npm / next
next
What changed in next 14 to 16, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
136 breaking68 security13 deprecations119 new APIs and options10 performance86 behavior and defaults42 tooling155 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initnext 16575 changes
Breaking changes 116
The true value is removed from the agentUpgrade option.
The obsolete experimental appNewScrollHandler configuration option was removed.
The navigation API is stabilized by removing its unstable_ prefix.
The prefetch API is stabilized by removing its unstable_ prefix.
Turbopack rules support type: 'text', and binding imports of non-ESM modules now error.
Strict route matching is enabled by default.
The static generation stream option was renamed to waitForAllReady.
Remote caching is authenticated with OIDC instead of a static personal access token.
Caches now error when called after prerendering has aborted.
The catchError API is stabilized by removing its unstable prefix.
Renames experimental.useExperimentalReact to blockingSSR.
Removes the flag because Node streams are now enabled.
The inert experimental.viewTransition flag was removed.
Invalid values returned by generateStaticParams now cause an error.
Empty or incomplete generateStaticParams results now cause an error with output: export.
instant no longer implicitly opts into Partial Prefetching.
Removes the instant navigation developer tools toggle.
The command now exits non-zero and prints a clear message when type generation fails.
Moves outputHashSalt out of the experimental configuration namespace.
Partial fallback behavior is now gated behind the partialPrefetching flag.
partialFallback behavior is now gated behind the partialPrefetching flag.
The partialFallbacks configuration flag is removed.
Renames the prefetch option value from force-runtime to allow-runtime.
The Server Actions body size limit is now enforced in the Edge runtime.
The serverActions.bodySizeLimit setting is enforced for Server Actions running in the Edge runtime.
Removes the obsolete shouldWaitOnAllReady render option.
supportsImmutableAssets is no longer supported with config.output.
Non-document requests to unknown paths now receive a plain-text 404 response.
The flag guarding unstable_io is removed.
RSC request-header validation is enabled by default.
Removes the inert experimental.viewTransition flag.
Disallowed development origins are blocked by default.
The experimental option is removed because no-cache behavior is now hard-coded.
Accessing undefined root params now produces an error.
Reduces the maximum image response body from 300MB to 50MB.
Disallows javascript URLs in router methods and redirects.
Moves Turbopack warning suppression from experimental configuration to turbopack.ignoreIssue.
Introduces unstable_instant for instant navigation behavior and testing.
Using unstable_instant without cacheComponents now produces a static error.
Turbopack no longer generates webpack statistics.
Server Action submissions from privacy-sensitive contexts are disallowed by default.
Build-time validation now detects ambiguous app routes.
The clientSegmentCache flag has been fully removed.
staleTimes.static now consistently enforces a 30-second minimum.
The unstable_forceStale prefetch option was removed.
Built-in AMP support and its codemod are removed.
The amp configuration and page-level AMP configuration are removed.
next build no longer runs linting automatically.
Supported browser minimums are Chrome 111, Edge 111, Firefox 111, and Safari 16.4.
Top-level option for migrating active dynamicIO or useCache usage to the Cache Components model.
PPR is enabled through the cacheComponents configuration instead of the experimental PPR flag.
The clientParamParsing configuration is removed and bundled with Cache Components.
The client segment cache is enabled by default.
Synchronous access is removed; cookies can only be accessed asynchronously in Next.js 16.
Next.js no longer overrides smooth scrolling during navigation by default; this attribute restores the previous override behavior.
All parallel route slots require explicit default.js files or builds fail.
The appIsrStatus option was removed; the development indicator itself remains available.
The buildActivity option was removed; the development indicator itself remains available.
The buildActivityPosition option was removed; the development indicator itself remains available.
Synchronous access is removed; draftMode can only be accessed asynchronously in Next.js 16.
The dynamicIO flag is removed.
proxy runs on the Node.js runtime and cannot be configured to use the Edge runtime.
The package uses ESLint Flat Config by default.
eslint-config-next version 16 requires ESLint 9 or later, while existing configurations may retain a compatible ESLint version.
The eslint option in the Next.js config file is removed.
The deprecated route-level experimental_ppr configuration is removed.
The experimental Partial Prerendering flag and route-level segment option are removed.
The cacheHandlers configuration moves out of the experimental namespace.
The Turbopack module IDs setting moves under the experimental configuration namespace.
Removed; migrate active usage to the top-level cacheComponents option or remove the flag.
The First Load JS metric is removed from next build output because it was inaccurate for server-driven architectures.
Synchronous access is removed; headers can only be accessed asynchronously in Next.js 16.
Image-generating functions receive id as a Promise when using generateImageMetadata.
Local IP image optimization is blocked by default and can be enabled only for private networks.
The 16-pixel value is removed from the default imageSizes array, reducing the shipped srcset size.
Local image sources with query strings require images.localPatterns configuration.
The default maximum image redirects changes from unlimited to 3.
The default minimum image cache TTL increases from 60 seconds to 4 hours, reducing revalidation cost.
