Update dependency next [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
next (source)	^12.1.0 -> ^15.0.0
next (source)	14.2.13 -> 14.2.21

GitHub Vulnerability Alerts

CVE-2024-47831

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

• The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
• The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras

CVE-2024-51479

Impact

If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.

Patches

This issue was patched in Next.js 14.2.15 and later.

If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

We'd like to thank tyage (GMO CyberSecurity by IERAE) for responsible disclosure of this issue.

CVE-2024-56332

Impact

A Denial of Service (DoS) attack allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution.

Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.

Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.

This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. If the host has no other mitigations to those then this vulnerability is novel.

This vulnerability affects only Next.js deployments using Server Actions.

Patches

This vulnerability was resolved in Next.js 14.2.21, 15.1.2, and 13.5.8. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credits

Thanks to the PackDraw team for responsibly disclosing this vulnerability.

---

Release Notes

vercel/next.js (next)

v15.1.6

Compare Source

v15.1.5

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix missing revalidate with notFound() (#​75009)
• fix: when metadatabase is set we should not warn (#​74840)
• Fix @​vercel/og license SPDX expression (#​74745)
• fix: ts language server rule metadata should allow null (#​74704)
• fix: eslint rule of using img in metadata routes (#​74864)
• Fix presentation when onerror receives an event without error (#​74643)
• fix fetch lock not being consistently released #​74623 (#​75028)

Credits

Huge thanks to @​ijjk, @​huozhi, @​matmannion and @​ztanner for helping!

v15.1.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• backport: force module format for virtual client-proxy (#​74608)
• Fix prerender tags when notFound is called (#​74607)
• Use provided waitUntil for pending revalidates (#​74604)
• Feature: next/image: add support for images.qualities in next.config (#​74588)
• Chore: docs: add missing search: '' on remotePatterns (#​74587)
• Chore: docs: update version history of next/image (#​73923) (#​74570)
• Chore: next/image: improve imgopt api bypass detection for unsupported images (#​74569)

Credits

Huge thanks to @​ and @​ for helping!

