chore(deps): update dependency next to v16.3.3 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	16.2.11 → 16.3.3

---

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

CVE-2026-75604 / GHSA-p293-qw3h-jr36

More information

Details

Impact

A vulnerability in applications using Pages and App router without Cache Component can lead to remote code execution when the server is hosted on machines using a Windows filesystem.

Workaround

There is no known workaround for affected windows-hosted applications. You should upgrade immediately if your server is hosted on Windows.

Severity

• CVSS Score: 9.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36
• https://nvd.nist.gov/vuln/detail/CVE-2026-75604
• https://github.com/vercel/next.js/commit/968b9fcb26bdeb8e0a861a9df05361474666d51b
• https://github.com/vercel/next.js/commit/b0f3460a92b955d3ca41fccff9a525a2b910fbf3
• https://github.com/vercel/next.js/releases/tag/v15.5.24
• https://github.com/vercel/next.js/releases/tag/v16.3.3
• https://github.com/advisories/GHSA-p293-qw3h-jr36

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

GHSA-2xp9-vwfh-vxw4

More information

Details

A vulnerability in the underlying libheif library used by sharp which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.

Until a fix has propagated, optimization of AVIF files is disabled.

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/strukturag/libheif/security/advisories/GHSA-g89c-p67h-r497
• https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4
• https://github.com/vercel/next.js/pull/97875
• https://github.com/vercel/next.js/pull/97931
• https://github.com/vercel/next.js/commit/3a15b4ac6ac8e70b1a9b18ecc18e8434462899b3
• https://github.com/vercel/next.js/commit/409772ec807def20132d251ad48fd8d8ad4c73c2
• https://github.com/vercel/next.js/commit/7a5937a8ab20b89d0a961f75eabb11577f5d5998
• https://github.com/vercel/next.js/releases/tag/v15.5.24
• https://github.com/vercel/next.js/releases/tag/v16.3.3
• https://github.com/advisories/GHSA-2xp9-vwfh-vxw4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v16.3.3

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#​97357)
• [backport] Fix catch-all index page being served for every other slug (#​97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#​97353) (#​97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#​97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#​97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#​97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

Compare Source

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in #​96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in #​96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in #​96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in #​96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in #​96900
• [backport] Bump @​swc/helpers by @​mischnic in #​96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in #​97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in #​97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in #​97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in #​97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in #​97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in #​97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in #​97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in #​97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in #​97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in #​97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in #​97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in #​97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in #​97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#​94905) by @​gaojude in #​97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.0

