Update dependency next to v13 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	12.3.4 → 13.5.11

---

XSS in Image Optimization API for Next.js

CVE-2021-39178 / GHSA-9gr3-7897-pp7m

More information

Details

Impact

• Affected: All of the following must be true to be affected
  • Next.js between version 10.0.0 and 11.1.0
  • The next.config.js file has images.domains array assigned
  • The image host assigned in images.domains allows user-provided SVG
• Not affected: The next.config.js file has images.loader assigned to something other than default
• Not affected: Deployments on Vercel are not affected

Patches

Next.js v11.1.1

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m
• https://github.com/vercel/next.js/releases/tag/v11.1.1
• https://nvd.nist.gov/vuln/detail/CVE-2021-39178
• https://github.com/vercel/next.js/pull/28620
• https://github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa
• https://github.com/advisories/GHSA-9gr3-7897-pp7m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0

CVE-2022-23646 / GHSA-fmvm-x8mv-47mj

More information

Details

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change next.config.js to use a different loader configuration other than the default.

Impact

• Affected: All of the following must be true to be affected
  • Next.js between version 10.0.0 and 12.0.10
  • The next.config.js file has images.domains array assigned
  • The image host assigned in images.domains allows user-provided SVG
• Not affected: The next.config.js file has images.loader assigned to something other than default

Patches

Next.js 12.1.0

Workarounds

Change next.config.js to use a different loader configuration other than the default, for example:

module.exports = {
  images: {
    loader: 'imgix',
    path: 'https://example.com/myaccount/',
  },
}

Or if you want to use the loader prop on the component, you can use custom:

module.exports = {
  images: {
    loader: 'custom',
  },
}

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mj
• https://github.com/vercel/next.js/releases/tag/v12.1.0
• https://nvd.nist.gov/vuln/detail/CVE-2022-23646
• https://github.com/vercel/next.js/pull/34075
• https://github.com/advisories/GHSA-fmvm-x8mv-47mj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Unexpected server crash in Next.js.

CVE-2021-43803 / GHSA-25mp-g6fv-mqxx

More information

Details

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package next hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx
• https://github.com/vercel/next.js/pull/32080
• https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264
• https://github.com/vercel/next.js/releases/v12.0.5
• https://nvd.nist.gov/vuln/detail/CVE-2021-43803
• https://github.com/vercel/next.js/releases/tag/v11.1.3
• https://github.com/advisories/GHSA-25mp-g6fv-mqxx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js missing cache-control header may lead to CDN caching empty reply

CVE-2023-46298 / GHSA-c59h-r6p8-q9wc

More information

Details

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

Severity

Low

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-46298
• https://github.com/vercel/next.js/issues/45301
• https://github.com/vercel/next.js/pull/54732
• https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13
• https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648
• https://github.com/advisories/GHSA-c59h-r6p8-q9wc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v13.5.11

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Lock swc binaries version

v13.5.10

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Match subrequest handling for edge and node

v13.5.9

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.
This release contains a security patch for CVE-2025-29927.

Core Changes

• [backport] middleware subrequest patch (#​77418)

v13.5.8

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Update React from d900fad to 1dba980: #​74202
• [i18n] Routing fix: #​70761

Credits

Huge thanks to @​wyattjoh and @​ztanner for helping!

v13.5.7

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Remove invalid fallback revalidate value (#​69990)
• Shared Revalidate Timings (#​64370)

Credits

Huge thanks to @​wyattjoh and @​ijjk for helping!

v13.5.6

Compare Source

Core Changes

• Upgrade edge-runtime/cookies #​57021
• Patch React with fix for write-after-close for ReadableStream #​57011

Credits

Huge thanks to @​ijjk @​huozhi @​gnoff for helping!

