[pull] main from tinacms:main by pull[bot] · Pull Request #310 · code/app-tinacms

pull · 2026-08-20T06:35:08Z

See Commits and Changes for more details.

Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

…update (#7324) Bumps the npm_and_yarn group with 1 update in the /examples/next/kitchen-sink directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /examples/next/tina-self-hosted-demo directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/@tinacms/auth directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/next-tinacms-azure directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/next-tinacms-cloudinary directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/next-tinacms-dos directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/next-tinacms-s3 directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /packages/tinacms directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /playwright/tina-playwright directory: [next](https://github.com/vercel/next.js). Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 15.5.12 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 14.2.35 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 14.2.35 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 14.2.35 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 14.2.35 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v15.5.21</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v15.5.20</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 15.5.15.</p> <h2>15.5.19</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>[15.5.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94244">#94244</a>)</li> </ul> <h3>Other</h3> <ul> <li>[15.5.x] Fix CI (<a href="https://redirect.github.com/vercel/next.js/issues/94281">#94281</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a> for helping!</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vercel/next.js/commit/e26f6ffaa710fc62ca0c8640db0e43b6663edf32"><code>e26f6ff</code></a> v15.5.21</li> <li><a href="https://github.com/vercel/next.js/commit/7f5deeb6c594b7515edecb879b0547beba1b8a82"><code>7f5deeb</code></a> [15.x] Improve performance of checking valid MPA form submissions</li> <li><a href="https://github.com/vercel/next.js/commit/57c31f724d746e86a9e8b92aa8be538a922446a4"><code>57c31f7</code></a> [15.x] Enforce <code>serverActions.bodySizeLimit</code> for Server Actions in Edge runtime</li> <li><a href="https://github.com/vercel/next.js/commit/e3e5666ccead3a15162793d697af5e48b7cc0498"><code>e3e5666</code></a> [15.x] Set correct origin for internal redirects in custom server</li> <li><a href="https://github.com/vercel/next.js/commit/35f501357e9b0fe7c950b0d6aa8fcf5343f707e9"><code>35f5013</code></a> [15.x] Ensure exotic rewrite param values are properly encoded</li> <li><a href="https://github.com/vercel/next.js/commit/062f66700b52a5d6bba2c0605d55577ab7ad262c"><code>062f667</code></a> [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request</li> <li><a href="https://github.com/vercel/next.js/commit/577c9dc0a08ac806e35f591fec528d5fb7407ad4"><code>577c9dc</code></a> [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies</li> <li><a href="https://github.com/vercel/next.js/commit/530d4fa31e010a05f28ea6e26a5f51f80f61e0c6"><code>530d4fa</code></a> [15.x] fix(next/image): improve performance of detectContentType()</li> <li><a href="https://github.com/vercel/next.js/commit/8fabaf3225be100d62dfb0f44d85ab43c2a14a20"><code>8fabaf3</code></a> [15.x] Performance improvements when decoding React Server function payloads</li> <li><a href="https://github.com/vercel/next.js/commit/ff12a6124e1504f17b62de948b8a553fdecaef7b"><code>ff12a61</code></a> [15.x] Validate server reference IDs during manifest lookup</li> <li>Additional commits viewable in <a href="https://github.com/vercel/next.js/compare/v15.5.12...v15.5.21">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for next since your current version.</p> </details> <br /> Updates `next` from 14.2.35 to 15.5.21 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</…

Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.6 to 7.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/withastro/astro/releases">astro's releases</a>.</em></p> <blockquote> <h2>astro@7.1.1</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/withastro/astro/pull/17399">#17399</a> <a href="https://github.com/withastro/astro/commit/4b0370262ce94a1f426944e659ef7a9c8773f451"><code>4b03702</code></a> Thanks <a href="https://github.com/matthewp"><code>@matthewp</code></a>! - Fixes encoded request paths being routed incorrectly when using domain-based i18n</li> </ul> <h2>astro@7.1.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17302">#17302</a> <a href="https://github.com/withastro/astro/commit/5f4dc0356f2c2ecf98fa88a257908c9226fac9f1"><code>5f4dc03</code></a> Thanks <a href="https://github.com/astrobot-houston"><code>@astrobot-houston</code></a>! - Adds a new <code>deferRender</code> option to the <code>glob()</code> content loader</p> <p>When set to <code>true</code>, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that <code>.mdx</code> files already use.</p> <p>This reduces memory usage during <code>astro build</code> for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like <code>rehype-katex</code>. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.</p> <pre lang="js"><code>// src/content.config.ts import { defineCollection } from 'astro:content'; import { glob } from 'astro/loaders'; <p>const docs = defineCollection({ loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }), }); </code></pre></p> <p>By default <code>deferRender</code> is <code>false</code>, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17296">#17296</a> <a href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a> Thanks <a href="https://github.com/ematipico"><code>@ematipico</code></a>! - Adds a new experimental <code>collectionStorage</code> option for controlling how the content layer persists its data store</p> <p>By default, Astro serializes the entire content layer data store to a single file (<code>.astro/data-store.json</code>). For very large content collections, this file can grow large enough to hit platform file-size limits.</p> <p>Set <code>experimental.collectionStorage: 'chunked'</code> to instead split the data store across many smaller, content-addressed files inside a <code>.astro/data-store/</code> directory, described by a manifest:</p> <pre lang="js"><code>// astro.config.mjs import { defineConfig } from 'astro/config'; <p>export default defineConfig({ experimental: { collectionStorage: 'chunked', }, }); </code></pre></p> <p>Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is <code>'single-file'</code>, which preserves the current behavior.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17214">#17214</a> <a href="https://github.com/withastro/astro/commit/44c4989139e84951c6579db9975a659765cf2b6c"><code>44c4989</code></a> Thanks <a href="https://github.com/ematipico"><code>@ematipico</code></a>! - Adds support for the more specific CSP directives <code>script-src-elem</code>, <code>script-src-attr</code>, <code>style-src-elem</code>, and <code>style-src-attr</code> through a new <code>kind</code> option.</p> <p>Previously, <a href="https://docs.astro.build/en/reference/configuration-reference/#securitycsp"><code>CSP</code></a> was only scoped to generic <code>script-src</code>/<code>style-src</code> directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline <code>style</code> attributes (such as those from <code>define:vars</code> or Shiki) without loosening the policy for your <code><style></code> and <code><link></code> elements.</p> <h4>Scoping sources and hashes in your config</h4> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md">astro's changelog</a>.</em></p> <blockquote> <h2>7.1.1</h2> <h3>Patch Changes</h3> <ul> <li><a href="https://redirect.github.com/withastro/astro/pull/17399">#17399</a> <a href="https://github.com/withastro/astro/commit/4b0370262ce94a1f426944e659ef7a9c8773f451"><code>4b03702</code></a> Thanks <a href="https://github.com/matthewp"><code>@matthewp</code></a>! - Fixes encoded request paths being routed incorrectly when using domain-based i18n</li> </ul> <h2>7.1.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17302">#17302</a> <a href="https://github.com/withastro/astro/commit/5f4dc0356f2c2ecf98fa88a257908c9226fac9f1"><code>5f4dc03</code></a> Thanks <a href="https://github.com/astrobot-houston"><code>@astrobot-houston</code></a>! - Adds a new <code>deferRender</code> option to the <code>glob()</code> content loader</p> <p>When set to <code>true</code>, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that <code>.mdx</code> files already use.</p> <p>This reduces memory usage during <code>astro build</code> for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like <code>rehype-katex</code>. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.