fix(deps): update nextjs monorepo to v16

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
eslint-config-next (source)	14.2.1 → 16.3.8
next (source)	14.2.1 → 16.3.8

---

Release Notes

vercel/next.js (eslint-config-next)

v16.3.8

Compare Source

This release contains security fixes for the following advisories:

High:

• Server-Side Request Forgery in Image Optimization

Medium:

• Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
• Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
• Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
• Pending use cache fill can leak Draft Mode content into regular responses and persisted pages
• Cache leak across root param values in nested 'use cache' functions

Low:

• Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#​98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

Compare Source

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

v16.3.5

Compare Source

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#​98185)
• next/image: Reject empty images when reading/writing to the disk cache (#​98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#​98167)
• Add CSP nonce to script tags of loading and template files (#​98403)
• Fix use cache prerender signal retention (#​98448)

v16.3.4

Compare Source

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#​97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#​97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#​97997)
• Fix unset crossOrigin in Turbopack manifests (#​97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#​97357)
• [backport] Fix catch-all index page being served for every other slug (#​97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#​97353) (#​97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#​97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#​97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#​97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

Compare Source

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in #​96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in #​96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in #​96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in #​96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in #​96900
• [backport] Bump @​swc/helpers by @​mischnic in #​96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in #​97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in #​97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in #​97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in #​97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in #​97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in #​97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in #​97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in #​97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in #​97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in #​97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in #​97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in #​97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in #​97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#​94905) by @​gaojude in #​97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