v13.5.5

Compare Source

Core Changes

• Update parallelizing tasks with webpackBuildWorker config: #​56287
• Misc Typescript and export updates: #​55841
• chore: pass defineEnv from next.js to rust directly: #​56216
• Expose util internally for debugging: #​56381
• App Router - preinitialize chunks during SSR: #​54752
• fix: use fs.existsSync to avoid race condition: #​56387
• Ensure loader generated export default has name: #​56388
• Move Edge SSR event waitUntil into the handler: #​56404
• fix: avoid unnecessary existSync call: #​56419
• fix: avoid creation of buffers for read ops: #​56421
• fix empty externals list, pnpm special case, and project path: #​56402
• chore: extract edge-app-route loader template: #​56424
• Separate RSC and SSR jsx-runtime modules: #​56438
• Async Batcher: #​56423
• Fix cli log next.js color: #​56448
• Turbopack: Implement Server Actions: #​53890
• Component Module Types: #​56454
• refactor: rewrite config schema in zod: #​56383
• Dev Service: #​56442
• feat(turbopack): port next.js template loading logic: #​56425
• Chunking Refactor Step 1: #​56467
• Use native node:fs in taskfile.js: #​56491
• Loose RSC import restrictions for 3rd party packages: #​56501
• turbopack: Chunking Refactor Step 2 : #​56504
• update turbopack, fix sass peer dependency: #​56508
• Remove ServerDirectiveTransformer: #​56496
• Improve failed to fetch RSC error: #​56517
• misc: fix wrong next start start duration: #​56512
• turbopack: Extract as_chunk into shared ChunkType trait: #​56506
• Flatten recursive wildcard exports in barrel optimization: #​56489
• Turbopack + app router: always use externals for predefined packages: #​56440
• fix: log error cause: #​56528
• Unsilence Taskr Webpack errors: #​56542
• refactor: cleanup app render: #​56538
• fix: don't add isolateModules to tsconfig when extending from tsconfig with verbatimModuleSyntax: #​54164
• enable verbatimModuleSyntax to make type imports/exports explicit: #​56551
• Ensure react-server-dom-turbopack-experimental uses the right package: #​56560
• Fix build restart log: #​56543
• feat(turbopack): add support for edge app pages: #​56426
• Improve error handling of Server Actions with skewed deployment: #​56618
• misc: split app-render into smaller functions: #​56611
• remove unnecessary structuredClone: #​56570
• Fix trace ignore handling: #​56674
• fix(next-core): allow sass loader for foreign codes: #​56679
• Fix SSG query with experimental-compile: #​56680
• Ensure rewrites are included in build manifest when using Turbopack: #​56692
• fix static worker restart behavior: #​56728
• Improve internal waitUntil utility: #​56720
• Fix reconnection loop when devserver is offline: #​56698
• Fix ensurePage for client-side navigation to / in Turbopack: #​56704
• ci: add job summary to the test suite runs: #​56742
• Prefer module over main on main fields for app router server compiler: #​56532
• Check origins of Server Action requests: #​56753
• OpenTelemetry: ignore bubble errors to avoid spamming traces: #​56625
• fix(turbopack): always alias server-only and client-only: #​56760
• Utilize Promise.withResolvers: #​56764
• Revert "Prefer module over main on main fields for app router server compiler": #​56766
• Revalidate Type: #​56763
• Revert static worker refactor: #​56767
• memoize useParams: #​56771
• Turbopack: Chunking Refactoring: #​56756
• Chunking Refactoring followup fixes: #​56789
• put app code into a separate layer: #​56800
• fix: add x-forwarded-* headers: #​56797
• fix(turbopack): middleware path and aliases: #​56804
• Implement preferredRegion array in Turbopack: #​56743
• Fix build traces case: #​56817
• Revert "Drop ipc server headers filters (#​56226)": #​56836
• Implement getOptimizedModuleAliases for Turbopack: #​56839
• chore: bump undici: #​56851
• bump: edge-runtime: #​56856
• feat(turbopack): support basic next/dynamic: #​56389
• Revert "feat(turbopack): support basic next/dynamic": #​56885