v15.1.3

Compare Source

v15.1.2

Compare Source

v15.1.1

Compare Source

v15.1.0

Compare Source

Core Changes

• fix: decrypt bound args before generating a cache key: #​72463
• Fix the path to the next/experimental/testing/server export: #​72527
• Expand server-source-maps scenarios to cover Edge runtime: #​72288
• Ensure logged errors in Edge runtime include the stack: #​72394
• fix: added cache control headers for static app routes: #​72521
• capture console issues as console errors: #​72468
• Add expireTag and expirePath APIs: #​72485
• fix: try/catch access to localStorage within __NEXT_APP_ISR_INDICATOR useEffect: #​72362
• Move client build ID to a global variable: #​72592
• refactor(turbopack): Remove swc_css: #​72602
• Bypass source map dev middleware for client chunks: #​72581
• chore: remove rc from URL: #​72599
• improve no-img-element lint error message: #​72410
• Combine bound "use cache" closure args into a single parameter: #​72587
• [Turbopack] add BackendOptions and allow to disable dependencies, children and storage: #​72426
• Omit unused args when calling "use cache" functions: #​72506
• Add experimental clientSegmentCache flag: #​72626
• Add compiler.define option: #​71802
• Fix static indicator with dynamicIO: #​72631
• Allow usage of Node.js prereleases: #​72635
• improved network url in (dev) cli: #​72634
• chore: update getting-started/react-essentials path: #​72250
• Fix static indicator for pure IO case: #​72639
• Bump the monorepo packages TypeScript to 5.6.3: #​72625
• Bump @capsizecss/metrics to 3.4.0 for Geist Google Font: #​72746
• refactor: remove unused asNotFound property: #​72585
• Remove unused enabled config from server actions transforms: #​72755
• Ensure Next.js is ignore-listed when used as external: #​72498
• Bump eslint-plugin-react to 7.37.0: #​72759
• upgrade amphtml-validator to 1.0.38: #​72645
• fix multi-level redirect in server actions: #​72770
• refactor: rename error boundary not-found to http-error-fallback: #​72586
• Upgrade React from 5c56b873-20241107 to 7ac8e612-20241113: #​72768
• Re-use randomly selected dev server port for automatic restarts: #​72771
• Emit build error when "use cache" is used without dynamicIO enabled: #​72781
• fix: not found bounary prop: #​72784
• silence sass legacy-js-api warning: #​72632
• [Segment Prefetch] Move access token to route tree: #​72775
• Add internal affordances to show ignore-listed stackframes in terminal: #​72763
• chore(turbopack): Centralize reqwest TLS feature configs in turbo-tasks-fetch: #​72526
• Upgrade React from 7ac8e612-20241113 to 380f5d67-20241113: #​72819
• Shorten unsourcemapped absolute locations in terminal stacktraces: #​72764
• codemod: replace revalidate(Tag|Path) to expire(Tag|Path): #​72826
• "Fix": Lift type check out of loop: #​72840
• hide stack trace in CanaryOnlyError: #​72859
• Allow missing CacheNodeSeedData during prefetch: #​72857
• Add Segment Cache feature check to prefetch API: #​72861
• Extract shared fetchFromServerResponse logic to separate functions: #​72865
• [Segment Cache] Implement behavior on cache miss : #​72841
• Emit build error for unknown cache kinds: #​72832
• Resolve mdx plugins string format: #​72802
• MDX: Only set experimental.turbo if enabled: #​72856
• [Turbopack] change persistent caching option to a boolean: #​72458
• refactor: generalize next route error helpers: #​72774
• Ensure host is in allowed headers: #​72867
• refactor: types for collected cache info in route modules: #​71434
• feat(turbopack): Enable tree shaking for modules with dynamic imports: #​71692
• Fix unhandled rejection in proxy-request: #​72530
• chore(build): remove injecting fast refresh to custom loader logs: #​72870
• ensure webpack worker exits bubble to parent process: #​72921
• Fix sourcemaps for internal client boundaries: #​72922
• Turbopack: thread tracing through to resolve results: #​72314
• Upgrade vercel og: #​72954
• Turbopack NFT: trace manifests and externals: #​72316
• Turbopack: NFT followups: #​72517
• Support custom servers with minimal node modules: #​72966
• Add support for ignore-listing sources in index maps: #​72913
• Turbopack: fix loading of externals on Edge: #​72349
• Bump SWC used for transpiling Next.js sources: #​72993
• fix: ensure HTML validity for the next-size-adjust meta tag: #​72994
• Revert "Support custom servers with minimal node modules": #​73003
• Allow CacheNode.loading to be a promise: #​72872
• Properly encode dynamic access in segment prefetch: #​72874
• [Segment Cache] Send during route prefetch: #​72890
• fix(next/image): improve svg heuristic for unoptimized: #​72970
• [Segment Cache] Initial implementation: #​72875
• Turbopack: Change edge wrapper to proxy exports : #​72502
• experimental: css inlining: #​72195
• Display where the env was loaded from when enabled typedEnv: #​70951
• create forked impl for Link component: #​73019
• remove unnecessary handling in forked Link components: #​73020
• Pass down ignored field to error overlay: #​72925
• remove locale from app link: #​73052
• fix: server action redirects between multiple root layouts: #​73063
• Add forbidden and unauthorized APIs: #​72785
