[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	16.3.8 → 16.4.1

---

Next.js: Denial of Service in App Router using Server Actions

CVE-2026-94482 / GHSA-p3m5-59mp-jv5r

More information

Details

Impact

Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.

Workarounds

No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-p3m5-59mp-jv5r
• https://github.com/vercel/next.js/releases/tag/v15.5.28
• https://github.com/vercel/next.js/releases/tag/v16.4.1
• https://github.com/advisories/GHSA-p3m5-59mp-jv5r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

GHSA-2464-fhr4-w9xw

More information

Details

Impact

A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.

Workaround

Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh installs automatically get a fixed version of sharp.
Upgrading Next.js to the patched versions will ensure package managers automatically provide a fixed version of sharp to Next.js.

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-2464-fhr4-w9xw
• https://nvd.nist.gov/vuln/detail/CVE-2026-96889
• https://github.com/vercel/next.js/commit/5e3b687b5edb868b064bdc058d768a7021e7f6ad
• https://github.com/vercel/next.js/commit/9571ec899f063df6533351bec390ccb2cc0af6a3
• https://github.com/vercel/next.js/releases/tag/v15.5.28
• https://github.com/vercel/next.js/releases/tag/v16.4.1
• https://github.com/advisories/GHSA-2464-fhr4-w9xw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js: Unauthenticated Remote Code Execution in use cache functions returning typed arrays

GHSA-673q-mjm6-r5xr

More information

Details

Impact

A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.

Workaround

There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.

Severity

• CVSS Score: 9.5 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-673q-mjm6-r5xr
• https://github.com/vercel/next.js/commit/a4cea6aec5da89d116b8960e113189cf51745d2f
• https://github.com/vercel/next.js/releases/tag/v16.4.1
• https://github.com/advisories/GHSA-673q-mjm6-r5xr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Compare Source

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #​75682
• fix(scripts): correct typo in rm.mjs error message: #​87015
• docs: improve clarity and punctuation in README: #​86096
• Fix debug build paths Pages Router support entries: #​93529
• bundle-analyzer: record historical snapshots on each analyze run: #​93520
• fix: detect proxy.ts correctly with compound pageExtensions: #​93246
• feat(turbopack): support false values for resolveAlias config: #​93331

