GitHub

v16.1.7

release notes

Published 3/16/2026

PatchSafe upgrade

Release notes

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
Apply server actions transform to node_modules in route handlers (#89380)
ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

Diff stats+2873-1228173 filesMain areasdocstestsexamplespackagespatcheserrors

release notes

Published 3/16/2026

PatchSafe upgrade

Release notes

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

[Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
Apply server actions transform to node_modules in route handlers (#89380)
ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Huge thanks to @unstubbable, @styfle, @eps1lon, and @ztanner for helping!

Diff stats+2873-1228173 filesMain areasdocstestsexamplespackagespatcheserrors