v16.3.0

Compare Source

Core Changes

• Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #​91558
• Fix invalid HTML response for route-level RSC requests in deployment adapter: #​91541
• Normalize encoded dynamic placeholders in app routes: #​91603
• Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #​90304
• Update tokio from 1.43.0 to 1.47.3: #​90945
• [turbopack] Simplify snapshotting logic: #​91178
• Turbopack: enable server HMR for app route handlers: #​91466
• turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #​91497
• [turbopack] Use bail! instead of panic! for duplicate module ident error: #​91636
• Skip loadBindings() Lightning CSS check during next start: #​91538
• turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #​91461
• Turbopack: Add importModule() support to webpack loaders: #​89630
• turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #​91640
• turbopack-css: demote recoverable CSS parse warnings to Warning severity: #​91524
• feat(node-streams): add config flag, define-env, and env precedence test: #​90427
• Rename /_next/webpack-hmr to /_next/hmr: #​91415
• Add per-slot error attribution for instant validation using slot markers and config depth preference: #​91610
• Handle encoded params further: #​91627
• [turbopack] Respect {eval:true} in worker_threads constructors: #​91666
• Fix missing route in otel spans without base-server: #​91665
• [turbopack] Optimize compaction cpu usage: #​91468
• Fix layout segment optimization: move app-page imports to server-utility transition: #​91701
• Fix server actions in standalone mode with cacheComponents: #​91711
• turbo-persistence: remove Unmergeable mmap advice: #​91713
• turbopack: move "compact database" tracing span to backend layer: #​91693
• Turbopack: lazy require metadata and handle TLA: #​91705
• Fix adapter outputs for dynamic metadata routes: #​91680
• Turbopack: fix webpack loader runner layer: #​91727
• [turbopack] Remove incorrect debug_assert in try_read_task_cell: #​91699
• Add module count field to module graph tracing spans: #​91697
• turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #​91657
• Turbopack: pull in updated vercel/nft tests: #​91651
• [turbopack] Improve regressed build speed on cross-compiled MUSL: #​91477
• [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #​91320
• [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #​91438
• Avoid deprecated TS node10 moduleResolution defaults: #​91847
• [turbopack] Rebuild the docker build scripts: #​91799
• Fix TS6 baseUrl deprecation for extended tsconfig: #​91855
• Add next internal post-build CLI command for Turbopack database compaction: #​91336
• Turbopack: Define Effect as a trait instead of a closure: #​89080
• Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #​89133
• turbo-tasks-backend: improve print_cache_item_size instrumentation: #​91742
• Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #​91832
• Use charCodeAt for normalizePathTrailingSlash: #​91380
• Turbopack: Only patch lockfile when bindings fails to load: #​91379
• [create-next-app] Skip interactive prompts when CLI flags are provided: #​91840
• [devtools] Make instant navs panel draggable: #​91914
• [Segment Bundling] Bundle static prefetches based on size: #​91439
• turbo-tasks-backend: assert non-transient task_ids in track_modification: #​91924
• fix(turbopack): preserve resolveExtensions priority in read_matches fast path: #​91856
• turbopack: Remove Vc::resolve(), migrate all callsites to Vc::to_resolved(): #​91725
• turbo-tasks: add hashed cell mode for hash-based change detection without cell data: #​91576
• [cna] Upgrade to Biome 2.4 with Tailwind support: #​86065
• [devtools] Show AggregateError.errors in the error overlay: #​91835
• Narrow the opengraph-image function return type: #​91893
• [experiment] Add useOffline flag with offline retry behavior: #​92011
• adapters: remove unused suffix code: #​91997
• [experiment] Add useOffline hook to expose offline state to userland: #​92012
• [turbopack] Don't use turborepo to build the docker image: #​92029
• Use RcStr directly in napi(object) structs instead of converting to String: #​92014
• Rename SingleModuleReference::asset to SingleModuleReference::module: #​92028
• Revert "turbo-tasks: add hashed cell mode for hash-based change detection without cell data": #​92103
• [ftl] Include cause of route types: #​92056
• fix: handle file:// URLs from import.meta.resolve in cache handler path (fixes #​73796): #​90370
• Turbopack: exclude metadata routes from server HMR: #​92034
• next.config.js: Accept an option for serverFastRefresh: #​91968
• TURBOPACK: support parse windows absolute path with single slash: #​92076
• Enable varyParams tracking for Cached Navigations: #​92113
• telemetry: set turboFlag correctly: #​92149
• Instant Validation: Allow unconfigured slots to render optionally: #​92126
• Turbopack: statically evaluate path.sep: #​92150
• Turbopack: use same hash for immutable-static-hashes.json: #​92157
• [turbopack] replace regex with indexof: #​92023
• Turbopack: createRequire(new URL("...", import.meta.url)): #​92153
• Add PPR evals and fix env loading for agent-eval 0.9.5: #​92063
• Turbopack: support targeting even older browsers: #​91563
• Add rust-fingerprint task and SCCACHE passthrough env: #​92167
• Improve error message for deprecated experimental.dynamicIO config: #​92081
• [turbopack] Fix CSS HMR on Safari: #​92123
• simplify session dependent tasks and add TTL support: #​91729
• disable bmi2 in qfilter: #​92177
