• feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution: #91338
• Fix segment explorer file pill accessibility: #92608
• Perf: Only instrument clientComponentLoadTimes when used: #91385

• Remove a ton of turbo task functions from Issue trait items: #92623
• feat(turbopack): change DiskFileSystem root to Vc for portable cache: #92603
• Turbopack: remove unused ChunkableModules struct: #92606
• Disable sccache temporarily: #92657

Huge thanks to @lukesandberg, @sokra, @mischnic, @timneutkens, and @mmastrac for helping!

• Node.js streams: Add forkpoint for CacheComponents: #92444
• Resolve compilerOptions.paths in tsconfigs without compilerOptions.baseUrl: #92277
• Add codemod command to middleware deprecation warning: #92532
• [partial fallbacks]: enable by default: #92627
• refactor: write pages router export files directly to server/pages/: #90018

• Fix NextFontIssue IssueStage: CodeGen → Resolve: #92588
• test: reduce writeToDisk memory test iterations to fix CI timeout: #92586
• Refactor effects system: dedup/conflict detection, simplified Effect trait: #92300
• fix(ci): improve Docker image cache streaming throughput and arch-awareness: #92617
• Turbopack: extract inline base64 decode helper to shared @turbopack/base64 module: #92549
• docs: add Link transitionTypes version history: #92624
• CI: Download and run self-contained datadog-ci instead of using pnpm dlx or npx: #92546
• turbopack: move CSS module composes validation from code generation to resolving: #92582
• Drop turbo_tasks::function from ValueDebug trait items: #92593
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false): #92631
• Bump swc to 63.1.1: #92604
• chore(turbopack): upgrade qfiler to v0.3.0-alpha.4: #92558
• Turbopack: cut number of client references in half: #92607
• fix(ci): improve Docker image caching and native build skip optimization: #92633

Huge thanks to @sokra, @timneutkens, @hamidrezahanafi, @mmastrac, @lukesandberg, @aurorascharff, @bgw, @ztanner, @mischnic, @fireairforce, and @bgub for helping!

• Don't swallow strings thrown in Server Components: #92592

Huge thanks to @eps1lon for helping!

• Add next internal upload-trace: #92191
• Perf: Add fast path to isAbsoluteUrl: #91389
• Perf: Don't require watchpack in production: #91387
• Request logging: Fix generate-params time being included in next.js time: #91386
• Perf: Use charCodeAt in removeTrailingSlash: #91384
• Perf: Cache regex in shouldServeStreamingMetadata: #91388
• fix: scope "Pages Router only" comment to default export in next/error: #92566
• Turbopack Build: Remove dev fouc from production bundle: #80935
• fix(hmr): reconnect WebSocket after sleep/wake: #91416
• Handle target option in React Compiler for Pages + React 18: #91500
• [turbopack] Rust dependency caching via sccache: #91873
• trace: detect rage restarts and deleted .next dirs: #92489

• turbo-tasks-backend: prevent duplicate task restores with restoring bits: #92389
• docs: update details about unstable_retry() behavior: #91827
• docs: link updateTag from cacheTag reference: #92379
• [test] Stop using deprecated target: "es5" TypeScript compiler option: #92458
• Docs: Instant docs updates: #92515
• Turbopack: Improve unable to resolve next error: #91394
• [test] Ensure incomplete minimum release age isn't propagated to fixture installs: #92568
• test: skip .next and other build artifacts in writeFiles filter: #92578
• Replace wasmer with wasmtime for SWC plugin WASM engine: #91533
• docs: native db drivers with sync queries: #92572
• turbopack: fix incremental build when module factories are restored from persistent cache: #92569
• CI: Another attempt to fix pnpm versions for next-stats-action on canary: #92550
• [turbopack] fix a debug_assert failure: #92581

Huge thanks to @sokra, @timneutkens, @devjiwonchoi, @aurorascharff, @eps1lon, @lukesandberg, @icyJoseph, @bgw, @mmastrac, and @wbinnssmith for helping!

