Next.js changelog

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes v16.4.2 [lts-active] Fix extensionless Google font URLs in both bundlers (#100277) [lts-active] Don't load the app-page

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in https://github.com/vercel/next.js/pull/100002 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091)

This release contains security fixes for the following advisories: Critical: Unauthenticated Remote Code Execution in use cache functions returning typed arrays Unauthenticated Remote Code Execution in Image Optimization API when SVG files

Check out the 16.4 announcement post to get an overview of the changes. Core Changes Show compiler plugin warning in more situations: #75682 fix(scripts): correct typo in rm.mjs error message: #87015 docs: improve clarity and punctuation in

This release contains security fixes for the following advisories: High: Server-Side Request Forgery in Image Optimization Medium: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass Cache poisoning o

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931) Credits Huge thanks to @lukesandbe

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

The following bug fixes have been backported. It does not include all pending features/changes on canary. next/image: Skip 0-byte entries when initializing disk LRU cache (#98185) next/image: Reject empty images when reading/writing to the

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949). The following bug fixes have been backported. It does not include all pending features/changes on canary. testmode: Fix infinite recursion in testmode passthrough fe

This release contains security fixes for the following advisories: Critical: Unauthenticated Remote Code Execution on windows-hosted servers Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes [backport] Scope app-entry export validation to files inside the app directory (#97357) [backport] Fix catch-all index p

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in https://github.com/vercel/next.js/pull/96653 [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_co

Check out the 16.3 announcement post to get an overview of the changes. Core Changes Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558 Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541 Normal

Backport/docs fixes 16.2 - July round by @icyJoseph in https://github.com/vercel/next.js/pull/96031 [Backport] Fixes to support TypeScript 7 by @lukesandberg in https://github.com/vercel/next.js/pull/95831

This release contains security fixes for the following advisories: High: Denial of Service in App Router using Server Actions Middleware / Proxy bypass in App Router applications using Turbopack and single locale Server-Side Request Forgery

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes Backport documentation fixes for v16.2 (#93804) [backport] Patch playwright-core to resolve _finishedPromise on requestF

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary. Security Fixes The following advisories have been addressed: High: GHSA-8h8q-6873-q5fj: Denial of Service wit

[!NOTE] This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary. Security Fixes The following advisories have been addressed: High: GHSA-8h8q-6873-q5fj: Denial of Service wit

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#92713) Turbopack: fix filesyste

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/ch

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes backport: Move expanded adapters docs to API reference (#92115) (#92129) Backport: TypeScript v6 deprecations for baseUr

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes docs: post release amends (#91715) docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698) Fi

[!TIP]Check out our Next v16.2 Blog Post to learn more about this release. Core Changes Upgrade React from f93b9fd4-20251217 to 65eec428-20251218: #87323 Turbopack: Create junction points instead of symlinks on Windows: #87606 Turbopack: Sy

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary. Core Changes [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194) Apply server actions transform to node_mod