You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#135965e4487 Thanks @vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3
#135965e4487 Thanks @vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunks
Until Next.js 16.2 the Turbopack wasm loaders were named loadWebAssembly and loadWebAssemblyModule functions living in [turbopack]_runtime.js, which the adapter rewrote to
resolve the chunk through a static import(). Next.js 16.3 emits them on demand in the chunks
instead ([turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching and WebAssembly.compileStreaming - which workerd does not implement - survived into the Worker.
Every wasm backed import then threw TypeError: WebAssembly.compileStreaming is not a function at
runtime, most visibly breaking Prisma with the workerd client runtime.
The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js
middleware bundles.
Next.js 16 replaces middleware.ts with proxy.ts which always runs on the Node.js runtime.
The Node.js middleware is now bundled into a Workers compatible middleware/handler.mjs:
the OpenNext config manifests are inlined at build time (as for the edge middleware) and the
middleware compiled by Next.js is statically bundled instead of being loaded from the
filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).
The support is experimental and requires the nodejs_compat compatibility flag.
#135965e4487 Thanks @vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundle
Next.js 16.3 registers the instrumentation hook from the middleware itself when the middleware
does not run on the edge runtime, by dynamically requiring .next/server/instrumentation.js.
workerd does not support dynamic requires so every request handled by the Node.js middleware
(proxy.ts) failed with Dynamic require of ".next/server/instrumentation.js" is not supported.
The guard Next.js uses (process.env.NEXT_RUNTIME !== "edge") is inlined by Next.js when it
compiles the middleware, so it can not be eliminated when the middleware is re-bundled. The loader
is stubbed out instead, which matches the edge runtime behaviour: the server function - which
shares the isolate - keeps registering the hook.
#1289eef243f Thanks @thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges run
BucketCachePurge.alarm() passed its tag bindings to SqlStorage.exec as a
single array. exec(query, ...bindings) is variadic over its bindings, so for a
multi-tag DELETE ... WHERE tag IN (?, ?, …) the binding count (1) disagreed
with the placeholder count (N) and exec threw "Wrong number of parameter
bindings" on every flush. On-demand revalidateTag purges therefore never
reached the Cloudflare cache, and with bypassTagCacheOnCacheHit enabled pages
served stale until the ISR TTL expired.
Spread the bindings, normalise the INSERT to the same variadic form, and
tighten the drain loop's guard from while (tags.length >= 0) (which never
exits via the condition) to while (tags.length > 0).
#1270802047e Thanks @alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mapping
Worker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing /_next/static/* requests to return 404 on past deployments. Versions are now filtered to those with workers/triggered_by in {upload, version_upload}.
#125229fe15d Thanks @vicb! - bump the number of retries for r2 cache uploads
Increase the retry count from 5 to 15 with a capped exponential backoff to improve resilience against transient R2 write failures during cache population.
The populateCache command adds columns to the D1 tag cache for SWR support.
This is required for older deployments made before those column were added.
SQLite errors when the columns exist and we should not log those errors.
Turbopack replaces wasm imports using WebAssembly.compileStreaming and WebAssembly.instantiateStreaming. These functions are not available in
the workerd runtime.
We add a helper loadWasmChunkFn. This is a generated switch statement
that contains an import for each wasm chunk. We use static strings for
all imports to ensure that all necessary wasm chunks will be detected
and bundled for the final build.
The Turbopack patcher replaces the invocations in loadWebAssembly and loadWebAssemblyModule, using the synchronous WebAssembly.instantiate
and redirecting to loadWasmChunkFn.
#1221a2679bf Thanks @mushan0x0! - Stop bundling @vercel/og (and its ~1.4 MiB resvg.wasm) when the app does not use it.
Next.js's externalImport helper keeps a dynamic import("next/dist/compiled/@vercel/og/index.edge.js") in the emitted handler even for apps that never use ImageResponse / opengraph-image. Previously this module was marked as external when useOg was false, which left Wrangler to resolve and bundle it — pulling in ~800 KiB of JS plus resvg.wasm and pushing many Workers over the Cloudflare free-tier 3 MiB gzip limit.
When useOg is false, the edge entry is now aliased to the existing throw.js shim, so the unreachable dynamic import resolves to a tiny module and the real @vercel/og library is no longer pulled into the Worker bundle.
#12082c5b472 Thanks @edmundhung! - Use OPEN_NEXT_BUILD_ID instead of NEXT_BUILD_ID in the cache keys.
As of Next 16.2 NEXT_BUILD_ID is a fixed value when deploymentId is set explicitly.
