fix(deps): update dependency next@>=15.0.0 <15.2.2 to v16 [security] - autoclosed

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next@>=15.0.0 <15.2.2 (source)	[>=15.5.23 → >=16.3.0](https://renovatebot.com/diffs/npm/next@>=15.0.0 <15.2.2/15.5.23/16.3.0)

---

Next.js: Denial of Service in App Router using Server Actions

CVE-2026-64641 / GHSA-m99w-x7hq-7vfj

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj
• https://github.com/vercel/next.js/pull/96013
• https://github.com/vercel/next.js/commit/019628571641dec57aaf349ba0c360e3964e6f12
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-m99w-x7hq-7vfj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Unauthenticated disclosure of internal Server Function endpoints

CVE-2026-64643 / GHSA-955p-x3mx-jcvp

More information

Details

Impact

In Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.

Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).

Affected users are applications using App Router + Server Actions.

By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses.

Workarounds

Never assume any authentication claims at the use cache or use server boundary. Always authenticate within the boundary.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp
• https://github.com/vercel/next.js/commit/1b0c3ae912a3ad925c60065cc8d55b070fa8bcd3
• https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-955p-x3mx-jcvp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Denial of Service in the Image Optimization API using SVGs

CVE-2026-64644 / GHSA-q8wf-6r8g-63ch

More information

Details

Impact

When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints.

• If you are using config.images.remotePatterns, only the patterns in that array are impacted.
• If you are using config.images.unoptimized: true, you are NOT impacted.
• If you are using config.images.loader: 'custom', you are NOT impacted.
• If you are using Vercel, you are NOT impacted.

Workarounds

If you cannot upgrade immediately, you can avoid the expensive work by setting config.experimental.imgOptSkipMetadata : true.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch
• https://github.com/vercel/next.js/pull/96006
• https://github.com/vercel/next.js/commit/93cb90891402fa4c47798d03cb9e05c13233766c
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-q8wf-6r8g-63ch

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

CVE-2026-64647 / GHSA-4633-3j49-mh5q

More information

Details

Impact

A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.

This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache.

Workarounds

If you cannot upgrade, consider only making fetch requests with UTF-8 bodies (default in Next.js). Applications using Pages Router are not vulnerable.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q
• https://github.com/vercel/next.js/pull/96008
• https://github.com/vercel/next.js/commit/025bf4a5f7b47fb7758c4ebf1c931a61c451c082
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-4633-3j49-mh5q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Cache confusion of response bodies for requests with bodies

CVE-2026-64648 / GHSA-68g3-v927-f742

More information

Details

Impact

A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped.

This only applies to fetch calls with a request that has a different init than the one passed to fetch.
Safe: fetch(new Request(init), init)
Unsafe: fetch(new Request(init), aDifferentInit)

Workarounds

No workaround exists besides upgrading. Applications using Pages Router are not vulnerable.

Severity

• CVSS Score: 6.0 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742
• https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c
• https://github.com/vercel/next.js/commit/73b94872bc343d09494b50394d8c08eb9fc8e56a
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-68g3-v927-f742

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Server-Side Request Forgery in Server Actions on custom servers

CVE-2026-64649 / GHSA-89xv-2m56-2m9x

More information

Details

Impact

When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.

Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward.

Workarounds

If you cannot upgrade, ensure clients do not control the host header your application receives. Pin or validate Host and X-Forwarded-Host at your edge or proxy. On version 14.2.0 and later, you can additionally set the __NEXT_PRIVATE_ORIGIN environment variable to your deployment's real origin:

__NEXT_PRIVATE_ORIGIN=https://www.example.com node server.js

#### Severity
- CVSS Score: 8.3 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
- [https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x)
- [https://github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b](https://redirect.github.com/vercel/next.js/commit/b51206321854193208c0805ba42acc49287f942b)
- [https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498](https://redirect.github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498)
- [https://github.com/vercel/next.js/releases/tag/v15.5.21](https://redirect.github.com/vercel/next.js/releases/tag/v15.5.21)
- [https://github.com/vercel/next.js/releases/tag/v16.2.11](https://redirect.github.com/vercel/next.js/releases/tag/v16.2.11)
- [https://github.com/advisories/GHSA-89xv-2m56-2m9x](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-89xv-2m56-2m9x) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
[CVE-2026-64645](https://nvd.nist.gov/vuln/detail/CVE-2026-64645) / [GHSA-p9j2-gv94-2wf4](https://redirect.github.com/advisories/GHSA-p9j2-gv94-2wf4)

<details>
<summary>More information</summary>

#### Details
##### Impact

A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A `redirects()` rule configured this way is vulnerable to an Open Redirect.

This affects any destination that puts a dynamic segment in the hostname, whether from the path:

```javascript
// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/:tenant',
        destination: 'https://:tenant.api.example.com',
      },
    ]
  },
}

or from a has capture:

// next.config.js
module.exports = {
  async rewrites() {
    return [
      {
        source: '/',
        has: [{ type: 'query', key: 'region', value: '(?<region>.+)' }],
        destination: 'https://:region.api.example.com',
      },
    ]
  },
}

Workarounds

If you cannot upgrade immediately, do not build the hostname of an external rewrites() or redirects() destination from user-controlled input. If a dynamic subdomain is required, constrain the value to hostname-safe characters: value: '(?<region>[a-z0-9-]+)'.

Severity

• CVSS Score: 8.3 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4
• https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9
• https://github.com/vercel/next.js/commit/d3033266c6dff23f7be71e19341fe3a8c6e2c599
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-p9j2-gv94-2wf4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

CVE-2026-64642 / GHSA-6gpp-xcg3-4w24

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication.

Workarounds

If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead of relying solely on middleware.

Severity

• CVSS Score: 8.3 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24
• https://github.com/vercel/next.js/pull/96014
• https://github.com/vercel/next.js/commit/6bf4df14508ad6c0cd46af50c6051ee42f2d9151
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-6gpp-xcg3-4w24

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Unbounded Server Action payload in Edge runtime

CVE-2026-64646 / GHSA-4c39-4ccg-62r3

More information

Details

Impact

Requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime

Workarounds

If you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3
• https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4
• https://github.com/vercel/next.js/commit/9a4651e754f70b12e397694ffc41f44c3ba8cc17
• https://github.com/vercel/next.js/releases/tag/v15.5.21
• https://github.com/vercel/next.js/releases/tag/v16.2.11
• https://github.com/advisories/GHSA-4c39-4ccg-62r3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

vercel/next.js (next@>=15.0.0 <15.2.2)

v16.3.0

Compare Source

v16.2.12

Compare Source

v16.2.11

Compare Source

v16.2.10

Compare Source

v16.2.9

Compare Source

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Compare Source

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#​93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#​93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#​93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#​93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#​93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#​93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#​93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#​94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#​94050)