The default image qualities value changes from allowing all qualities to only [75].
The routeType value changes from middleware to proxy for Proxy requests.
Proxy only supports the Node.js runtime.
The next/amp hook imports and useAmp usage are removed.
The next build output no longer includes the size and First Load JS metrics because they were inaccurate for server-driven architectures.
Flat config becomes the default ESLint configuration format.
The next lint command is removed; use Biome or ESLint directly.
Removed; replace next lint scripts with ESLint CLI commands.
next/root-params replaces the removed unstable_rootParams function.
Next.js 16 requires Node.js 20.9.0 or newer; Node.js 18 is unsupported.
Route params become Promises.
Image-generating functions receive params as a Promise and must await it.
Synchronous params access is removed in layouts, pages, routes, defaults, and metadata image conventions.
During next dev, process.argv no longer includes dev when loaded from the Next config file.
The middleware function should be renamed to proxy, including named exports.
MiddlewareMatcher is renamed to ProxyMatcher.
Removed; use NEXT_PUBLIC_ environment variables for client-accessible configuration instead.
An image quality value absent from images.qualities is coerced to the closest configured value.
The rdcForNavigations configuration is removed and bundled with Cache Components.
revalidateTag now requires a cacheLife profile; the single-argument form is deprecated and causes a TypeScript error.
Router scroll optimization is enabled by default.
Turbopack fully supports importing Sass files from node_modules, but does not support the legacy tilde prefix.
Next.js no longer overrides scroll-behavior during navigation by default; the previous behavior is opt-in.
Route searchParams become Promises.
serverRuntimeConfig is removed; server-only values should use environment variables instead.
The sitemap generating function receives id as a promise and must await it.
The size metric is removed from next build output because it was inaccurate for server-driven architectures.
The middleware URL normalization flag is renamed to skipProxyUrlNormalize.
Deprecated synchronous access to Dynamic APIs is removed.
Turbopack configuration moves from experimental.turbopack to a top-level nextConfig option.
Turbopack adds a separate filesystem cache setting for builds.
Turbopack adds a separate filesystem cache setting for development.
The persistent caching configuration names are replaced by filesystem cache names.
The minimum supported TypeScript version is increased to 5.1.0.
The unstable_rootParams function has been removed; use next/root-params instead.
Next.js adds updateTag and changes the revalidateTag signature.
The useAmp API is removed as part of AMP support removal.
next build fails when it detects a custom webpack configuration while Turbopack is the default.
Security 52
Security fixes address unauthenticated remote code execution when SVG files are used with the Image Optimization API.
Fixes a denial-of-service vulnerability in the App Router when using Server Actions.
Security fix for unauthenticated remote code execution in functions returning typed arrays.
Adds AI-assisted upgrade support, including security vulnerability coverage.
Security fix prevents information disclosure through App Router metadata image routes when dynamicParams is bypassed.
Security fixes address a server-side request forgery vulnerability in image optimization.
Security fix prevents cache poisoning of ISR pages in self-hosted Next.js applications.
Security fixes address information disclosure in the Next.js development server's Model Context Protocol endpoint.
Security fix prevents cross-user content substitution and persistent denial of service from cache poisoning during SSG/ISR rendering.
Security fixes prevent pending use cache fills from leaking Draft Mode content into regular responses and persisted pages.
Security fixes prevent cache leaks across root parameter values in nested use cache functions.
Fixed a remote code execution vulnerability in next/og ImageResponse.
Adds CSP nonces to script tags in loading and template files.
Security fixes address unauthenticated remote code execution when AVIF files are used.
Security fixes address unauthenticated remote code execution on Windows-hosted servers.
Internal development request-id headers are no longer exposed through userland headers().
Fixes unbounded Server Action payloads in the Edge runtime.
Fixes a denial-of-service vulnerability in the Image Optimization API when processing SVGs.
Fixes a Middleware / Proxy bypass affecting App Router applications using Turbopack and a single locale.
Fixes cache confusion of response bodies for requests with bodies.
Fixes cache confusion for request bodies containing invalid UTF-8 byte sequences.
Fixes server-side request forgery through rewrites with attacker-controlled destination hostnames.
Fixes server-side request forgery in Server Actions on custom servers.
Fixes unauthenticated disclosure of internal Server Function endpoints.
An incomplete prior fix for App Router middleware or proxy bypass through segment-prefetch routes was addressed.
Fixes a moderate cross-site scripting vulnerability when beforeInteractive scripts use untrusted input.
Fixes a high-severity denial-of-service vulnerability caused by connection exhaustion.
Fixes a moderate cross-site scripting vulnerability in App Router applications using CSP nonces.
Fixes a moderate denial-of-service vulnerability in the Image Optimization API.
Fixes a high-severity bypass affecting App Router applications through segment-prefetch routes.
Fixes low-severity cache poisoning affecting Middleware / Proxy redirects.
Fixes a high-severity bypass through dynamic route parameter injection.