Compare Source

Core Changes

• Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #​91558
• Fix invalid HTML response for route-level RSC requests in deployment adapter: #​91541
• Normalize encoded dynamic placeholders in app routes: #​91603
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #​90304
• Update tokio from 1.43.0 to 1.47.3: #​90945
• [turbopack] Simplify snapshotting logic: #​91178
• Turbopack: enable server HMR for app route handlers: #​91466
• turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #​91497
• [turbopack] Use bail! instead of panic! for duplicate module ident error: #​91636
• Skip loadBindings() Lightning CSS check during next start: #​91538
• turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #​91461
• Turbopack: Add importModule() support to webpack loaders: #​89630
• turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #​91640
• turbopack-css: demote recoverable CSS parse warnings to Warning severity: #​91524
• feat(node-streams): add config flag, define-env, and env precedence test: #​90427
• Rename /_next/webpack-hmr to /_next/hmr: #​91415
• Add per-slot error attribution for instant validation using slot markers and config depth preference: #​91610
• Handle encoded params further: #​91627
• [turbopack] Respect {eval:true} in worker_threads constructors: #​91666
• Fix missing route in otel spans without base-server: #​91665
• [turbopack] Optimize compaction cpu usage: #​91468
• Fix layout segment optimization: move app-page imports to server-utility transition: #​91701
• Fix server actions in standalone mode with cacheComponents: #​91711
• turbo-persistence: remove Unmergeable mmap advice: #​91713
• turbopack: move "compact database" tracing span to backend layer: #​91693
• Turbopack: lazy require metadata and handle TLA: #​91705
• Fix adapter outputs for dynamic metadata routes: #​91680
• Turbopack: fix webpack loader runner layer: #​91727
• [turbopack] Remove incorrect debug_assert in try_read_task_cell: #​91699
• Add module count field to module graph tracing spans: #​91697
• turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #​91657
• Turbopack: pull in updated vercel/nft tests: #​91651
• [turbopack] Improve regressed build speed on cross-compiled MUSL: #​91477
• [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #​91320
• [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #​91438
• Avoid deprecated TS node10 moduleResolution defaults: #​91847
• [turbopack] Rebuild the docker build scripts: #​91799
• Fix TS6 baseUrl deprecation for extended tsconfig: #​91855
• Add next internal post-build CLI command for Turbopack database compaction: #​91336
• Turbopack: Define Effect as a trait instead of a closure: #​89080
• Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #​89133
• turbo-tasks-backend: improve print_cache_item_size instrumentation: #​91742
• Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #​91832
• Use charCodeAt for normalizePathTrailingSlash: #​91380
• Turbopack: Only patch lockfile when bindings fails to load: #​91379
• [create-next-app] Skip interactive prompts when CLI flags are provided: #​91840
• [devtools] Make instant navs panel draggable: #​91914
• [Segment Bundling] Bundle static prefetches based on size: #​91439
• turbo-tasks-backend: assert non-transient task_ids in track_modification: #​91924
• fix(turbopack): preserve resolveExtensions priority in read_matches fast path: #​91856
• turbopack: Remove Vc::resolve(), migrate all callsites to Vc::to_resolved(): #​91725
• turbo-tasks: add hashed cell mode for hash-based change detection without cell data: #​91576
• [cna] Upgrade to Biome 2.4 with Tailwind support: #​86065
• [devtools] Show AggregateError.errors in the error overlay: #​91835
• Narrow the opengraph-image function return type: #​91893
• [experiment] Add useOffline flag with offline retry behavior: #​92011
• adapters: remove unused suffix code: #​91997
• [experiment] Add useOffline hook to expose offline state to userland: #​92012
• [turbopack] Don't use turborepo to build the docker image: #​92029
• Use RcStr directly in napi(object) structs instead of converting to String: #​92014
• Rename SingleModuleReference::asset to SingleModuleReference::module: #​92028
• Revert "turbo-tasks: add hashed cell mode for hash-based change detection without cell data": #​92103
• [ftl] Include cause of route types: #​92056
• fix: handle file:// URLs from import.meta.resolve in cache handler path (fixes #​73796): #​90370
• Turbopack: exclude metadata routes from server HMR: #​92034
