cache Components] Discriminate static shell validation errors by type: #​85747
• Turbopack: add NEXT_TURBOPACK_WRITE_ROUTES_HASHES_MANIFEST to write hashes into manifest: #​86257
• Add reasons for some server-external-packages: #​86254
• Send dynamic validation errors to browser via WebSocket: #​85818
• Delete un-used prefetch outputs with PPR: #​86100
• Revert "Turbopack: add bundle-analyzer to versioning and add dependen…: #​86394
• Turbopack: add bundle-analyzer to versioning and add dependency: #​86355
• fix issue - #​86365: #​86366
• Turbopack: fix import chain by determining depth locally per route: #​86350
• Use JSONC for default server-external-packages: #​86252
• add debug logs to onSegmentPrerenderError: #​86358
• Skip request if "full" prefetch is already pending: #​86405
• fix: Rename proxy.js to middleware.js in NFT file (#​86214)
• fix: prevent fetch abort errors propagating to user error boundaries (#​86277)
• Turbopack: fix passing project options from napi (#​86256)
• Eslint: Improve Google Tag manager third parties message: #​51903
• [ts-plugin] keep showing the types in the function body: #​86273
• [turbopack] Enable the filesystem cache for dev in canary builds: #​85940
• docs: fix typos in packages: #​82508
• Turbopack: Expose an environment variable for exposing the detail field of issues: #​86518
• Turbopack: inner graph tree shaking: #​85973
• [next-upgrade] Fall back to npx if yarn dlx is not available: #​86384
• Update font data: #​86521
• Convert any export from a 'use cache' module to a cache function: #​86014
• fix(nodejs-middleware): await for body cloning to be properly finalized (#​85418)
• Fix stale dev types causing build failure after route deletion: #​86489
• bump the browserslist version to silence a warning in CI (#​86625)
• add bundle analyzer as dev dependency to next: #​86497
• Remove obsolete setReferenceManifestsSingleton call: #​86574
• Add flag to show ignore listed frames: #​86285
• Add alinea to server-external-packages.json: #​55006
• Fix error logging for 'use cache' runtime errors in production: #​86500
• Upgrade React from 8ac5f4eb-20251119 to fd524fe0-20251121: #​86473
• Add "@​zenstackhq/runtime" to server-external-packages.json: #​54829
• [Cache Components] Ensure cache misses always cause a restart in dev: #​86583
• bump the browserslist version to silence a warning in CI: #​86625
• Turbopack: import to char not replaced: #​86573
• Revert "add bundle analyzer as dev dependency to next (#​86497)": #​86672
• Handle cross-page client reference contamination in development: #​86591
• Match behavior of baseline-browser-mapping with caniuse-lite: #​86653
• Turbopack: don't generateBuildId in dev: #​86581
• [devtool] unify the bundler field: #​86514
• Turbopack: normalize distDir separators: #​86697
• Cover org package external in externals-transitive test: #​86691
• [turbopack] Enable filesystem cache by default for development: #​85975
• Log generate params duration in dev: #​86726
• [CC] Fix hanging dynamic promise when abandoning render: #​86690
• Convert Windows paths as well when reading sourcemap: #​86723
• Deterministic functions-config-manifest.json: #​86736
• Abstract deployment id access into module: #​86727
• Deterministically order pages in the MappedPages structure: #​86744
• [turbopack] move edge entry wrapper to build template: #​86699
• Properly type ComponentMod: #​86765
• Properly type edge handler fn: #​86766
• Remove unused Server.responseCache: #​86768
• [Cache Components] Fast setImmediate: #​86018
• [devtool] make the draggable content selective: #​86816
• Create server module map proxy only once: #​86750
• fix(next/image): add ?dpl query string for local images (without static import): #​86485
• fix(next/image): handle ?dpl for src without protocol: #​86836
• Upgrade React from 7dc903cd-20251203 to 66ae640b-20251204: #​86843
• Upgrade React from 66ae640b-20251204 to 378973b3-20251205: #​86852
• Turbopack: remove pages router double template: #​86842
• Introduce NextConfigRuntime: #​86812
• Generate required-server-files before prerendering: #​86830
• Update react version in cna templates (#​86950)
• Include nextConfig in edge runtime via separate manifest: #​86769
• Fix required-server-files: #​86875
• Add pino-related packages to server-external-packages: #​86884
• Fix validateTurboNextConfig running for next start: #​86886
• Add experimental.runtimeServerDeploymentId: #​86865
• [turbopack] Mark packages as side effect free when local analysis determines that they are.: #​86398
• Fix: Missing null check in LRU cleanup: #​87124
• improve segment cache lru typesafety: #​87129
• [Segment Cache] Detect third-party redirect + static export w/ HEAD request: #​85910
• Fix: External redirect swallowed by Next.js: #​87121
• Fix error propagation and teardown in Server Action request decoding: #​87193
• Fix interception routes with trailing slash configuration: #​86787
• [ci] Stop building when creating release: #​87178
• fix: otel error spans from streamed responses: #​86955
• Refactor: Unify history traversal with other nav types: #​87128
• Create initial tree using same function as navigations: #​87147
• Re-implement hmr-refresh in terms of refresh: #​87135
• Delete old navigation response handling implementation: #​87149
• Reflect runtime type of resHeaders in static types: #​87145
• [turbopack] Flag turbopackInferModuleSideEffects so it is only enabled in canary builds: #​87215
• [turbopack] update warning message in the bundle analyzer: #​87255
• chore: update rspack 1.6.5: #​86853
• Update font data: #​87259
• bundle-analyzer: make running the web server default: #​87258
• bundle analyzer: remove custom output option: #​87267
• Ensure constructor for useSearchParams can be imported for instanceof checks: #​87269
• Upgrade React from b45bb335-20251211 to f93b9fd4-20251217: #​87281
• feat: use Rspack persistent cache by default: #​81399
• Move next-env.d.ts to dist dir: #​86752
• Revert "Move next-env.d.ts to dist dir": #​87311

Example Changes

• Chore: Update with-supabase example to Next.js 16: #​86105
• docs: add example for enabling both AVIF and WebP image formats for better image optimization: #​86191
• examples: fix typos: [#​82506](https

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.