Fixes a high-severity bypass in Pages Router applications using i18n.
Fixes low-severity cache poisoning caused by collisions in React Server Component cache-busting.
Fixes moderate cache poisoning affecting React Server Component responses.
Fixes a high-severity denial-of-service vulnerability affecting Server Components.
Fixes a high-severity server-side request forgery vulnerability in applications using WebSocket upgrades.
Patched a high-severity vulnerability where specially crafted requests to Server Function endpoints could trigger excessive CPU usage and denial of service.
Cross-site development-only WebSocket connections from privacy-sensitive origins can now be blocked.
Adds images.maximumDiskCacheSize to control the next/image LRU disk cache size.
Patched http-proxy to prevent request smuggling in rewrites.
The maxPostponedStateSize limit is now always respected.
Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components
Minimal-mode PPR resume handling now prevents unbounded request buffering or decompression from exhausting memory.
Server Function endpoints now include fixes for denial-of-service vulnerabilities that could cause crashes, out-of-memory exceptions, or excessive CPU usage.
The Image Optimizer now prevents unrestricted memory use when optimizing external images, avoiding denial-of-service conditions.
A security patch was released; see the linked changelog for more information about CVE-2026-23864.
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
This release contains a security patch; consult the linked security update for details.
The hardened React Server Components implementation fixes a critical remote-code-execution vulnerability; upgrading to 16.0.7 is required.
The images.domains configuration is deprecated and warns; image remote patterns are preferred.
Remote image hosts should be configured with remotePatterns for improved security.
Deprecations 12
React 18 support is deprecated for the Pages Router.
Undocumented custom server methods are deprecated.
The Edge Runtime is deprecated.
experimental.useCache receives a deprecated annotation.
The experimental useCache feature is now deprecated.
TypeScript v6 deprecates baseUrl, affecting projects that use this compiler option.
TypeScript v6 deprecates moduleResolution, affecting projects that use this compiler option.
Middleware is deprecated and developers are directed to use Proxy.
The named middleware export is deprecated and should be renamed to proxy.
Use of the legacy image component emits a deprecation warning.
Runtime configuration is deprecated and emits a deprecation warning.
Runtime configuration is deprecated and emits a deprecation warning.
New APIs and options 113
Turbopack can be configured with additional filesystem roots.
create-next-app adds a Cache Components option and prompt.
Adds experimental configuration for mozjpeg image optimization.
Turbopack supports experimental.serverMinification, and experimental.turbopackMinify was expanded.
Turbopack import.meta.glob accepts a module type argument.
Adds Instant Insights for prefetch() and navigation().
Adds Instant Insights for prefetch() and navigation().
The loaders API gained a version and a .resolve capability.
A next/cache-handlers types entrypoint was added for cache handler type usage.
Adds an option to preserve React Compiler memoization.
Setting TURBO_PERSISTENCE_MMAP=0 disables mmap for turbo-persistence.
Introduces configuration options for Turbopack garbage collection.
Adds unstable_ensureStatic segment configuration with shell and prefetch modes.
Adds navigation as an ensureStatic level.
An unstable navigation API was introduced for Partial Prefetching workflows.
Adds APIs for matching route parameters.
An unstable prefetch API was introduced for Partial Prefetching workflows.
Webpack loaders receive this.mode.
Webpack loaders receive this.target.
bfcacheId can opt out of state preservation.
Adds an option to control development-server restarts triggered by memory thresholds.
Next.js adds the experimental.appShells feature flag.
An experimental appShells feature flag was added.
Adds experimental chunking heuristics configuration to next.config.js.
Turbopack adds a graph-based CSS chunking algorithm behind experimental.cssChunking.
Adds a flag controlling whether development validation runs in a worker.
Adds experimental React Compiler support in Turbopack.
Next.js adds SWC preset-env configuration through experimental.swcEnvOptions.
Adds the experimental.turbopackChunking configuration option.
Workers can remain same-origin when assetPrefix points to a CDN.
Adds an experimental image optimization operation cache.
Turbopack supports import.meta.env.
Turbopack adds import.meta.glob support for Vite compatibility.
Turbopack supports the caseSensitive option for import.meta.glob.
Webpack loaders can use importModule support under Turbopack.
Adds request timing information to Instant Insights.
The environment variable salts content-hash filenames.
A CLI command compacts the Turbopack database after a build.
The environment variable controls the Turbopack trace output location.
A new environment variable controls the Turbopack trace output location.
Next.js adds the instrumentationClientInject configuration option.
Adapters can override outputHashSalt in modifyConfig.
Adds a global opt-in for Partial Prefetching.
The Turbopack CLI adds filesystem-backed persistent caching.
The project directory is passed to adapter modifyConfig.
robots.ts supports non-standard directives through the other field.
Adds an experimental flag to cancel superseded Server Components HMR requests.
Adds a next.config.js option for serverFastRefresh.
Adds an environment variable for debugging CSS chunking.
