Update dependency next to v14.2.10 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
next (source)	^13.5.6 → ^14.0.0
next (source)	14.0.2 → 14.2.10
next (source)	13.5.4 → 14.2.10

---

Next.js Server-Side Request Forgery in Server Actions

CVE-2024-34351 / GHSA-fr5h-rqp8-mj6g

More information

Details

Impact

A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.

Prerequisites

• Next.js (<14.1.1) is running in a self-hosted* manner.
• The Next.js application makes use of Server Actions.
• The Server Action performs a redirect to a relative path which starts with a /.

* Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner.

Patches

This vulnerability was patched in #​62561 and fixed in Next.js 14.1.1.

Workarounds

There are no official workarounds for this vulnerability. We recommend upgrading to Next.js 14.1.1.

Credit

Vercel and the Next.js team thank Assetnote for responsibly disclosing this issue to us, and for working with us to verify the fix. Thanks to:

Adam Kues - Assetnote
Shubham Shah - Assetnote

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g
• https://github.com/vercel/next.js/pull/62561
• https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085
• https://nvd.nist.gov/vuln/detail/CVE-2024-34351
• https://github.com/advisories/GHSA-fr5h-rqp8-mj6g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Next.js Cache Poisoning

CVE-2024-46982 / GHSA-gp8f-8m3g-qvj9

More information

Details

Impact

By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well.

To be potentially affected all of the following must apply:

• Next.js between 13.5.1 and 14.2.9
• Using pages router
• Using non-dynamic server-side rendered routes e.g. pages/dashboard.tsx not pages/blog/[slug].tsx

The below configurations are unaffected:

• Deployments using only app router
• Deployments on Vercel are not affected

Patches

This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not.

Workarounds

There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

Credits

• Allam Rachid (zhero_)
• Henry Chen

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9
• https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3
• https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda
• https://nvd.nist.gov/vuln/detail/CVE-2024-46982
• https://github.com/advisories/GHSA-gp8f-8m3g-qvj9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

vercel/next.js (next)

v14.2.10

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Remove invalid fallback revalidate value (#​69990)
• Revert server action optimization (#​69925)
• Add ability to customize Cache-Control (#​69802)

Credits

Huge thanks to @​huozhi and @​ijjk for helping!

v14.2.9

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Revert "Fix esm property def in flight loader (#​66990)" (#​69749)
• Disable experimental.optimizeServer by default to fix failed server action (#​69788)
• Fix middleware fallback: false case (#​69799)
• Fix status code for /_not-found route (#​64058) (#​69808)
• Fix metadata prop merging (#​69807)
• create-next-app: fix font file corruption when using import alias (#​69806)

Credits

Huge thanks to @​huozhi, @​ztanner, @​ijjk, and @​lubieowoce for helping!

v14.2.8

Compare Source

What's Changed

[!NOTE]
This release is backporting bug fixes and minor improvements. It does not include all pending features/changes on canary.

Support esmExternals in app directory

• Support esm externals in app router (#​65041)
• Turbopack: Allow client components from foreign code in app routes (#​64751)
• Turbopack: add support for esm externals in app dir (#​64918)
• other related PRs: #​66990 #​66727 #​66286 #​65519

Reading cookies set in middleware in components and actions

• initialize ALS with cookies in middleware (#​65008)
• fix middleware cookie initialization (#​65820)
• ensure cookies set in middleware can be read in a server action (#​67924)
• fix: merged middleware cookies should preserve options (#​67956)

Metadata and icons

• support facebook-specific metadata (fb:app_id, fb:admins) in generateMetaData (#​65713)
• Always collect static icons for all segments (#​68712)
• Fix favicon merging with customized icons (#​67982)
• Warn metadataBase missing in standalone mode or non vercel deployment (#​66296)

Parallel routes fixes

• fix missing stylesheets when parallel routes are present (#​69507)

