v16.3.0-preview.9

Misc Changes

• [Bench] Add client-trace attribution pass and document metrics to render-pipeline: #95828
• Turbopack: Split up turbo-tasks-fs/src/lib.rs into smaller modules: #96030
• Turbopack: Use Arc and Box to make InvalidatorMap slightly more efficient: #95987
• Turbopack: Use swc_core::ecma::utils::prop_name_eq for a couple of the next-custom-transforms: #96035
• [Cache Components] Exclude dynamic params from prerenders when no generateStaticParams values is provided: #95872
• Gate partialFallback behavior behind partialPrefetching flag: #96074
• [turbopack] Fix deployment skew protection for component chunks: #96079
• Turbopack: stop copying sourcesContent into every serialized source map: #95934
• Upgrade React from 81e442ea-20260721 to 711c445b-20260722: #96066
• fix: cache miss in App Shell for cached pages with gSP: #95665
• skill(cc-adoption): add dev-only validation sweep reference: #96057
• Refine Cache Components and Partial Prefetching adoption skills: #95817
• [test] Move the dev-only use cache test suite to test/development: #96023
• Fix stale dev 'use cache' for cookieless requests and route handlers: #96022
• [test] Add failing tests for stale route handler and page cached data: #96021
• Add a dedicated HMR message for static params changes: #96020
• Emit the static paths HMR update after updating the cache: #96019
• [test] Add source-mapping coverage of React's fake stack frame scripts in use cache: #95945
• Fix basePath fallback parameter parsing: #95966
• Restore canary version 16.3.0-canary.93 after v16.3.0-preview.8 preview release

Credits

Huge thanks to @gaearon, @bgw, @gnoff, @acdlite, @sampoder, @vercel-release-bot, @lubieowoce, @aurorascharff, @unstubbable, and @timneutkens for helping!

v16.3.0-canary.95

Misc Changes

• Turbopack: Very minor improvements for watcher loop: #96103
• Turbopack: Refactor watcher event handling and batching logic: #96087
• fix: remove deprecated url.parse() from custom-server example: #96105
• Upgrade React from 711c445b-20260722 to 28cd4bb0-20260723: #96100
• Throw for empty or incomplete generateStaticParams results with output: export: #95969
• Throw when generateStaticParams returns invalid values: #95968
• Remove inert experimental.viewTransition flag: #96098
• Restore partial fallback shell upgrade coverage: #96096
• fix(next/font/google): bound Google Fonts fetch timeout on Turbopack: #95981
• Rewrite edge server source map sources in Rust, drop JS fallback: #95980
• docs: view transitions guide — skill section, source-audit fixes, flag-removal docs: #96097
• Restore canary version 16.3.0-canary.94 after v16.3.0-preview.9 preview release
• [Bench] Add client-trace attribution pass and document metrics to render-pipeline: #95828
• Turbopack: Split up turbo-tasks-fs/src/lib.rs into smaller modules: #96030
• Turbopack: Use Arc and Box to make InvalidatorMap slightly more efficient: #95987
• Turbopack: Use swc_core::ecma::utils::prop_name_eq for a couple of the next-custom-transforms: #96035

Credits

Huge thanks to @bgw, @wasim-builds, @vercel-release-bot, @devjiwonchoi, @aurorascharff, @lukesandberg, and @gaearon for helping!

v16.3.0-preview.8

Misc Changes

• Always consult npm_config_user_agent first: #95879
• Rewrite next-cache-components-optimizer around a test-driven instant() loop: #94721
• docs: attribute App Shell prefetch to Partial Prefetching: #96003
• Turbopack: Remove chunk group id from value of chunk groups map: #95142
• [ci] Enforce minimumReleaseAge in e2e tests that install external dependencies: #95628
• Turbopack: Fix missing canonicalization of paths and always use verbatim paths internally for Windows: #95668
• Revert "[turbopack] Don't SSR on pages only navigated to through a soft nav (#95539)": #96028
• Turbopack: Use Arc<PathBuf> for keys in turbo-task-fs's per-path MutexMap: #95951
• chore(deps): bump sharp@0.35.3: #95507
• [turbopack] Tree-shake CJS exports that use the Object.defineProperty syntax: #95994
• Restore canary version 16.3.0-canary.92 after v16.3.0-preview.7 preview release