• next.config.js: Accept an option for serverFastRefresh: #​91968
• TURBOPACK: support parse windows absolute path with single slash: #​92076
• Enable varyParams tracking for Cached Navigations: #​92113
• telemetry: set turboFlag correctly: #​92149
• Instant Validation: Allow unconfigured slots to render optionally: #​92126
• Turbopack: statically evaluate path.sep: #​92150
• Turbopack: use same hash for immutable-static-hashes.json: #​92157
• [turbopack] replace regex with indexof: #​92023
• Turbopack: createRequire(new URL("...", import.meta.url)): #​92153
• Add PPR evals and fix env loading for agent-eval 0.9.5: #​92063
• Turbopack: support targeting even older browsers: #​91563
• Add rust-fingerprint task and SCCACHE passthrough env: #​92167
• Improve error message for deprecated experimental.dynamicIO config: #​92081
• [turbopack] Fix CSS HMR on Safari: #​92123
• simplify session dependent tasks and add TTL support: #​91729
• disable bmi2 in qfilter: #​92177
• Improve revalidateTag JSDoc to include guidance about required second parameter: #​92176
• fix: pin 19 actions to commit SHA, extract 7 expressions to env vars: #​92016
• partial fallbacks: adapter support for intermediate shells: #​91902
• Turbopack: trace fs.readdir calls: #​92148
• feat: add NEXT_HASH_SALT env var for content-hash filename salting: #​91871
• Fix DashMap read-write self-deadlock in task_cache causing hangs: #​92210
• [turbopack] use a single query parameter for cache busting: #​92214
• Generate a CLI warning if using Rosetta 2 on Apple Silicon: #​92220
• remove the loop from StaticSortedFile::lookup: #​91688
• Add telemetry for adapterPath config usage: #​92228
• Node.js streams: First pass: #​90500
• fix: preserve HTTP access fallbacks during prerender recovery: #​92231
• Remove unnecessary ALS re-exports from entry-base.ts: #​91527
• Allow multi-level .localhost subdomains in dev origin check: #​92262
• turbo-tasks-backend: stability fixes for task cancellation and error handling: #​92254
• Add MCP get_compilation_issues tool and NAPI method: #​92062
• Add view transitions eval (agent-043): #​92260
• [turbopack] optimize RcStr parsing: #​91773
• Ensure app-page reports stale ISR revalidation errors via onRequestError: #​92282
• Move streamToUint8Array back to node-web-streams-helper.ts: #​92263
• Revert "simplify session dependent tasks and add TTL support (#​91729)": #​92320
• fix: add @​deprecated annotation to experimental.useCache: #​92316
• Improve existing dev server error message to suggest using it: #​92317
• Restart the next dev server if .next is deleted: #​92135
• Update Rust toolchain to nightly-2026-04-02: #​92288
• Turbopack: Remove FileSystemPath::value_to_string in favor of ValueToStringRef::to_string_ref: #​92284
• [turbopack] use zero copy qfilter deserialization: #​90574
• feat: add experimental.swcEnvOptions for SWC preset-env configuration: #​92272
• Turbopack: Dedupe our two filesystempath extension/extension_ref functions: #​92048
• turbo-tasks: replace async resolve fns with custom Future types (ResolveRawVcFuture, ResolveVcFuture, ToResolvedVcFuture): #​91554
• next-core: deduplicate output assets and detect content conflicts on emit: #​92292
• Handle edge runtime in places that import node:stream: #​92354
• Fix fallback route params case in app-page handler: #​91737
• use sorted inserts to improve builder performance: #​91553
• Allow for parsing app route strings with and without slot names.: #​92327
• fix(server-hmr): metadata routes overwrite page runtime HMR handler: #​92273
• turbo-persistence: optimize file syncing: #​90542
• Turbopack: Remove turbo_tasks::apply_effects, use Effects::apply instead: #​91858
• Turbopack: Add a check for node version before allowing workerThreads: #​91614
• turbo-persistence: skip BlockCache for uncompressed (mmap-backed) blocks: #​92390
• Include more context in macOS Rosetta 2 warning message: #​92436
• change the process name of builds: #​92411
• turbo-persistence: pin referenced BlockCache entries to prevent eviction: #​92361
• Fix styled-jsx race condition: styles lost due to concurrent rendering: #​92459
• turbo-tasks: fix hashed cell mode crash on task error (re-land #​91576): #​92108
• Fix sst inspect tool to respect CURRENT and stale sst files: #​92414
• Optimize how we track data for persistence: #​89370
• [turbopack] add family name to many spans: #​92415
• Route Handlers: Fix devRequestTimingInternalsEnd and Turbopack server HMR: #​92271
• next-routing: middleware matching and app request URL normalization: #​91859