• chore: rename modules for better meaning and searching: #​73067
• fix(next/image): reduce avif sharp effort from 4 to 3 for faster encoding: #​73030
• (E2E) Log which config file is used for next start: #​73105
• Remove extra space in envionment log: #​73108
• remove inheritance from NextCustomServer: #​73005
• Align navigation digest with message: #​73074
• refactor: move redirect helpers into separate module: #​73118
• Update font data: #​73115
• Current behavior for fallbacks with async metadata and prefetching: #​73106
• Revert "ensure webpack worker exits bubble to parent process (#​72921)": #​73136
• Reapply "ensure webpack worker exits bubble to parent process (#​72921)": #​73138
• Upgrade React from 380f5d6-20241113 to b01722d-20241114: #​73107
• Implement metadata types support for exactOptionalPropertyTypes: #​72936
• Reenable otel test for Turbopack: #​73093
• Omit unnecessary cache wrapper import: #​73160
• Increase max cache tags to 128: #​73124
• Do not inline CSS in RSC payload for dynamic client nav: #​73182
• fix(next/image): dpl query string should only be used for local images, not remote images: #​73184
• feat(after): unflag unstable_after internals: #​73190
• feat(after): allow using unstable_after in generateStaticParams: #​73217
• Error on navigation API usage in pages router and middleware: #​73100
• Undeprecate revalidate APIs and rename expire APIs: #​73193
• Revert "codemod: replace revalidate(Tag|Path) to expire(Tag|Path)": #​73269
• feat(after): wait for after-callbacks before server shutdown: #​72590
• Fixed interception on a catch-all route: #​72902
• add option to disable experimental CssChunkingPlugin: #​73286
• rename cssChunkPlugin experimental options: #​73291
• Replace the group frames with button for ignored frames: #​72964
• handle pages router ignored frames: #​73280
• fix(after): no request APIs in force-static: #​73321
• fix(after): allow reading draftMode status in after: #​73324
• [Turbopack] reland refactor filesystem writes to an effect based system: #​73294
• fix(pages): dynamic css missing style after client navigation: #​72959
• Make notFound() work in "use cache" page: #​73210
• refactor(after): remove unnecessary conditionals: #​73447
• Bump @swc/core to 1.9.3: #​73420
• fix: running cleanup before server is initialized: #​73476
• [edge-runtime] drop node16: #​73432
• feat(after): allow request APIs in after (actions/handlers): #​73345
• Sourcemap errors logged in Edge runtime: #​73438
• refactor: rename ALS instances to prevent bad auto imports: #​73480
• Show a proper error if a server function's bound args cannot be serialized: #​73471
• remove unnecessary internal middleware header from response: #​73482
• Ensure Issue Overlay sourcemaps externals in Turbopack: #​73439
• Fix missing error message in terminal for bound args serialization error: #​73508
• fix: memory leak from warnOnce(): #​73483
• Upgrade React from b01722d5-20241114 to 1b1283ad-20241203: #​73506
• Fix: Importing an ESM file from next/dist/client/.js fails: #​73485
• fix: fixed dedupe response cloning: #​73274
• Upgrade React from 1b1283ad-20241203 to de68d2f4-20241204: #​73525
• fix(after): improve error message if promise arg rejects: #​73524
• feat: added compression to resume data cache using deflate: #​73227
• Use React 19 stable in Pages Router: #​73562
• Use stable @types/react: #​73563
• Cache the bound args encryption result for inline server functions: #​73521
• chore: remove non-existent hash fragments from URLs: #​73165
• next-upgrade: Ensure highest versions are used not latest: #​73566
• Upgrade React from de68d2f4-20241204 to 1c9b1387-20241204: #​73565
• Use consistent error formatting in terminal: #​71909
• [Segment Cache] Interception routes: #​73434
• Upgrade to typescript 5.7: #​73594
• [Segment Cache] Use LRU to manage cache data : #​73486
• [Segment Cache] Add isPartial to segment prefetch : #​73528
• Fix missing client reference manifest error when using route groups: #​73606
• feat(after): stabilize unstable_after: #​73605
• [Segment Cache] Add isHeadPartial: #​73530
• fix: do not add suffix for sitemap under group routes: #​73570
• Dynamic IO: Improve error handling: #​73607
• fix: Update @​swc/helpers: #​73666
• Upgrade React from 1c9b1387-20241204 to 7283a213-20241206: #​73608
• next-codemod(upgrade): handle absence of scripts in package.json: #​73688
• Add inlineCss trade-offs/gotchas and remove canary check: #​73609
• Ignore-list stack frames in node_modules even if not explicitly ignore-listed by their sourcemaps: #​73689
• Remove ignore for anonymous stack frame: #​73610
• test: move HMR Error Recovery test to a separate file: #​73592
• test: move HMR basic test to a separate file: #​73612
• fixes webpack persistent caching in development and add test case for persistent caching: #​73697
• fix: empty generateStaticParams should still create an ISR route: #​73358
• Limit the number of concurrently open file watchers on macos: #​73741
• fix: warnOnce() lru: #​73742
• [Segment Cache] Respond with 204 on cache miss: #​73649
• [Segment Cache] Skip dynamic request if possible: #​73540