• Improve revalidateTag JSDoc to include guidance about required second parameter: #​92176
• fix: pin 19 actions to commit SHA, extract 7 expressions to env vars: #​92016
• partial fallbacks: adapter support for intermediate shells: #​91902
• Turbopack: trace fs.readdir calls: #​92148
• feat: add NEXT_HASH_SALT env var for content-hash filename salting: #​91871
• Fix DashMap read-write self-deadlock in task_cache causing hangs: #​92210
• [turbopack] use a single query parameter for cache busting: #​92214
• Generate a CLI warning if using Rosetta 2 on Apple Silicon: #​92220
• remove the loop from StaticSortedFile::lookup: #​91688
• Add telemetry for adapterPath config usage: #​92228
• Node.js streams: First pass: #​90500
• fix: preserve HTTP access fallbacks during prerender recovery: #​92231
• Remove unnecessary ALS re-exports from entry-base.ts: #​91527
• Allow multi-level .localhost subdomains in dev origin check: #​92262
• turbo-tasks-backend: stability fixes for task cancellation and error handling: #​92254
• Add MCP get_compilation_issues tool and NAPI method: #​92062
• Add view transitions eval (agent-043): #​92260
• [turbopack] optimize RcStr parsing: #​91773
• Ensure app-page reports stale ISR revalidation errors via onRequestError: #​92282
• Move streamToUint8Array back to node-web-streams-helper.ts: #​92263
• Revert "simplify session dependent tasks and add TTL support (#​91729)": #​92320
• fix: add @​deprecated annotation to experimental.useCache: #​92316
• Improve existing dev server error message to suggest using it: #​92317
• Restart the next dev server if .next is deleted: #​92135
• Update Rust toolchain to nightly-2026-04-02: #​92288
• Turbopack: Remove FileSystemPath::value_to_string in favor of ValueToStringRef::to_string_ref: #​92284
• [turbopack] use zero copy qfilter deserialization: #​90574
• feat: add experimental.swcEnvOptions for SWC preset-env configuration: #​92272
• Turbopack: Dedupe our two filesystempath extension/extension_ref functions: #​92048
• turbo-tasks: replace async resolve fns with custom Future types (ResolveRawVcFuture, ResolveVcFuture, ToResolvedVcFuture): #​91554
• next-core: deduplicate output assets and detect content conflicts on emit: #​92292
• Handle edge runtime in places that import node:stream: #​92354
• Fix fallback route params case in app-page handler: #​91737
• use sorted inserts to improve builder performance: #​91553
• Allow for parsing app route strings with and without slot names.: #​92327
• fix(server-hmr): metadata routes overwrite page runtime HMR handler: #​92273
• turbo-persistence: optimize file syncing: #​90542
• Turbopack: Remove turbo_tasks::apply_effects, use Effects::apply instead: #​91858
• Turbopack: Add a check for node version before allowing workerThreads: #​91614
• turbo-persistence: skip BlockCache for uncompressed (mmap-backed) blocks: #​92390
• Include more context in macOS Rosetta 2 warning message: #​92436
• change the process name of builds: #​92411
• turbo-persistence: pin referenced BlockCache entries to prevent eviction: #​92361
• Fix styled-jsx race condition: styles lost due to concurrent rendering: #​92459
• turbo-tasks: fix hashed cell mode crash on task error (re-land #​91576): #​92108
• Fix sst inspect tool to respect CURRENT and stale sst files: #​92414
• Optimize how we track data for persistence: #​89370
• [turbopack] add family name to many spans: #​92415
• Route Handlers: Fix devRequestTimingInternalsEnd and Turbopack server HMR: #​92271
• next-routing: middleware matching and app request URL normalization: #​91859
• turbo-persistence: Use AtomicBool for is_empty() to avoid lock contention: #​92481
• fix: mention params and searchParams in blocking-route error messages: #​92360
• CPU prof: Write profiles to .next-profiles instead of .next/cpu-profiles: #​92078
• Turbopack: Write trace file to .next-profiles: #​92189
• feat: generate root params types: #​91019
• fix: resolve function configs in unstable_getResponseFromNextConfig: #​92501
• Node.js streams: Fork points: #​92252
• Turbopack: Add --internal-trace cli flag: #​92190
• Fix minimumReleaseAgeExclude for React and friends: #​92535
• Add experimental unstable_io() API behind experimental.unstableIO flag: #​92521
• Update React from 74568e86-20260328 to 404b38c7-20260408: #​92536
• Turbopack: switch from immutable token to path prefix: #​92164
• [build info]: distinguish between PPR and fully static routes in gSP: #​92518
• [build info]: omit symbol from top level gSP route: #​92525
• turbo-tasks-backend: prevent duplicate task restores with restoring bits: #​92389
• Add next internal upload-trace: #​92191
• Request logging: Fix generate-params time being included in next.js time: #​91386
• fix: scope "Pages Router only" comment to default export in next/error: #​92566
• Turbopack Build: Remove dev fouc from production bundle: #​80935
• Turbopack: Improve unable to resolve next error: #​91394
• fix(hmr): reconnect WebSocket after sleep/wake: #​91416
• Handle target option in React Compiler for Pages + React 18: #​91500
• Replace wasmer with wasmtime for SWC plugin WASM engine: #​91533
• turbopack: fix incremental build when module factories are restored from persistent cache: #​92569
• [turbopack] Rust dependency caching via sccache: #​91873
• trace: detect rage restarts and deleted .next dirs: #​92489
• [turbopack] fix a debug_assert failure: #​92581
• Don't swallow strings thrown in Server Components: #​92592
• Fix NextFontIssue IssueStage: CodeGen → Resolve: #​92588
• Node.js streams: Add forkpoint for CacheComponents: #​92444