• turbo-persistence: Use AtomicBool for is_empty() to avoid lock contention: #​92481
• fix: mention params and searchParams in blocking-route error messages: #​92360
• CPU prof: Write profiles to .next-profiles instead of .next/cpu-profiles: #​92078
• Turbopack: Write trace file to .next-profiles: #​92189
• feat: generate root params types: #​91019
• fix: resolve function configs in unstable_getResponseFromNextConfig: #​92501
• Node.js streams: Fork points: #​92252
• Turbopack: Add --internal-trace cli flag: #​92190
• Fix minimumReleaseAgeExclude for React and friends: #​92535
• Add experimental unstable_io() API behind experimental.unstableIO flag: #​92521
• Update React from 74568e86-20260328 to 404b38c7-20260408: #​92536
• Turbopack: switch from immutable token to path prefix: #​92164
• [build info]: distinguish between PPR and fully static routes in gSP: #​92518
• [build info]: omit symbol from top level gSP route: #​92525
• turbo-tasks-backend: prevent duplicate task restores with restoring bits: #​92389
• Add next internal upload-trace: #​92191
• Request logging: Fix generate-params time being included in next.js time: #​91386
• fix: scope "Pages Router only" comment to default export in next/error: #​92566
• Turbopack Build: Remove dev fouc from production bundle: #​80935
• Turbopack: Improve unable to resolve next error: #​91394
• fix(hmr): reconnect WebSocket after sleep/wake: #​91416
• Handle target option in React Compiler for Pages + React 18: #​91500
• Replace wasmer with wasmtime for SWC plugin WASM engine: #​91533
• turbopack: fix incremental build when module factories are restored from persistent cache: #​92569
• [turbopack] Rust dependency caching via sccache: #​91873
• trace: detect rage restarts and deleted .next dirs: #​92489
• [turbopack] fix a debug_assert failure: #​92581
• Don't swallow strings thrown in Server Components: #​92592
• Fix NextFontIssue IssueStage: CodeGen → Resolve: #​92588
• Node.js streams: Add forkpoint for CacheComponents: #​92444
• Resolve compilerOptions.paths in tsconfigs without compilerOptions.baseUrl: #​92277
• Turbopack: extract inline base64 decode helper to shared @turbopack/base64 module: #​92549
• Add codemod command to middleware deprecation warning: #​92532
• turbopack: move CSS module composes validation from code generation to resolving: #​92582
• Drop turbo_tasks::function from ValueDebug trait items: #​92593
• [partial fallbacks]: enable by default: #​92627
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false): #​92631
• Turbopack: cut number of client references in half: #​92607
• Remove a ton of turbo task functions from Issue trait items: #​92623
• feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution: #​91338
• feat(turbopack): change DiskFileSystem root to Vc for portable cache: #​92603
• Turbopack: remove unused ChunkableModules struct: #​92606
• Fix segment explorer file pill accessibility: #​92608
• Disable sccache temporarily: #​92657
• Delete some dead turbo task functions: #​92596
• Node.js streams: Add forkpoint for error recovery: #​92457
• turbo-tasks: Drop output_dependent on immutable task completion: #​92683
• Turbopack: properly remove unused TS enums with scope hoisting: #​88205
• fix(server-actions): skip type-only ExportNamed in pre-pass to prevent phantom registerServerReference: #​92494
• Turbopack: Add import.meta.glob support (Vite compat): #​92640
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation: #​92725
• TURBOPACK: support crsossOriginLoading: #​92070
• Compiler: Support boolean and number primtives in next.config defines: #​92731
• Fix prefetch hints not being loaded during revalidation: #​92625
• Exclude trace files from directory deletion in builds: #​92486
• Switch segment prefetch cache miss response from 204 to 404: #​92751
• Ensure x-nextjs-data header is only set during resolve: #​92752
• feat(trace-server): add query CLI and MCP API to turbopack-trace-server: #​92030
• Improve error stacks for dynamic API usage in "use cache": #​92736
• Node.js streams: Add forkpoint for continueDynamicHTMLResume: #​92471
• Node.js streams: Add forkpoint for generateDynamicFlightRenderResult: #​92474
• Node.js streams: Add forkpoint for generateStagedDynamicFlightRenderResult: #​92509
• Add unstable_prefetch route segment config and decouple runtime prefetching from unstable_instant: #​92754
• feat(turbo-tasks-backend): gate prepare_tasks_with_callback trace span behind feature flag: #​92779
• Update next versions of internal apps: #​92666