</p> <pre lang="js"><code>// src/content.config.ts import { defineCollection } from 'astro:content'; import { glob } from 'astro/loaders'; <p>const docs = defineCollection({ loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }), }); </code></pre></p> <p>By default <code>deferRender</code> is <code>false</code>, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17296">#17296</a> <a href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a> Thanks <a href="https://github.com/ematipico"><code>@ematipico</code></a>! - Adds a new experimental <code>collectionStorage</code> option for controlling how the content layer persists its data store</p> <p>By default, Astro serializes the entire content layer data store to a single file (<code>.astro/data-store.json</code>). For very large content collections, this file can grow large enough to hit platform file-size limits.</p> <p>Set <code>experimental.collectionStorage: 'chunked'</code> to instead split the data store across many smaller, content-addressed files inside a <code>.astro/data-store/</code> directory, described by a manifest:</p> <pre lang="js"><code>// astro.config.mjs import { defineConfig } from 'astro/config'; <p>export default defineConfig({ experimental: { collectionStorage: 'chunked', }, }); </code></pre></p> <p>Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is <code>'single-file'</code>, which preserves the current behavior.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17214">#17214</a> <a href="https://github.com/withastro/astro/commit/44c4989139e84951c6579db9975a659765cf2b6c"><code>44c4989</code></a> Thanks <a href="https://github.com/ematipico"><code>@ematipico</code></a>! - Adds support for the more specific CSP directives <code>script-src-elem</code>, <code>script-src-attr</code>, <code>style-src-elem</code>, and <code>style-src-attr</code> through a new <code>kind</code> option.</p> <p>Previously, <a href="https://docs.astro.build/en/reference/configuration-reference/#securitycsp"><code>CSP</code></a> was only scoped to generic <code>script-src</code>/<code>style-src</code> directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline <code>style</code> attributes (such as those from <code>define:vars</code> or Shiki) without loosening the policy for your <code><style></code> and <code><link></code> elements.</p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/withastro/astro/commit/91c645acdedf066ccd2b4257c92b33c49dbb7729"><code>91c645a</code></a> [ci] release (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17403">#17403</a>)</li> <li><a href="https://github.com/withastro/astro/commit/4b0370262ce94a1f426944e659ef7a9c8773f451"><code>4b03702</code></a> Normalize domain-based i18n request paths consistently (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17399">#17399</a>)</li> <li><a href="https://github.com/withastro/astro/commit/fdd673cc193734d7818fe5ace39c86b9500b2754"><code>fdd673c</code></a> [ci] release (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17387">#17387</a>)</li> <li><a href="https://github.com/withastro/astro/commit/d9f99e19e4045da75c7f38650a0f2eeb5c79892b"><code>d9f99e1</code></a> Preserve CSP resource defaults for element directives (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17394">#17394</a>)</li> <li><a href="https://github.com/withastro/astro/commit/092da560eea77ee63a3e2c583c80d8238544e42b"><code>092da56</code></a> Add more escaping for rendered content (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17393">#17393</a>)</li> <li><a href="https://github.com/withastro/astro/commit/186a1e74c2eb342ea35a73fc2c0b1930b3c08921"><code>186a1e7</code></a> fix(logger): allows setting in updateConfig() (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17391">#17391</a>)</li> <li><a href="https://github.com/withastro/astro/commit/4407483e6f9e159164fec83c36d66259baa87e1f"><code>4407483</code></a> fix(logger): use <code>console</code> API in JSON logger for cross-runtime compatibility...</li> <li><a href="https://github.com/withastro/astro/commit/16de02130575c61eb294b382e09bc863cf935ec3"><code>16de021</code></a> feat(logger): allow passing entrypoint as URL (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17389">#17389</a>)</li> <li><a href="https://github.com/withastro/astro/commit/ed71eaf2b5eaa837de438eb252e8651a2aa086f6"><code>ed71eaf</code></a> fix(logger): make AstroLoggerDestination not generic (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17390">#17390</a>)</li> <li><a href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a> feat: chunk data store (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17296">#17296</a>)</li> <li>Additional commits viewable in <a href="https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com> Co-authored-by: kulesy <kulewidak@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