Remove process.version / process.versions.node overrides now that unjs/unenv#493 is merged and shipped in unenv@2.0.0-rc.16 (project uses 2.0.0-rc.24)
#119932594d6 Thanks @SdSadat! - fix(cli): fail fast in non-TTY environments instead of hanging on config-creation prompts
When open-next.config.ts (or wrangler.(toml|json|jsonc)) is missing, the CLI
prompts the user to auto-create it. In non-TTY environments (Cloudflare Workers
Builds, Docker, CI) the Enquirer prompt can't read stdin, so the build hangs or
fails with a truncated prompt and a cryptic exit code — the user sees ? Missing required open-next.config.ts file, do you want to create one? (Y/n)
and then ELIFECYCLE Command failed with exit code 13, with no hint at what
to do next.
Now, in non-interactive environments, both prompts throw an actionable error
with the exact template to paste (for open-next.config.ts) or point at the
existing --skipWranglerConfigCheck / SKIP_WRANGLER_CONFIG_CHECK escape
hatch (for the wrangler config). Interactive behavior is unchanged.
#113979b01b8 Thanks @james-elicx! - Fix Turbopack external module resolution by dynamically discovering external imports at build time.
When packages are listed in serverExternalPackages, Turbopack externalizes them via externalImport() which uses dynamic await import(id). The bundler (ESBuild) can't statically analyze import(id) with a variable, so these modules aren't included in the worker bundle.
The sharded tag cache miss path already reads tag data from the Durable Object before answering the request. Reuse that fetched data when populating the regional cache so a shard miss does not immediately trigger a second identical Durable Object read.
#1206585795d Thanks @314systems! - fix: regression where getEnvFromPlatformProxy received wrong options type
This fixes a regression introduced in 32ba91a where getEnvFromPlatformProxy call sites passed OpenNextConfig even though the function expects Wrangler GetPlatformProxyOptions.
The fix restores the pre-32ba91a argument shape by passing { configPath, environment } from CLI arguments, so env resolution follows the selected Wrangler config/environment.
#1270802047e Thanks @alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mapping
Worker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing /_next/static/* requests to return 404 on past deployments. Versions are now filtered to those with workers/triggered_by in {upload, version_upload}.
#1166f89fba1 Thanks @ash1day! - fix: sort .endsWith() checks by path length descending to prevent suffix collisions in dynamic requires
Routes whose paths are suffixes of other routes (e.g. /test/app vs /) were resolved incorrectly because the shorter path matched first in the generated .endsWith() chain. Sorting by path length descending ensures more specific (longer) paths are always checked first.
Using remote dev is not subject to the Cloudflare API rate limit of 1,200 requests per 5 minutes that caused failures for large applications with thousands of prerendered pages.
#1160161e726 Thanks @matthewvolk! - fix(patches): include prefetch-hints.json in loadManifest build-time inlining
Next.js 16.2.0 introduced prefetch-hints.json as a new server manifest loaded unconditionally
by NextNodeServer.getPrefetchHints(). The file exists in the build output but wasn't matched by
the glob pattern *-manifest.json, causing the patched loadManifest() to throw at runtime.
#1151a143282 Thanks @nathanschram! - fix: handle known optional manifests gracefully in loadManifest/evalManifest patches
Next.js loads certain manifests with handleMissing: true (returning {} when the file doesn't
exist). The adapter's build-time glob scan doesn't find these files when they're conditionally
generated, so the patched function threw at runtime, crashing dynamic routes with 500.
Instead of a blanket catch-all, handle only the specific optional manifests from Next.js route-module.ts:
react-loadable-manifest (Turbopack per-route, not all routes have dynamic imports)
subresource-integrity-manifest (only when experimental.sri configured)
_client-reference-manifest.js (optional for static metadata routes, evalManifest)
Manifest matching strips .json before comparison since some Next.js constants omit
the extension (SUBRESOURCE_INTEGRITY_MANIFEST, DYNAMIC_CSS_MANIFEST, etc.).
Unknown manifests still throw to surface genuine errors.
#113325d5835 Thanks @dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.
#11384487f1f Thanks @james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.
#11272b437f1 Thanks @dario-piotrowicz! - In the migrate command, add an initial step to create a Next.js config file (required by open-next) if it doesn't exist
This command helps users migrate existing Next.js applications to the OpenNext Cloudflare adapter by automatically setting up all necessary configuration files, dependencies, and scripts.
To use the command simply run: npx opennextjs-cloudflare migrate
The build will now error for unsupported Next version which may contain unpatched security vulnerabilities.
You can bypass the check using the --dangerouslyUseUnsupportedNextVersion flag.
There was a regression in Next 16.1.0 (vercel/next.js#86830) and some fields were missing in the config.
The Next team fixed that in 16.1.4 (vercel/next.js#88733).
