Next.js Updates & Release Notes

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in #100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in #100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in #100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in #100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in #100217
• [lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in #100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in #100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in #100262

Full Changelog: v16.4.1...v16.4.2

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #75682
• fix(scripts): correct typo in rm.mjs error message: #87015
• docs: improve clarity and punctuation in README: #86096
• Fix debug build paths Pages Router support entries: #93529
• bundle-analyzer: record historical snapshots on each analyze run: #93520
• fix: detect proxy.ts correctly with compound pageExtensions: #93246
• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• docs: correction to dynamicParams migration: #96624
• docs: proxy event argument: #96435
• docs: remove experimental note from runtime prefetching: #96615
• Preserve per-segment prefetching after dynamic navigation: #96583
• Rename static generation stream option to waitForAllReady: #96564
• Remove obsolete static generation plumbing: #96563
• [turbopack] Drop dead writes to exports: #96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #96549
• [turbopack] Strip leading BOM before parsing CSS: #96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
• docs: use relative doc links in instant-navigation error pages: #96672
• Turbopack: terminate failed plugin worker threads: #96592
• Fix HTML-limited bot matching in prerender bypass rules: #96584
• [ci] Fix create_release_branch for new repo permissions: #96641
• test: skip action module instance deploy test: #96629
• docs: quote the dynamicParams build error in a blockquote: #96633
• [react-sync] Open pull requests as the bot that authors the commits: #96682
• [Bench] Fixes for pure Fizz bench: #96771
• Derive foreground cache revalidation from the consumer: #96731
• Fix race when navigating Back before hydration: #96252
• docs: present each Skill as steps in the AI agents guide: #96751
• Reuse completed cache entries for the rest of a request: #96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
• Remove WorkStore execution mode: #96674
• Remove cache revalidation execution mode reads: #96670
• Separate App Route render and prerender pipelines: #96662
• Remove App Page execution mode reads: #96660
• test: fix missing await in css-chunking test: #96725
• docs (Skills): stop assuming app/ at the root and port 3000: #96696
• Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
• Use Tailwind Turbopack loader in create-next-app: #96606
• docs: instant navigation quick start with an adoption prompt: #96663
• Separate App Page render and prerender pipelines: #96659
• Move App Router execution intent to entrypoints: #96640
• Pass explicit render capabilities through App Render: #96576
• Pass explicit prefetch hint policy through App Render: #96572
• Replace WorkStore isStaticGeneration with executionMode: #96570
• docs: document ! exclusion and src/ prefix for --debug-build-paths: #96703
• Change loadManifest to return undefined with handleMissing: #96530
• Refactor server from CacheNodeSeedData -> TransportData: #96679
• Unify full/partial navigation response types: #96439
• Unify RouteTree and CacheNodeSeedData on the client: #96406
• Consolidate Promise.withResolvers polyfills: #96772
• [ci] Open automated update pull requests with nextjs-bot: #96683
• Require Cache Components for Instant Navigation testing: #96745
• Fix use cache over- and under-invalidation in dev: #96235
• Fix which pages the dev server announces, and when: #96250
• docs: update redirected links to current targets: #96723
• Fix(deployment-id): prevent exception on old webkit: #94604
• [fragment-scroll] Remove config.experimental.appNewScrollHandler: #95602
• [turbopack] Enable reexport-unknown execution test: #96774
• ci: stop publishing @vercel/devlow-bench: #96887
• fix(turbopack): name the module in the non-ESM-placeable error, and stop duplicating the importer in traces: #96560
• fix(turbopack): support type: 'text' in rules, and error on binding imports of non-ESM modules: #96558
• Lint devlow-bench with the root eslint config: #96871
• Remove turbopack/packages and relocate devlow to packages/: #96860
• Flush pending revalidations for forwarded action error responses: #96945
• Handle Server Actions on dynamic PPR fallback routes: #96932
• Turbopack: Improve how DiskWatcher is configured and fix polling watcher bugs: #96440
• Turbopack: Allow DiskWatcher to use a mocked DiskFileSystem, add a small unit test: #96353
• [turbopack] Add e2e test that uses component chunks + workers: #96556
• [turbopack] Support experimental.serverMinification & expand experimental.turbopackMinify: #96578
• Add a turbopackChunking documentation page for pages router: #96698
• [turbopack] Don't run Webpack tests on Turbopack-only changes: #96656
• [turbopack] Enable the shared runtime by default: #96778
• [turbopack] Enable CJS tree shaking by default: #96779
• refactor: clean up places that needlessly list all RenderStages: #96907
• Fix the documented invocation for generating tests non-interactively: #96896
• Make NextConfigComplete typing more accurate: #96700
• Upgrade to swc 75: #96702