`@tinacms/mdx` bundles the acorn parser three times. This collapses it to one, with no source change to the package and no change to emitted output. ### The two causes 1. **`pnpm-workspace.yaml` pinned `acorn: 8.8.2`** while `micromark-extension-mdxjs` pulls `^8.0.0`, resolving to 8.16.0 — two 8.x copies side by side. Aligned to `^8.16.0` (a caret, not an exact pin: `micromark-extension-mdxjs` declares a range, so an exact pin would re-split the moment a lockfile refresh moved it to 8.17.0). 2. **`acorn-jsx` reaches acorn via `require`**, which acorn's export map answers with the CJS build while every other importer gets ESM — so esbuild bundled `acorn.js` *and* `acorn.mjs`. The `@tinacms/mdx` esbuild config now aliases `acorn` to the ESM entry acorn itself declares in its `module` field. ### Measured | Entry | raw before | raw after | Δ | gzip before | gzip after | Δ | |---|---:|---:|---:|---:|---:|---:| | `index.browser.js` | 1,976,421 | 1,578,764 | **−397,657 (−20.1%)** | 440,787 | 356,471 | **−84,316 (−19.1%)** | | `index.js` | 2,013,419 | 1,615,828 | −397,591 (−19.7%) | 452,063 | 367,630 | −84,433 (−18.7%) | Acorn versions in the browser bundle: `8.8.2` + `8.16.0` before, `8.16.0` alone after. ### Output is unchanged All 64 `src/next/tests/*` fixtures round-tripped through `parseMDX` → `serializeMDX` from the old and new bundles produce **one identical SHA-256**, across both the node and browser entries. That check was mutation-proved. The first mutant survived — acorn's module-level `parseExpressionAt` wrapper is never called, because `micromark-extension-mdxjs` passes `Parser.extend(acornJsx())` and reaches the **static** method (39 calls, measured). Unreachable by construction, not a hole. Mutating the entry that *is* called flipped the digest and changed 12 of 64 fixtures. **What it does not cover:** only markdown/MDX fixtures in this repo — no `parser.type: 'slatejson'`, no consumer-side integration, and the browser bundle ran under node+jsdom rather than a real browser engine. ### Verification `pnpm types` forced cold: 46/46. `pnpm test`: 60/60. `pnpm lint` and `pnpm format` clean. Lockfile diff is 13 lines across 4 hunks — the catalog entry, the mdx importer, and `acorn@8.8.2` dropped from both sections. No other published package changes size: `@tinacms/graphql` and `packages/tinacms` externalise `@tinacms/mdx`, and `@tinacms/app` has no build step. `packages/v4/**` are all `private: true`. ### Left alone A **fourth** acorn (~138 KB) is vendored inside prettier's own pre-bundled dist. esbuild cannot dedupe it — it is baked into prettier's published bundle. It goes away with the prettier replacement stacked on top of this PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Closes #7239 · Part of #7237 (Phase 0 — baselines land before any risky work) The repo's first Playwright suite that runs against a **production** `tinacms build` output — every existing suite boots `tinacms dev`, which is structurally blind to bugs that only exist in production bundles. This baselines today's vite-built admin; #7243 will rerun the identical suite with the prebuilt flag on. ## The hostile fixture (`playwright/prebuilt-admin/`) All seven ingredients from the issue, each guarding a named failure class: - custom field component colocated with the schema - a component importing `next/image` (CJS dep → CJS `require('react')` against the bundle's React) - `aspect-w-9` (class the admin never uses) + `bg-blue-500` (must resolve to Tina's themed `rgb(0,132,255)`) - real `media.loadCustomStore` behind a dynamic `import()` - `UsernamePasswordAuthJSProvider` from `tinacms-authjs/dist/tinacms` (drags CJS `next-auth/react`); runtime-selected against `LocalAuthProvider` so both stay in the bundle while specs choose which is active - `cmsCallback` registering a `createScreen` screen (react-router path) - `build.basePath: 'my-site'` ## Specs (8 files, 12 tests) `boot` (collection list; exactly one React renderer via an injected devtools-hook stub — production React has no hook; zero console errors), `custom-field` (save round-trips to disk), `screen` (navigates to the registered screen **through the admin's own sidebar nav**, so `useNavigate`/`NavLink` actually execute rather than a URL deep-link), `tailwind` (computed styles for both probe classes), `basepath` (**with and without** trailing slash), `media`, `auth`, plus a setup **meta-assertion** that greps the built chunks for `next/image`/custom-store/`next-auth`/screen markers — so the fixture can never go tame silently. `webServer` recipe: `tinacms build --local` emits the production SPA into `public/admin` and keeps the local GraphQL/media server on :4001; a zero-dep static server (`serve-admin.mjs`) serves the built SPA under `/my-site/admin` (bare + trailing slash) on :3000. ## Notes for a reviewer **The renderer-count + console-error check runs on the edit form, not just the list.