Documentation Changes

• add digest property to error prop: #​56339
• Updates MDX docs: #​56378
• Update redirect.mdx: #​56414
• docs: add missing word: #​56547
• docs: update code snippet for correct file name: #​56006
• corrected sentence: #​56595
• clarify client components render on server on full page load: #​55469
• docs(router): clarify dynamic route slug is about a file name, not "folder": #​56596
• Update 01-contribution-guide.mdx: Fix a typo: #​56665
• fix(docs): adjust api route documentation examples: #​56660
• Updates Large Page Data error message doc to use JSON.parse to make reading output easier: #​56713
• Docs: Add missing description field: #​56749
• Changes codeblock filename delimiter: #​56712
• Update supported-browsers.mdx: #​56815
• docs: fix cypress script typo in 10-testing.mdx: #​56765
• Fix typo: #​56863

Example Changes

• Maintenance: minor example dep bumps to fix moderate vulns: #​56375
• Update actions.ts: #​56579
• updated fauna fql v10: #​56185
• fix lint error from fauna example: #​56719
• chore(example): bump @radix-ui/react-icons: #​56452
• fix: http2 example issue: #​56768

Misc Changes

• Fix mjs import for Turbopack test: #​56354
• Add test case for the permalink option of useFormState: #​56329
• Fix code freeze disable handling: #​56340
• add cargo fmt to lint staged: #​56430
• fix: .../templates/*/app/layout.* import order: #​56380
• Update .node-version: #​56460
• Fix logging level in actions test: #​56473
• Remove app dir warning test: #​56350
• Use consistent name for App Router tests: #​56352
• Remove isTurbo check in custom-routes test: #​56360
• test: speed up isolated next instance test setup: #​56525
• Update rust-toolchain to nightly-2023-10-06: #​56541
• update test manifest: #​56522
• chore: bump pnpm to 8.9: #​56649
• fix: next dev with edge runtime on windows: #​56502
• invert test filtering logic to exclude known failing: #​56663
• (test only) Integration tests: remove flatMap polyfill: #​56546
• Use node:fs instead of fs-extra in .github/actions: #​56536
• Use unique names for separate test suites: #​56695
• misc: tweak stats github action: #​56694
• CI: add manual workflow for running e2e on prod: #​56738
• Improve chunk encoding test to check right path for Turbopack: #​56747
• change those->some for clarity: #​56688
• docs: fix typo in Update 02-get-static-paths.mdx: #​56757
• Break out E2E deploy test workflow to its own: #​56755
• Trigger canary release nightly: #​56758
• feat: add self-documenting .env.example file: #​56469
• update manifest: #​56737
• docs: fix several typos: #​56788
• Skip artifact download for test e2e deploy workflow: #​56807
• Add missing nanoid dependency to app-dir tests: #​56830
• Remove specific hash checks for metadata.test.ts: #​56843
• Fix CSP test when using Turbopack: #​56833
• Skip webpack specific tests in Turbopack test run: #​56877

Credits

Huge thanks to @​ijjk, @​timneutkens, @​shuding, @​wyattjoh, @​Syphini, @​manovotny, @​ForsakenHarmony, @​gnoff, @​anonrig, @​viktorronnback, @​Rylab, @​sokra, @​hamirmahal, @​huozhi, @​jridgewell, @​SukkaW, @​wbinnssmith, @​feedthejim, @​balazsorban44, @​jazsouf, @​2XG-DEV, @​stefanprobst, @​ztanner, @​mzab1985, @​Mustafadagkiranlar, @​JoRyGu, @​cmbritten, @​styfle, @​Krishnanand2517, @​bahag-buttf, @​kwonoj, @​Shadid12, @​delbaoliveira, @​mayankkamboj47, @​dvoytenko, @​mayank1513, @​himself65, @​suravshrestha, @​fvaysh, @​dianacpg, @​joristirado, and @​Kikobeats for helping!