Adds an environment variable for debugging CSS chunking.
Routes can configure unstable_prefetch independently from unstable_instant.
The experiment adds a useOffline flag with offline retry behavior.
The experiment adds a useOffline hook exposing offline state to userland.
Turbopack adds LocalPathOrProjectPath PostCSS config resolution.
Adds CPU profiling support to the dev, build, and start commands.
Adds experimental gesture push support to the App Router.
Adds an experimental App Router scroll handler.
Adds an experimental flag for cached navigations and caching visited static pages.
Adds an experimental Turbopack immutable asset token option.
Adds an experimental configuration option for Lightning CSS features.
Adds an experimental option to bundle segment prefetches into a single response.
Adds an experimental Turbopack option to report system environment variable inlining.
Next.js adds a runtime server deployment ID configuration option.
Adds experimental strict route type checking for App Router pages, routes, cache profiles, and Pages Router routes.
Adds an experimental feature flag for vary parameter tracking.
Adds support for custom image cache handlers.
Adds a configuration limit for the maximum image response body size.
Allows Node.js experimental inspector flags when running next build.
Adds the NEXT_DEPLOYMENT_ID global for deployment identification.
Allows Node.js experimental inspector flags when running next dev.
Allows inspecting the server started by next start.
Adds the transitionTypes prop to next/link.
Adds component-level error recovery through unstable_catchError in error.js.
Adds an unstable route segment configuration for dynamic stale time.
Adds unstable_retry() to error.js for retrying error states.
Turbopack adds an input source maps option and respects serverSourceMaps.
An MCP tool named get_routes is added for retrieving routes.
Turbopack adds support for analyzing builds with next build --analyze.
The dev server can be inspected on its default port with the --inspect option.
This environment variable enables writing route hashes into the manifest.
Next.js adds a next upgrade command, including fallback to npx when yarn dlx is unavailable.
Appwrite Sites is added to the supported adapters.
React 19.2 adds Activity for hiding background UI while preserving state and cleaning up effects.
Call before reading process.env when environment variables must be evaluated at runtime rather than bundled during build.
create-next-app adds a webpack flag and applies it when users choose webpack or decline Turbopack.
Adding data-scroll-behavior="smooth" restores the previous scroll override during navigation.
Turbopack adds the debugIds configuration option.
The native TypeScript resolver for Next.js configuration requires an explicit experimental flag.
The alpha Build Adapters API adds experimental.adapterPath for custom build-process adapters.
The Next.js development MCP server adds a get_errors endpoint.
The Next.js development MCP server adds a get_page_metadata endpoint.
Next Image adds an option controlling whether local IP addresses may be loaded.
Next Image adds a maximum redirect limit for image loading.
The Next.js development server includes an MCP server, enabled by default.
The next/cache module adds a refresh API.
Turbopack implements the declarations option for next/font/local.
Adds the next-rspack-binding package for Rspack integration.
Next.js configuration can use the
.mtsextension with Node.js native TypeScript resolution.The recommended named export for the renamed routing file is proxy.
Proxy replaces the deprecated Middleware file convention, with a codemod available for migration.
The renamed proxy.ts file is the recommended replacement for middleware.ts.
The App Router uses React 19.2 features including View Transitions, useEffectEvent, and Activity.
Next.js adds a configuration option for enabling React Compiler integration, which is stable.
The redirects configuration can be defined as a synchronous function.
Allows refreshing the client router from within a Server Action after performing an action.
The rewrites configuration can be defined as a synchronous function.
Generated globally available RouteContext types help migrate route handlers to async params with type safety.
Turbopack provides resolveAlias for mapping imports such as browser requests for Node.js modules.
Turbopack provides resolveAlias for browser-side aliases such as mapping Node.js modules to empty modules.
updateTag provides Server Actions with read-your-writes cache expiration and immediate refresh semantics.
React 19.2 adds useEffectEvent for extracting non-reactive effect logic into reusable Effect Event functions.
React 19.2 adds View Transitions for animating elements updated inside a transition or navigation.
The --webpack flag opts out of the default Turbopack build and uses Webpack.
Performance 9
Dynamic imports are compiled lazily in development on the client and for SSR.
App Shells are prefetched on the client and used in runtime prefetches to improve navigation performance.
Cached misses can now be served from the filesystem route cache.
Hot module replacement avoids quadratic queue shifts, improving development update performance.
Turbopack uses file sourcemaps to improve development performance.
Turbopack no longer emits a polyfill chunk for API routes.
A single Node.js instance is pre-warmed when the development server starts, improving development startup behavior.
Turbopack enables mimalloc on musl-based Linux distributions, fixing a significant allocator-related performance issue.
Prefetching multiple URLs with a shared layout downloads the layout once.
Behavior and default changes 85
Adapter route collapses are enabled by default.
New create-next-app projects enable Cache Components by default.
Draft Mode is allowed on unlisted closed routes in adapter deployments.
Durable use-cache entries now work with client components.
