Next.js: Security Patch Wave and Windows Path Fixes
A batch of six security advisories landed together covering fetch caching, image detection, server actions, and proxy handling, while a separate deep-dive into Windows path canonicalization in Turbopack fixed a cluster of subtle CI and filesystem bugs. Cached components in dev also got attention, with new failing tests exposing stale data served to clients that skip the HMR refresh cookie.
Duration: PT2M44S
Episode overview
This episode is a short developer briefing from Next.js.
It explains recent repository work in plain language.
- Show: Next.js
- Published: 2026-07-22T13:13:03Z
- Audio duration: PT2M44S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's July 22nd, and today's codebase activity is dominated by security hardening and a deep infrastructure fix in Turbopack.
Start with security: six separate advisories were patched in quick succession, all authored by eps1lon. That includes a byte-exact fetch cache key fix for binary bodies in PR 96008, a performance and correctness fix for image content-type detection in PR 96006, validation of server reference IDs during manifest…
Second theme: Windows correctness in Turbopack. Bgw's PR 95668 traced a nasty bug back to inconsistent path canonicalization in the disk filesystem layer — it turned out CI was only working by coincidence, because pnpm wasn't canonicalizing junction points either. Once workspace files were added for PR 95628's…
Third: cached components in dev. Unstubbable opened PR 96022 and 96021 to fix stale `use cache` entries served to clients that don't carry the HMR refresh cookie — think curl, plain fetch calls, or a second device. Related to this, gaearon's PR 95945 and 96037 tightened up source-map coverage for React's fake stack…
Also notable: sampoder reverted PR 95539's soft-navigation SSR change in PR 96028 after it broke cached components in…
W…
Nearby episodes from Next.js
- Caching Gets Honest About What's Stale
- Taming Instant Validation, and Turbopack's Tree-Shaking Push
- Chasing Down Dev Server Memory and Source Map Costs
- Weekly Recap - Navigation Stability & Turbopack Runtime Slimming
- Trimming Waste in Rendering and Requests
- Turbopack Performance Push and Navigation Reliability Fixes
- Navigation Internals Under Pressure
- Turbopack Runtime Overhaul and TypeScript 7 Crash Fixes