#1023a4a2f02 Thanks @dario-piotrowicz! - When running wrangler deploy add a OPEN_NEXT_DEPLOY environment variable to let wrangler know that it is being run by open-next
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: web4@undefined
npm error Found: next@15.4.5
npm error node_modules/next
npm error next@"15.4.5" from the root project
npm error
npm error Could not resolve dependency:
npm error peer next@">=15.5.24 <16 || >=16.3.3" from @opennextjs/cloudflare@1.20.6
npm error node_modules/@opennextjs/cloudflare
npm error @opennextjs/cloudflare@"1.20.6" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-10T20_36_58_073Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-10T20_36_58_073Z-debug-0.log
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.3.1→1.20.6Release Notes
opennextjs/opennextjs-cloudflare (@opennextjs/cloudflare)
v1.20.6Compare Source
Patch Changes
#1378
7a990e7Thanks @vicb! - Bump Next to 16.3.4 and@opennextjs/awsto 4.1.4See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.4
v1.20.5Compare Source
Patch Changes
#1374
64a69ecThanks @conico974! - chore: bump@opennextjs/awsto 4.1.3See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.3
v1.20.4Compare Source
Patch Changes
#1365
bf52109Thanks @vicb! - chore: bump@opennextjs/awsto 4.1.2See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.2
v1.20.3Compare Source
Patch Changes
#1361
8c31fbcThanks @vicb! - chore: bump@opennextjs/awsto 4.1.1See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.1
#1359
65e4487Thanks @vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3#1359
65e4487Thanks @vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunksUntil Next.js 16.2 the Turbopack wasm loaders were named
loadWebAssemblyandloadWebAssemblyModulefunctions living in[turbopack]_runtime.js, which the adapter rewrote toresolve the chunk through a static
import(). Next.js 16.3 emits them on demand in the chunksinstead (
[turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching andWebAssembly.compileStreaming- which workerd does not implement - survived into the Worker.Every wasm backed import then threw
TypeError: WebAssembly.compileStreaming is not a functionatruntime, most visibly breaking Prisma with the
workerdclient runtime.The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js
middleware bundles.
#1309
56dfaccThanks @ScienHAC! - feature: support Node.js middleware (proxy.ts)Next.js 16 replaces
middleware.tswithproxy.tswhich always runs on the Node.js runtime.The Node.js middleware is now bundled into a Workers compatible
middleware/handler.mjs:the OpenNext config manifests are inlined at build time (as for the edge middleware) and the
middleware compiled by Next.js is statically bundled instead of being loaded from the
filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).
The support is experimental and requires the
nodejs_compatcompatibility flag.#1359
65e4487Thanks @vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundleNext.js 16.3 registers the instrumentation hook from the middleware itself when the middleware
does not run on the edge runtime, by dynamically requiring
.next/server/instrumentation.js.workerd does not support dynamic requires so every request handled by the Node.js middleware
(
proxy.ts) failed withDynamic require of ".next/server/instrumentation.js" is not supported.The guard Next.js uses (
process.env.NEXT_RUNTIME !== "edge") is inlined by Next.js when itcompiles the middleware, so it can not be eliminated when the middleware is re-bundled. The loader
is stubbed out instead, which matches the edge runtime behaviour: the server function - which
shares the isolate - keeps registering the hook.
v1.20.2Compare Source
Patch Changes
#1312
38ea40bThanks @james-elicx! - fix: handle encoded middleware and cache paths safelyUpgrade
@opennextjs/awsto prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.#1313
766eee9Thanks @james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11#1306
97ef330Thanks @james-elicx! - fix: normalize Windows paths when patching the Turbopack runtimeEnsure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.
v1.20.1Compare Source
Patch Changes
#1297
780a21cThanks @james-elicx! - fix: disable response compression for skew protection API requestsAvoid truncated compressed Cloudflare API responses causing worker version lookups to fail during deployment.
v1.20.0Compare Source
Minor Changes
#1290
46c50fcThanks @james-elicx! - feature: add opt-in batch upload viarclonefor fast R2 cache population.Key Changes:
Optional
rcloneUpload: Install the optionalrclone.jspeer dependency and pass--rcloneto opt in torclonebased batch uploads.R2_ACCESS_KEY_IDR2_SECRET_ACCESS_KEYCF_ACCOUNT_IDExplicit Opt-in: The existing worker-based population path remains the default.
rcloneis only loaded when--rcloneis used for a remote cache.Clear Errors: The CLI reports missing credentials or a missing
rclone.jsinstallation when the option is used.Usage:
Install
rclone.js, then add the secrets in a.env/.dev.varsfile in your project root:pnpm add rclone.js pnpm approve-builds # select rclone.js pnpm rebuild rclone.js R2_ACCESS_KEY_ID=your_key R2_SECRET_ACCESS_KEY=your_secret CF_ACCOUNT_ID=your_account opennextjs-cloudflare deploy --rcloneYou can also set the environment variables for CI builds.