Turbopack shared runtime is enabled by default.
Turbopack export name mangling is enabled by default for builds.
The stabilization of forbidden was reverted, so its stabilized status no longer applies.
The next analyze command is promoted.
Static exports support immutable static assets when output is set to export.
Turbopack resolveAlias configuration now supports false values.
The shared Turbopack runtime is enabled by default on canary builds.
TURBOPACK_PRINT_CHUNK_GROUPS is available in release builds.
Turbopack enables export mangling by default in production builds to reduce bundle sizes.
Turbopack resolves imports rooted at / from the project directory.
The stabilization of unauthorized was reverted, so its stabilized status no longer applies.
web-vitals was upgraded to v6 and soft navigations are reported.
Export validation is now limited to files inside the app directory.
Only cache entries predating tag revalidation are discarded, and completed entries are reused.
Retains fewer stale cache versions and uses a TTL, with an mtime fallback.
The allow-runtime behavior is unified with Partial Prefetching.
cacheLife profiles are now type-resolved, removing runtime assertions.
Skips interactive prompts when CLI flags are provided, making flagged project creation non-interactive.
App Shells are enabled by default when Cache Components is enabled.
experimental.cachedNavigations is enabled by default with cacheComponents.
experimental.cachedNavigations is enabled by default when cacheComponents is enabled.
experimental.optimisticRouting is enabled by default.
experimental.optimisticRouting is enabled by default.
The Turbopack filesystem cache for builds is enabled by default in non-stable releases.
experimental.varyParams is enabled by default.
experimental.varyParams is enabled by default.
The new fragment scroll handler is enabled by default.
Turbopack enables import with { type: 'text' } by default.
Metadata image routes are statically prerendered under Cache Components.
Instant navigation validation is enabled by default.
next build applies sourcemaps by default during prerender.
Node streams are enabled by default.
outputHashSalt moved out of experimental configuration.
Partial fallback shell upgrades for next start are gated behind partialPrefetching.
The export const prefetch API is stabilized.
Prefetching attempts a static prefetch before falling back to runtime behavior.
Request Insights display settings are persisted.
The retry API is stabilized by removing its unstable prefix.
Root params support is enabled by default.
Client-handled Server Action redirects now return HTTP 200.
Disables supportsImmutableAssets when config.output is used.
The Turbopack build filesystem cache is enabled by default.
The TypeScript CLI is enabled by default.
The unstable_instant API is stabilized.
The unstable_io API is stabilized and its guarding flag is removed.
The next@latest dist-tag points to this stable release, affecting which version is resolved when installing or updating the package.
Includes the deployment id in cacheHandlers keys.
Allows boolean and number primitives in next.config defines.
adapterPath moves from experimental configuration to the stable top-level configuration.
Enables the experimental React debug channel by default.
Server Function logging is available through logging.serverFunctions and remains enabled by default.
Allows reset() to be called from a user-defined global-error component.
Prefetch completion always performs an upsert.
Server actions now limit the number of arguments to 1000.
Server HMR is enabled by default for App Router pages.
Unknown CSS selectors are reported as warnings.
Functions using use cache can access root params.
Route handlers now apply the server actions transform to modules in node_modules.
The response cache now uses an LRU cache scoped by invocation ID in minimal mode.
Running the bundle analyzer web server is now the default.
The turbopackInferModuleSideEffects flag is enabled only in canary builds.
Turbopack filesystem caching is enabled by default for development.
Rspack persistent caching is enabled by default.
The React version in create-next-app templates was updated.
Production Turbopack server source maps now use relative paths.
The Segment Cache fallback implementation was generalized.
Cache Components becomes a stable top-level configuration option.
The default cache handler uses the cacheMaxMemorySize configuration.
Turbopack filesystem caching is enabled by default for next build.
Turbopack filesystem caching is enabled by default for next dev.
The headers configuration can be defined as a synchronous function.
Next.js prefetches only parts not already in cache instead of entire pages.
next build now uses Turbopack by default, replacing the previous default build behavior.
next dev now writes to a separate .next/dev output directory, enabling concurrent dev and build execution.
next dev now uses Turbopack by default, so the --turbopack or --turbo flag is no longer needed.
Turbopack becomes the default bundler, with a webpack opt-out flag.
Turbopack configuration moves from experimental.turbopack to the top-level turbopack option.
Create Next App no longer needs to explicitly pass --turbopack because Turbopack is the default bundler.
Filesystem caching is enabled by default for next dev to preserve compiler artifacts between runs.
The unstable_ prefix is removed from the cacheLife API, while the unstable prefix remains accepted for compatibility.
The unstable_ prefix is removed from the cacheTag API, while the unstable prefix remains accepted for compatibility.
Tooling 41
A bundle analyzer skill was added for analyzing application bundles.
Each analyze run records a historical snapshot for later comparison.
Next.js codemods transform .mjs files.
eslint-config-next supports ESLint 10.
The skill was renamed to next-bundle-optimizer and its usage was documented.