Draft mode and edge improvements

• fix: unstable_cache should not cache new result in draft mode (#​67772)
• Add draft mode flag for multi-zone (#​68997)
• Fix edge preview props are not matched with cookie (#​67779)
• other related PRs: #​65426, #​67787, #​64946, #​64313, #​64370

next/image fixes

• Allow external image urls with _next/image pathname to be rendered via Image component (#​69586)

Server actions improvements

• optimize server actions (#​66523)
• Apply optimization for unused actions (#​69178)
• Improve SWC transform ID generation (#​69183)

Other changes

• Ensure we match comment minify behavior between terser and swc (#​68372)
• send initialCanonicalUrl in array format to prevent crawler confusion (#​69509)

Create-next-app updates

• enable @​typescript-eslint/recommended in create-next-app --typescript (#​52845)
• Update create-next-app template CSS (#​66233)
• Update create-next-app template CSS (#​66043)
• Update create-next-app template (#​65803)
• add font antialiasing to templates (#​67425)
• Move create-next-app public/ assets from local folder→ remote URL (#​66931)
• Use classnames to set font family in Tailwind create-next-app templates (#​66374)
• other related PRs: #​64478, #​68899, #​68534, #​69021, #​67146, #​66145

Full Changelog: vercel/next.js@v14.2.7...v14.2.8

---

Huge thanks to everyone who contributed to this release:
@​abhi12299, @​delbaoliveira, @​eps1lon, @​ForsakenHarmony, @​huozhi, @​ijjk, @​JoshuaKGoldberg, @​leerob, @​lubieowoce, @​Netail, @​ronanru, @​samcx, @​shuding, @​sokra, @​stylessh, @​timfuhrmann, @​wbinnssmith, @​wyattjoh, @​ypessoa, @​ztanner

v14.2.7

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Revert "chore: externalize undici for bundling" (#​65727)
• Refactor internal routing headers to use request meta (#​66987)
• fix(next): add cross origin in react dom preload (#​67423)
• build: upgrade edge-runtime (#​67565)
• GTM dataLayer parameter should take an object, not an array of strings (#​66339)
• fix: properly patch lockfile against swc bindings (#​66515)
• Add deployment id header for rsc payload if present (#​67255)
• Update font data (#​68639)
• fix i18n data pathname resolving (#​68947)
• pages router: ensure x-middleware-cache is respected (#​67734)
• Fix bad modRequest in flight entry manifest #​68888
• Reject next image urls in image optimizer #​68628
• Fix hmr assetPrefix escaping and reuse logic from other files #​67983

Credits

Huge thanks to @​kjugi, @​huozhi, @​ztanner, @​SukkaW, @​marlier, @​Kikobeats, @​syi0808, @​ijjk, and @​samcx for helping!

v14.2.6

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Ensure fetch cache TTL is updated properly (#​69164)

v14.2.5

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• avoid merging global css in a way that leaks into other chunk groups (#​67373)
• Fix server action edge redirect with middleware rewrite (#​67148)
• fix(next): reject protocol-relative URLs in image optimization (#​65752)
• fix(next-swc): correct path interop to filepath for wasm (#​65633)
• Use addDependency to track metadata route file changes (#​66714)
• Fix noindex is missing on static not-found page (#​67135)
• perf: improve retrieving versionInfo on Turbo HMR (#​67309)
• fix(next/image): handle invalid url (#​67465)
• fix(next): initial prefetch cache not set properly with different search params (#​65977)
• fix: Backport class properties fix (#​67377)
• Upgrade acorn (#​67592)

Misc

• Log stdio for pull-turbo-cache script (#​66759)
• Ensure turbo is setup when building in docker (#​66804)

Credits

Huge thanks to @​devjiwonchoi, @​ijjk, @​emmerich, @​huozhi, @​kdy1, @​kwonoj, @​styfle, and @​sokra for helping!