Example Changes

• example: add more files to playwright .gitignore: #​72447
• examples: update app-dir-i18n-routing to v15: #​72636
• chore(example): add example for image optimization with secure compute: #​72641
• examples: update app-dir-i18n-routing to v15: #​72642
• examples: polish some README.md: #​72117
• examples(with-supabase): fix action type error: #​72783
• use explicit resource management for sandbox: #​72780
• update: remove unnecessary in Dockerfile: #​72534
• Fix Mongoose example failed build due to env variable not found: #​72918
• (example) using await params when dynamic routing: #​72896
• Updated the example of with-styled-jsx-scss to utilize the App Router.: #​70567
• Updated the example of with-styled-jsx-plugins to utilize the App Router: #​70663
• Updated the example of with-unstated to utilize the App Router.: #​73211
• updated with-react-foundation example to utilize the App router.: #​73243
• updated with-plausible example to utilize the app router.: #​73255
• updated with-cssed example to utilize the app router.: #​73348
• updated with-babel-macros example to utilize the app router.: #​73347
• updated image-legacy-component example to utilize the app router.: #​73344
• updated with-styletron example to utilize the app router.: #​73252
• updated with-context-api example to utilize the App Router.: #​73316
• updated with-mqtt-js example to utilize the App Router.: #​73303
• chore(examples): update api-routes-cors: #​73408
• chore: release turbopack npm packages: #​73443
• examples: remove app-dir in i18n-routing directory name: #​73453
• examples: move Postgres example: #​73531
• Bump examples/** Eslint to v9: #​73560
• Update with next sass example: #​73548
• examples: remove next-env.d.ts files: #​73673
• examples: update with-sass README.md: #​73668
• examples: remove next-offline example: #​73675
• examples: remove the old files from with-postgres: #​73587
• examples: remove with-emotion-* directories: #​73674
• updated with-ionic-typescript example to utilize the App Router.: #​73418
• examples: update with-styletron README.md: #​73411
• examples: update with-babel-macros README.md: #​73410
• examples: update with-plausible README: #​73305
• examples: unify related CMS examples in README: #​73247
• examples: fix view source pathname at image-legacy-component: #​73414
• examples: remove with-styled-components-babel: #​73229
• examples: replaced GTM component with GA in Google Analytics example: #​73597
• examples: introduce LaunchPad in strapi: #​73244
• examples: remove with-storybook-styled-jsx-scss: #​73228