Bundler configuration validation is skipped in next/jest and under test.
Development validation runs on a worker thread when using Cache Components.
Adds pipeline spans to Instant Insights.
Startup hints and help examples now include the port option.
A CLI command was added to inspect static route information.
The Turbopack tracing command uses next internal trace with the trace output path.
A CLI command was added for uploading traces.
The ESLint rule no-location-assign-relative-destination has been enhanced.
Adds local span tracing for Request Insights.
Turbopack enables server HMR for app route handlers, improving development feedback for route changes.
Adds Turbopack resolution support for LocalPathOrProjectPath PostCSS configurations.
Adds an agents-md codemod command for AI coding agents.
create-next-app now generates AGENTS.md with bundled Next.js documentation.
Adds route filtering and negation pattern support to debug-build-paths.
Adds server HMR infrastructure and runtime support to Turbopack development.
The @next/playwright package is published to npm as part of canary releases.
Turbopack can resolve TypeScript files used in Tailwind configuration.
Recognizes @typescript/native-preview as an alternative TypeScript compiler.
The Turbopack TypeScript transform now supports verbatimModuleSyntax.
The bundle analyzer now shows compressed sizes, helping developers evaluate output size more accurately.
Next.js introduces a built-in bundle analyzer for Turbopack.
The experimental bundle analyzer gains a bundle analyzer UI.
Turbopack source maps now support relative paths.
Enabling the React Compiler requires installing the React Compiler Babel plugin.
The default create-next-app template now includes ESLint.
Create Next App templates use ESLint Flat config.
ESLint is added to the default Create Next App template.
Generated globally available LayoutProps types help migrate to async params with type safety.
A migration codemod updates synchronous params, searchParams, cookies(), headers(), and draftMode() access to async APIs.
The upgrade codemod updates Turbopack configuration, linting, middleware conventions, stabilized API names, and experimental PPR settings.
A lockfile prevents multiple next dev or next build instances from running on the same project.
The upgrade CLI prepares migration guides and codemod instructions for a coding agent.
Generated globally available PageProps types help migrate to async params and searchParams with type safety.
The Sass loader supports modern Sass syntax and new features.
The Next.js development MCP server exposes a server action tool.
Turbopack adds support for the Webpack loader this.fs.readFile API.
Fixes and other changes 147
Turbopack fixes chunk-list collisions for lazy dynamic imports.
Turbopack now ignores realpath errors during module resolution, matching Node.js behavior.
Repeated tag revalidation triggered from after() is propagated.
Client params no longer suspend on shallow URL updates.
Static export now preserves configured output directories.
Custom cache handlers are available on initial requests.
An explicitly configured generateBuildId is always used.
HTTP status codes are preserved during prerendering.
Turbopack resolves ../ and root-based import.meta.glob patterns correctly.
Metadata rendering remains stable across streaming modes and respects Edge SSR streaming policy.
Internal image responses no longer share the requester's socket.
The upgrade codemod honors non-interactive mode in its prompts.
Per-segment prefetching is preserved after dynamic navigation.
Proxy files are detected correctly when pageExtensions contains compound extensions.
revalidateTag now reaches custom cache handlers when profiles differ.
Server Actions are handled on dynamic PPR fallback routes.
Server Actions no longer hang after navigation to PPR pages.
Static metadata prerendering is restored for dynamic routes.
URL updates no longer trigger an unnecessary Suspense fallback.
Development invalidation no longer over- or under-invalidates use cache entries.
Fixes strongly consistent reads hanging when a task is canceled.
Skips 0-byte entries when initializing the disk LRU cache.
Rejects empty images when reading from or writing to the disk cache.
Emits whole-app server NFTs when standalone output is used with an adapter.
Fixes prerender signal retention for the use cache directive.
AVIF Image Optimization is re-enabled for developers using Next.js 16.3.4.
Fixes crossOrigin being unset in Turbopack manifests.
Fixes infinite recursion in testmode passthrough fetch behavior.
Fixes a build error when TypeScript is aliased to @typescript/typescript6.
Fixes Turbopack worker chunk loading when an asset prefix is configured.
Fixes catch-all index pages from being served for every other slug.
The prior i18n localization change for dynamic Pages API routes is reverted.
Reverts an i18n localization change for dynamic Pages API routes.
headers() again provides a live view of the incoming request.
Hot module reloading works for dynamic imports evaluated from layouts.
Image responses are preserved after optimization.
Optimistic routing bugs that caused repeated prefetch loops are fixed.
Missing styled-jsx styles in Pages Router SSR on adapter builds are fixed.
Cache item names generated by unstable_cache are encoded.
Files using the use cache directive can export literals.
Fixes callbacks running after the response has ended and request APIs used in promises passed to after.
Redirect destinations preserve basePath.
Redirect destinations preserve basePath.
Cache handler names are validated correctly.
cacheHandlers names are validated correctly.
expire values are normalized and validated, including Infinity, so configuration mistakes surface earlier.
fetch respects HTTP Cache-Control headers when using TTL-based invalidation.