Credits

Huge thanks to @eps1lon, @gaojude, @icyJoseph, @bgw, @sampoder, and @styfle for helping!

v16.3.0-canary.94

Misc Changes

• [Cache Components] Exclude dynamic params from prerenders when no generateStaticParams values is provided: #95872
• Gate partialFallback behavior behind partialPrefetching flag: #96074
• [turbopack] Fix deployment skew protection for component chunks: #96079
• Turbopack: stop copying sourcesContent into every serialized source map: #95934
• Upgrade React from 81e442ea-20260721 to 711c445b-20260722: #96066
• fix: cache miss in App Shell for cached pages with gSP: #95665
• skill(cc-adoption): add dev-only validation sweep reference: #96057
• Refine Cache Components and Partial Prefetching adoption skills: #95817
• [test] Move the dev-only use cache test suite to test/development: #96023
• Fix stale dev 'use cache' for cookieless requests and route handlers: #96022
• [test] Add failing tests for stale route handler and page cached data: #96021
• Add a dedicated HMR message for static params changes: #96020
• Emit the static paths HMR update after updating the cache: #96019
• [test] Add source-mapping coverage of React's fake stack frame scripts in use cache: #95945
• Fix basePath fallback parameter parsing: #95966
• Restore canary version 16.3.0-canary.93 after v16.3.0-preview.8 preview release
• Always consult npm_config_user_agent first: #95879
• Rewrite next-cache-components-optimizer around a test-driven instant() loop: #94721

Credits

Huge thanks to @gnoff, @acdlite, @sampoder, @gaearon, @vercel-release-bot, @lubieowoce, @aurorascharff, @unstubbable, @timneutkens, @eps1lon, and @gaojude for helping!

v16.3.0-preview.7

Example Changes

• fix: error handling and loading states in with-apollo-and-redux example: #91457