• Turbopack: switch from immutable token to path prefix: #92164
• [build info]: distinguish between PPR and fully static routes in gSP: #92518
• [build info]: omit symbol from top level gSP route: #92525

• CI: Fix issue with conflicting 'engines.pnpm' field in next-stats-action: #92533
• Exclude use tests from react18 testing: #92542
• Fix React18 tests for unstable_io: #92543

Huge thanks to @bgw, @mischnic, @gnoff, and @ztanner for helping!

• fix: mention params and searchParams in blocking-route error messages: #92360
• CPU prof: Write profiles to .next-profiles instead of .next/cpu-profiles: #92078
• feat: generate root params types: #91019
• fix: resolve function configs in unstable_getResponseFromNextConfig: #92501
• Bundle skills/ directory into next/dist/skills: #92493
• Node.js streams: Fork points: #92252
• fix: replace docs/canary links with stable docs paths in error messages: #92528

• CI: Remove unused dependencies from next-stats-action dockerfile: #92485
• docs: add note on React canary version to View transitions guide: #92315
• docs: note PPR default in cacheComponents reference: #92378
• Upgrade swc_core 57 -> 58, swc_sourcemap 9 -> 10, swc_plugin_runner 24 -> 25: #91532
• docs: instant-navs draft, samples for build validation: #91850
• docs: add middleware.mdx deprecation stub for discoverability: #92281
• docs: improve blocking-route error page for params discoverability: #92359
• docs: clarify cacheLife() cannot be called at module scope: #92326
• perf: use whole_app_module_graph for get_compilation_issues MCP tool: #92473
• Turbopack: Write trace file to .next-profiles: #92189
• Update Rspack development test manifest: #92502
• Update Rspack production test manifest: #92503
• CI: Use pnpm lockfile for next-stats-action: #92488
• docs: add note on installing server-only in data security guide: #92445
• CI: Use minimumReleaseAge in pnpm workspace files: #92480

Huge thanks to @bgw, @aurorascharff, @lukesandberg, @icyJoseph, @timneutkens, @sokra, @vercel-release-bot, @abhishekmardiya, @bgub, @TooTallNate, and @gaojude for helping!

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

[!NOTE] This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

• Ensure app-page reports stale ISR revalidation errors via onRequestError (#92282)
• Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#91981 through #92273)
• Deduplicate output assets and detect content conflicts on emit (#92292)
• Fix styled-jsx race condition: styles lost due to concurrent rendering (#92459)
• turbo-tasks-backend: stability fixes for task cancellation and error handling (#92254)

Huge thanks to @icyJoseph, @sokra, @wbinnssmith, @eps1lon and @ztanner for helping!

• next-routing: middleware matching and app request URL normalization: #91859
• docs: clarify serverless runtime behavior for use cache: #92232

• Adding more system info to the 'initialize project' trace: #92427
• CI: Update and cleanup next-stats-action, force using pnpm 10.33.0: #92475
• turbo-persistence: Use AtomicBool for is_empty() to avoid lock contention: #92481

Huge thanks to @ijjk, @andrewimm, @bgw, @wwenrr, and @lukesandberg for helping!

• Include more context in macOS Rosetta 2 warning message: #92436
• change the process name of builds: #92411
• Fix styled-jsx race condition: styles lost due to concurrent rendering: #92459
• turbo-tasks: fix hashed cell mode crash on task error (re-land #91576): #92108
• Optimize how we track data for persistence: #89370
• Route Handlers: Fix devRequestTimingInternalsEnd and Turbopack server HMR: #92271

• turbo-persistence: skip BlockCache for uncompressed (mmap-backed) blocks: #92390
• docs: clarify that proxy/middleware matches static assets by default: #92441
• turbo-persistence: pin referenced BlockCache entries to prevent eviction: #92361
• [test] Skip flaky client-cache.parallel-routes in production and deploy: #92195
• Fix sst inspect tool to respect CURRENT and stale sst files: #92414
• [turbopack] add family name to many spans: #92415
• scripts/pr-status: add reply-and-resolve-thread command: #92450
• [test] Regenerate checked-in tsconfig.json files: #92455

Huge thanks to @sokra, @bgw, @lukesandberg, @icyJoseph, @eps1lon, and @wbinnssmith for helping!