• Resolve compilerOptions.paths in tsconfigs without compilerOptions.baseUrl: #​92277
• Turbopack: extract inline base64 decode helper to shared @turbopack/base64 module: #​92549
• Add codemod command to middleware deprecation warning: #​92532
• turbopack: move CSS module composes validation from code generation to resolving: #​92582
• Drop turbo_tasks::function from ValueDebug trait items: #​92593
• [partial fallbacks]: enable by default: #​92627
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false): #​92631
• Turbopack: cut number of client references in half: #​92607
• Remove a ton of turbo task functions from Issue trait items: #​92623
• feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution: #​91338
• feat(turbopack): change DiskFileSystem root to Vc for portable cache: #​92603
• Turbopack: remove unused ChunkableModules struct: #​92606
• Fix segment explorer file pill accessibility: #​92608
• Disable sccache temporarily: #​92657
• Delete some dead turbo task functions: #​92596
• Node.js streams: Add forkpoint for error recovery: #​92457
• turbo-tasks: Drop output_dependent on immutable task completion: #​92683
• Turbopack: properly remove unused TS enums with scope hoisting: #​88205
• fix(server-actions): skip type-only ExportNamed in pre-pass to prevent phantom registerServerReference: #​92494
• Turbopack: Add import.meta.glob support (Vite compat): #​92640
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation: #​92725
• TURBOPACK: support crsossOriginLoading: #​92070
• Compiler: Support boolean and number primtives in next.config defines: #​92731
• Fix prefetch hints not being loaded during revalidation: #​92625
• Exclude trace files from directory deletion in builds: #​92486
• Switch segment prefetch cache miss response from 204 to 404: #​92751
• Ensure x-nextjs-data header is only set during resolve: #​92752
• feat(trace-server): add query CLI and MCP API to turbopack-trace-server: #​92030
• Improve error stacks for dynamic API usage in "use cache": #​92736
• Node.js streams: Add forkpoint for continueDynamicHTMLResume: #​92471
• Node.js streams: Add forkpoint for generateDynamicFlightRenderResult: #​92474
• Node.js streams: Add forkpoint for generateStagedDynamicFlightRenderResult: #​92509
• Add unstable_prefetch route segment config and decouple runtime prefetching from unstable_instant: #​92754
• feat(turbo-tasks-backend): gate prepare_tasks_with_callback trace span behind feature flag: #​92779
• Update next versions of internal apps: #​92666
• turbo-persistence: stop background persisting after unrecoverable failure: #​92106
• Stop using deprecated downlevelIteration: #​92652
• Disable build caches for production/staging/force-preview deploys: #​92792
• Fix turbo cache flag: use --force: #​92796
• Fix devlow-bench: tsconfig rootDir mismatch with package.json bin: #​92800
• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router): #​92580
• Enable wasm plugins on windows arm: #​92544
• prefetchInlining: fix build crash on notFound() pages: #​92806
• turbopack: gate ValueDebugFormat and ValueDebug behind debug_assertions: #​92628
• Add TurboMalloc::thread_park() to flush and collect on thread park: #​92804
• Stop using deprecated baseUrl: #​92653
• Turbopack: Use FrozenMap for module export information: #​92802
• Turbopack: remove webpack chunk detection: #​92773
• Turbopack: refactor ESM codegen generation: #​92777
• Fix monorepo @next/swc binary postinstall: #​92813
• webpack: fix swcPlugins with relative paths: #​92770
• Turbopack: shorter error for ChunkGroupInfo::get_index_of: #​92814
• Turbopack: properly set NODE_ENV for SWC plugins: #​92579
• Node.js streams: Add forkpoint for logMessagesAndSendErrorsToBrowser: #​92510
• Node.js streams: Add forkpoint for createCombinedPayloadStream: #​92511
• Node.js streams: Add forkpoint for renderWithRestartOnCacheMissInValidation: #​92512
• Node.js streams: Add forkpoint for prerenderToStream: #​92513
• Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index: #​92828
• Turbopack: refactor export analysis: #​92781
• fix(trace-server): default MCP port to --port + 1 to avoid conflicts: #​92831
• Revert "Node.js streams: Add forkpoint for prerenderToStream": #​92845
• Turbopack: remove StarImportAnalyzer: #​92830
• Turbopack: analyzer improvement followups: #​92834
• Turbopack: move assignment_scopes computation into ImportMap: #​92835
• Warn for non-deterministic "use cache" args during final prerender: #​92820
• Turbopack: Use lld again on ARM64 glibc Linux: #​92860
• turbopack: cache TransformPlugin in narrow-scoped turbo-tasks functions: #​92842
• Allow overriding outputHashSalt in modifyConfig: #​92856
• Support type cast expressions in page static info extractor: #​92837
• turbo-tasks: add info_span for blocking waits during task restore: #​92878
• Fix dev mode hydration failure when page is served from HTTP cache: #​92892
• [devtools] Preserve full code frames in browser overlay: #​92621
• Enable prefetchInlining by default: #​92863
• Turbopack: Use an async lock in the filesystem watcher: #​92906
• Replace deprecated moduleResolution: "node": #​92654
• turbo-tasks: Reduce allocations on cache hits: #​92756
• fix(next/image): ensure images.maximumResponseBody applies to local images too: #​92920
• rename MagicAny: #​92918
• turbopack: reduce EffectStateStorage memory by storing u128 content hashes: #​92902
• turbo-trace-server: reduce allocation overhead when loading large trace files: #​92896
• Turbopack: optimize SelfTimeTree performance, memory usage, and fix range query boundaries: #​92931
• remove flag guarding unstable_io: #​92923