Misc Changes

• docs: correction to dynamicParams migration: #​96624
• docs: proxy event argument: #​96435
• docs: remove experimental note from runtime prefetching: #​96615
• Preserve per-segment prefetching after dynamic navigation: #​96583
• Rename static generation stream option to waitForAllReady: #​96564
• Remove obsolete static generation plumbing: #​96563
• [turbopack] Drop dead writes to exports: #​96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #​96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #​96549
• [turbopack] Strip leading BOM before parsing CSS: #​96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #​96550
• docs: use relative doc links in instant-navigation error pages: #​96672
• Turbopack: terminate failed plugin worker threads: #​96592
• Fix HTML-limited bot matching in prerender bypass rules: #​96584
• [ci] Fix create_release_branch for new repo permissions: #​96641
• test: skip action module instance deploy test: #​96629
• docs: quote the dynamicParams build error in a blockquote: #​96633
• [react-sync] Open pull requests as the bot that authors the commits: #​96682
• [Bench] Fixes for pure Fizz bench: #​96771
• Derive foreground cache revalidation from the consumer: #​96731
• Fix race when navigating Back before hydration: #​96252
• docs: present each Skill as steps in the AI agents guide: #​96751
• Reuse completed cache entries for the rest of a request: #​96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #​96735
• Remove WorkStore execution mode: #​96674
• Remove cache revalidation execution mode reads: #​96670
• Separate App Route render and prerender pipelines: #​96662
• Remove App Page execution mode reads: #​96660
• test: fix missing await in css-chunking test: #​96725
• docs (Skills): stop assuming app/ at the root and port 3000: #​96696
• Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #​95808
• Use Tailwind Turbopack loader in create-next-app: #​96606
• docs: instant navigation quick start with an adoption prompt: #​96663
• Separate App Page render and prerender pipelines: #​96659
• Move App Router execution intent to entrypoints: #​96640
• Pass explicit render capabilities through App Render: #​96576
• Pass explicit prefetch hint policy through App Render: #​96572
• Replace WorkStore isStaticGeneration with executionMode: #​96570
• docs: document ! exclusion and src/ prefix for --debug-build-paths: #​96703
• Change loadManifest to return undefined with handleMissing: #​96530
• Refactor server from CacheNodeSeedData -> TransportData: #​96679
• Unify full/partial navigation response types: #​96439
• Unify RouteTree and CacheNodeSeedData on the client: #​96406
• Consolidate Promise.withResolvers polyfills: #​96772
• [ci] Open automated update pull requests with nextjs-bot: #​96683
• Require Cache Components for Instant Navigation testing: #​96745
• Fix use cache over- and under-invalidation in dev: #​96235
• Fix which pages the dev server announces, and when: #​96250
• docs: update redirected links to current targets: #​96723
• Fix(deployment-id): prevent exception on old webkit: #​94604
• [fragment-scroll] Remove config.experimental.appNewScrollHandler: #​95602
• [turbopack] Enable reexport-unknown execution test: #​96774
• ci: stop publishing @​vercel/devlow-bench: #​96887
• fix(turbopack): name the module in the non-ESM-placeable error, and stop duplicating the importer in traces: #​96560
• fix(turbopack): support type: 'text' in rules, and error on binding imports of non-ESM modules: #​96558
• Lint devlow-bench with the root eslint config: #​96871
• Remove turbopack/packages and relocate devlow to packages/: #​96860
• Flush pending revalidations for forwarded action error responses: #​96945
• Handle Server Actions on dynamic PPR fallback routes: #​96932
• Turbopack: Improve how DiskWatcher is configured and fix polling watcher bugs: #​96440
• Turbopack: Allow DiskWatcher to use a mocked DiskFileSystem, add a small unit test: #​96353
• [turbopack] Add e2e test that uses component chunks + workers: #​96556
• [turbopack] Support experimental.serverMinification & expand experimental.turbopackMinify: #​96578
• Add a turbopackChunking documentation page for pages router: #​96698
• [turbopack] Don't run Webpack tests on Turbopack-only changes: #​96656
• [turbopack] Enable the shared runtime by default: #​96778
• [turbopack] Enable CJS tree shaking by default: #​96779
• refactor: clean up places that needlessly list all RenderStages: #​96907
• Fix the documented invocation for generating tests non-interactively: #​96896
• Make NextConfigComplete typing more accurate: #​96700
• Upgrade to swc 75: #​96702
• docs: link View Transitions skill on skills.sh and clarify the example prompt: #​96863
• [ci] Reset the turbopack deploy test project in the weekly cron: #​96822
• docs: add authentication with Cache Components guide and iron-session example: #​95802
