Misc Changes

• [PPF] Scaffold unstable_ensureStatic segment config: #98190
• [agent-feedback] Respect CI and telemetry opt-out: #99062
• Fix prefetch loop when a predicted route redirects: #98998
• Fix dev overlay header layout on small screens: #99049
• [PPF] Separate tracking of runtime data accesses for shells and prefetches: #98129
• Harden next/og SVG serialization: #99061
• test: clarify dev-only intent of duplicate Sass warning test: #98917
• test: enable upward distDir deployment coverage: #98886
• test: remove redundant deployment skips from mode-guarded suites: #98908
• Turbopack: trace static project files referenced by packages: #98712
• Durable use cache: fix next/image pulling in NEXT_DEPLOYMENT_ID: #98739
• Unify hydration error tree details: #99008
• Turbopack: forward module graph, entrypoint write, and emit spans to the JS trace: #98408
• Fix startTime and shutdown delivery of forwarded Turbopack trace spans: #98426
• Turbopack: loader change invalidation: #95732
• perf: optimize CSS graph cycle removal: #98860
• Use AGENTS.md for managed agent instructions: #99043
• Turbopack: analyze mode tracing imports only: #98825
• Turbopack: compact re-export registration: #98617
• test: Add test for ESM and CJS exports of next/* APIs: #98882

Credits

Huge thanks to @lubieowoce, @aurorascharff, @acdlite, @eps1lon, @jamiboym, @sokra, and @mischnic for helping!

Core Changes

• feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

• Enable AI upgrade for canary: #99001
• fix(turbo-persistence): preserve write errors on writer drop: #98840
• Skip slow valued tombstone test under Miri: #98992
• Improve the agent feedback review flow: #98937
• Run AI upgrades with the latest official canary: #98870
• test: move whole development-only suites out of e2e: #98842
• Fix instant-false codemod to run on route segment filenames: #98880
• test: migrate legacy deployment exclusion callers: #98473
• Split revalidation errors by execution context: #98993
• Enable strict route matching by default: #97397
• Surface agent feedback gate connection failures: #98991
• Generalize the build-time generator work-unit store name: #98891
• Use structural React keys during server rendering: #98944
• Upgrade React from ff8f88fc-20260915 to 59aff3e1-20260918: #98897
• Remove unused hasWarnings and warnings: #96956

Credits

Huge thanks to @sokra, @devjiwonchoi, @aurorascharff, @jamiboym, @gnoff, and @martinfrancois for helping!

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

Misc Changes

• Preserve closed-parameter restrictions in client route prediction: #98889
• [test] Fix deployment tests that relied on implicit startup: #98935
• Turbopack: Add support for specifying additional roots: #98003
• Turbopack: Add symlinks and additional roots to NFT metadata: #98469

Credits

Huge thanks to @gnoff, @unstubbable, and @bgw for helping!

Misc Changes

• Persist resurrected tasks as new tasks: #98729
• Rspack: Remove bincode dependency from rspack by way of turbo-unix-path: #98855
• Pin tasks across restore waiter handoff: #98728
• test: honor skipStart for Vercel deployments: #98776
• Use internal prefix for Turbopack shutdown env: #98747
• test: retry waiting for ISR fallback in prefetch-static-shell: #98884
• Fix generated Turbopack GC option docs: #98888
• Add agent feedback behavior evals: #98887
• Add experimental agent feedback workflow: #98582
• Clean up unnecessary output asset creation: #98834
• Properly disable laziness on next/dynamic: #98828
• Set experimental.agenticAutoUpgrade after successful upgrade: #98871
• example(cache-handler-redis): fix connection leak, hangs on a down Redis, and cross-page tag invalidation: #98716
• Do not check Node version while agentic upgrade: #98852
• test: run cargo unit tests with miri as well: #97535
• test: unflake instant-validation: #98854

Credits

Huge thanks to @sokra, @bgw, @gnoff, @wbinnssmith, @lubieowoce, @jimmyhmiller, @aurorascharff, @devjiwonchoi, @leejpsd, and @mischnic for helping!