• [backport] Propagate adapter preferred regions (#​94200)
• [16.2.x] Don't drop FormData entries (#​94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#​94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

v16.2.6

Compare Source

[!NOTE]
This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#​92231)
• Fix fallback route params case in app-page handler (#​91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#​91541)
• Patch setHeader for direct route handlers (#​93101)
• Include deployment id in cacheHandlers keys (#​93453)
• Fix double-encoding of URL pathname parts in client param parsing (#​93491)

v16.2.5

Compare Source

[!NOTE]
This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#​92231)
• Fix fallback route params case in app-page handler (#​91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#​91541)
• Patch setHeader for direct route handlers (#​93101)
• Include deployment id in cacheHandlers keys (#​93453)
• Fix double-encoding of URL pathname parts in client param parsing (#​93491)

v16.2.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#​92713)
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#​92631)
• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#​92580)
• Compiler: Support boolean and number primtives in next.config defines (#​92731)
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#​92725)
• Turbopack: shorter error for ChunkGroupInfo::get_index_of (#​92814)
• Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#​92828)
• Adding more system info to the 'initialize project' trace (#​92427)

Credits

Huge thanks to @​Badbird5907, @​lukesandberg, @​andrewimm, @​sokra, and @​mischnic for helping!

v16.2.3

Compare Source

[!NOTE]
This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

• Ensure app-page reports stale ISR revalidation errors via onRequestError (#​92282)
• Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#​91981 through #​92273)
• Deduplicate output assets and detect content conflicts on emit (#​92292)
• Fix styled-jsx race condition: styles lost due to concurrent rendering (#​92459)
• turbo-tasks-backend: stability fixes for task cancellation and error handling (#​92254)

Credits

Huge thanks to @​icyJoseph, @​sokra, @​wbinnssmith, @​eps1lon and @​ztanner for helping!

v16.2.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• backport: Move expanded adapters docs to API reference (#​92115) (#​92129)
• Backport: TypeScript v6 deprecations for baseUrl and moduleResolution (#​92130)
• [create-next-app] Skip interactive prompts when CLI flags are provided (#​91840)
• next.config.js: Accept an option for serverFastRefresh (#​91968)
• Turbopack: enable server HMR for app route handlers (#​91466)
• Turbopack: exclude metadata routes from server HMR (#​92034)
• Fix CI for glibc linux builds
• Backport: disable bmi2 in qfilter #​92177
• [backport] Fix CSS HMR on Safari (#​92174)

Credits

Huge thanks to @​nextjs-bot, @​icyJoseph, @​ijjk, @​gaojude, @​wbinnssmith, @​lukesandberg, and @​bgw for helping!

v16.2.1

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• docs: post release amends (#​91715)
• docs: fix broken Activity Patterns demo link in preserving UI state guide (#​91698)
• Fix adapter outputs for dynamic metadata routes (#​91680)
• Turbopack: fix webpack loader runner layer (#​91727)
• Fix server actions in standalone mode with cacheComponents (#​91711)
• turbo-persistence: remove Unmergeable mmap advice (#​91713)
• Fix layout segment optimization: move app-page imports to server-utility transition (#​91701)
• Turbopack: lazy require metadata and handle TLA (#​91705)
• [turbopack] Respect {eval:true} in worker_threads constructors (#​91666)

Credits

Huge thanks to @​icyJoseph, @​abhishekmardiya, @​ijjk, @​mischnic, @​unstubbable, @​sokra, and @​lukesandberg for helping!

v16.2.0

Compare Source

[!TIP]
Check out our Next v16.2 Blog Post to learn more about this release.

Core Changes

• Upgrade React from f93b9fd4-20251217 to 65eec428-20251218: #​87323
• Turbopack: Create junction points instead of symlinks on Windows: #​87606
• Turbopack: Symlink handling follow-up: #​87637
• Add experimental routing package for resolving adapter routes: #​86404
• Ensure outputs are correct with cache components in deployment adapters: #​87018
• Move off of deprecated url.parse: #​87257
• [strict-route-types] Add experimental.strictRouteTypes config: #​87378
• misc: fix type check log for CI envs: #​87838