• turbo-persistence: stop background persisting after unrecoverable failure: #​92106
• Stop using deprecated downlevelIteration: #​92652
• Disable build caches for production/staging/force-preview deploys: #​92792
• Fix turbo cache flag: use --force: #​92796
• Fix devlow-bench: tsconfig rootDir mismatch with package.json bin: #​92800
• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router): #​92580
• Enable wasm plugins on windows arm: #​92544
• prefetchInlining: fix build crash on notFound() pages: #​92806
• turbopack: gate ValueDebugFormat and ValueDebug behind debug_assertions: #​92628
• Add TurboMalloc::thread_park() to flush and collect on thread park: #​92804
• Stop using deprecated baseUrl: #​92653
• Turbopack: Use FrozenMap for module export information: #​92802
• Turbopack: remove webpack chunk detection: #​92773
• Turbopack: refactor ESM codegen generation: #​92777
• Fix monorepo @next/swc binary postinstall: #​92813
• webpack: fix swcPlugins with relative paths: #​92770
• Turbopack: shorter error for ChunkGroupInfo::get_index_of: #​92814
• Turbopack: properly set NODE_ENV for SWC plugins: #​92579
• Node.js streams: Add forkpoint for logMessagesAndSendErrorsToBrowser: #​92510
• Node.js streams: Add forkpoint for createCombinedPayloadStream: #​92511
• Node.js streams: Add forkpoint for renderWithRestartOnCacheMissInValidation: #​92512
• Node.js streams: Add forkpoint for prerenderToStream: #​92513
• Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index: #​92828
• Turbopack: refactor export analysis: #​92781
• fix(trace-server): default MCP port to --port + 1 to avoid conflicts: #​92831
• Revert "Node.js streams: Add forkpoint for prerenderToStream": #​92845
• Turbopack: remove StarImportAnalyzer: #​92830
• Turbopack: analyzer improvement followups: #​92834
• Turbopack: move assignment_scopes computation into ImportMap: #​92835
• Warn for non-deterministic "use cache" args during final prerender: #​92820
• Turbopack: Use lld again on ARM64 glibc Linux: #​92860
• turbopack: cache TransformPlugin in narrow-scoped turbo-tasks functions: #​92842
• Allow overriding outputHashSalt in modifyConfig: #​92856
• Support type cast expressions in page static info extractor: #​92837
• turbo-tasks: add info_span for blocking waits during task restore: #​92878
• Fix dev mode hydration failure when page is served from HTTP cache: #​92892
• [devtools] Preserve full code frames in browser overlay: #​92621
• Enable prefetchInlining by default: #​92863
• Turbopack: Use an async lock in the filesystem watcher: #​92906
• Replace deprecated moduleResolution: "node": #​92654
• turbo-tasks: Reduce allocations on cache hits: #​92756
• fix(next/image): ensure images.maximumResponseBody applies to local images too: #​92920
• rename MagicAny: #​92918
• turbopack: reduce EffectStateStorage memory by storing u128 content hashes: #​92902
• turbo-trace-server: reduce allocation overhead when loading large trace files: #​92896
• Turbopack: optimize SelfTimeTree performance, memory usage, and fix range query boundaries: #​92931
• remove flag guarding unstable_io: #​92923
• Support more prefetch configuration options: #​92859
• Improve deduping of concurrent 'use cache' invocations: #​91830
• [partial fallbacks]: include prefetch requests in shell upgrade handling: #​92894
• Redesign blocking route dev overlay and build errors: #​92638
• Switch to cargo-binstall and pre-built sccache binaries: #​92911
• Remove prefetch from instant config: #​92761
• Improve "make root node" trace attributes: #​92941
• Use existing commitId for tarball URL in stats action: #​92899
• Use OIDC for CodSpeed: #​93059
• Restore dev-mode cache-fill timeout for 'use cache': #​93055
• Make 'use cache' fill timeout configurable: #​93070
• Strengthen _rsc cache-busting param: #​92755
• turbo-tasks: drop once_cell, const-init TRAIT_METHOD, ctor WORKER_TASKS: #​93090
• Patch setHeader for direct route handlers: #​93101
• [turbopack] Persistent last_successful_parse: #​92852
• [turbopack] Unify Cell Storage: #​92974
• fix(use-cache): remove awaiting revalidation: #​92636
• [turbopack] Fix max_level_hint to return most verbose per-target level: #​93128
• feat(turbopack): add NEXT_TURBOPACK_TRACING_PATH to control trace output location: #​93084
• Turbopack: move import_usage computation into ImportMap: #​92891
• Turbopack: unify ModuleGraph constructors: #​93203
• Turbopack: move get_inner_asset into ecmascript module: #​93191
• [turbopack] drop TransientState: #​92853
• instant(): Block out-of-band client fetches: #​93099