• [turbopack] Fix a potential deadlock in scope_and_block: #​95695
• Remove the turbopack-build-events trace span, use next build instead: #​96746
• docs: add export const dynamic = 'force-static' to Route Handlers example on Static Exports: #​96964
• [turbopack] Follow re-exports for side-effect free async modules: #​95993
• [turbopack] Treat constants with values referencing other values as unsafe: #​96190
• [refactor] Rename encodeCacheTag to encodeHeaderSafe: #​96936
• Fix formatting of Google Fonts section in documentation: #​88447
• Fixing a bug - typo issue fixed: #​97141
• examples: fix Webiny API env variable name: #​97134
• docs: fix Link prefetch grammar and Client Components wording: #​97132
• Use emitted app entries for post-build processing: #​97139
• docs(mdx): fix package name in .md handling section: #​97131
• [turbopack] Reduce native React Compiler work: #​96820
• docs: rename repo to repository for consistency: #​87849
• Fix typo in Data Access Layer section: #​87202
• docs: runtime prefetching -> optimizing prefetching: #​96934
• [CC] Track APIs that cause incompatible static/app shells: #​97040
• Fix client component loading span timing: #​96455
• Trace development route compilation: #​96454
• Prefix 'use cache' debug logs with the full directive: #​97037
• Revert "[turbopack] Enable CJS tree shaking by default (#​96779)": #​97018
• Revert "[turbopack] Follow re-exports for side-effect free async modules": #​97009
• [fragment-scroll] Rename ScrollAndMaybeFocusHandler to ScrollHandler: #​96828
• Trace development route preparation: #​96453
• test: cleanup Turbopack snapshot config: #​97013
• Remove unused htmlLimitedBots from renderOpts: #​96701
• fix(turbopack): point at the glob that matched a file with no module type: #​96561
• [turbopack] Bail CJS tree-shaking on var x = module.exports = {}: #​97130
• docs: server client and directives: #​96145
• docs: clarify client cache freshness after hydration: #​97180
• docs: create client-side fetching guide: #​96341
• Turbopack: accept a module type argument for import.meta.glob: #​96991
• docs: align Cache Components authentication guide title: #​97143
• test: re-enable a few more passing NFT unit cases: #​97017
• [turbopack] Do the CJS analysis needed for scope hoisting: #​95826
• Remove legacy PPR code paths: #​96868
• Use Cache Components as the internal PPR signal: #​96827
• Make legacy PPR paths explicit: #​96753
• fix: typos in code comments: #​97137
• Fix spelling in two comments: #​97136
• Decouple loader tree construction from children ordering: #​97192
• Bump lightningcss: #​97159
• Update gh-stack skill guidance: #​97163
• [test] Unflake use-cache-custom-handler-dev tests: #​97187
• Forward a build-container pin to deploy-test deployments: #​97191
• Fix shared Turbopack runtime initialization race: #​97215
• Fix stale data after navigation despite revalidation: #​95439
• [turbopack] Only use the shared runtime by default on canary: #​97208
• test: fix 'ouput' typo in parseIdsFromCliOutput: #​97266
• Add the mtime fallback back: #​97268
• Allow issue participants to request reopening: #​96947
• [turbopack] Document clusters for chunking: #​97267
• Link to issues in the contribution guide and discourage trivial PRs: #​97188
• Stop serializing hmr version state: #​97146
• [turbopack] Add clusters to chunking heuristics: #​95157
• [test] Redirect the deployment host in-process for proxy deploy tests: #​97260
• [test] Unflake two cache-components-dev-streaming assertions: #​97246
• [test] Unflake use-cache-default-profile-expire-zero tests: #​97250
• Allow running ncc before pnpm build: #​97234
• Invalidate deferred Webpack entry sources: #​97205
• Unify how a response's shell and full payloads are written: #​96878
• Convert per-segment prefetches to NavigationFlightResponse format: #​96877
• Unify how server responses are written into the client cache: #​96876
• Convert tree prefetches to NavigationFlightResponse format: #​96788
• fix(next/image): skip 0-byte entries when initializing disk LRU cache: #​94068
• Update authentication diagram URL: #​97320
• Add a script for adopting fork pull requests: #​97252
• Migrate napi-rs bindings from v2 to v3: #​95412
• Upgrade React from 11eddecd-20260805 to 22e4f993-20260811: #​97249
• Add RDC compression rollout controls: #​97247
• [testmode] Fix infinite recursion in testmode passthrough fetch: #​96525
• Turbopack: add imports_wildcard NFT unit test: #​97373
• Turbopack: improve chunk_item_content docs: #​97370
• test: Reenable i18n-api-support deploy test for Turbopack with adapters: #​96898
• Trace instrumentation startup: #​97296
• Trace route module preparation: #​97295
• Trace route module loading: #​97318
• fix(deps): bump satori and @vercel/og: #​97276
• [test] Cover 'use cache: private' in route handlers: #​97349
• Fix missing Pages runtime in adapter Pages API outputs: #​96819
• docs: align SPA guide reducer example with React conventions: #​97341