• fix: revalidateTag with profile should not trigger client cache invalidation: #​88069
• chore: warn when running tests against stale build: #​88001
• Redesign default error pages with cleaner, more user-friendly UI: #​87988
• dx: avoid next-env.d.ts change in dev: #​88103
• prevent browser cache from using stale RSC responses from previous builds: #​86554
• [strict-route-types] Typecheck App Router page props: #​87386
• [strict-route-types] Enforce common React Component return types in App Router: #​87389
• [strict-route-types] Switch to satisfies when validating page and route modules: #​87398
• [strict-route-types] Don't reject number in config.api.bodyParser.sizeLimit when validating route: #​87633
• Revert "dx: avoid next-env.d.ts change in dev": #​88153
• [strict-route-types] Typecheck pages router routes in absence of App Router: #​87628
• [strict-route-types] Ensure cache profiles and routes are type-checked even if .next is excluded: #​87768
• add compilation error for taint when not enabled: #​88173
• feat(next/image)!: add images.maximumResponseBody config: #​88183
• Add maximum size limit for postponed body parsing: #​88175
• metadata: use fixed segment in dynamic routes with static metadata files: #​88113
• feat: add --experimental-cpu-prof flag for dev, build, and start: #​87946
• Add experimental option to use no-cache instead of no-store in dev: #​88182
• fix overlay frames cannot be opened sometimes: #​88210
• Handle pnpm-workspace.yaml while searching for monorepo root: #​74818
• Add more debug logs to 'use cache' wrapper: #​88219
• Omit unused arguments from 'use cache' function calls: #​86920
• Only log pending revalidates... debug log if applicable: #​88221
• fix(next/image): bump sharp@​0.34.5: #​88238
• Disallow javascript urls in router methods and redirects: #​88185
• Fix relative same host redirects in node middleware: #​88253
• Remove loadConfig from main development process, pass value from child process: #​88230
• Update deploy adapters outputs and handler interfaces for node and edge: #​88247
• Move Ready in time before handler initialization: #​88235
• next/image: support custom cache handlers: #​88248
• feat: add Claude Code plugin marketplace with Cache Components skill: #​87993
• refactor: consolidate PPR into cacheComponents architecture: #​88243
• Turbopack: include fewer traced files for standalone: #​88322
• feat(turbopack): add resolve plugin condition variant of Always and Never: #​88190
• perf: use length = 0 to clear the logging array: #​88244
• Time logs: Show full millisecond instead of 1 decimal: #​88313
• [turbopack] Enable inferring module side effects by default: #​87216
• Track search string as part of "refresh state": #​87203
• Pass RouteTree into navigation function: #​87256
• Read from segment cache unknown routes: #​87293
• Pass loading boundary as part of RSC data: #​87825
• Revert "refactor: consolidate PPR into cacheComponents architecture (#​88243)": #​88421
• fix: support TypeScript noUncheckedSideEffectImports for CSS imports: #​88199
• Don't import typescript at runtime: #​88321
• fix: use RDC for server action requests: #​88129
• Warn when overriding Cache-Control header on /_next/ routes: #​88353
• [prebuilt-skew-protection] feat: adding in automatic deploymentId: #​88012
• Revert "[prebuilt-skew-protection] feat: adding in automatic deploymentId": #​88449
• Turbopack: Update reqwest, remove experimental system TLS feature: #​88290
• Revert "prevent browser cache from using stale RSC responses from pre…: #​88457
• Turbopack: retain loader tree order for metadata: #​88487
• Turbopack: more dead code: #​88505
• fix(build): prevent route handler manifests from inheriting unrelated client components: #​88419
• Upgrade React from 65eec428-20251218 to 3e1abcc8-20260113: #​88530
• Better typesafety for interopDefault: #​88486
• keep next-env.d.s unchanged between dev and build: #​88428
• Remove sibling caches from CacheNode tree: #​87991
• Upgrade React from 3e1abcc8-20260113 to 4a3d993e-20260114: #​88547
• Finish deleting Mutable from router implementation: #​88046
• fetch(next/image): reduce maximumResponseBody from 300MB to 50MB: #​88588
• [CC] Fix dev validation error from server action bound args: #​88600
• Fix incorrect 'Ready in' time for next start: #​88589
• feat: server action logging: #​88277
• Log browser error and warnings in terminal: #​88352
