Next.js

Summary

Release with no code changes to ensure next@latest points to a stable version

Summary

No code changes in this release.

Summary

Backported bug fixes to 15.5.19, excluding new canary features

Summary

Backported numerous bug fixes across core, Playwright integration, dev-mode hydration, router query handling, cache tag encoding, server action rewrites, Turbopack hash encoding, FormData handling, module type handling, and adapter regio...

Summary

Production build fixes target route generation and CSS ordering.

Summary

Patched high‑severity vulnerabilities including DoS via server components, middleware/proxy bypasses, SSRF in WebSocket upgrades, and cache poisoning in React Server Component responses.

Summary

Address multiple high, moderate, and low severity security advisories (DoS, SSRF, XSS, cache poisoning, and middleware proxy bypass)

Summary

Patched multiple high‑severity security vulnerabilities (DoS, SSRF, proxy bypass, cache poisoning, XSS) across Server Components, Middleware, and Image Optimization.

Summary

Patched high‑severity vulnerabilities such as denial‑of‑service, proxy bypass, SSRF, and cache exhaustion across server components, middleware, and caching layers.

Summary

Docs explain stricter remote image matching with clearer examples.

Summary

Bump reqwest to 0.13.2, fixing Google Fonts handling on Windows ARM64

Summary

Fixed the vulnerability identified as CVE‑2026‑23869

Summary

Backported security fixes addressing CVE‑2026‑23869.

Summary

Backported bug fixes and stability improvements, including CSS HMR on Safari and glibc Linux CI fixes.

Summary

Backported bug fixes for core and Turbopack, including adapter output handling, server actions in standalone mode, and layout segment optimization.

Summary

Add LRU disk cache and images.maximumDiskCacheSize option to next/image (feature).

Summary

Added many experimental and performance features such as strict route type checking, new routing package, CPU profiling flag, custom cache handlers, LRU cache with invocation IDs, gesturePush, and Claude Code plugin marketplace; expanded...

Summary

Backported bug fixes from the canary branch.

Summary

Fixed multiple security vulnerabilities (CVE‑2026‑27977‑27980, CVE‑2026‑29057) and prevented request smuggling and unsafe websocket connections.

Summary

Backports bug fixes from canary without including all pending features

Summary

Fixed memory leak in span map and ensured LRU cache items have a minimum size to prevent unbounded growth.

Summary

Backported bug fixes from the canary release.

Summary

Security update addressing CVE-2025-59471, CVE-2025-59472, and CVE-2026-23864.

Summary

Addresses a critical security vulnerability.

Summary

Fix security vulnerabilities identified in CVE-2025-59471 and CVE-2025-59472

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

Applied security patch addressing identified vulnerabilities.

Summary

Security patch released to address a vulnerability.

Summary

Addresses security vulnerabilities in the application.

Summary

Backports bug fixes without including pending canary features

Summary

Backported key bug fixes to the stable release.

Summary

Update Turbopack's SWC core to v50.2.3, fixing crashes with MDX files containing multibyte characters

Summary

Backported bug fixes from the canary channel to v16.1.1.

Summary

Added a built‑in bundle analyzer (next analyze) and multiple Turbopack experimental features, improving build insights and source‑map handling.

Summary

Applied a security patch to address vulnerabilities.

Summary

Applied security update to address vulnerabilities in Next.js.

Summary

Applied security patch for Next.js vulnerabilities

Summary

Applied Next.js security update to patch known vulnerabilities

Summary

Security patch released for Next.js vulnerabilities.

Summary

Applies Next.js security update to patch vulnerabilities.

Summary

Applied security patch for Next.js

Summary

Applies a security patch for Next.js to address known vulnerabilities

Summary

Backported bug fixes from the canary release

Summary

Fix for CVE-2025-66478 vulnerability.

Summary

Addressed security vulnerability CVE-2025-66478

Summary

Addresses security vulnerability CVE-2025-66478.

Summary

Fixes security vulnerability CVE‑2025‑66478

Summary

Imported from changelog source; review and generate a concise summary before publishing.

Summary

Fixes vulnerability identified in CVE‑2025‑66478.

Summary

Fixed security vulnerability referenced as CVE-2025-66478.

Summary

Backported bug fixes from canary; not all pending features are included.

Summary

Backports bug fixes without adding pending features from canary.

Summary

Rename proxy.js to middleware.js in the NFT module.