v14.2.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• fix: ensure route handlers properly track dynamic access (#​66446)
• fix NextRequest proxy in edge runtime (#​66551)
• Fix next/dynamic with babel and src dir (#​65177)
• Use vercel deployment url for metadataBase fallbacks (#​65089)
• fix(next/image): detect react@​19 for fetchPriority prop (#​65235)
• Fix loading navigation with metadata and prefetch (#​66447)
• prevent duplicate RSC fetch when action redirects (#​66620)
• ensure router cache updates reference the latest cache values (#​66681)
• Prevent append of trailing slash in cases where path ends with a file extension (#​66636)
• Fix inconsistency with 404 getStaticProps cache-control (#​66674)
• Use addDependency to track metadata route file changes (#​66714)
• Add timeout/retry handling for fetch cache (#​66652)
• fix: app-router prefetch crash when an invalid URL is passed to Link (#​66755)

Credits

Huge thanks to @​ztanner, @​ijjk, @​wbinnssmith, @​huozhi, and @​lubieowoce for helping!

v14.2.3

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix: resolve mixed re-exports module as cjs (#​64681)
• fix: mixing namespace import and named import client components (#​64809)
• Fix mixed exports in server component with barrel optimization (#​64894)
• Fix next/image usage in mdx(#​64875)
• fix(fetch-cache): fix additional typo, add type & data validation (#​64799)
• prevent erroneous route interception during lazy fetch (#​64692)
• fix root page revalidation when redirecting in a server action (#​64730)
• fix: remove traceparent from cachekey should not remove traceparent from original object (#​64727)
• Clean-up fetch metrics tracking (#​64746)

Credits

Huge thanks to @​huozhi, @​samcx, @​ztanner, @​Jeffrey-Zutt, and @​ijjk for helping!

v14.2.2

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Fix Server Action error logs for unhandled POST requests (#​64315)
• Improve rendering performance (#​64408)
• Fix the method prop case in Server Actions transform (#​64398)
• fix(next-lint): update option --report-unused-disable-directives to --report-unused-disable-directives-severity (#​64405)
• tweak test for Azure (#​64424)
• router restore should take priority over pending actions (#​64449)
• Fix client boundary inheritance for barrel optimization (#​64467)
• improve turborepo caching (#​64493)
• feat: strip traceparent header from cachekey (#​64499)
• Fix more Turbopack build tests
• Update lockfile for compatibility with turbo (#​64360)
• Fix typo in dynamic-rendering.ts (#​64365)
• Fix DynamicServerError not being thrown in fetch (#​64511)
• fix(next): Metadata.openGraph values not resolving basic values when type is set (#​63620)
• disable production chunking in dev (#​64488)
• Fix cjs client components tree-shaking (#​64558)
• fix refresh behavior for discarded actions (#​64532)
• fix: filter out middleware requests in logging (#​64549)
• Turbopack: Allow client components to be imported in app routes (#​64520)
• Fix ASL bundling for dynamic css (#​64451)
• add pathname normalizer for actions (#​64592)
• fix incorrect refresh request when basePath is set (#​64589)
• test: skip turbopack build test (#​64356)
• hotfix(turbopack): Update with patch for postcss.config.js path resolution on Windows (#​64677)

Credits

Huge thanks to @​shuding, @​coltonehrman, @​ztanner, @​huozhi, @​sokra, @​Jeffrey-Zutt, @​timneutkens, @​wbinnssmith, @​wiesson, @​ijjk, @​devjiwonchoi, and @​bgw for helping!

v14.2.1

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• use pathToFileUrl to make esm import()s work with absolute windows paths (#​64386) @​sokra

Credits

Huge thanks to @​sokra for helping!

