Sebastian "Sebbie" Silbermann

Revert "Remove legacy PPR codepaths" (#95113)

fix(incremental-cache): byte-exact fetch cache key for binary bodies (#96008) https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q Co-authored-by: Karim Rahal <karim@karimrahal.com>

[DOM] Scroll to text siblings of empty Fragments instead of the parent (#37060) When a Fragment has no children, React would consider scrolling to siblings first and then to parents. However, React only considered `HostComponent` for the siblings. Since we already have a heuristic for scrolling to `HostText`, we can reuse that same heuristic. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Ensure unique resolved `headers()` value between render passes (#96085) A HTTP request can render the same React tree in multiple passes with different semantics for `connection()`: the prospective and final prerenders of a runtime prefetch, or a navigation's dynamic render and the runtime prerender that is spawned from it to refresh the client's prefetch cache. All of these passes previously resolved `headers()` to the single sealed headers object created lazily by the request store, so userland caches keyed on the identity of `await headers()` (any per-request memoization that treats the headers object as "the request") leaked promises across passes. With this change, every render pass resolves `headers()` to a distinct object over the same underlying data, making "the headers object identifies the request within one render pass" a real contract. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Consolidate unhandled rejection logging into a single listener (#95999) An unhandled rejection was previously logged by up to three independent process listeners at once: the render runtime's crash-prevention handler in `process-error-handlers.ts` (a bare `console.error`), the router server's `Log.error('unhandledRejection: ', err)`, and the dev server's `logErrorWithOriginalStack`. The runtime handler must exist on every deployment target (#77997), but on self-hosted `next start`/`next dev` it shares a process with the router server's and dev server's listeners, so a single rejection was logged multiple times in different formats. THe first commits adds a test showing the current behavior where we log multiple times. The second commit introduces `registerUnhandledRejectionListener` and `isUnhandledRejectionListenerRegistered` in `process-error-handlers.ts`, and converts the router server and dev server to check-then-register instead of installing their own rejection loggers: - The listener function is shared via a `Symbol.for` key on `globalThis`, so multiple copies of the module (e.g. in the pre-compiled server bundle and in a route module bundle) register and detect a single listener instance. - The registration check queries `process.listeners('unhandledRejection')` instead of a module-global flag, so it stays accurate even after external code calls `process.removeAllListeners`. `installProcessErrorHandlers` therefore calls the register function unconditionally. The `uncaughtException` handlers are left as they are; they have the same duplication and could be consolidated the same way in a follow-up.

Validate server reference IDs during manifest lookup (#96007) https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp Co-authored-by: Josh Story <story@hey.com>

[Fiber] Collect Host Singleton children of Fragments (#37063) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

[cd] Replace the release package with our own GitHub release creation (#95352)

[instant] Let dev-server requests bypass the fetch lock (#95761)

[ci] Match the test job summary style to the PR test report comment (#95882)

Update vendored `@mswjs/interceptors` to 0.41.9 (#96059) The previous `@mswjs/interceptors` has a bug where the response it forwarded never set the [`complete` field](https://nodejs.org/api/http.html#messagecomplete). This wasn't an issue so far (or not reported) but is an issue for `httpxy` which relies on an accurate `complete` field. Bumping `@mswjs/interceptor` now so that we can switch from `http-proxy` to `httpxy`.

Enforce `serverActions.bodySizeLimit` for Server Actions in Edge runtime (#96012) https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 Co-authored-by: Dmitrii Troitskii <jsleitor@gmail.com> Co-authored-by: Sushanth Tiruvaipati <puzzleverseai@gmail.com>

Throw special error if rejected Promises are incorrectly instrumented (#36328) When a rejected `Promise` is instrumented in userspace while setting the rejection reason in the wrong field (e.g. `error` instead of `reason`), React will throw undefined (because `usable.reason` doesn't exist). This makes it incredibly hard to find the actual rejection reason. React is now throwing a generic error if we couldn't find the rejection reason. That will produce a callstack pointing into the problematic Promise from where you can hopefully extract the real rejection reason (alongside fixing the bad instrumentation). We're doing this in prod since this is unlikely to surface in dev. We're only doing runtime type-checking for the rejected case. That should be hit rarely and therefore hopefully have negligible runtime impact.

[ci] Add stats comment with partial stats (#95401) We used to not post a comment when a part of the bundler matrix got cancelled. Conceptually, a cancelled job is just like a failed on in the sense of not being able to produce stats. Now we always aggregate stats and post stats from the bundlers that did produce them. The risk here is a race between a run that was cancelled because another run superseded it and the run that superseded it. Though practically, aggregating the stats isn't slower than running the full workflow. Not impossible (especially given how slow the Webpack job is) but incredibly rare.

Ensure exotic rewrite param values are properly encoded (#96010) https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4

Remove legacy PPR codepaths (#94955)

Unified release process (#36456)

[Flight] Define Flight chunk `.then` with `Object.defineProperty` (#37109) [Secure Ecmascript](https://github.com/tc39/proposal-ses) would freeze the prototype of intrinsics. Since `ReactPromise` inherits the prototype from `Promise`, it also copies over the writable definition. Using `defineProperty` on an inherited property is compatible with SES though. That's also closer to how classes are specced in JS. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

[Flight] Port ReplyServer traversal guards to FlightClient (#37144) Additional defense-in-depth in case consumers pass untrusted input into Flight Client. Flight Client generally assumes trusted input. We'll reserve these kind of fixes for Flight Client in case the untrusted input leads to catastrophic vulnerabilities e.g. prototype pollutions that can be used for remote code executions.

[cd] More robust publish pipeline (#94622)