Total Releases
500
In the last year
Stable Releases
63
Production ready
Canary Releases
437
Experimental features
Latest Release
v16.3.0-canary.79
7/6/2026
Filter Releases
Showing 1-8 of 63 releases
timneutkens released this a month ago
[!NOTE] This release is backporting bug fixes. It does
Core Changes
- Backport documentation fixes for v16.2 (#93804)
- [backport] Patch
- [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
- [backport] Fix catch-all
- [backport] Encode non-ASCII characters in cache tags at construction (#93918)
- [backport] Fix server action forwarding loop with middleware rewrites (#93919)
- [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
- [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
- [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
- [backport] Propagate adapter preferred regions (#94200)
- [16.2.x] Don't drop
- [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)
Credits
Huge thanks to @eps1lon, @icyJoseph, @unstubbable, @mischnic, @bgw, @timneutkens, and @lukesandberg for helping!
timneutkens released this a month ago
timneutkens released this 2 months ago
[!NOTE] This release contains security fixes and backported bug fixes. It does
Security Fixes
The following advisories have been addressed:
High:
- GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
- GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
- GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
- GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
- GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
- GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
- GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n
Moderate:
- GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
- GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
- GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
- GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses
Low:
- GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
- GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned
Core Changes
- fix: preserve HTTP access fallbacks during prerender recovery (#92231)
- Fix fallback route params case in app-page handler (#91737)
- Fix invalid HTML response for route-level RSC requests in deployment adapter (#91541)
- Patch setHeader for direct route handlers (#93101)
- Include deployment id in
- Fix double-encoding of URL pathname parts in client param parsing (#93491)
timneutkens released this 2 months ago
This release contains security fixes for the following advisories:
High:
- GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
- GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
- GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
- GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
- GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
- GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
- GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n
Moderate:
- GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
- GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
- GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
- GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses
Low:
⌨️ Keyboard Shortcuts:
← Previous→ NextEsc Scroll to Top