v13.5.4

Compare Source

Core Changes

• chore: NextJS -> Next.js: #​55961
• fix-failed-to-generate-self-signed-certificate issue:#​55891: #​55947
• Remove .test.js from dist: #​55946
• Turbopack next/font/google: don't insert css rules for multiple weights or styles: #​55852
• Fix stale revalidate stream handling: #​55978
• turbopack: improve turbopack/test stability: #​56024
• Mark testmode fetches internal: #​56036
• chore: Remove 'beta.' Subdomain from beta.nextjs.org Links: #​55924
• Remove experimental.sharedPool: #​56021
• fix(worker): pass env to build worker w/ config.experimental.workerThreads: #​55257
• Update swc_core to v0.83.26: #​55780
• Revert "Update swc_core to v0.83.26": #​56077
• fix reporting of illegal segments when directory only contains irrelevant files: #​56076
• Make permanentRedirect return 308 in route handlers: #​56065
• Remove unneeded next-dev js in next-core: #​56039
• Fix: Use boolean instead of false for experimental logging config: #​56110
• chore: remove chalk in favor of picocolors: #​55992
• Revert: "Generate prefetch RSC payload during build for SSR paths (#​54403)": #​56059
• fetching logging on edge: #​56108
• Optimize build trace handling: #​56048
• Update font data: #​56121
• feat(turbopack): port bloom filter to nexturbo: #​55678
• Fixes performance problems due to TaskScopes: #​55721
• perf: remove react dom legacy from app router: #​56082
• perf: replace zod with superstruct: #​56083
• perf: externalise ws for bundled server: #​56095
• misc: refactor node utils: #​56096
• Add support for skipTrailingSlashRedirect and skipMiddlewareUrlNormalize in Turbopack: #​56147
• Add experimental.scrollRestoration for Turbopack: #​56150
• misc: refactor handleExternals: #​56161
• perf: add option to bundle pages externals: #​56162
• Allow jest to run with use server directive: #​56148
• Update experimental compile cache handling: #​56139
• App render related code clean up: #​56178
• Add support for i18n config in Turbopack: #​56182
• Implement list of config options for Turbopack: #​56188
• Turbopack: add support for an assetPrefix and basePath: #​56058
• update turbopack: #​56197
• Update supported options list to reflect #​56188: #​56200
• Add support for experimental.logging.level in Turbopack: #​56201
• Add next.config.js options to turbopack warning file: #​56207
• fix: @​libsql/client build error: #​56192
• chore: bump postcss: #​56225
• Add additional handling for experimental-compile: #​56224
• Drop ipc server headers filters: #​56226
• only override NODE_EXTRA_CA_CERTS when using experimental https flag: #​56252
• Pass same mangling option as terser to SWC minifier: #​56281
• update turbopack: #​56285
• clear require cache only when needed: #​56198
• misc: enable source maps for bundled runtime: #​56289
• misc: shortcut styled-jsx in external resolution: #​56291
• Support serverRuntimeConfig and publicRuntimeConfig in Turbopack: #​56310
• Reland static prefetches & fix prefetch bailout behavior: #​56228
• fix(#​53190): add missing crossOrigin to assetsPrefix resources: #​56311
• misc: fix instrumentation with bundled server: #​56318
• fix(next/client): keep hash when navigating from app to pages router: #​56223
• fix: support both decoded and encoded url requests of conventioned files : #​56187
• fix: Invalid URL (404) provided on server actions error: #​56323
• Revert "misc: shortcut styled-jsx in external resolution (#​56291)": #​56334
• Fix build output logging order: #​56335

