Sourced from next's releases.
v16.1.7
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
- Apply server actions transform to node_modules in route handlers (#89380)
- ensure
maxPostponedStateSizeis always respected (See: CVE-2026-27979)- feat(next/image): add lru disk cache and
images.maximumDiskCacheSize(See: CVE-2026-27980)- Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
- Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
- fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)
Credits
Huge thanks to
@unstubbable,@styfle,@eps1lon, and@ztannerfor helping!v16.1.6
[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.
Core Changes
- Upgrade to swc 54 (#88207)
- implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)
- tweak LRU sentinel key (#89123)
Credits
Huge thanks to
@mischnic,@wyattjoh, and@ztannerfor helping!
bdf3e35
v16.1.7dc98c04
[backport]: fix: patch http-proxy to prevent request smuggling in
rewrites (#...9023c0a
[backport] Disallow Server Action submissions from privacy-sensitive
contexts...36a97b9
Allow blocking cross-site dev-only websocket connections from
privacy-sensiti...93c3993
[backport]: feat(next/image): add lru disk cache and
`images.maximumDiskCache...c68d62d
Backport documentation fixes for 16.1.x (#90655)5214ac1
[backport]: ensure maxPostponedStateSize is always respected (#90060)
(#90471)c95e357
Backport/docs fixes 16.1.x (#90125)cba6144
[backport] Apply server actions transform to node_modules
in route handlers...3db9063
[backport] [Cache Components] Prevent streaming fetch calls from hanging
in d...