v16.1.7

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
• Apply server actions transform to node_modules in route handlers (#89380)
• ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
• feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
• Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
• Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

v15.5.13

Note

This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @ztanner for helping!

v16.2.0-canary.100

Core Changes

• fix: test-cargo-unit CI job timing out since LTO was enabled: #91424

Credits

Huge thanks to @lukesandberg for helping!

v16.2.0-canary.99

Core Changes

• Add eval and docs for unstable_instant: #91334
• Simplify scroll restoration with shared ScrollRef on CacheNode: #91348

Misc Changes

• disable sub shell generation test outside of adapter: #91353
• Turboopack: put import attributes behind a pointer, 23% faster analyze: #91347
• Turbopack: require(/* turbopackChunkingType: parallel */: #91278
• Turbopack: use keyed cell access for AsyncModulesInfo: #91305
• Enable thin LTO for release builds: #91343
• [turbopack] const-ify most of the registration code: #90868

Credits

Huge thanks to @gaojude, @ztanner, @mischnic, @acdlite, @sokra, and @mmastrac for helping!

v16.2.0-canary.98

Core Changes

• partial fallbacks: only upgrade shells with remaining prerenderable params: #91158
• partial fallbacks: complete generic shells into more specific shells: #91231

Misc Changes

• Turbopack: Remove old macos-compress script: #90967
• docs: remove incorrect _document.tsx font example: #91346

Credits

Huge thanks to @bgw, @ztanner, and @zamadye for helping!

v16.2.0-canary.97

Core Changes

• Expose edge runtime fields in build-complete: #91239
• [turbopack] Remove turbo_tasks::function from ModuleReference getters: #91229
• [Turbopack] write route bundle stats to .next/diagnostics/route-bundle-stats.json: #90949

Misc Changes

• re-enable RDC deployment tests: #91327
• Use keyed cells for used_exports and export_circuit_breakers in BindingUsageInfo: #91306
• [test] Show decoded binary WebSocket messages in traces: #91308
• Docs skills: guide and api-reference: #90992
• Turbopack: switch chunk/asset hashes from hex to base40 encoding: #91137
• Turbopack: don't emit polyfill chunk for API routes: #91331
• [test] Current behavior for request APIs in generateStaticParams: #91188
• Update Rspack production test manifest: #91301
• Update Rspack development test manifest: #91300

Credits

Huge thanks to @ztanner, @ijjk, @sokra, @lukesandberg, @eps1lon, @delbaoliveira, @mischnic, @unstubbable, @vercel-release-bot, and @wbinnssmith for helping!

v16.2.0-canary.96

Core Changes

• perf: use Buffer.from for base64 encoding of binary Flight data: #91221
• Skip dimming when --inspect is used: #91271
• Respect generateStaticParams in instant navigation shell: #91316
• [Prefetch Inlining] Generate size-based hints on server: #90891
• Wire cache handlers in edge paths and add e2e regression coverage: #91236

Misc Changes

• docs(turbopack): Move singleton pattern documentation from mdbook to rustdoc: #91175
• Docs: Split route segment config options into their own files: #90991
• Turbopack: rename CSS module structs for clarity: #91304
• [test] Deflake instant-navs-devtools: #91256
• Expose resolved invocation targets in next-routing: #91242
• Delete blob files during compaction when entries are superseded: #91314
• [test] Resolve stale merge issues: #91329
• Turbopack: Remove the IntoTraitRef trait, make it an inherent method on Vc: #91223

Credits

Huge thanks to @bgw, @delbaoliveira, @benfavre, @unstubbable, @mischnic, @acdlite, @eps1lon, @ijjk, and @sokra for helping!

v16.2.0-canary.95

Core Changes

• chore(deps): Bump tar from 7.5.7 to 7.5.11 in /packages/next: #91233
• Upgrade React from 46103596-20260305 to 5e9eedb5-20260312: #91272
• feat(server): expose requestMeta router helpers and merge fallback context: #91235
• [Instant] Show owner stack for validation-blocking errors: #91277
• Hydrate page loads during instant navigation testing: #91207

Misc Changes

• docs(turbopack): Move mdbook "tasks" docs over to turbo_tasks::function rustdoc: #91132
• test-new-tests: enable adapter in deploy flow: #91269
• Revert "Exclude partial fallback for deploy mode": #91172
• [test] Properly log framereceived payload: #91266
• docs(turbopack): Merge task input docs from mdbook into rustdocs: #91136
• bundle-analyzer: merge _app route modules into current route visualization: #90841
• docs(turbopack): Migrate docs about traits from mdbook to rustdocs: #91170
• Remove LMDB backend and ReadTransaction abstractions from turbo-tasks-backend: #91284

Credits

Huge thanks to @bgw, @ijjk, @ztanner, @eps1lon, @lubieowoce, @wbinnssmith, @acdlite, and @lukesandberg for helping!

v16.2.0-canary.94

Core Changes

• [cna] Bump picocolors to 1.1.1: #91252
• [Instant] Build-time validation: #90964
• [Instant] fix instant config suggested by editor plugin: #91262

Misc Changes

• TURBOPACK: typescript transform support verbatimModuleSyntax: #90907
• [ci] Disable test-level retries during flakiness detection: #91261
• [cna] Bump vendored json-schema-types: #91255
• Remove sequential madvise for compressed blocks in StaticSortedFile: #91263

Credits

Huge thanks to @fireairforce, @eps1lon, @lubieowoce, and @sokra for helping!

v16.2.0-canary.93

Core Changes

• Adds a Start button to the Instant Navs panel to initiate inspection …: #91216
• Preserve RSC metadata in Proxy request with skipProxyUrlNormalize: #91213

Misc Changes

• fix(turbopack): unref ThreadsafeFunctions to allow Node.js exit after build: #91107
• remove worktrees accidentally committed in #90166: #91215
• Fix syntax contexts in server action transform: #91210
• docs(turbopack): Merge the contents of the "cells" page in the mdbook with our rustdocs: #91126

Credits

Huge thanks to @xusd320, @samselikoff, @lukesandberg, @mischnic, @bgw, and @ijjk for helping!