Sebastian "Sebbie" Silbermann

Revert "Remove legacy PPR codepaths" (#95113)

fix(incremental-cache): byte-exact fetch cache key for binary bodies (#96008) https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q Co-authored-by: Karim Rahal <karim@karimrahal.com>

[DOM] Scroll to text siblings of empty Fragments instead of the parent (#37060) When a Fragment has no children, React would consider scrolling to siblings first and then to parents. However, React only considered `HostComponent` for the siblings. Since we already have a heuristic for scrolling to `HostText`, we can reuse that same heuristic. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Validate server reference IDs during manifest lookup (#96007) https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp Co-authored-by: Josh Story <story@hey.com>

[cd] Replace the release package with our own GitHub release creation (#95352)

[ci] Move Turbopack, Rspack and font data workflows off of `RELEASE_BOT_GITHUB_TOKEN` (#93455) Co-authored-by: Benjamin Woodruff <github@benjam.info>

[instant] Let dev-server requests bypass the fetch lock (#95761)

[next/image] Only fire `onError` once (#93209)

Enforce `serverActions.bodySizeLimit` for Server Actions in Edge runtime (#96012) https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3 Co-authored-by: Dmitrii Troitskii <jsleitor@gmail.com> Co-authored-by: Sushanth Tiruvaipati <puzzleverseai@gmail.com>

[FlightReply] Type hardening and performance improvements (#36425) Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>

Throw special error if rejected Promises are incorrectly instrumented (#36328) When a rejected `Promise` is instrumented in userspace while setting the rejection reason in the wrong field (e.g. `error` instead of `reason`), React will throw undefined (because `usable.reason` doesn't exist). This makes it incredibly hard to find the actual rejection reason. React is now throwing a generic error if we couldn't find the rejection reason. That will produce a callstack pointing into the problematic Promise from where you can hopefully extract the real rejection reason (alongside fixing the bad instrumentation). We're doing this in prod since this is unlikely to surface in dev. We're only doing runtime type-checking for the rejected case. That should be hit rarely and therefore hopefully have negligible runtime impact.

[ci] Add stats comment with partial stats (#95401) We used to not post a comment when a part of the bundler matrix got cancelled. Conceptually, a cancelled job is just like a failed on in the sense of not being able to produce stats. Now we always aggregate stats and post stats from the bundlers that did produce them. The risk here is a race between a run that was cancelled because another run superseded it and the run that superseded it. Though practically, aggregating the stats isn't slower than running the full workflow. Not impossible (especially given how slow the Webpack job is) but incredibly rare.

Ensure exotic rewrite param values are properly encoded (#96010) https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4

Remove legacy PPR codepaths (#94955)

Unified release process (#36456)

[cd] More robust publish pipeline (#94622)

Set correct origin for internal redirects in custom server (#96011) https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4

[Fizz] Stop firing `onAllReady` after the shell errored (#36903) Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Revert "Keep the dev React debug channel on Node streams end to end" (#94459)

[test] Add coverage for multi-byte code units in stream APIs (#36900) Adds a test documenting why a `string.length` fast path is unsound. `byteSize` feeds heuristic decisions (outlining threshold at 500 bytes, progressive chunk sizing). `string.length` undercounts multi-byte content, so a boundary that is really >500 bytes could drop below the outlining threshold. --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>