• Support more prefetch configuration options: #​92859
• Improve deduping of concurrent 'use cache' invocations: #​91830
• [partial fallbacks]: include prefetch requests in shell upgrade handling: #​92894
• Redesign blocking route dev overlay and build errors: #​92638
• Switch to cargo-binstall and pre-built sccache binaries: #​92911
• Remove prefetch from instant config: #​92761
• Improve "make root node" trace attributes: #​92941
• Use existing commitId for tarball URL in stats action: #​92899
• Use OIDC for CodSpeed: #​93059
• Restore dev-mode cache-fill timeout for 'use cache': #​93055
• Make 'use cache' fill timeout configurable: #​93070
• Strengthen _rsc cache-busting param: #​92755
• turbo-tasks: drop once_cell, const-init TRAIT_METHOD, ctor WORKER_TASKS: #​93090
• Patch setHeader for direct route handlers: #​93101
• [turbopack] Persistent last_successful_parse: #​92852
• [turbopack] Unify Cell Storage: #​92974
• fix(use-cache): remove awaiting revalidation: #​92636
• [turbopack] Fix max_level_hint to return most verbose per-target level: #​93128
• feat(turbopack): add NEXT_TURBOPACK_TRACING_PATH to control trace output location: #​93084
• Turbopack: move import_usage computation into ImportMap: #​92891
• Turbopack: unify ModuleGraph constructors: #​93203
• Turbopack: move get_inner_asset into ecmascript module: #​93191
• [turbopack] drop TransientState: #​92853
• instant(): Block out-of-band client fetches: #​93099
• [next/image] Stop using deprecated url.parse: #​93208
• Suspend dynamic route params in dev instant shell: #​93108
• Recognize super(...) messages in Error subclass constructors: #​93182
• [turbopack-trace-server] Performance improvements for span event handling: #​93179
• Preserve __NEXT_ERROR_CODE across the /_error page handoff: #​93183
• Reduce allocations in the next_debug_instant_stack transform: #​93222
• Apply sourcemaps by default during prerender in next build: #​93280
• Turbopack: compute exports without full analysis: #​92823
• Turbopack: cheaper check in map_next_dynamic: #​93283
• Fix route handler SWR blocking on Node runtime: #​93189
• [turbo-tasks-backend] Single-item optimization for lost follower operations: #​93200
• Fix export * as X from './self' in scope-hoisted modules: #​93192
• Turbopack: only compute module ids for included modules: #​93276
• Forward invalid dynamic usage errors on client-side navigations: #​93184
• HMR: debounce status indicator transitions to prevent flicker during bursts of changes: #​93229
• Turbopack: iter_reachable_modules: #​93315
• Turbopack: add failing test for cross-module side-effect inference: #​93323
• Turbopack: also add edge count to trace: #​93314
• Turbopack: pull in updated vercel/nft tests: #​93321
• [turbopack-trace-server] optimize loading: #​93264
• turbo-tasks: precompute trait-impl vtables at compile time: #​93092
• Honor the route-level expire value with blocking revalidation: #​93211
• Turbopack: add experimental.turbopackWorkerAssetPrefix to keep Workers same-origin when assetPrefix is a CDN: #​93271
• Report OS memory pressure in TurboMalloc and trace samples: #​93333
• Speed up native postinstall script: #​93312
• Turbopack: remove unused module references: #​93335
• Turbopack: remove ModuleResolveResultItem::OutputAsset: #​93349
• Turbopack: delete unused turbo-static crate: #​93324
• fix a snapshot encoding error that could happen under concurrent mutation and snapshotting: #​92658
• Enable server HMR for metadata routes (manifest.ts, robots.ts, etc.): #​93110
• [next/image] Only fire onError once: #​93209
• fix: handling of falsey values in error boundaries: #​93134
• Update upload trace url: #​93350
• enable validateRSCRequestHeaders by default: #​93367
• Deprecate edge runtime: #​93369
• Update 05-server-and-client-components.mdx: #​93374
• Only log partytown setup error once: #​93378
• Remove leftover Turbopack manifests: #​93398
• trace-server: shrink_to_fit LazySortedVec after sorting: #​93361
• Revert "Revert "Node.js streams: Add forkpoint for prerenderToStream"": #​93376
• feat(metadata): support non-standard directives in robots.ts via other: #​93206
• [turbo-trace-server] optimize loading even more: #​93332
• Fix streaming in draft mode for cache components: #​93417
• Drop once_cell from all direct crate deps: #​93095
• Replace Lazy static lookups with phf::Map: #​93096
• Include deployment id in cacheHandlers keys: #​93453
• fix(next/image): Improve error message for private IP (SSRF) rejections: #​91686
• turbo-tasks-backend: fix snapshot coordination races + extract SnapshotCoordinator: #​93416
• Fix dev mode reload and error on back navigation between Next.js pages: #​93486
• Fix double-encoding of URL pathname parts in client param parsing: #​93491
• Don't suppress usage of deprecated TypeScript compilerOptions: #​93377
• Turbopack: fix import_usage for functions behind member expressions: #​93504
• [turbopack] shrink the size of futures: #​93474
• [turbopack] Simplify local task tracking: #​93478
• [turbopack] correct a fencepost error in our inline string descision: #​93524
• Turbopack: make rcstr! macro expansion const: #​93516
• Turbopack: lazy aggregation optimize via persistent pending flag: #​93454
• Detect 'use cache' module-scope deadlocks early in dev: #​93500
• Turbopack: really fix MAX_INLINE_LEN: #​93531
• Bundle the 'use cache' deadlock probe worker: #​93538
• Support configuring a default instant validation level : #​93301
• Turbopack: simplify asset ident constructors: [#​93213](https://redirect.github.com/vercel/next.js/issues/93213