Documentation Changes

• docs: add not-found to file conventions page: #​55944
• Update 03-linking-and-navigating.mdx: #​55907
• docs: Correct place for passing extension option to createMDX(): #​55967
• docs-55629 update router cache column in cache interactions api table: #​55630
• Update 03-linking-and-navigating.mdx: #​55969
• Updates "Prerender Error" page for App Router: #​56044
• Add the default import alias to create-next-app prompt for clarity: #​55896
• Update revalidatePath.mdx to fix confusing wording of arguments section.: #​56099
• docs: Renamed function that is used by other name: #​56170
• (docs) Document Server Actions .bind method: #​56164
• docs: Use Response.json over NextResponse.json: #​56173
• correcting link to useSearchParams ref: #​56169
• docs(sharp-missing-in-production.mdx): update standalone command: #​56191
• docs(sharp-missing-in-production.mdx): update standalone command: #​56239
• Update image.mdx: #​56269
• Update image.mdx: #​56266

Example Changes

• chore(examples): bump dependency versions: #​55899
• Update to with-supertokens example app: #​56035
• Update dependencies in examples : #​55993
• Chore/update with supabase demo deploy button: #​52483
• chore(examples): remove deprecated dependency from with-jest: #​56152
• chore(examples): fix with-jest types: #​56193
• (Examples) update Grafbase example: #​54705
• fix: typo in with-stripe-typescript example: #​56274

Misc Changes

• Skip production tests for Turbopack: #​56045
• Fix invalid build-and-test workflow: #​56053
• turbopack: Add more skipped tests: #​56052
• Skip next build test: #​56079
• add flakey test: #​56080
• Skip more production tests for turbopack: #​56084
• Ensure tests suites have unique names: #​56085
• Skip experimental.nextScriptWorkers test for Turbopack: #​56086
• Skip production tests for Turbopack: #​56089
• Skip Babel tests for Turbopack: #​56091
• misc: add node-version file: #​55938
• Ensure unique name for app dir css tests: #​56088
• Decrease default test timeouts: #​56116
• misc: stop hiding node_modules in vscode: #​56081
• special case timeout on windows: #​56120
• Turbopack: update test manifest: #​56133
• More test updates: #​56146
• fix(cna): pin dependency versions: #​56177
• Update swc_core to v0.83.28: #​56134
• Fix middleware-general test for Turbopack: #​56211
• More Turbopack test fixes: #​56248
• update test mainfest: #​56214
• More Turbopack fixes: #​56275
• More Turbopack fixes: #​56299
• misc: update code owners: #​56290
• Fix flaky test for size output: #​56303
• update webp crate: #​56307
• Remove buildId test as it's no longer relevant: #​56316
• Add code freeze GitHub actions for releasing: #​56325
• test: add flaky turbopack integration tests to manifest: #​56309

Credits

Huge thanks to @​balazsorban44, @​sdkdeepa, @​aayman997, @​mayank1513, @​timneutkens, @​2XG-DEV, @​eliot-akira, @​hi-matthew, @​riobits, @​wbinnssmith, @​ijjk, @​sokra, @​dvoytenko, @​rishabhpoddar, @​manovotny, @​A7med3bdulBaset, @​huozhi, @​jridgewell, @​joulev, @​SukkaW, @​kdy1, @​feedthejim, @​Fredkiss3, @​styfle, @​MildTomato, @​ForsakenHarmony, @​walfly, @​bzhn, @​shuding, @​boylett, @​Loki899899, @​devrsi0n, @​ImBIOS, @​vinaykulk621, @​ztanner, @​sdaigo, @​hamirmahal, @​blurrah, @​omarmciver, and @​alexBaizeau for helping!