Misc Changes

• Upgrade React from 172742b4-20260716 to 81e442ea-20260721: #96016
• Fix Turbopack middleware matcher with i18n single locale: #96014
• Improve performance of validating MPA form submissions: #96013
• Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime: #96012
• Set correct origin for internal redirects in custom server: #96011
• Ensure exotic rewrite param values are properly encoded: #96010
• fix(fetch-cache): key fetch(Request, init) by the effective request: #96009
• fix(incremental-cache): byte-exact fetch cache key for binary bodies: #96008
• Validate server reference IDs during manifest lookup: #96007
• fix(next/image): improve performance of detectContentType() : #96006
• Preserve basePath in redirect destinations: #95608
• [ci] Skip passed-tests cache steps for jobs that never run tests: #96001
• docs: add upgrade section to installation and expand AI agents guide: #95861
• docs: fix unstable_cache syntax error: #96002
• Insights: use a single Learn more link in console errors: #95967
• Refine development validation signal handling: #95998
• Include examples of static export tools & GitHub Pages template: #95929
• docs: note the :has() scaling limit in the Interactive apps guide: #95925
• Prevent unhandled rejections when a "use cache" cache handler errors: #95985
• [test] Add coverage for throwing custom "use cache" cache handler: #95984
• docs: clarify layout.js nesting behavior in route groups: #95720
• Fix instant validation blocking navigations: #95939
• [ci] Share a single browser instance across all test suites in a single job: #95589
• [turbopack] Rename turbopackTreeShaking to turbopackModuleFragments: #95978
• cna: use LayoutProps helper in TS layout templates: #95675
• [turbopack] Skip redundant top-level root updates: #95903
• [turbopack] Drop unused exports from a CJS module: #95716
• Turbopack: Simplify parent directory creation retry loop logic: #95835
• Run Rust doctests in CI: #95911
• docs: add 'Set up your editor' to the installation guide: #95928
• fix(cms-contentful): await draftMode() and use Promise<> params type: #95631
• Move outputHashSalt out of experimental: #95840
• Move immutable static assets config option out of experimental: #95351
• [instant] Let dev-server requests bypass the fetch lock: #95761
• Upgrade React from 7023f501-20260714 to 172742b4-20260716: #95901
• Fix Rust doctest failures: #95909
• [turbopack] Clean up server_chunking_context: #95908
• [turbopack] Don't SSR on pages only navigated to through a soft nav: #95539
• Package skills/ as a Claude Code plugin: #95907
• [ci] Avoid apt-get in the next-stats-action Docker image: #95847
• Back/forward set the Nav Inspector back to pending: #95865
• fix(agent-rules): pad managed AGENTS.md block with blank lines: #95892
• Revert "Run more test suites under cacheComponents flag": #95884
• Fix repeated navigations while the Instant Navigation lock is held: #95864
• Run more test suites under cacheComponents flag: #95878
• Unify appShells flag with Partial Prefetching: #95415
• Fix Request Insights span collection: #95818
• Revert "Replay same-document traversals that happen before hydration": #95853
• [ci] Allow running all deploy tests with builds from a private registry: #95784
• [turbopack] Only ship pages-router routes in the client chunk-group bootstrap manifest: #94671
• [turbopack] Inline the chunk group bootstrap in Next.js to drop the per-route runtime: #94666
• [turbopack] Add chunk_group_bootstrap_params and the chunk-loading global to the build manifest: #94663
• [turbopack] Add registerEntry() to handle inline bootstrapping: #94664
• [turbopack] Add inline_chunk_group_bootstrap to BrowserChunkingContext and chunk_group_bootstrap_params to ChunkGroupResult: #94661
• [turbopack] Create a chunk_group_bootstrap_params() function: #94631
• [turbopack] Create a shared asset with browser runtime code: #94586
• Turbopack: trace externals imported only by server actions: #95824
• [turbopack] Generate component chunks for each merged group to increase cache hits: #95261
• Exclude stale under 5 minutes from app shells: #95833
• docs: remove experimental @next/routing note: #94903
• [turbopack] Tell agents not to mention next.config.js options: #95825
• chore: Remove stale build warning: #95813
• Replay same-document traversals that happen before hydration: #95682
• docs: cssChunking graph option: #95693
• [Bench] Extend bench app to have realistic client chunk counts: #95814
• Add more realistic bench fixtures: #95807
• Fix Request Insights subscription initialization: #95794
• Model async userland loading in app routes as a state machine: #95791
• Preserve init errors from async route modules: #95799
• Fix cache warming and static params for metadata images with top-level await: #95790
• Only track pending imports for real promises: #95789
• Support metadata routes in --debug-build-paths: #95788
• Respect NEXT_HASH_SALT for server side assetsHashes: #95738
• telemetry: add agentName to anonymous metadata: #95586
• [turbopack] Optimize the implementation of AutoMap/AutoSet
  : #95694
• Better support the CLI spinner when running the TSC CLI: #95753
• Upgrade React from 5123b063-20260708 to 7023f501-20260714: #95782
• docs: add route-side URL data audit to the Partial Prefetching adoption guide: #95389
• docs: revalidateTag with expire zero, for route handlers: #95760
• request insights: add DevTools request panel (5/5): #93978
• docs: Improve immutable static docs: #95752
• Add React sync development skill: #95620
• docs: useSearchParams example stray link: #95759
• Improve the NFT error message and ignore comment handling: #95144
• Upgrade to swc 73: #95731
• [turbopack] Switch make_production_chunks to use floats: #95749
• Fix termination handling: #95692
• Restore canary version 16.3.0-canary.84 after v16.3.0-preview.6 preview release