Misc Changes

• Revert "[Turbopack] add rocksdb": #​72505
• [Docs]: Remove try catch and link to error handling docs: #​72500
• [Turbopack] improve performance of the trace server: #​71661
• Docs: Move next.config.js API pages under a config folder, fix headings in TS and ESLint config pages: #​72465
• Skip canary checks during internal development with VSCode: #​72504
• Devlow snowflake backend: use milliseconds instead of seconds for event time: #​72490
• [Turbopack] add TODO comment: #​72510
• docs: unify the header deps by removing #: #​72451
• fix: remove unnecessary fragment: #​72492
• Fix grammatical error: remove unnecessary 'a' in 03-server-actions-and-mutations.mdx: #​72496
• docs: fix broken link: #​72169
• codemod(turbopack): Replace return Err(anyhow!()) with anyhow::bail!(): #​72487
• Upgrade React from 66855b96-20241106 to 5c56b873-20241107: #​72469
• fix(turbopack): Remove self-references from tree shaking results: #​72567
• Turbopack: Don't run PostCSS on internal assets: #​72579
• Update swc_core to v5.0.4 from v5.0.1: #​72604
• (e2e) module-level patchFileDelay flag: #​72439
• docs: remove unstable_after from Dynamic APIs: #​72595
• chore: release turbopack npm packages: #​72491
• Include bound args param in server reference information byte arg mask: #​72588
• [Turbopack] fix bug where task was not recomputed when stale: #​72509
• CNA: prompt enable turbopack value to true: #​72616
• docs(use-cache): add missing function to page component examples: #​72620
• docs(data-fetching): fix static params as promise examples : #​72565
• Re-enable fetch logging test - HMR: #​72640
• [Turbopack] migrate benchmark to new backend: #​72457
• test: add wait for the error page navigation: #​72760
• CNA: use eslint 9: #​72762
• CNA: replace geist font from local to google: #​72618
• fix(turbopack): Depend on side effect from import binding: #​72601
• chore: keep create-next-app messages and docs the same: #​72444
• ci: flake detection should run in both bundlers: #​72773
• [Turbopack] reduce nesting: #​72747
• docs: update file structure: #​72748
• chore(cna): switch to .mjs tailwind config: #​72124
• [Turbopack] fix collectibles counting and aggregation: #​72609
• [Turbopack] implement dispose root task: #​72611
• feat(turbopack): Merge single-pointer nodes in reverse direction: #​72571
• test: fix hydration error on not-found test texture: #​72818
• docs(turbo-tasks): Improve RcStr docs: #​72825
• fix(turbopack): type error when "dynamic_embed_contents" is on: #​72828
• [Turbopack] make issue ordering stable: #​72751
• refactor(turbopack): Use ResolvedVc for turbopack crate: #​72791
• refactor(turbo-tasks): Simplify most type bounds on Vc and related types: #​72823
• fix(turbopack): Fix CSS Module renaming behavior for @container: #​72607
• refactor(turbopack): Cleanup tree shaking graph logic: #​72836
• [Turbopack] fix hanging waiting on in progress cells: #​72758
• [Turbopack] avoid writing manifests in data/rsc variant of page: #​72767
• Consolidate server actions transform errors into emit_error function: #​72811
• refactor(turbo-rcstr): Move turbo_tasks::RcStr into it's own crate: #​72858
• Add explicit section about type overriding for v15: #​72866
• refactor(turbopack): Use ResolvedVc for turbopack-ecmascript: #​72564
• refactor(turbopack): Use graph for server action workaround: #​72812
• [Turbopack] refactor filesystem writes to an effect based system: #​72847
• Fix sourcemaps for async Turbopack chunks: #​72827
• docs(turbopack): Document build dependency on clang for rocksdb: #​72493
• Clarify how MDX plugins are supported in Turbopack: #​72917
• Turbopack: Don't replace constant conditions with sideeffects: #​72608
• [Turbopack] fix effects tracing: #​72928
• docs: fix code block language in redirecting docs: #​72944
• docs: fix code block language in error pages: #​72943
• docs: update "Migrate to async Dynamic APIs" docs: #​72852