• Update blob version.: #​97342
• Upgrade React from 22e4f993-20260811 to eb8feb71-20260814: #​97382
• Adopt SelectedMetadata for metadata rendering: #​97387
• fix(next/image): reject empty image on read/write to disk cache : #​97278
• Turbopack: remove stale manifests for deleted routes: #​97333
• Turbopack: make unreachable codegen more generic: #​97385
• Wait for back-before-hydration recoveries in the browser: #​97321
• Extract metadata resolution primitives: #​97388
• test: update React 18 redbox snapshot: #​97415
• Remove server route matcher stack: #​94157
• Anchor the async local storage instances to global symbols: #​97255
• test: deflake use-cache-size-zero warm reload: #​97421
• Scaffolding for concurrentRouterQueue flag: #​97413
• Reorganize client router modules: #​97402
• fix(turbo-persistence): allow 32-bit usize conversion: #​97288
• test: restore missing NFT exports* unit fixtures: #​97459
• [ci] Fix backport canary release dispatch: #​97383
• turbo-tasks-backend: Enforce that tasks exist when accessing them: #​96043
• turbo-tasks-backend: add persistence delete/tombstone plumbing for GC: #​95975
• turbo-persistence: add key-value tombstones for MultiValue families: #​96929
• Trace lazy App Route module loading: #​97439
• [ci] Wait for the next version to be available on npm before deploy tests: #​97460
• docs: fix stale Dev Overlay README link in contributing guide: #​97486
• docs: app router reference accuracy: #​97477
• test: Don't wait trying to load non-existing images: #​97488
• test: cover dynamic APIs with i18n base path: #​97367
• style(examples): remove redundant justify-content declaration: #​97222
• docs: rename Vercel Edge Config to Global Config in redirecting guide: #​97456
• fix: improve form accessibility by associating labels with inputs: #​96335
• [docs] fix: grammar typos in linking and navigating guide: #​95544
• fix(examples): correct error message typo: #​97223
• docs: fix typos in example links: #​97149
• Model prerenders as render candidates: #​97431
• Turbopack: support character class ranges in regex: #​97502
• docs: warn when catching permanentRedirect: #​97496
• Remove the development debug channel persistence: #​97510
• Stop the browser from restoring stale pages in development: #​97505
• Turbopack: gracefully handle outputFileTracingIncludes matching a symlink: #​97507
• docs: mention Valibot as validation library option in forms guides: #​97468
• [PPF] Remove unstable_eager: #​97524
• [PPF] Do not mark complete shell requests as partial: #​97503
• fix: add accessible label to icon-only link: #​96334
• Fix stale cross-references in skills/: #​97566
• docs: generateMetadata values should be serializable with use cache: #​97551
• Move preview props into separate manifest: #​96004
• docs: adjust interactive app guide: #​97558
• Turbopack: allow TURBOPACK_PRINT_CHUNK_GROUPS in release builds: #​97515
• [test] Point next-image-legacy images at a reachable endpoint: #​97545
• test: improve error-on-next-codemod-comment flakiness: #​97553
• Turbopack: cross-module constants: #​90300
• test: better isolate concurrent-install suite: #​97546
• docs: outlining and lcp: #​96942
• Turbopack: More aggressively debounce filesystem watch events if we detected changes to node_modules: #​96116
• docs: document metadata pagination field: #​95509
• docs: document deploymentId build ID override and Pages Router skew in 16.2: #​97645
• Upgrade React from eb8feb71-20260814 to eafeac09-20260819: #​97636
• Turbopack: rename to use turbopack: no side effects: #​94427
• refactor: move useDynamic{Route,Search}Params to reduce snapshot churn: #​97360
• [PPF] unstable_navigation(): #​96908
• [PPF] Scaffold unstable_navigation(): #​97236
• docs: Explicit cache output description: #​97548
• Improve Cache Components sync IO migration guidance: #​97572
• [test] Use a non-native stub for the server externals list test: #​97614
• Avoid GitHub API rate limits for create-next-app examples: #​97612
• [test] Cover the prerender worker-thread backend with an addon we control: #​97543
• [test] Convert the prerender-native-module suite to local fixture packages: #​97542
• [test] Replace the turbopack-reports sqlite3 dependency with a local addon fixture: #​97541
• [test] Drop the dead sqlite3 build approval from the sharp-basic suite: #​97540
• Remove HmrTarget: #​97253
• Keep HMR instructions typed until serialization: #​96569
• Serialize frozen collections by value only: #​96686
• feat(turbopack): isolate HMR listeners across microfrontends: #​95997
• Turbopack: deduplicate Pages Router app chunks: #​97664
• [react-sync] Check assignability before assigning the actor: #​97638
• fix: preserve trailing slash during export MPA fallback: #​97613
• Turbopack: Split the read and write codepath data structures for symlinks: #​97395
• Turbopack: Show last modified file when waiting for the filesystem to settle: #​97648