Fetch cache keys are byte-exact for binary request bodies.
fetch(Request, init) is keyed by the effective request, and binary request bodies use byte-exact cache keys.
Fetch cache keys now use the effective request when fetch receives a Request and init.
Ensures headers() resolves to a unique value between render passes.
Cache Components now respects htmlLimitedBots without buffering the full response.
Local fonts now work in statically prerendered ImageResponse metadata routes.
images.maximumResponseBody now applies to local images as well as remote images.
Instant Navigation Testing now supports full-page loads when deployed.
Instrumentation is awaited in RouteModule.prepare and middleware instrumentation is awaited correctly with adapters.
Middleware rewrite query parameters are preserved in Pages API routes.
The development server restarts if the .next directory is deleted.
Server-side asset hashes now respect NEXT_HASH_SALT.
Response-based OpenTelemetry attributes are now set properly when using adapters.
revalidate values are normalized and validated, including Infinity, so configuration mistakes surface earlier.
optimizePackageImports now respects the sideEffects field in package.json.
Fixes add support for TypeScript 7, allowing Next.js projects to use that TypeScript release.
The package was published after being accidentally omitted since 16.2.4, making it available for developers to use.
A no-change release attempted to fix next@latest pointing at a prerelease version.
Propagates adapter preferred regions so regional deployment preferences are preserved.
Ensures non-ASCII characters in cache tags are encoded when tags are constructed.
Fixes hydration failures when a page is served from the HTTP cache during development.
FormData entries are no longer dropped, preserving submitted form data.
Prevents catch-all router.query corruption when basePath and rewrites are used together.
Fixes a forwarding loop for server actions when middleware rewrites are applied.
Fixes handling of type: module in the project directory when using standalone output or adapters.
Double-encoding of URL pathname parts during client parameter parsing was corrected.
Fixes double-encoding of URL pathname parts during client parameter parsing.
Fixes the fallback route params case in the app-page handler.
Preserves HTTP access fallbacks during prerender recovery.
Fixes invalid HTML responses for route-level RSC requests in the deployment adapter.
Patches setHeader for direct route handlers.
Fixes the filesystem watcher configuration so follow_symlinks(false) is applied.
Fixes Google Fonts with Turbopack for Windows on ARM64.
Scopes the Safari cache-buster to CSS and font assets in the Pages Router.
Content conflicts are detected when output assets are emitted.
Fixes an issue where manifest.ts breaks HMR.
Stale ISR revalidation errors are now reported via onRequestError.
Output assets are deduplicated during emission.
Fixes a race condition that could cause styles to be lost during concurrent rendering.
Fixes CSS HMR on Safari.
Turbopack excludes metadata routes from server HMR.
Adapter outputs for dynamic metadata routes were fixed.
Server actions now work correctly in standalone mode when cacheComponents is enabled.
The webpack loader runner layer was fixed for Turbopack builds.
Metadata lazy requiring and top-level await handling were fixed in Turbopack.
Turbopack now respects eval: true in worker_threads constructors.
Turbopack now respects eval: true in worker_threads constructors.
Handling of allowed development origins is fixed for no-cors requests.
Errors related to allowed development origins are improved.
Cache life and tag propagation is corrected for cache handler hits.
Strict route type validation no longer rejects numeric body parser size limits.
CSS parse error recovery and reporting are improved.
Data URL CSS is no longer rejected by the Pages Router global CSS restriction.
Supports TypeScript noUncheckedSideEffectImports when importing CSS.
The monorepo root search now handles pnpm workspace files.
React Server Components error messages are improved.
Type inference for fallback props is fixed.
Streaming fetch calls no longer hang during development with Cache Components.
Next config is filtered only when the experimental flag is enabled.
Fixes a linked-list bug when removing entries from the LRU cache.
Fixes relative same-host redirects in Node.js middleware.
Turbopack no longer crashes when processing MDX files containing multibyte characters.
Creates junction points instead of symlinks on Windows.
Fixes flashes and stuck empty canvases when resizing the bundle analyzer.
The bundle analyzer no longer flashes or leaves canvases stuck empty when resized.
Setting cacheMaxMemorySize no longer disables the development HMR cache.
NFT output now uses middleware.js instead of proxy.js.
Local images without static imports and sources without protocols now correctly handle the ?dpl query string.
The codemod now correctly handles the next ESLint plugin.
Static types now correctly reflect the runtime type of resHeaders.
Object and array literals can again be exported from use cache files.
The useSearchParams constructor can now be imported for instanceof checks.
The useSearchParams constructor can now be imported for instanceof checks.
Body cloning in Node.js middleware is properly finalized by awaiting it.
Fetch abort errors no longer propagate to user error boundaries.
Project options are now passed correctly from napi to Turbopack.
False-positive build errors involving cacheLife and cacheTag are fixed.
False-positive build errors involving cacheLife in client code are fixed.
