vercel/next.js v16.0.0 → v16.2.7

Release v16.2.7 is a long backport series, but the user-facing story is steady: it tightens routing, cache, Turbopack, and deploy behavior while also carrying a stream of security and stability fixes across the 16.2 line. If you’re upgrading from v16.0.0, the main thing to watch is the rollout of new cache, instant navigation, and adapter/runtime behavior.

What's new

• Adds next analyze, a built-in bundle analyzer for Turbopack, along with UI support in next build --experimental-analyze and related polish like polyfill annotations and normalized local/IPv6 links. This gives you a first-class way to inspect bundles without leaving the Next.js toolchain. (#85915, #85788, #86062, #86219)
• Introduces next upgrade and the next-upgrade flow, plus a codemod path for AI coding agents via agents-md. This is aimed at making framework upgrades and repo guidance easier to discover and automate. (#86120, #88961)
• Expands Cache Components and prefetching with runtime prefetching, cached navigations, and new instant navigation APIs. Notable pieces include experimental.cachedNavigations, experimental.prefetchInlining, Instant Navigation Testing API, unstable_instant, and @next/playwright helpers for testing instant navigation flows. (#90928, #90555, #89465, #90396, #90470)
• Adds more control over cache and route behavior, including experimental.varyParams, unstable_dynamicStaleTime, unstable_catchError(), and stricter cacheLife handling for nested caches. These changes give you more explicit knobs for cache lifetimes, route variability, and component-level error recovery. (#89307, #91437, #89688, #89481)
• Introduces or extends deployment/runtime hooks such as NextConfigRuntime, runtimeServerDeploymentId, deploymentId-aware cache handlers, and adapter-facing route and output updates. This makes deployment metadata and adapter integration more explicit across build and runtime. (#86812, #88665, #90735, #93453)

Breaking changes

• unstable_forceStale is removed, and prefetch={true} is restored to its previous behavior. If you were relying on unstable_forceStale to opt into the old full-data prefetch path, you now need to use the segment-level export const prefetch config instead. (#85411)
• next-js is excluded from middleware, proxy, and instrumentation bundles. Third-party code targeting those entrypoints can no longer assume the full Next.js library surface is available there. (#85321)
• create-next-app no longer prompts for Turbopack, because it is enabled by default. The --turbopack flag still exists for bundler parity, but it is a no-op. (#85404)
• next dev --inspect and next start --inspect are now supported directly, which changes the preferred debugging setup. If you previously depended on NODE_OPTIONS=--inspect or process-specific inspector behavior, the new flags are the intended path. (#85037, #88744)

Fixes

• Fixes proxy and middleware path handling on Windows, including proxy detection and NFT file naming. (#85443, #86214)
• Fixes req.query being non-writable after the Express 5 upgrade path. (#81573)
• Fixes crashes and bad state updates in server actions, redirects, and useActionQueue flows. (#85459, #85533, #87193)
• Fixes cache and prefetch edge cases, including stale static prefetch loops, hanging streaming fetches in dev, and several cache-keying issues. (#85479, #89171, #90400, #91454)
• Fixes route and adapter issues such as interception-route 404s, fallback params, build-time route validation, and deployment adapter metadata. (#85779, #85319, #85834, #85820)

Other notable changes

• Backports a large set of security fixes across the 16.1 and 16.2 branches; several releases in this range are security-only.
• Upgrades React repeatedly across the range, along with SWC, Rspack, and the Rust toolchain. (#85277, #85464, #85518, #85819, #86103, #86351, #86625, #88207, #89111, #90084, #91324, #91522)
• Turbopack gets major internal work, including deterministic task handling, filesystem cache defaults, bincode-based persistence, HMR support, loader and source-map fixes, and bundle-analyzer work. (#85524, #85975, #86338, #88870, #90561, #90167, #87093)
• next/image gains cache and deployment-id related fixes, plus new disk-cache and response-size controls in later 16.2 releases. (#89963, #91660)
• Various docs, examples, and test infrastructure were updated throughout the range.

Contributors

@wyattjoh @eps1lon @ale-grosselle @gnoff @devjiwonchoi @icyJoseph @mhart @acdlite @styfle @lukesandberg @unstubbable @kdy1 @bgw @sokra @huozhi @remcohaszing @arnabsen @zwarnava @ijjk @nextjs-bot @gusfune @denesbeck @codr @InfiniteCodeMonkeys @vercel-release-bot @lucasadrianof