• docs: fix parallelRouteKey parameter name in useSelectedLayoutSegment(s): #​97710
• Turbopack: Avoid cloning paths in fs watcher if the path is already in a map: #​97655
• Remove generated error codes: #​97687
• [PPF] Instant validation for unstable_navigation(): #​97309
• Turbopack: trace graceful-fs calls: #​97694
• Migrate some async blocks to async closures: #​97666
• turbo-tasks: add scope_unbounded, a scoped execution primitive that allows more work to be discovered: #​95974
• test: make app-document-import-order more robust: #​97682
• Add a Turbopack error for missing root layouts: #​97639
• Improve Partial Prefetching adoption checks: #​97637
• test: stabilize poisoned proxy error overlay: #​97609
• docs: correct the upper stale bound for App Shell exclusion in cacheLife: #​97653
• docs: Adapters entry page lists its children pages twice: #​97677
• [PPF] unstable_prefetch(): #​97622
• [PPF] Scaffold unstable_prefetch(): #​97618
• docs: clarify beforeInteractive placement for root layouts: #​97643
• fix(turbopack): give eager import.meta.glob values the ESM namespace: #​96559
• introduce an options struct for constructing backend storage: #​97284
• [devtools] Fix indicator dragging on touch screens: #​97723
• Add next/cache-handlers types entrypoint: #​97592
• Remove unused return values from getPageStaticInfo: #​97661
• [turbopack] defer NFT module content hashes: #​97773
• test: deflake basePath external navigation: #​97611
• docs(adapters): document assetsHashes and routing.middlewareMatchers: #​96536
• Migrate remaining async blocks to async closures: #​97701
• Turn off the adapter route collapses by default: #​97774
• Serve a run of fallback shells from one route entry: #​97738
• [test] Capture the route table for apps with several param shapes: #​97728
• Stop emitting a separate route entry for a dynamic route's RSC form: #​97726
• Stop emitting a redundant route per prefetch segment: #​97720
• [test] Capture the dynamic routes a build passes to an adapter: #​97719
• turbo-tasks: compile conditional cell updates once, not per cell type: #​97763
• Turbopack: add unit test coverage for FileSystemPath::hash_file: #​97743
• Record fallback cache lifetime for blocking PPR routes: #​97821
• Document catchError for the Pages Router: #​97748
• clippy: allow needless late init where it makes sense: #​96410
• Turbopack: emit/collect: #​96631
• docs: note that response headers must be set before calling handle() in a custom server: #​97693
• Deduplicate the regress, wat/wasmparser and base64 dependencies: #​97762
• perf: split cold TurboMalloc accounting paths: #​97767
• turbo-tasks: execute scheduled tasks inline when they are read: #​96808
• Revert "Record fallback cache lifetime for blocking PPR routes (#​97821)": #​97835
• Sweep stale Turbopack output from distDir on dev startup: #​97591
• Fix metadata prefetch cache key for search params: #​97729
• Turbopack: Improve file existence error handling in realpath_with_links and in module resolution: #​97717
• Write traces with buffered synchronous IO: #​96874
• fix(wasm): don't enable SWC's plugin host for wasm targets: #​97859
• fix(turbopack-node): make process_pool inert on wasm: #​97858
• fix(turbopack): make the SWC wasm-plugin backend native-only: #​97857
• fix(turbopack-trace-utils): skip the ctrl-c handler on wasm: #​97856
• refactor(turbopack-cli-utils): replace crossterm with owo-colors: #​97855
• fix(turbo-tasks-fs): create symlinks through the WASI API on wasi: #​97854
• fix(turbo-tasks): compile EventListener::wait on wasm: #​97853
• fix(turbo-rcstr): allow the napi feature on wasm targets: #​97852
• fix(next-napi-bindings): detect the target, not the host, in build.rs: #​97576
• Stop printing a stack frame for error message text: #​97829
• docs: clarify revalidateTag profile expire semantics: #​97836
• docs: param access on use-server: #​97865
• docs: fix typos and correctness issues in App Router docs: #​97823
• Add deploy release test skill: #​97563
• [test] Deflake the page config test for a string config value: #​97848
• test: stabilize read-only page recreation: #​97674
• Show the errors of an AggregateError behind a cause: #​97830
• Upgrade React from eafeac09-20260819 to bd6ea412-20260824: #​97812
• fix: reuse a single drain listener when piping Node streams through gzip: #​97698
• test: preserve server cache after compile error: #​97724
• Fix Turbopack resolution through chained symlinks: #​97825
• Add evals for whether agents actually use Next.js: #​97816
• evals: judge behavior instead of matching source text: #​97826
• Bump @​vercel/agent-eval to 2.2.1: #​97885
• feat(turbopack): resolve /-rooted imports from the project directory: #​97799
• [ci] Use short-lived access tokens for preview-build uploads instead of static token: #​97256
• Turbopack: correctly trace through TypeScript __importStar: #​97697