False-positive build errors involving cacheTag in client code are fixed.
Deployment adapter metadata for the root route is fixed.
Turbopack fixes the font-family declaration generated for local fonts.
Turbopack fixes the font-family declaration for local fonts.
The development fallback parameters are synchronized when generateStaticParams changes.
getServerInsertedHTML now skips rendering correctly.
The next-js condition is excluded from middleware, proxy, and instrumentation.
The package's type definitions were corrected.
Duplicate include entries are no longer generated on Windows.
Requests with Origin: null headers are handled correctly.
Parallel route parameter resolution now tracks depth correctly for static paths.
prefetch={true} functionality was restored.
The proxy file is picked up correctly on Windows.
req.query is writable.
Turbopack correctly traces files referenced with npm.
Components using useActionQueue no longer crash when suspending.
Coding agents can use version-matched Next.js documentation referenced from AGENTS.md during upgrades.
Turbopack fixes precedence handling for the pageExtensions configuration.
TURBOPACK may now be undefined without causing a failure.
The TURBOPACK environment value may now be undefined without causing a failure.
Misspelling the 'use cache' directive now produces a build error.
withRspack becomes idempotent, allowing repeated application without changing the result.
next 1553 changes
Breaking changes 20
Next.js now rejects TypeScript versions 7.0 and later with an actionable error.
Turbopack no longer defines process.cwd() in node_modules, changing how dependencies access the current working directory.
Automatic Speed Insights instrumentation was removed; applications must add an explicit integration if they still need it.
The stable bundlePagesRouterDependencies option replaces experimental.bundlePagesExternals.
Page segments are no longer reused during Link or useRouter navigation, but remain reused for back-forward navigation and shared layouts.
cookies is now asynchronous and must be awaited for recommended usage.
draftMode is now asynchronous and must be awaited for recommended usage.
fetch requests are no longer cached by default; use cache: 'force-cache' to opt in.
The geo property was removed from NextRequest because hosting providers supply geolocation values.
GET functions in Route Handlers are no longer cached by default.
headers is now asynchronous and must be awaited for recommended usage.
The ip property was removed from NextRequest because hosting providers supply IP values.
The @next/font package was removed; imports must use the built-in next/font instead.
Font imports move from @next/font to the built-in next/font API.
params is now asynchronous in layouts, pages, route handlers, and related metadata files.
The minimum React DOM version is now 19.
The minimum React version is now 19.
The experimental-edge runtime value now errors; use edge instead.
useActionState replaces useFormState and provides direct access to pending state.
useFormState is deprecated and has been replaced by useActionState.
Security 15
Additional security hardening was added to next/og.
This release includes a security patch; consult the Next.js Security Update for details.
A security patch was released; the changelog contains more information about the issue.
This release includes a security patch; see the Next.js Security Update for details.
This release includes a security patch; the notes refer developers to the CVE-2026-23864 changelog for details.
This release contains a security patch; consult the Next.js Security Update for details.
This release includes security changes; see the linked CVE for additional details.
Applies a security patch addressing CVE-2026-23864.
A security patch is available; consult the Next.js Security Update for details.
A security patch was released; see the linked changelog for details about CVE-2026-23864.
This release contains a security patch; consult the Next.js Security Update for details.
A crafted request could expose compiled source code from Server Functions, potentially revealing business logic and embedded secrets.
A security patch was released; see the linked changelog for more information.
This release contains a security patch; see the Next.js Security Update for details.
The vulnerable RSC protocol was hardened to prevent remote code execution from attacker-controlled requests in App Router applications.
Deprecations 1
useFormState is deprecated in React 19 and will be removed in a future release.
New APIs and options 6
staleTimes opts page segments into client caching with dynamic and static durations.
fetchCache can opt all fetch requests in a layout or page into caching.
The upgrade codemod can retry with --skip-eslint-upgrade to preserve repaired ESLint dependencies.
The upgrade codemod can retry with --skip-react-upgrade to preserve repaired React dependencies.
useActionState replaces useFormState and provides additional properties such as direct access to pending state.
useFormStatus now exposes data, method, and action in React 19.
Performance 1
Turbopack validates CSS without computing all paths.
Behavior and default changes 1
The stable serverExternalPackages option replaces experimental.serverComponentsExternalPackages.
Tooling 1
Turbopack now supports patterns in the exports field.
Fixes and other changes 8
AVIF Image Optimization is re-enabled when newer versions of sharp are installed.
The package was published after being accidentally unavailable since 15.5.15.
Restores Content-Length and ETag for /_next/data/ JSON responses.
LRU cache items now have a minimum size of 1, preventing unbounded growth.
Fixes NFT tracing behavior in additional cases.
Fixes Turbopack NFT tracing for sharp 0.34.
Fixes a memory leak in the span map.
The Pages Router supports React 18 and React 19, making the React 19 upgrade optional for Pages Router applications.
next 141 changes
Security 1
A security patch was released; see the linked Next.js Security Update for details.