• Upgrade React from 4a3d993e-20260114 to bef88f7c-20260116: #​88649
• fix: make RedirectType constant properties literal types: #​88653
• Turbopack: add support for matching loaders on resource queries: #​88644
• fix: capture promisified setImmediate separately: #​88346
• fix: setImmediate[util.promisify.custom] access fails in edge runtime: #​88685
• Fix --debug-build-paths bracket escaping for glob patterns: #​88660
• Add negation pattern support to --debug-build-paths: #​88654
• Only filter next config if experimental flag is enabled: #​88733
• [Devtool Indicator] Fix cross alignment: #​88664
• Turbopack: don't use build id for pages router client-side manifests: #​88641
• Allow inspecting server with next start --inspect: #​88744
• Turbopack: Add --debug-build-paths support to filter routes: #​88655
• Upgrade React from bef88f7c-20260116 to 41b3e9a6-20260119: #​88756
• Use rewritten pathname for implicit cache tags: #​88732
• Upgrade React from 41b3e9a6-20260119 to d2908752-20260119: #​88774
• Add experimental_gesturePush to App Router: #​88776
• Rename rewroteURL to rewrittenPathname in request metadata: #​88751
• Simplify getImplicitTags to accept pathname instead of url object: #​88753
• Add NEXT_DEPLOYMENT_ID global: #​86738
• Turbopack: remove deployment id suffix from client reference manifest chunks: #​88741
• Inject <html data-dpl-id> and don't inline it into JS anymore: #​88761
• [metadata] match the Metadata and ResolvedMetadata type: #​88739
• Reuse bfcache data during Full prefetches: #​88606
• Embed static sibling info in route tree: #​88692
• Fix revalidatePath with params and trailing slash when deployed: #​88623
• fix: preserve cache behavior for PPR fallback shells with root params: #​88556
• Upgrade React from d2908752-20260119 to b546603b-20260121: #​88860
• stabilize browser log forward options: #​88857
• [devtools] Wrap long file names of stack frames in the error overlay: #​88886
• [devtools] Fix notch coloring of error overlay in forced colors mode: #​88892
• Remove deploymentId from App Router RenderOptsPartial: #​88866
• feat: implement LRU cache with invocation ID scoping for minimal mode response cache: #​88509
• [prebuilt-skew-protection] feat: adding in automatic deploymentId: #​88496
• [devtool] Add hydration diff indicator for diff lines: #​88919
• Revert "[prebuilt-skew-protection] feat: adding in automatic deploymentId": #​88942
• [turbopack] add task type infromation to the print_cache_item_size feature: #​88925
• Upgrade React from b546603b-20260121 to 24d8716e-20260123: #​88963
• Turbopack: add ?dpl= to all asset urls returned by Turbopack: #​88828
• feat(next-codemod): add agents-md command for AI coding agents: #​88961
• Update font data: #​88975
• Improve agents-md prompt to force doc retrieval: #​88997
• [Reapply] Add useEffectEvent to disallowed React APIs in Server Components: #​88985
• Apply fixes for onBuildComplete and route module: #​88831
• Rename renderOpts.nextExport to isBuildTimePrerendering: #​88951
• docs: fix typos in README.mds: #​89022
• refactor: consume global-error from loader tree: #​88437
• Fix chunk loading when using __turbopack_load_by_url__ with query: #​88899
• [mcp] change the mcp endpoint response to JSON: #​88911
• Reapply "[turbopack] Add bundling support for worker_threads" (#​88725): #​88967
• fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth: #​89040
• Upgrade React from 24d8716e-20260123 to 8c34556c-20260126: #​89066
• Use null-prototype objects in server actions manifests: #​89069
• Re-enable types-and-precompiled: #​89070
• Apply segment changes to adapters outputs: #​89072
• Improve no response route handler error: #​89036
• Limit number of server action arguments to 1000: #​89068
• [prebuilt-skew-protection] feat: adding in automatic deploymentId: #​88958
• Decouple route stale time from segment-level data: #​88834
• Decouple route and segment cache lifecycles: #​88989
• [ci] Silence baseline-browser-mapping warnings: #​89175
• [Cache Components] Prevent streaming fetch calls from hanging in dev: #​89171
• React types update: #​89110
• [ne

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

ERROR: This version of pnpm requires at least Node.js v22.13
The current version of Node.js is v18.20.8
Visit https://r.pnpm.io/comp to see the list of past pnpm versions with respective Node.js version support.

[github-actions]

Thank you for following the naming conventions! 🙏