v14.2.0

Compare Source

Learn more: https://nextjs.org/blog/next-14-2

Core Changes

• Update build worker warning to use debug: #​60847
• fix: added @​sentry/profiling-node to sep list to prevent build/bundle breakage: #​60855
• Optimize build trace ignores: #​60859
• Deprecation warning for config.analyticsId: #​60677
• chore: indicate staleness more prominently in next info output: #​60376
• Telemetry: createComponentTree span: #​60857
• chore: replace micromatch w/ picomatch: #​60699
• Report HMR latency as trace spans for Turbopack: #​60799
• Turbopack: always log HMR rebuild times: #​60908
• Error overlay refactors: #​60886
• Use precompiled source-map in overlay middleware: #​60932
• Use more precompiled deps in react-dev-overlay: #​60959
• Fix next phase for next build: #​60969
• chore: update turbopack: #​60980
• refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc: #​59300
• disable static generation on interception routes: #​61004
• Docs: Address community feedback: #​60960
• avoid output of webpack stats: #​61023
• Revert "refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc": #​61021
• fix useSelectedLayoutSegment's support for parallel routes: #​60912
• Dynamic APIs: #​60645
• Enable next.js version checker in turbopack: #​61034
• chore: Update terser to v5.27.0: #​61068
• Update swc_core to v0.87.28: #​60876
• update turbopack: #​61015
• Implement client_root for edge in Turbopack: #​61024
• fix parallel route top-level catch-all normalization logic to support nested explicit (non-catchall) slot routes: #​60776
• fix(image): warn when animated image is missing unoptimized prop: #​61045
• Fix version checker not displaying when version newer than npm: #​61075
• Fix sitemap generateSitemaps support for string id: #​61088
• ppr: ensure the router state tree is provided for interception routes: #​61059
• Improve the Server Actions SWC transform: #​61001
• Fix instrument bundling as client components: #​60984
• fix(turbopack): use correct layout for 404 page: #​61032
• fix: emotion import source should be enabled in SSR contexts: #​61099
• chore: update turbopack: #​61090
• fix(turbopack): custom page extensions for _app: #​60789
• Disable trace uploads with NEXT_TRACE_UPLOAD_DISABLE: #​61101
• add optimizeServerReact to config-shared: #​61106
• Fix filesystempublicroutes test for Turbopack: #​61132
• chore: upgrade webpack to 5.90.0: #​61109
• Add maxDuration to typescript plugin allowed exports: #​59193
• Upgrade Turbopack: #​61190
• build: remove sentry from the externals list: #​61194
• exclude default routes from isPageStatic check: #​61173
• Add stack trace to client rendering bailout error: #​61200
• chore: refactor image optimization to separate external/internal urls: #​61172
• parallel routes: support multi-slot layouts: #​61115
• Refine revalidatePath warning message: #​61220
• revert changes to process default routes at build: #​61241
• Fix cookie merging in Server Action redirections: #​61113
• Update swc_core to v0.89.x: #​61086
• Fix Server Reference being double registered: #​61244
• Fix Server Action redirection with absolute internal URL: #​60798
• Fix indentation in source code of dev overlay: #​61216
• Update swc_core to v0.89.4: #​61285
• fix: Revert preset-env mode of styled-jsx in webpack mode: #​61306
• DX: add route context to the dynamic errors: #​61332
• Telemetry: add time-to-first-byte signal: #​61238
• Refine logging message of experiments: #​61337
• fix(turbopack): don't parse .ts files as .tsx: #​61219
• Update turbopack: #​61381
• Same as #​61360: #​61369
• Always respect NEXT_TRACE_UPLOAD_DISABLED: #​61402
• parallel routes: fix catch-all slots being treated as optional catch-all: #​61174
• fix hmr telemetry reporting: #​61420
• chore: Update swc_core to v0.89.6: #​61426
• Update turbopack: #​61433
• fix a perf problem in VersionedContentMap: #​61442
• Fix next dynamic import named export from client components: #​61378
• fix issues loading CSS in default slots: #​61428
• avoid sending issues turbopack messages to browser: #​61443
• Support crossOrigin in Turbopack: #​61461