Credits

Huge thanks to @vercel-release-bot, @eps1lon, @ZaforAbdullah, @gaojude, @aurorascharff, @icyJoseph, @timneutkens, @WildChargerTV, @ankurdotio, @bgw, @sampoder, @marcoshernanz, @manoraj, @mischnic, @acdlite, @gaearon, @gnoff, @andrewimm, @lukesandberg, and @feedthejim for helping!

v16.3.0-canary.93

Misc Changes

• docs: attribute App Shell prefetch to Partial Prefetching: #96003
• Turbopack: Remove chunk group id from value of chunk groups map: #95142
• [ci] Enforce minimumReleaseAge in e2e tests that install external dependencies: #95628
• Turbopack: Fix missing canonicalization of paths and always use verbatim paths internally for Windows: #95668
• Revert "[turbopack] Don't SSR on pages only navigated to through a soft nav (#95539)": #96028
• Turbopack: Use Arc<PathBuf> for keys in turbo-task-fs's per-path MutexMap: #95951
• chore(deps): bump sharp@0.35.3: #95507
• [turbopack] Tree-shake CJS exports that use the Object.defineProperty syntax: #95994
• Restore canary version 16.3.0-canary.92 after v16.3.0-preview.7 preview release

Credits

Huge thanks to @icyJoseph, @bgw, @sampoder, and @styfle for helping!

v16.3.0-canary.92

Example Changes

• fix: error handling and loading states in with-apollo-and-redux example: #91457

Misc Changes

• Upgrade React from 172742b4-20260716 to 81e442ea-20260721: #96016
• Fix Turbopack middleware matcher with i18n single locale: #96014
• Improve performance of validating MPA form submissions: #96013
• Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime: #96012
• Set correct origin for internal redirects in custom server: #96011
• Ensure exotic rewrite param values are properly encoded: #96010
• fix(fetch-cache): key fetch(Request, init) by the effective request: #96009
• fix(incremental-cache): byte-exact fetch cache key for binary bodies: #96008
• Validate server reference IDs during manifest lookup: #96007
• fix(next/image): improve performance of detectContentType() : #96006
• Preserve basePath in redirect destinations: #95608
• [ci] Skip passed-tests cache steps for jobs that never run tests: #96001
• docs: add upgrade section to installation and expand AI agents guide: #95861
• docs: fix unstable_cache syntax error: #96002
• Insights: use a single Learn more link in console errors: #95967
• Refine development validation signal handling: #95998
• Include examples of static export tools & GitHub Pages template: #95929
• docs: note the :has() scaling limit in the Interactive apps guide: #95925
• Prevent unhandled rejections when a "use cache" cache handler errors: #95985
• [test] Add coverage for throwing custom "use cache" cache handler: #95984
• docs: clarify layout.js nesting behavior in route groups: #95720
• Fix instant validation blocking navigations: #95939
• [ci] Share a single browser instance across all test suites in a single job: #95589
• [turbopack] Rename turbopackTreeShaking to turbopackModuleFragments: #95978
• cna: use LayoutProps helper in TS layout templates: #95675

Credits

Huge thanks to @vercel-release-bot, @eps1lon, @ZaforAbdullah, @gaojude, @aurorascharff, @icyJoseph, @timneutkens, @WildChargerTV, @ankurdotio, @bgw, and @sampoder for helping!

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v15.5.21

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.3.0-canary.91

Misc Changes

• [turbopack] Skip redundant top-level root updates: #95903
• [turbopack] Drop unused exports from a CJS module: #95716
• Turbopack: Simplify parent directory creation retry loop logic: #95835
• Run Rust doctests in CI: #95911
• docs: add 'Set up your editor' to the installation guide: #95928
• fix(cms-contentful): await draftMode() and use Promise<> params type: #95631
• Move outputHashSalt out of experimental: #95840
• Move immutable static assets config option out of experimental: #95351
• [instant] Let dev-server requests bypass the fetch lock: #95761

Credits

Huge thanks to @marcoshernanz, @sampoder, @bgw, @aurorascharff, @manoraj, @mischnic, and @eps1lon for helping!