• [turbopack] simplify ecmascript effect queue: #​97771
• Update default Create Next App favicon: #​97634
• fix: don't drop client references when the concatenated module id is 0: #​97936
• Replace resumed render bailout error with ReactDOM.browser behind a flag: #​96844
• Replace useSearchParams bailout error with ReactDOM.browser behind a flag: #​96843
• Replace CSRBailout error with ReactDOM.browser behind a flag: #​96826
• fix(next/image): reject non-2xx internal image responses: #​97957
• [test] Pin Vercel CLI to Node 20.9 compatible version: #​97960
• Re-enable AVIF image optimization: #​97931
• Don't report a client-aborted RSC stream as a render error: #​96715
• [PPF] Only track runtime accesses when the promise is used: #​97165
• Fix Turbopack re-export cycle deadlock: #​97933
• Port React's @​gate test directive to the e2e harness: #​96228
• Migrate from box_patterns to deref_patterns: #​97924
• Turbopack: expose list of non-inlined env vars: #​95310
• feat(turbo-tasks-fetch): stub HTTP on wasm targets: #​97585
• fix(turbo-rcstr): make TaggedValue usable on wasm: #​97577
• docs: explain origin matching for allowedOrigins and allowedDevOrigins: #​97805
• Turbopack: improve Pat::Assign modelling in analyzer: #​97867
• Upgrade rustc to nightly-2026-08-20: #​97665
• Upgrade React from bd6ea412-20260824 to f789f203-20260825: #​97887
• [test] Fix flaky build CLI output capture: #​97900
• turbo-tasks-backend: parent_count reference counting: #​95976
• Upgrade Turbopack to hashbrown 0.15: #​97808
• ci: skip framework tests for agent evals and skills: #​97998
• Expand Turbopack dev cleanup: #​97833
• Add Cache Components option to create-next-app: #​97695
• Mark deploy release test skill as internal: #​97961
• Turbopack: shorten CSS module class names: #​97944
• Prune incomplete parallel route matchers: #​97108
• Upgrade React from f789f203-20260825 to 29d9d318-20260826: #​97995
• docs(skills): preserve prefetched UI during Partial Prefetching adoption: #​97712
• Omit undeclared children slots from app routes: #​97184
• Turbopack: widen the chunk ident hash from 7 to 13 base38 chars: #​97945
• Fix request-context retention in the default use cache handler: #​97941
• docs: improve discovery summaries: #​97982
• test: add test for local font with deployment id: #​97987
• Retain interception route host slots: #​97242
• test: disable flaky sync-io-blocks-root.test.ts: #​97986
• [test] Drain build output before start: #​97947
• Expose durableUseCacheEntries config in workStore: #​97926
• Pages Router: Deprecate React 18 support: #​97689
• Turbopack: call loadActionManifest for app-route: #​97921
• [test] Unpin Vercel CLI version: #​97974
• Turbopack: don't replace single-arg calls with argument in analyzer: #​95277
• Turbopack: allow compiling turbopack-node without a pool backend: #​97943
• Support immutable static assets with output: 'export': #​97711
• Fix build error when aliasing typescript to @typescript/typescript6: #​97942
• Fix optimistic routing for encoded dynamic params: #​97948
• Fix intercepted route params after Proxy rewrites: #​97953
• [PPF] Fix navigation() in prospective runtime prerenders: #​98000
• Revert "test: re-enable sync IO root coverage": #​98050
• Turbopack: drop rust analyzer skip annotation: #​98047
• Turbopack: add next_config.use_react_experimental getter: #​98032
• More granular cache keys for use-cache entries: #​95233
• [ci] Remove dormant code_freeze workflow: #​97756
• test: re-enable sync IO root coverage: #​97996
• [ci] Remove the unused wrong-issue-template workflow and action: #​97749
• [image-optimizer] Refactor into lightweight transform module: #​97988
• [ci] Remove the stale-issue workflow: #​97758
• [ci] Use presigned URLs to upload preview builds: #​97922
• Turbopack: allow get_definable_name to return a list: #​97984
• docs(examples): document env var handling in the Docker examples: #​97968
• Turbopack: unify member and in handling: #​97985
• Update outdated snapshots: #​98011
• Guard filesystem reads against unresolved symlinks: #​97902
• Turbopack: enable export mangling by default in production builds: #​97676
• Turbopack: mangle exported names for smaller bundle sizes: #​97672
• [ci] Remove the popular workflow and its action: #​97753
• Store keys in key order in SST blocks that omit hashes: #​97480
• Honor non-interactive mode in upgrade codemod prompts: #​98030
• Transform .mjs files with Next.js codemods: #​98029
• evals: stop requiring the removed viewTransition f

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3403684

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vapor-ui	Ready	Preview	Oct 26, 2026 4:36am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: goorm-dev/vapor-ui
• Branch: main
• File: .coderabbit.yaml
• Commit: 8ec9bd9
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 586ce267-a578-45c1-bbba-02c4ed5b25f1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}