• Fix broken link to the rootDir doc: #​72893
• docs: use relative urls: #​72941
• docs: add the section titles to error page: #​72942
• simplify vapid key generation docs: #​72916
• docs: add and unify notes to error pages: #​72838
• feat(turbopack): Implement module walking for side effect optimization: #​71241
• docs: remove deprecated frameborder, adjust allowFullScreen and update the demo: #​72644
• docs: fix code block language: #​72839
• Docs: Changing information about data fetching cache: #​72301
• Turbopack: apply effects in tests: #​72952
• doc: remove internal customServer flag from custom server docs: #​72962
• codemod(turbopack): Some more script-generated migrations to ResolvedVc: #​72889
• Consolidate FnExpr and FnDecl server function transforms: #​72960
• Allow method properties to be server functions: #​72969
• Include debug script in test directories: #​72992
• docs(sitemap): remove extra 's': #​73023
• chore(turbopack-core): Delete dead all_modules_and_affecting_sources helper function: #​73016
• [Turbopack] concurrent write batches and little endian encoding: #​72929
• Remove unused retry around browser.eval: #​72999
• [Turbopack] Invalidation and Persisting fixes: #​72950
• docs: missing await when using params: #​73044
• docs: incorrect params.id: #​73045
• Remove hardcoded timeouts in Redbox test helpers: #​73000
• perf(turbopack): Enable merging of export fragments: #​72813
• Turbopack build: Add bench for Turbopack cache: #​73040
• 🍪 Understanding Cookie Behavior in Server Components: #​73001
• docs: add Fleek's Next.js template: #​72988
• docs(fetch): clarify default fetch behavior: #​72982
• docs: update staleTimes.mdx: #​72967
• docs: Redirecting fix route handler path: #​72617
• Rename waitForAndOpenRuntimeError to openRedbox: #​72996
• Revert "docs: add Fleek's Next.js template": #​73054
• fix benchmark directory: #​73057
• hmr-test waits for compile signal: #​73064
• docs(next-config): add experimental inline css docs: #​73070
• docs: update tags when upgrading from 13 to 14: #​73071
• docs: fix static params as promise examples: #​72553
• fix: missing await, missing type Promise: #​73088
• Disallow multiple server directives at the same level (file or function): #​73018
• Docs: Add canary tags to expirePath and expireTag: #​73096
• docs: update pages automatic static optimization rendering page: #​72545
• docs(authentication): fix typescript code example: #​72533
• docs: add details on React Compiler annotations with "use memo": #​73053
• docs: fix code block language on redirecting docs: #​73073
• docs(routing): update params type to be async (v15): #​73111
• docs: clarify Switching to Dynamic Rendering section: #​73113
• Method/function props of exported objects are not server functions: #​73058
• Forbid this and arguments in server functions: #​73059
• port turbopack-swc-utils to ResolvedVc: #​73086
• port turbopack-mdx to use ResolvedVc: #​73080
• feat: Update lightningcss to v1.0.0-alpha.61: #​73161
• port turbopack-resolve to ResolvedVc: #​73083
• move turbopack-image to ResolvedVc: #​73079
• Turbopack: more tracing spans: #​73010
• Handle server function directives in class methods: #​73060
• 15.1 docs: forbidden, unauthorized, and authInterrupts: #​73039
• Enable another Turbopack build test: #​73166
• CNA: replace .eslintrc.json with eslint.config.mjs: #​73162
• Turbopack: don't compute all paths for builds: #​73036
• perf(turbopack): Use ResolvedVc for turbopack-css: #​73172
• Revert change to ReactRefreshRequire test: #​73186
• chore(CI): Remove sysroot override for macos arm64: #​73188
• docs: Improve Accuracy and Type Safety on Data Fetching Examples: #​73122
• docs: eslint flat config: #​73167
• perf(turbopack): Use ResolvedVc for turbopack-core: #​73065
• perf(turbopack): Use ResolvedVc for turbopack, turbopack-tests, turbopack-wasm: #​73196
• perf(turbopack): Use ResolvedVc for turbopack-nodejs: #​73200
