Sourced from next's releases.
v16.2.11
This release contains security fixes for the following advisories:
High:
- Denial of Service in App Router using Server Actions
- Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Server-Side Request Forgery in Server Actions on custom servers
Moderate:
- Cache confusion of response bodies for requests with bodies
- Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
- Denial of Service in the Image Optimization API using SVGs
- Unauthenticated disclosure of internal Server Function endpoints
- Unbounded Server Action payload in Edge runtime
v16.2.10
Contains no changes except publishing
@next/swc-wasm-webwhich was accidentally not published since 16.2.4.v16.2.9
Empty release to ensure
next@latestpoints at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.v16.2.8
Release with no changes in an attempt to fix
next@latestpointing at a prerelease version.v16.2.7
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- Backport documentation fixes for v16.2 (#93804)
- [backport] Patch
playwright-coreto resolve_finishedPromiseonrequestFailed(#93920)- [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
- [backport] Fix catch-all
router.querycorruption withbasePath+rewrites(#93917)- [backport] Encode non-ASCII characters in cache tags at construction (#93918)
- [backport] Fix server action forwarding loop with middleware rewrites (#93919)
- [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
- [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
- [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
- [backport] Propagate adapter preferred regions (#94200)
- [16.2.x] Don't drop
FormDataentries (#94240)- [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)
Credits
Huge thanks to
@eps1lon,@icyJoseph,@unstubbable,@mischnic,@bgw,@timneutkens, and@lukesandbergfor helping!
... (truncated)
9beca08
v16.2.113c48c7a
[16.x] Fix Turbopack middleware matcher with i18n single localeac1eff3
[16.x] Improve performance of checking valid MPA form submissions9a4651e
[16.x] Enforce serverActions.bodySizeLimit for Server
Actions in Edge runtimeb512063
[16.x] Set correct origin for internal redirects in custom serverd303326
[16.x] Ensure exotic rewrite param values are properly encoded73b9487
[16.x] fix(fetch-cache): key fetch(Request, init) by the effective
requestbf9d17f
[16.x] fix(incremental-cache): byte-exact fetch cache key for binary
bodiesfe28768
[16.x] fix(next/image): improve performance of detectContentType()d8afb8d
[16.x] Performance improvements when decoding React Server function
payloadsThis version was pushed to npm by GitHub Actions, a new releaser for next since your current version.