** That check is the suite's sharpest instrument, but `FixtureField` — the component importing `next/image` — only mounts on the edit form. Scoped to the collection list it would miss a render-time throw from the very ingredient it exists to catch. Factored into `trackConsoleErrors` / `assertHealthyRender` (`e2e/utils/admin-helpers.ts`) and called from every spec that reaches the form. **The mutating spec is isolated and resets per attempt.** `custom-field` writes to disk, so it owns `content/post/roundtrip.mdx`; the read-only specs use `hello.mdx`. Snapshot/restore is `beforeEach`/`afterEach`, not `beforeAll`/`afterAll` — with `retries: 2`, an attempt that saves successfully then times out on the disk read would otherwise leave the file mutated and make the retry fail deterministically, turning a transient flake into a guaranteed red. **`next` is pinned to 15.5.21.** 14.2.35 carries seven high-severity advisories and `dependency-review` reads the fixture's manifest like any other. `next/image` is still CJS and still does `require('react')` in 15, so the trap is intact; React stays on 18.3.1. ## Verified - **CI green**, `prebuilt-admin-e2e` included, on the current head - 12/12 green on repeated clean runs - Trap re-introduction: breaking bare-path serving turns `basepath.spec` red; removing the `next/image` import turns the meta-assertion red - Workflow path-filtered on `packages/@tinacms/{cli,app}/**`, `packages/tinacms/**`, `playwright/prebuilt-admin/**`; traces and the HTML report upload on failure ## Finding (feeds #7243) `tinacms build --local` does **not** bake the local apiUrl into the admin — `buildProductionSpa` always uses `codegen.productionUrl`, so with an empty clientId the SPA crashes on boot. The fixture works around it with `contentApiUrlOverride: 'http://localhost:4001/graphql'` (documented in its README). Worth an independent check on whether kitchen-sink local builds are similarly pointed at TinaCloud. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Bumps [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) from 6.30.3 to 7.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/blob/react-router-dom@7.0.0/packages/react-router-dom/CHANGELOG.md">react-router-dom's changelog</a>.</em></p> <blockquote> <h2>7.0.0</h2> <h3>Major Changes</h3> <ul> <li> <p>Remove the original <code>defer</code> implementation in favor of using raw promises via single fetch and <code>turbo-stream</code>. This removes these exports from React Router: (<a href="https://redirect.github.com/remix-run/react-router/pull/11744">#11744</a>)</p> <ul> <li><code>defer</code></li> <li><code>AbortedDeferredError</code></li> <li><code>type TypedDeferredData</code></li> <li><code>UNSAFE_DeferredData</code></li> <li><code>UNSAFE_DEFERRED_SYMBOL</code>,</li> </ul> </li> <li> <p>Use <code>createRemixRouter</code>/<code>RouterProvider</code> in <code>entry.client</code> instead of <code>RemixBrowser</code> (<a href="https://redirect.github.com/remix-run/react-router/pull/11469">#11469</a>)</p> </li> <li> <p>Remove single_fetch future flag. (<a href="https://redirect.github.com/remix-run/react-router/pull/11522">#11522</a>)</p> </li> <li> <p>Remove <code>future.v7_startTransition</code> flag (<a href="https://redirect.github.com/remix-run/react-router/pull/11696">#11696</a>)</p> </li> <li> <p>Remove <code>future.v7_normalizeFormMethod</code> future flag (<a href="https://redirect.github.com/remix-run/react-router/pull/11697">#11697</a>)</p> </li> <li> <p>Allow returning <code>undefined</code> from actions and loaders (<a href="https://redirect.github.com/remix-run/react-router/pull/11680">#11680</a>)</p> </li> <li> <p>update minimum node version to 18 (<a href="https://redirect.github.com/remix-run/react-router/pull/11690">#11690</a>)</p> </li> <li> <p>Remove <code>future.v7_prependBasename</code> from the ionternalized <code>@remix-run/router</code> package (<a href="https://redirect.github.com/remix-run/react-router/pull/11726">#11726</a>)</p> </li> <li> <p>Remove <code>future.v7_throwAbortReason</code> from internalized <code>@remix-run/router</code> package (<a href="https://redirect.github.com/remix-run/react-router/pull/11728">#11728</a>)</p> </li> <li> <p>Add <code>exports</code> field to all packages (<a href="https://redirect.github.com/remix-run/react-router/pull/11675">#11675</a>)</p> </li> <li> <p>node package no longer re-exports from react-router (<a href="https://redirect.github.com/remix-run/react-router/pull/11702">#11702</a>)</p> </li> <li> <p>updates the minimum React version to 18 (<a href="https://redirect.github.com/remix-run/react-router/pull/11689">#11689</a>)</p> </li> <li> <ul> <li>Remove the <code>future.v7_partialHydration</code> flag (<a href="https://redirect.github.com/remix-run/react-router/pull/11725">#11725</a>) <ul> <li>This also removes the <code><RouterProvider fallbackElement></code> prop <ul> <li>To migrate, move the <code>fallbackElement</code> to a <code>hydrateFallbackElement</code>/<code>HydrateFallback</code> on your root route</li> </ul> </li> <li>Also worth nothing there is a related