• perf(turbopack): Use ResolvedVc for turbopack-env: #​73202
• Getting Started Docs: Add new "Layouts and Pages" page: #​73049
• Docs: forbidden and unauthorized nits: #​73213
• Turbopack: make client references actual references: #​73174
• Docs: Update turbopack API Reference: #​73215
• Update authentication docs to use useActionState: #​72503
• Don't hoist a server function if a compile error was emitted: #​73189
• Forbid super in static class methods with server function directives: #​73061
• port turbopack-node to ResolvedVc: #​73082
• port turbopack-static to ResolvedVc: #​73084
• perf(turbopack): Use ResolvedVc for next-api, part 1: #​73234
• Pin undici in tests: #​73263
• Turbopack: use try_join instead of future::try_join_all: #​73261
• docs(server-actions): add missing formData type: #​73257
• perf(turbopack): Use ResolvedVc for next-api, part 2: #​73235
• docs: update static-tweet to react-tweet: #​73253
• docs(fetching): params to await params: #​73254
• convert let keyword to const keyword to data fetching and caching example: #​73251
• [Turbopack] instead of depending on all env vars, track them via Proxy in webpack loaders: #​73112
• docs: update the demo link of kontent.ai: #​73250
• Docs: Fix headings in Layouts and Pages: #​73268
• remove ResolvedVc from trait functions: #​73270
• perf(turbopack): Use ResolvedVc for next-api, part 3: #​73236
• [Turbopack] Revert "refactor filesystem writes to an effect based system": #​73287
• Devlow: exit with non-zero code on failure: #​73276
• perf(turbopack): Use ResolvedVc for next-api, part 4: #​73237
• perf(turbopack): Use ResolvedVc for turbopack-browser: #​73198
• perf(turbopack): Use ResolvedVc for next-core: #​73177
• perf(turbopack): Use ResolvedVc for next-api, part 5: #​73238
• test: reduce number of rendering loop causing flakiness: #​73277
• Turbopack build: Fix css-minify test: #​72990
• chore(turbo-tasks): Add a lint for Vc<T> in turbo-tasks types: #​73298
• docs: add await before headers() and cookies() calls: #​73315
• port turbopack-ecmascript to ResolvedVc: #​73226
• test: fix canary test with 18.3.1: #​73327
• Pin version of nwsapi (revert later): #​73351
• fix Turbopack devlow bench: #​73278
• Revert "Pin version of nwsapi (revert later)": #​73353
• [Turbopack] Performance improvements for Persistent Caching: #​73265
• refactor(turbopack): Use ResolvedVc<T> for struct fields in next-core: #​73310
• refactor(turbopack): Use ResolvedVc<T> for struct fields in turbopack-ecmascript: #​73302
• refactor(turbopack): Use ResolvedVc<T> for struct fields in turbopack-css: #​73300
• refactor(turbopack): Use ResolvedVc<T> for struct fields in next-api, part 1: #​73366
• docs: add missing default to page component examples: #​73233
• Documentation Fix: Typo and URL Correction: #​73397
• [Turbopack] Custom persistence layer: #​73029
• chore(cna): add .pnpm-debug.log* to all cna gitignore: #​73446
• cna: update .gitignore to ignore all .env files: #​73415
• chore(turbo-tasks): improve ast-grep lint time: #​73440
• [Turbopack] fix mmap advise on windows: #​73462
• Getting Started docs: Images and Fonts: #​73340
• Add mention of changing debugWithEdge to debugWithChrome.: #​73409
• docs: Add note about remove of the swcMinify flag: #​73281
• docs(typo): fix typos in file conventions,

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

	Fails
🚫	PR is not labeled with one of: ["cleanup","BREAKING CHANGE","feature request","bug","documentation","maintenance","build","dependencies"]
🚫	PR is not labeled with one of: ["ci:normal","ci:merged","ci:daily","ci:docs"]
🚫	PR title must be in the format of "Area: Summary", With both Area and Summary starting with a capital letter Good examples: - "Docs: Describe Canvas Doc Block" - "Svelte: Support Svelte v4" Bad examples: - "add new api docs" - "fix: Svelte 4 support" - "Vue: improve docs"

Generated by 🚫 dangerJS against 04302c5