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
text-tools	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 26, 2025 9:18am

[secure-code-warrior-for-github]

Micro-Learning Topic: Race condition (Detected by phrase)

Matched on "race condition"

What is this? (2min video)

A race condition is a flaw that produces an unexpected result when the timing of actions impact other actions.

Try a challenge in Secure Code Warrior

[secure-code-warrior-for-github]

Micro-Learning Topic: Cross-site scripting (Detected by phrase)

Matched on "Cross-site scripting"

Cross-site scripting vulnerabilities occur when unescaped input is rendered into a page displayed to the user. When HTML or script is included in the input, it will be processed by a user's browser as HTML or script and can alter the appearance of the page or execute malicious scripts in their user context.

Try a challenge in Secure Code Warrior

Helpful references

• Prevent Cross-Site Scripting (XSS) in ASP.NET Core - A detailed Microsoft article on how to prevent cross-site scripting in ASP.NET Core.
• OWASP Cross Site Scripting (XSS) Software Attack - OWASP community page with comprehensive information about cross site scripting, and links to various OWASP resources to help detect or prevent it.
• OWASP Cross Site Scripting Prevention Cheat Sheet - This article provides a simple positive model for preventing XSS using output encoding properly.

Micro-Learning Topic: Denial of service (Detected by phrase)

Matched on "Denial of Service"

The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service

Try a challenge in Secure Code Warrior

Micro-Learning Topic: Server-side request forgery (Detected by phrase)

Matched on "Server-side request forgery"

What is this? (2min video)

Server-Side Request Forgery (SSRF) vulnerabilities are caused when an attacker can supply or modify a URL that reads or sends data to the server. The attacker can create a malicious request with a manipulated URL, when this request reaches the server, the server-side code executes the exploit URL causing the attacker to be able to read data from services that shouldn't be exposed.

Try a challenge in Secure Code Warrior

[secure-code-warrior-for-github]

Micro-Learning Topic: Information disclosure (Detected by phrase)

Matched on "Information disclosure"

Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. Source: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

Try a challenge in Secure Code Warrior