Misc Changes

• Nudge the agents for future defaults adoption: #98721
• Add future defaults upgrade coverage for next upgrade --ai: #98643
• Nudge the agents for latest version upgrade: #98640
• Add "latest" upgrade coverage for next upgrade --ai: #98633
• Nudge the agents for security vulnerable version upgrade: #98637
• Add next upgrade --ai and security vulnerability coverage: #98562
• agents: Add a --comments-only flag to pr-status script, trim down context bloat in AGENTS.md: #98781
• Keep guards across restore owner handoff: #98700
• [turbopack] Track webpack loader build dependency files: #98777
• Replace lzzzz with lz4_flex: #98799
• Fix metadata propagation for deduplicated nested caches: #98808
• Bump to swc v79: #98809
• [PPF] Fix unnecessary runtime prefetch with prefetch={true}: #98651
• Keep metadata rendering stable across streaming modes: #97440
• [test] Expand root-param navigation regression coverage: #98731
• docs: rewrite the bots and crawlers section in the caching guide: #98782
• Fix isStableBuild() treating commit preview tarballs as stable: #98811
• perf(turbo-persistence): shard meta files by family: #97703
• turbo-persistence: assorted read-path cleanups: #97797
• turbo-persistence: give key block searches a dense region of their own: #97705
• Introduce config options for Turbopack GC: #98378

Credits

Huge thanks to @devjiwonchoi, @bgw, @sokra, @jimmyhmiller, @unstubbable, @mischnic, @lubieowoce, @gnoff, @icyJoseph, and @lukesandberg for helping!

Misc Changes

• Store code generation AST paths in a shared trie: #98581
• Turbopack: Remove wasmer from lockfile by deleting dead feature option from our wasm crate: #98761
• Prefer using join over try_join when you don't want a vec: #98547
• Preserve committed app route response status during fallback: #98649
• docs: scope React cache() guidance to the render pass: #98741
• fix(next-custom-transforms): never place generated imports before directives: #98717
• Pin tasks during construction: #98688
• fix(use-cache): track root params read in "use cache" as vary params: #98674
• [test] Fix Webpack deployment failures in PostCSS tests: #98710
• Revert "Fix App Router locale path matching with Pages i18n": #98715

Credits

Huge thanks to @lukesandberg, @bgw, @alangenfeld, @icyJoseph, @mischnic, @jimmyhmiller, @aryabyte21, @unstubbable, and @timneutkens for helping!

Misc Changes

• Fix App Router locale path matching with Pages i18n: #98095
• Upgrade React from 019019be-20260911 to ff8f88fc-20260915: #98693

Credits

Huge thanks to @timneutkens for helping!

Misc Changes

• fix(turbopack): trace cyclic modules to explicit entries: #98661
• Use default pnpm package import method: #98703
• Fix constant inlining in shorthand properties: #98662
• test(turbopack): add strong read operation roots: #98248
• Use pnpm for isolated test installs: #98425
• [turbopack] Forward usage information across re-exports: #96282
• [turbopack] Use options object for ESM references: #98680
• test: enable verified runtime deploy tests: #98457
• test: enable verified assets deploy tests: #98527
• test: enable verified pages-router deploy tests: #98526
• test: enable verified tooling deploy tests: #98525
• test: enable verified app-router deploy tests: #98524
• test: enable verified caching deploy tests: #98523
• Fix unexpected query parameters in adapter deployments: #98584
• Keep never-prerenderable params out of self-hosted shells: #98612
• Fix addMissingDependency: #98588
• docs: clarify metadata support in root not-found: #98670
• Pages Router: do not return the __appRouter prefetch marker as route info on shallow navigation: #98187
• Pages Router: key the client router filter prefetch marker by the as path: #98182
• test: remove unsupported deployment ID builder cases: #98668
• docs: add an intro paragraph to the glossary: #98654

Credits

Huge thanks to @sokra, @lukesandberg, @sampoder, @jamiboym, @unstubbable, @jimmyhmiller, @kostyniuk, @Stanzilla, and @icyJoseph for helping!