• docs: link View Transitions skill on skills.sh and clarify the example prompt: #96863
• [ci] Reset the turbopack deploy test project in the weekly cron: #96822
• docs: add authentication with Cache Components guide and iron-session example: #95802
• [turbopack] Fix a potential deadlock in scope_and_block: #95695
• Remove the turbopack-build-events trace span, use next build instead: #96746
• docs: add export const dynamic = 'force-static' to Route Handlers example on Static Exports: #96964
• [turbopack] Follow re-exports for side-effect free async modules: #95993
• [turbopack] Treat constants with values referencing other values as unsafe: #96190
• [refactor] Rename encodeCacheTag to encodeHeaderSafe: #96936
• Fix formatting of Google Fonts section in documentation: #88447
• Fixing a bug - typo issue fixed: #97141
• examples: fix Webiny API env variable name: #97134
• docs: fix Link prefetch grammar and Client Components wording: #97132
• Use emitted app entries for post-build processing: #97139
• docs(mdx): fix package name in .md handling section: #97131
• [turbopack] Reduce native React Compiler work: #96820
• docs: rename repo to repository for consistency: #87849
• Fix typo in Data Access Layer section: #87202
• docs: runtime prefetching -> optimizing prefetching: #96934
• [CC] Track APIs that cause incompatible static/app shells: #97040
• Fix client component loading span timing: #96455
• Trace development route compilation: #96454
• Prefix 'use cache' debug logs with the full directive: #97037
• Revert "[turbopack] Enable CJS tree shaking by default (#96779)": #97018
• Revert "[turbopack] Follow re-exports for side-effect free async modules": #97009
• [fragment-scroll] Rename ScrollAndMaybeFocusHandler to ScrollHandler: #96828
• Trace development route preparation: #96453
• test: cleanup Turbopack snapshot config: #97013
• Remove unused htmlLimitedBots from renderOpts: #96701
• fix(turbopack): point at the glob that matched a file with no module type: #96561
• [turbopack] Bail CJS tree-shaking on var x = module.exports = {}: #97130
• docs: server client and directives: #96145
• docs: clarify client cache freshness after hydration: #97180
• docs: create client-side fetching guide: #96341
• Turbopack: accept a module type argument for import.meta.glob: #96991
• docs: align Cache Components authentication guide title: #97143
• test: re-enable a few more passing NFT unit cases: #97017
• [turbopack] Do the CJS analysis needed for scope hoisting: #95826
• Remove legacy PPR code paths: #96868
• Use Cache Components as the internal PPR signal: #96827
• Make legacy PPR paths explicit: #96753
• fix: typos in code comments: #97137
• Fix spelling in two comments: #97136
• Decouple loader tree construction from children ordering: #97192
• Bump lightningcss: #97159
• Update gh-stack skill guidance: #97163
• [test] Unflake use-cache-custom-handler-dev tests: #97187
• Forward a build-container pin to deploy-test deployments: #97191
• Fix shared Turbopack runtime initialization race: #97215
• Fix stale data after navigation despite revalidation: #95439
• [turbopack] Only use the shared runtime by default on canary: #97208
• test: fix 'ouput' typo in parseIdsFromCliOutput: #97266
• Add the mtime fallback back: #97268
• Allow issue participants to request reopening: #96947
• [turbopack] Document clusters for chunking: #97267
• Link to issues in the contribution guide and discourage trivial PRs: #97188
• Stop serializing hmr version state: #97146
• [turbopack] Add clusters to chunking heuristics: #95157
• [test] Redirect the deployment host in-process for proxy deploy tests: #97260
• [test] Unflake two cache-components-dev-streaming assertions: #97246
• [test] Unflake use-cache-default-profile-expire-zero tests: #97250
• Allow running ncc before pnpm build: #97234
• Invalidate deferred Webpack entry sources: #97205
• Unify how a response's shell and full payloads are written: #96878
• Convert per-segment prefetches to NavigationFlightResponse format: #96877
• Unify how server responses are written into the client cache: #96876
• Convert tree prefetches to NavigationFlightResponse format: #96788
• fix(next/image): skip 0-byte entries when initializing disk LRU cache: #94068
• Update authentication diagram URL: #97320
• Add a script for adopting fork pull requests: #97252
• Migrate napi-rs bindings from v2 to v3: #95412
• Upgrade React from 11eddecd-20260805 to 22e4f993-20260811: #97249
• Add RDC compression rollout controls: #97247
• [testmode] Fix infi...

Next.js 16.4 is now available. Highlights include:

• Faster development: Client dynamic imports and server modules compile lazily.
• A smaller development cache: Compression and retention changes reduce Turbopack's on-disk footprint.
• Smaller production bundles: Export mangling and shorter CSS Module class names reduce output size.
• React 19.3: Stable View Transitions and Fragment Refs, browser(), Trusted Types support, and more.
• Cache Components in create-next-app: New projects have Cache Components enabled by default.
• Agent feedback (experimental): Collect structured, reviewable feedback from coding agents through an opt-in workflow.

This release contains security fixes for the following advisories:

High

• Server-Side Request Forgery in Image Optimization

Medium

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low

• Information disclosure in the Next.js development server's Model Context Protocol endpoint