• Pass down __NEXT_EXPERIMENTAL_REACT env to webpack build worker explicitly: #​61463
• Replace image optimizer IPC call with request handler: #​61471
• feat(next): trace build dependencies for turborepo: #​59553
• Turbopack: fix telemetry attributes for swc options: #​61474
• Always show version text in error overlay: #​61421
• Fix build worker callback arg missing correct page path : #​61347
• Update font data: #​61479
• build: upgrade edge-runtime: #​61030
• Fix experimental react support in app-route runtime: #​61511
• Fix .env hmr for Node.js runtime in Turbopack: #​61504
• remove unnecessary PPR branch in non-PPR reducer: #​61176
• fix: bump @vercel/nft@0.26.3: #​61538
• chore: update ESLint and plugins to latest: #​61544
• Update turbopack: #​61553
• feat: first pass of next/font manifest: #​61424
• Fix .env HMR for Turbopack in Edge runtime: #​61565
• build(cargo): bump up turbopack: #​61590
• refactor(next-core): consolidate custom ecma transform rules: #​61481
• ensure server action errors notify rejection handlers: #​61588
• feat(turbopack): only preload fonts that opt in: #​61591
• feat(turbopack): serve google fonts locally and allow preloading them: #​61596
• Update font data: #​61621
• Remove unused mockedRes in resolveRoutes: #​61635
• Fix @​react-pdf/renderer not working in RSC: #​61317
• Remove extra edge-runtime/primitives override: #​61641
• Encode revalidateTag value fixes #​61390: #​61392
• Update README.md: #​48717
• chore: update README.md: #​61650
• avoid processing client components and server actions in route handlers: #​60985
• chore: Update @swc/helpers to v0.5.5: #​61659
• feat(ts): expose MiddlewareConfig interface: #​61576
• Revert "build: upgrade edge-runtime": #​61686
• feat(ts): add JSDoc comments for public APIs: #​61649
• fix(next-core): adjust server alias for the context: #​61690
• fix setAssetPrefix when running on NextCustomServer: #​61676
• fix: status code for 404 props queries to avoid client side navigation with empty props: #​60968
• fix(next-eslint): .eslintrc.json not being created by next lint on App Router: #​55104
• Update React from 60a927d to 2bc7d33: #​61522
• fix(turbopack): read preload option for google fonts: #​61679
• decode magic identifiers: #​61658
• Associate server error digest with browser logged one: #​61592
• chore: update turbopack: #​61682
• fix loading issue when navigating to page with async metadata: #​61687
• fix(ts): ReadonlyURLSearchParams should extend URLSearchParams: #​61419
• fix navigation issue when dynamic param casing changes: #​61726
• Fix next/server api alias for ESM pkg: #​61721
• feat(transforms): enable rsc transforms for the remaining contexts: #​61231
• fix: allow some recursion for middleware subrequests: #​60615
• feat(next-swc): support wasm32-* build target: #​61586
• Turbopack: convert between locations correctly: #​61477
• feat(next/image)!: remove squoosh in favor of sharp as optional dep: #​61696
• Navigation Signals in PPR: #​60450
• Revert "Turbopack: convert between locations correctly (#​61477)": #​61733
• Fix duplicate line in README: #​61691
• docs: fix example code missing comma: #​59012
• Reapply "Turbopack: convert between locations correctly (#​61477)" (#​61733): #​61735
• Fix: Error Fetching _devpagesmanifest.json #​17274: #​60349
• fix jsDoc of notFound: #​61692
• feat(next-core): expand matching js extensions for the rules: #​61745
• source map fixes: #​61723
• Add experimental touchstart flag for testing: #​61747
• partially fix css duplication in app dir: #​61198
• build(cargo): add deps for the wasi: #​61784
• fix(ts): match MiddlewareConfig with documentation: #​61718
• Fix attempted import error for react: #​61791
• consolidate prefetch utils & separate build util: #​61789
• Skip client-side data-fetching after ssr error : #​51377
• fix(next-swc): Detect exports.foo from cjs_finder: #​61795
• feat(next-core): build time client|server-only assertion: #​61732
• Fall back loading chunks for sourcemap tracing: #​61790
• Increase Rust stack size: #​61809
• Revert "feat(next/image)!: remove squoosh in favor of sharp as optional dep": #​61810