breaking changer with this future flag: <ul> <li>Without <code>future.v7_partialHydration</code> (when using <code>fallbackElement</code>), <code>state.navigation</code> was populated during the initial load</li> <li>With <code>future.v7_partialHydration</code>, <code>state.navigation</code> remains in an <code>"idle"</code> state during the initial load</li> </ul> </li> </ul> </li> </ul> </li> <li> <p>Remove <code>future.v7_fetcherPersist</code> flag (<a href="https://redirect.github.com/remix-run/react-router/pull/11731">#11731</a>)</p> </li> </ul> <h3>Minor Changes</h3> <ul> <li>Add prefetching support to <code>Link</code>/<code>NavLink</code> when using Remix SSR (<a href="https://redirect.github.com/remix-run/react-router/pull/11402">#11402</a>)</li> <li>Enhance <code>ScrollRestoration</code> so it can restore properly on an SSR'd document load (<a href="https://redirect.github.com/remix-run/react-router/pull/11401">#11401</a>)</li> <li>Add built-in Remix-style hydration support to <code>RouterProvider</code>. When running from a Remix-SSR'd HTML payload with the proper <code>window</code> variables (<code>__remixContext</code>, <code>__remixManifest</code>, <code>__remixRouteModules</code>), you don't need to pass a <code>router</code> prop and <code>RouterProvider</code> will create the <code>router</code> for you internally. (<a href="https://redirect.github.com/remix-run/react-router/pull/11396">#11396</a>) (<a href="https://redirect.github.com/remix-run/react-router/pull/11400">#11400</a>)</li> </ul> <h3>Patch Changes</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/remix-run/react-router/commit/e8e3b004d94a949372e77ce97a543bff5bc6fb89"><code>e8e3b00</code></a> chore: Update version for release (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12344">#12344</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/1499f3e43fa51370be698fc84a78150b13bd7535"><code>1499f3e</code></a> chore: Update version for release (pre) (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12315">#12315</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/995bcbb7e480a5a481475825957b20c89f7f0201"><code>995bcbb</code></a> chore: Update version for release (pre) (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12235">#12235</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/0e9b34690d532340b3cf3b304d0b8612c7638a11"><code>0e9b346</code></a> chore: Update version for release (pre) (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12205">#12205</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/6576bd0714830b75d2dcd6556bd22a68f1c4da0e"><code>6576bd0</code></a> chore: Update version for release (pre) (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12202">#12202</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/8daac72b0ec5e909ff691ecb05d7c3397bfe407f"><code>8daac72</code></a> Merge branch 'dev' into release-next</li> <li><a href="https://github.com/remix-run/react-router/commit/2d5924f567f35fe1aec13165d8a8c601bddf5bd9"><code>2d5924f</code></a> feat: configure export conditions properly (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12136">#12136</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/18dc8b8ead6d161a1f5aa13220d4f21fb26d069a"><code>18dc8b8</code></a> chore: Update version for release (pre) (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12184">#12184</a>)</li> <li><a href="https://github.com/remix-run/react-router/commit/fde69511bbfddf5a04e00d8c8bb9a7702a32b9bf"><code>fde6951</code></a> Merge branch 'dev' into release-next</li> <li><a href="https://github.com/remix-run/react-router/commit/813497a10eefbf0fdd3049baddeace6139268744"><code>813497a</code></a> Drop support for Node 18 and installGlobals (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/12171">#12171</a>)</li> <li>Additional commits viewable in <a href="https://github.com/remix-run/react-router/commits/react-router-dom@7.0.0/packages/react-router-dom">compare view</a></li> </ul> </details> <details> <summary>Attestation changes</summary> <p>This version has no provenance attestation, while the previous version (6.30.3) was attested. Review the <a href="https://www.npmjs.com/package/react-router-dom?activeTab=versions">package versions</a> before updating.</p> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com> Co-authored-by: kulesy <kulewidak@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

dependabot Bot and others added 5 commits August 20, 2026 12:28

pull Bot locked and limited conversation to collaborators Aug 20, 2026

pull Bot added the ⤵️ pull label Aug 20, 2026

pull Bot merged commit ce88510 into code:main Aug 20, 2026
11 of 12 checks passed

Navigation Menu

Uh oh!

[pull] main from tinacms:main - #310

[pull] main from tinacms:main#310
pull[bot] merged 5 commits into
code:mainfrom
tinacms:main

pull Bot commented Aug 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

pull Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pull Bot commented Aug 20, 2026 •

edited

Loading