vercel/next.js v16.2.0 → v16.2.4

This release range is a backport-heavy maintenance train for Next.js 16.2, with a security release in the middle and a steady stream of Turbopack, HMR, and runtime fixes around it. Most user-visible changes are about stabilizing dev/build behavior, plus a few config and CLI improvements.

What's new

  • create-next-app now skips the interactive follow-up prompts when you already pass CLI flags like --typescript, --tailwind, --eslint, --app, and --src-dir. That makes non-interactive scaffolding work better for scripted and agent-driven setups (#91840).
  • experimental.serverFastRefresh can now be set in next.config.js, so plugins and apps can opt out of server-side Fast Refresh without changing start scripts. A hidden positive --server-fast-refresh flag was also added alongside --no-server-fast-refresh, with config taking effect at startup and CLI precedence when both are set (#91968).
  • Turbopack now supports server HMR for app route handlers, not just app pages. It also excludes metadata routes from server HMR, so route handlers like robots.ts, sitemap.ts, manifest.ts, and icon.tsx no longer interfere with page updates (#91466, #92034).
  • experimental.swcEnvOptions exposes SWC preset-env options such as mode, coreJs, include, exclude, skip, shippedProposals, forceAllTransforms, debug, and loose. That gives client-side compilation a built-in path for polyfill injection and other preset-env behavior that previously required Babel workarounds (#92272).
  • Turbopack’s standalone CLI gained --persistent-caching and --cache-dir flags for turbopack dev and turbopack build, so it can use the filesystem-backed cache without going through next (#91657).
  • NEXT_HASH_SALT and experimental.outputHashSalt let you salt content-addressed chunk and asset filenames. When both are set, the salts are concatenated, so you can combine a per-project config value with a per-deployment build-time value (#91871).
  • experimental.turbopackLocalPostcssConfig lets Turbopack resolve postcss.config.js from the CSS file’s directory first, then fall back to the project root. The same change also avoids filename collisions for per-directory PostCSS configs by deriving evaluate-pool asset names from the full module ident (#91338).

Breaking changes

  • Turbopack’s hash encoding switched from base40 to base38, removing ~ and . from generated filenames. This was done to avoid 403s from hardened Nginx and WAF rules, but anything that depends on the old character set will need to account for the new filenames (#91832).
  • The Safari cache-busting workaround in the Pages Router is now scoped to CSS and font assets only. It no longer appends ?ts= to script URLs, which avoids leaking that query string into asset resolution and causing next/image validation errors (#92580).
  • Immutable static assets now use _next/static/immutable/... when config.experimental.supportsImmutableAssets is enabled. The old immutable token behavior was replaced by a path-prefix approach, so middleware or deployment setups that matched _next/static may need to account for the new path shape (#92164).

Fixes

  • Restored server HMR when metadata routes and app pages load in the same process. Before this, a metadata route could overwrite the page runtime’s HMR handler and make updates stop applying to the page (#92273).
  • Fixed a regression where Turbopack treated inline new Worker(..., { eval: true }) code as a module path. It now skips creating a worker reference for eval: true workers (#91666).
  • Fixed lazy metadata loading in Turbopack so metadata imports are required lazily and TLA modules are handled correctly (#91705).
  • Fixed standalone server actions when cacheComponents is enabled (#91711).
  • Fixed adapter outputs for dynamic metadata routes (#91680).
  • Fixed CSS HMR on Safari (#92174).
  • Fixed stale ISR revalidation errors on app pages so they are reported through onRequestError (#92282).
  • Fixed a recomputation loop in turbo-tasks when a task errors during recomputation (#92725).
  • Fixed duplicate task restores in turbo-tasks so the same task is not loaded from backing storage more than once at the same time (#92389).
  • Fixed filesystem watcher config so follow_symlinks(false) is actually applied (#92631).
  • Fixed Turbopack’s webpack loader runner layer so using turbopack.rules.loader and turbopackLoader together no longer triggers dependency-tracking loops (#91727).
  • Fixed next.config.js defines to support boolean and number primitives (#92731).
  • Fixed build failures for Google Fonts on Windows ARM64 by bumping reqwest (#92713).
  • Fixed the next resolution error message in Turbopack so it includes the filesystem root used for resolution (#91394).
  • Fixed manifest.ts HMR breakage in Next.js 16.2 (#92273 through #92273).
  • Fixed export type in "use server" files from being registered as Server Actions (#92494).
  • Fixed import.meta.resolve() cache handler paths so file:// URLs are converted correctly instead of breaking ESM cache handlers (#90370).
  • Fixed notFound(), forbidden(), and unauthorized() prerender recovery so HTTP access fallbacks preserve the correct boundary instead of falling back to a generic error shell (#92231).
  • Fixed build output deduplication so identical assets are merged and conflicting assets are reported instead of silently overwriting each other (#92292).

Other notable changes

  • tokio was bumped from 1.43.0 to 1.47.3 (#90945).
  • SWC dependencies were upgraded to newer major versions, including swc_core 58 and swc_sourcemap 10 (#91532).
  • Turbopack now uses wasmtime for SWC plugin WASM execution instead of wasmer (#91533).
  • The HMR WebSocket endpoint was renamed from /_next/webpack-hmr to /_next/hmr (#91415).
  • CPU profiles now write to .next-profiles instead of .next/cpu-profiles (#92078).
  • Various Turbopack persistence, tracing, and error-message refinements landed across the range (#92191, #92427, #92814, #92828).

Contributors

@styfle @lllomh @icyJoseph @abhishekmardiya @ijjk @mischnic @unstubbable @sokra @lukesandberg @nextjs-bot @gaojude @wbinnssmith @bgw @Badbird5907 @andrewimm @banchichen @eps1lon @timneutkens @VedantMadane @sleitor @devjiwonchoi @fireairforce @mmastrac @ztanner

Only the most active 100 of 388 merged PRs were included. See the full compare view.

View on GitHub →