[forain]

Snyk has created this PR to upgrade next from 16.3.8 to 16.4.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 65 versions ahead of your current version.

• The recommended version was released 21 days ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Use After Free SNYK-JS-SHARP-21347772	300	No Known Exploit
	Use After Free SNYK-JS-SHARP-20552492	300	Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: next

• 16.4.0 - 2026-10-06
  

  Check out the 16.4 announcement post to get an overview of the changes.

  Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015
  • docs: improve clarity and punctuation in README: #86096
  • Fix debug build paths Pages Router support entries: #93529
  • bundle-analyzer: record historical snapshots on each analyze run: #93520
  • fix: detect proxy.ts correctly with compound pageExtensions: #93246
  • feat(turbopack): support false values for resolveAlias config: #93331

  Misc Changes

  • docs: correction to dynamicParams migration: #96624
  • docs: proxy event argument: #96435
  • docs: remove experimental note from runtime prefetching: #96615
  • Preserve per-segment prefetching after dynamic navigation: #96583
  • Rename static generation stream option to waitForAllReady: #96564
  • Remove obsolete static generation plumbing: #96563
  • [turbopack] Drop dead writes to exports: #96381
  • [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
  • [turbopack] Add test for sideEffects with optimizePackageImports: #96549
  • [turbopack] Strip leading BOM before parsing CSS: #96678
  • Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
  • docs: use relative doc links in instant-navigation error pages: #96672
  • Turbopack: terminate failed plugin worker threads: #96592
  • Fix HTML-limited bot matching in prerender bypass rules: #96584
  • [ci] Fix create_release_branch for new repo permissions: #96641
  • test: skip action module instance deploy test: #96629
  • docs: quote the dynamicParams build error in a blockquote: #96633
  • [react-sync] Open pull requests as the bot that authors the commits: #96682
  • [Bench] Fixes for pure Fizz bench: #96771
  • Derive foreground cache revalidation from the consumer: #96731
  • Fix race when navigating Back before hydration: #96252
  • docs: present each Skill as steps in the AI agents guide: #96751
  • Reuse completed cache entries for the rest of a request: #96727
  • Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
  • Remove WorkStore execution mode: #96674
  • Remove cache revalidation execution mode reads: #96670
  • Separate App Route render and prerender pipelines: #96662
  • Remove App Page execution mode reads: #96660
  • test: fix missing await in css-chunking test: #96725
  • docs (Skills): stop assuming app/ at the root and port 3000: #96696
  • Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
  • Use Tailwind Turbopack loader in create-next-app: #96606
  • docs: instant navigation quick start with an adoption prompt: #96663
  • Separate App Page render and prerender pipelines: #96659
  • Move App Router execution intent to entrypoints: #96640
  • Pass explicit render capabilities through App Render: #96576
  • Pass explicit prefetch hint policy through App Render: #96572
  • Replace WorkStore isStaticGeneration with executionMode: #96570
  • docs: document ! exclusion and src/ prefix for --debug-build-paths: #96703
  • Change loadManifest to return undefined with handleMissing: #96530
  • Refactor server from CacheNodeSeedData -> TransportData: #96679
  • Unify full/partial navigation response types: #96439
  • Unify RouteTree and CacheNodeSeedData on the client: #96406
  • Consolidate Promise.withResolvers polyfills: #96772
  • [ci] Open automated update pull requests with nextjs-bot: #96683
  • Require Cache Components for Instant Navigation testing: #96745
  • Fix use cache over- and under-invalidation in dev: #96235
  • Fix which pages the dev server announces, and when: #96250
  • docs: update redirected links to current targets: #96723
  • Fix(deployment-id): prevent exception on old webkit: #94604
  • [fragment-scroll] Remove config.experimental.appNewScrollHandler: #95602
  • [turbopack] Enable reexport-unknown execution test: #96774
  • ci: stop publishing @ vercel/devlow-bench: #96887
  • fix(turbopack): name the module in the non-ESM-placeable error, and stop duplicating the importer in traces: #96560
  • fix(turbopack): support type: 'text' in rules, and error on binding imports of non-ESM modules: #96558
  • Lint devlow-bench with the root eslint config: #96871
  • Remove turbopack/packages and relocate devlow to packages/: #96860
  • Flush pending revalidations for forwarded action error responses: #96945
  • Handle Server Actions on dynamic PPR fallback routes: #96932
  • Turbopack: Improve how DiskWatcher is configured and fix polling watcher bugs: #96440
  • Turbopack: Allow DiskWatcher to use a mocked DiskFileSystem, add a small unit test: #96353
  • [turbopack] Add e2e test that uses component chunks + workers: #96556
  • [turbopack] Support experimental.serverMinification & expand experimental.turbopackMinify: #96578
  • Add a turbopackChunking documentation page for pages router: #96698
  • [turbopack] Don't run Webpack tests on Turbopack-only changes: #96656
  • [turbopack] Enable the shared runtime by default: #96778
  • [turbopack] Enable CJS tree shaking by default: #96779
  • refactor: clean up places that needlessly list all RenderStages: #96907
  • Fix the documented invocation for generating tests non-interactively: #96896
  • Make NextConfigComplete typing more accurate: #96700
  • Upgrade to swc 75: #96702
  • docs: link View Transitions skill on skills.sh and clarify the example prompt: #96863
  • [ci] Reset the turbopack deploy test project in the weekly cron: #96822
  • docs: add authentication with Cache Components guide and iron-session example: #95802
  • [turbopack] Fix a potential deadlock in scope_and_block: #95695
  • Remove the turbopack-build-events trace span, use next build instead: #96746
  • docs: add export const dynamic = 'force-static' to Route Handlers example on Static Exports: #96964
  • [turbopack] Follow re-exports for side-effect free async modules: #95993
  • [turbopack] Treat constants with values referencing other values as unsafe: #96190
  • [refactor] Rename encodeCacheTag to encodeHeaderSafe: #96936
  • Fix formatting of Google Fonts section in documentation: #88447
  • Fixing a bug - typo issue fixed: #97141
  • examples: fix Webiny API env variable name: #97134
  • docs: fix Link prefetch grammar and Client Components wording: #97132
  • Use emitted app entries for post-build processing: #97139
  • docs(mdx): fix package name in .md handling section: #97131
  • [turbopack] Reduce native React Compiler work: #96820
  • docs: rename repo to repository for consistency: #87849
  • Fix typo in Data Access Layer section: #87202
  • docs: runtime prefetching -> optimizing prefetching: #96934
  • [CC] Track APIs that cause incompatible static/app shells: #97040
  • Fix client component loading span timing: #96455
  • Trace development route compilation: #96454
  • Prefix 'use cache' debug logs with the full directive: #97037
  • Revert "[turbopack] Enable CJS tree shaking by default (#96779)": #97018
  • Revert "[turbopack] Follow re-exports for side-effect free async modules": #97009
  • [fragment-scroll] Rename ScrollAndMaybeFocusHandler to ScrollHandler: #96828
  • Trace development route preparation: #96453
  • test: cleanup Turbopack snapshot config: #97013
  • Remove unused htmlLimitedBots from renderOpts: #96701
  • fix(turbopack): point at the glob that matched a file with no module type: #96561
  • [turbopack] Bail CJS tree-shaking on var x = module.exports = {}: #97130
  • docs: server client and directives: #96145
  • docs: clarify client cache freshness after hydration: #97180
  • docs: create client-side fetching guide: #96341
  • Turbopack: accept a module type argument for import.meta.glob: #96991
  • docs: align Cache Components authentication guide title: #97143
  • test: re-enable a few more passing NFT unit cases: #97017
  • [turbopack] Do the CJS analysis needed for scope hoisting: #95826
  • Remove legacy PPR code paths: #96868
  • Use Cache Components as the internal PPR signal: #96827
  • Make legacy PPR paths explicit: #96753
  • fix: typos in code comments: #97137
  • Fix spelling in two comments: #97136
  • Decouple loader tree construction from children ordering: #97192
  • Bump lightningcss: #97159
  • Update gh-stack skill guidance: #97163
  • [test] Unflake use-cache-custom-handler-dev tests: #97187
  • Forward a build-container pin to deploy-test deployments: #97191
  • Fix shared Turbopack runtime initialization race: #97215
  • Fix stale data after navigation despite revalidation: #95439
  • [turbopack] Only use the shared runtime by default on canary: #97208
  • test: fix 'ouput' typo in parseIdsFromCliOutput: #97266
  • Add the mtime fallback back: #97268
  • Allow issue participants to request reopening: #96947
  • [turbopack] Document clusters for chunking: #97267
  • Link to issues in the contribution guide and discourage trivial PRs: #97188
  • Stop serializing hmr version state: #97146
  • [turbopack] Add clusters to chunking heuristics: #95157
  • [test] Redirect the deployment host in-process for proxy deploy tests: #97260
  • [test] Unflake two cache-components-dev-streaming assertions: #97246
  • [test] Unflake use-cache-default-profile-expire-zero tests: #97250
  • Allow running ncc before pnpm build: #97234
  • Invalidate deferred Webpack entry sources: #97205
  • Unify how a response's shell and full payloads are written: #96878
  • Convert per-segment prefetches to NavigationFlightResponse format: #96877
  • Unify how server responses are written into the client cache: #96876
  • Convert tree prefetches to NavigationFlightResponse format: #96788
  • fix(next/image): skip 0-byte entries when initializing disk LRU cache: #94068
  • Update authentication diagram URL: #97320
  • Add a script for adopting fork pull requests: #97252
  • Migrate napi-rs bindings from v2 to v3:

[forain]

This is a minor version upgrade from 16.3.8 to 16.4.0. While not introducing major breaking API changes, it strongly recommends a new 'Cache Components' model and makes it the default for new projects. Existing applications will not adopt this new model automatically upon upgrading.

Key Changes:

• New Caching Model: The release officially recommends 'Cache Components' as the best practice for all applications, which will become the framework default in Next.js 17. This changes the caching strategy from an opt-out model for dynamic routes to an opt-in model where components and functions are explicitly cached. Adopting this is a separate migration effort from just bumping the version number.
• New APIs: Introduces ensureStatic, navigation(), and prefetch() to give finer control over static rendering guarantees and prefetching behavior.
• React 19.3 Upgrade: This version of Next.js bundles React 19.3, which includes stable View Transitions.
• Performance Improvements: Features a smaller Turbopack disk cache (20-25% reduction), lazy server module compilation, and smaller production bundles.

Potential Impact:

While simply upgrading the package version should not break existing applications, the significant shift in the recommended caching paradigm requires careful consideration. The core change is behavioral and requires developers to adopt a new mental model for caching. Failure to properly migrate to Cache Components could lead to incorrect caching behavior, such as leaking user-specific data in shared caches.

Recommendation:

1. Upgrade the next package version without enabling the new Cache Components feature initially. Test your application thoroughly to ensure no regressions from the underlying dependency updates (like React 19.3).
2. Plan the migration to Cache Components as a separate, deliberate effort. This will involve code changes to mark cache boundaries and should be tested extensively in a staging environment.

Source: Next.js 16.4 Release Announcement

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

PR Preview Action v1.8.2
🚀 View preview at https://instructure.design/pr-preview/pr-2766/
Built to branch gh-pages at 2026-10-27 22:13 UTC. Preview will be ready when the GitHub Pages deployment is complete.