• DX: fix error overlay flash: #​61813
• feat: Allow specifying useLightningcss for styled-jsx: #​61359
• Guard against restoring router state with missing data: #​61822
• fix: babel usage with next/image: #​61835
• fix:(next/image) handle remotePatterns with a dot in the pathname: #​60488
• Update React from 2bc7d33 to ba5e6a8: #​61837
• DX: fix error overlay flash: #​61813
• feat: Allow specifying useLightningcss for styled-jsx: #​61359
• Guard against restoring router state with missing data: #​61822
• fix: babel usage with next/image: #​61835
• fix:(next/image) handle remotePatterns with a dot in the pathname: #​60488
• Update React from 2bc7d33 to ba5e6a8: #​61837
• update turbopack: #​61187
• conditionally send Next-URL in Vary response: #​61794
• provide interception rewrites to edge runtime: #​61414
• Update app-index to only ever construct the initial data response once: #​61869
• Move turbopack helpers: #​61917
• hot-reloader-turbopack refactors: #​61929
• More hot-reloader-turbopack refactors: #​61940
• fix(next/image): improve warning when fill and sizes="100vw": #​61949
• build(cargo): bump up turbopack to latest: #​61952
• build(cargo): update turbopack for filewatcher fix: #​61955
• ci(workflow): deploy rustdocs for turbopack: #​61958
• Support resuming a complete HTML prerender that has dynamic flight data: #​60865
• Fix empty white page with parallel routes + loading boundaries: #​61597
• Update swc_core to v0.90.7 and update turbopack: #​61662
• Turbopack: remove server addr: #​61932
• More hot-reloader-turbopack refactors: #​61993
• Use destructured object for #​61993: #​61996
• only prefix prefetch cache entries if they vary based on Next-URL: #​61235
• seed prefetch cache with initial page: #​61535
• Remove leftover server addr references: #​61997
• log fast refresh in app dir: #​61441
• docs(turbopack): build more docs: #​61977
• fix(next-core): correct error message: #​62011
• docs(turbopack): reduce documentation size: #​62016
• Reduce memory/cache overhead from over loader processing: #​62005
• fix: bump @vercel/nft@0.26.4: #​62019
• refactor(next-core): do not reexport turbopack_binding: #​62018
• build: Update swc_core to v0.90.8: #​61976
• merge pages and app overlays: #​60899
• Rename internal utility naming for clarification : #​62048
• fix: handle multiple x-forwarded-proto headers: #​58824
• Fix server components externals on SSR layer: #​61986
• Fixed useParams hook undesired re-renders and updated it to use PathParamsContext in the app router.: #​60708
• docs(turbopack): conslidate existing links: #​62034
• fix(custom-transform): allow to assert empty program for rsc: #​61922
• fix navigation applying stale data when triggered from global not found: #​62033
• fix(turbopack): react-dom/server in rsc context: #​61165
• refactor(tests): make chain more "correct": #​51728
• Add puppeteer-core to server-external-packages.json: #​62063
• Fix extra swc optimizer applied to node_modules in browser layer: #​62051
• docs(turbopack): revise links: #​62062
• Fix output: export with custom distDir: #​62064
• fix(next-core): apply image-loader alias to the remaining context: #​62070
• More hot-reloader-turbopack refactors: #​62055
• Ensure Turbopack writes font optimization manifest: #​62079
• update turbopack: #​62080
• chore: hide version info network error: #​62084
• Add dev option to Turbopack createProject(): #​62083
• Remove unused app-turbopack files: #​62087
• make router restore action resilient to a missing tree: #​62098
• Turbopack: add support for dynamic requests in require() and import(): #​62092
• docs(turbopack): move docs to separate: #​62069
• Implement Vc: #​62099
• fix: add zeromq to server-external-packages.json: #​62105
• Fix trailing slash for canonical url: #​62109
• Consolidate NextMode checks: #​62106
• Improve the Server Actions SWC transform (part 2): #​62052
• Should not warn metadataBase missing if only absolute urls are present: #​61898
• Update to turbopack-240215.5: [#​621

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}