v13.5.3

Compare Source

Core Changes

• only put css in entry_css_files: #​55585
• update taskfile to generate types during build: #​55628
• refactor: use fs.existsSync instead of accessSync: #​55675
• Capitalize compiling log: #​55685
• Split prerending by route kind: #​55622
• turbopack: Update the next/dist/esm rewrite ResolvePlugin: #​55689
• refactor: modernize get-online with dns/promises: #​55674
• ensure fetchServerResponse is a valid record when stored in router cache: #​55690
• fix(react-refresh-utils): avoid memory leaks caused by prevExports: #​53797
• fix(ts): allow auto-import of next/navigation: #​55743
• remove --watch from generate_types task: #​55748
• Remove the left padding in next info output: #​55704
• test(turbopack): remove escape hatches for custom turbopack bindings: #​55757
• fix: Invoke cancel, only if the stream is not closed: #​55684
• Revert "fix: Invoke cancel, only if the stream is not closed (#​55684)": #​55764
• fix thenable types & update another incorrect cache record: #​55758
• turbopack: Rewrite ESM modules to CJS during client transition: #​55693
• Fix output log extra new line: #​55770
• Remove unused internal env var: #​55762
• fix Image when used with --experimental-https: #​55775
• chore: update turbopack to turbopack-230922.2: #​55828
• Move DefineEnv to separate file: #​55811
• Remove legacy checks for unstable_getXProps: #​55813
• Remove next-typescript check in webpack config: #​55819
• Correctly mark turbo sessions in telemetry: #​55835
• feat(turbopack): construct output path with distDir next.js config: #​55613
• Remove extra type: #​55837
• Update rust toolchain to nightly-2023-09-21: #​55774
• Remove unused internal env var: #​55762
• fix Image when used with --experimental-https: #​55775
• chore: update turbopack to turbopack-230922.2: #​55828
• Move DefineEnv to separate file: #​55811
• Remove legacy checks for unstable_getXProps: #​55813
• Remove next-typescript check in webpack config: #​55819
• Correctly mark turbo sessions in telemetry: #​55835
• feat(turbopack): construct output path with distDir next.js config: #​55613
• Remove extra type: #​55837
• Update rust toolchain to nightly-2023-09-21: #​55774
• Ensure next-swc-loader types are used: #​55846
• Use swc for runtime bundling: #​55842
• fix bugs pertaining to server actions + navigation: #​55853
• Ensure opentelemetry mismatched version error bubbles: #​55868
• test: re-enabled the disabled manifest test: #​55810
• Remove unnecessary Object.assign: #​55882
• Move experimental.runtime warning to config loading: #​55880
• Add experimental.strictNextHead to Turbopack: #​55915
• Loose types of app routes return value: #​55849
• Add trailingSlash, basePath, and assetPrefix to Turbopack: #​55921
• app router: ensure static prefetch renders loading.js: #​55950

Documentation Changes

• add tip for case sensitivity of imports: #​55662
• Docs - Fix VSCode Full Stack Debugging Regex Pattern: #​55670
• Feedback: Remove line saying server actions is dynamic-only: #​55746
• Update 01-pages-and-layouts.mdx: #​55795
• fix typo in API Reference - Image Component: #​55776
• Update 01-pages-and-layouts.mdx: #​55795
• fix typo in API Reference - Image Component: #​55776
• docs: useFormState: #​55564
• Update 10-testing.mdx: #​55801
• Revert "fix typo in API Reference - Image Component": #​55889
• Fix missing async keyword in function declaration: #​55887
• docs: Add note that Server Actions work with static routes: #​55626
• docs: Add example on query parameters in route handlers: #​55789

Example Changes

• Fix/upgrade examples with clerk: #​55676
• Fix/upgrade examples data fetch: #​55695

Misc Changes

• Upgrade to latest NAPI-RS infra: #​55505
• ci(tests): enable turbopack /e2e tests: #​55681
• chore: bump nissuer: #​55723
• improve CI log: #​55736
• fix(cna): separate dependencies/devDependencies: #​55730
• misc: improve profiling script: #​55732
• test(fixture): prevent start failure teardowns whole process: #​55760
• Update fnm setup for CI: #​55765
• test(turbopack): explicitly clean up instance for turbopack: #​55772
• Update flakey next-image tests: #​55838
• Update flakey next-image tests: #​55838
• Allow filtering individual

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[squash-labs]

Manage this branch in Squash

Test this branch here: https://renovatenpm-next-vulnerability-ft0hf.squash.io