• [next/image] Stop using deprecated url.parse: #​93208
• Suspend dynamic route params in dev instant shell: #​93108
• Recognize super(...) messages in Error subclass constructors: #​93182
• [turbopack-trace-server] Performance improvements for span event handling: #​93179
• Preserve __NEXT_ERROR_CODE across the /_error page handoff: #​93183
• Reduce allocations in the next_debug_instant_stack transform: #​93222
• Apply sourcemaps by default during prerender in next build: #​93280
• Turbopack: compute exports without full analysis: #​92823
• Turbopack: cheaper check in map_next_dynamic: #​93283
• Fix route handler SWR blocking on Node runtime: #​93189
• [turbo-tasks-backend] Single-item optimization for lost follower operations: #​93200
• Fix export * as X from './self' in scope-hoisted modules: #​93192
• Turbopack: only compute module ids for included modules: #​93276
• Forward invalid dynamic usage errors on client-side navigations: #​93184
• HMR: debounce status indicator transitions to prevent flicker during bursts of changes: #​93229
• Turbopack: iter_reachable_modules: #​93315
• Turbopack: add failing test for cross-module side-effect inference: #​93323
• Turbopack: also add edge count to trace: #​93314
• Turbopack: pull in updated vercel/nft tests: #​93321
• [turbopack-trace-server] optimize loading: #​93264
• turbo-tasks: precompute trait-impl vtables at compile time: #​93092
• Honor the route-level expire value with blocking revalidation: #​93211
• Turbopack: add experimental.turbopackWorkerAssetPrefix to keep Workers same-origin when assetPrefix is a CDN: #​93271
• Report OS memory pressure in TurboMalloc and trace samples: #​93333
• Speed up native postinstall script: #​93312
• Turbopack: remove unused module references: #​93335
• Turbopack: remove ModuleResolveResultItem::OutputAsset: #​93349
• Turbopack: delete unused turbo-static crate: #​93324
• fix a snapshot encoding error that could happen under concurrent mutation and snapshotting: #​92658
• Enable server HMR for metadata routes (manifest.ts, robots.ts, etc.): #​93110
• [next/image] Only fire onError once: #​93209
• fix: handling of falsey values in error boundaries: #​93134
• Update upload trace url: #​93350
• enable validateRSCRequestHeaders by default: #​93367
• Deprecate edge runtime: #​93369
• Update 05-server-and-client-components.mdx: #​93374
• Only log partytown setup error once: #​93378
• Remove leftover Turbopack manifests: #​93398
• trace-server: shrink_to_fit LazySortedVec after sorting: #​93361
• Revert "Revert "Node.js streams: Add forkpoint for prerenderToStream"": #​93376
• feat(metadata): support non-standard directives in robots.ts via other: #​93206
• [turbo-trace-server] optimize loading even more: #​93332
• Fix streaming in draft mode for cache components: #​93417
• Drop once_cell from all direct crate deps: #​93095
• Replace Lazy static lookups with phf::Map: #​93096
• Include deployment id in cacheHandlers keys: #​93453
• fix(next/image): Improve error message for private IP (SSRF) rejections: #​91686
• turbo-tasks-backend: fix snapshot coordination races + extract SnapshotCoordinator: #​93416
• Fix dev mode reload and error on back navigation between Next.js pages: #​93486
• Fix double-encoding of URL pathname parts in client param parsing: #​93491
• Don't suppress usage of deprecated TypeScript compilerOptions: #​93377
• Turbopack: fix import_usage for functions behind member expressions: #​93504
• [turbopack] shrink the size of futures: #​93474
• [turbopack] Simplify local task tracking: #​93478
• [turbopack] correct a fencepost error in our inline string descision: #​93524
• Turbopack: make rcstr! macro expansion const: #​93516
• Turbopack: lazy aggregation optimize via persistent pending flag: #​93454
• Detect 'use cache' module-scope deadlocks early in dev: #​93500
• Turbopack: really fix MAX_INLINE_LEN: #​93531
• Bundle the 'use cache' deadlock probe worker: #​93538
• Support configuring a default instant validation level : #​93301
• Turbopack: simplify asset ident constructors: #​93213
• Disable instant validations in draft mode: #​93472
• Drop ReferencedAsset::from_resolve_result as a turbotask: #​93297
• Turbopack: Cache effect errors, replace the write_lock Mutex with a lazily created Notify instance: #​93476
• Order loader tree imports by tree depth: #​93537
• Turbopack: more strict vergen setup: #​93541
• [devtools] Force ANSI colors on overlay code frames regardless of TTY: #​93550
• turbo-rcstr: replace rcstr!

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.