Notes:
rclonemay not be supported on all platforms.Patch Changes
#1289
eef243fThanks @thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges runBucketCachePurge.alarm()passed its tag bindings toSqlStorage.execas asingle array.
exec(query, ...bindings)is variadic over its bindings, so for amulti-tag
DELETE ... WHERE tag IN (?, ?, …)the binding count (1) disagreedwith the placeholder count (N) and
execthrew "Wrong number of parameterbindings" on every flush. On-demand
revalidateTagpurges therefore neverreached the Cloudflare cache, and with
bypassTagCacheOnCacheHitenabled pagesserved stale until the ISR TTL expired.
Spread the bindings, normalise the
INSERTto the same variadic form, andtighten the drain loop's guard from
while (tags.length >= 0)(which neverexits via the condition) to
while (tags.length > 0).#1291
51439b1Thanks @james-elicx! - fix: disable response compression when provisioning R2 cache bucketsAvoid truncated compressed Cloudflare API responses causing R2 cache bucket provisioning to fail.
v1.19.11Compare Source
Patch Changes
#1270
802047eThanks @alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mappingWorker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing
/_next/static/*requests to return 404 on past deployments. Versions are now filtered to those withworkers/triggered_byin{upload, version_upload}.Closes #1230
v1.19.10Compare Source
Patch Changes
#1261
780dd4fThanks @vicb! - Allow populating R2 when the domain is protected by Cloudflare AccessYou need to:
v1.19.9Compare Source
Patch Changes
3b35c6eThanks @vicb! - chore: bump Next.js to 15.5.18 / 16.2.6 and @opennextjs/aws to 4.0.2v1.19.8Compare Source
Patch Changes
#1256
9696cd0Thanks @vicb! - bump@opennextjs/awsto 4.0.1See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.0.1
v1.19.7Compare Source
Patch Changes
#1252
29fe15dThanks @vicb! - bump the number of retries for r2 cache uploadsIncrease the retry count from 5 to 15 with a capped exponential backoff to improve resilience against transient R2 write failures during cache population.
#1255
364b7d9Thanks @vicb! - Bump react and nextv1.19.6Compare Source
Patch Changes
#1246
5d2014fThanks @vicb! - fix: do not log expected expected D1 errorsThe
populateCachecommand adds columns to the D1 tag cache for SWR support.This is required for older deployments made before those column were added.
SQLite errors when the columns exist and we should not log those errors.
#1244
01babceThanks @tahmid-23! - fix: drop streaming wasm calls in Turbopack runtimeTurbopack replaces wasm imports using
WebAssembly.compileStreamingandWebAssembly.instantiateStreaming. These functions are not available inthe workerd runtime.
We add a helper
loadWasmChunkFn. This is a generated switch statementthat contains an import for each wasm chunk. We use static strings for
all imports to ensure that all necessary wasm chunks will be detected
and bundled for the final build.
The Turbopack patcher replaces the invocations in
loadWebAssemblyandloadWebAssemblyModule, using the synchronousWebAssembly.instantiateand redirecting to
loadWasmChunkFn.#1243
1c815deThanks @tahmid-23! - fix: detect object-valued conditionsThe pre-existing build condition transform logic had subtle errors:
(e.g. "workerd": { "import": ..., "require": ... })
Now, we fully support object conditions. Furthermore, we prune siblings,
unless its subtree also contains the build condition.
v1.19.5Compare Source
Patch Changes
dd7de1dThanks @vicb! - fix: add missing git ignored files for the migrate commandv1.19.4Compare Source
Patch Changes
#1221
a2679bfThanks @mushan0x0! - Stop bundling@vercel/og(and its ~1.4 MiBresvg.wasm) when the app does not use it.Next.js's
externalImporthelper keeps a dynamicimport("next/dist/compiled/@vercel/og/index.edge.js")in the emitted handler even for apps that never useImageResponse/opengraph-image. Previously this module was marked asexternalwhenuseOgwasfalse, which left Wrangler to resolve and bundle it — pulling in ~800 KiB of JS plusresvg.wasmand pushing many Workers over the Cloudflare free-tier 3 MiB gzip limit.When
useOgisfalse, the edge entry is now aliased to the existingthrow.jsshim, so the unreachable dynamic import resolves to a tiny module and the real@vercel/oglibrary is no longer pulled into the Worker bundle.#1208
2c5b472Thanks @edmundhung! - UseOPEN_NEXT_BUILD_IDinstead ofNEXT_BUILD_IDin the cache keys.As of Next 16.2
NEXT_BUILD_IDis a fixed value when deploymentId is set explicitly.See opennextjs/opennextjs-aws#1144
#1193
1e8d232Thanks @conico974! - Fix tag cache stale logicv1.19.3Compare Source
Patch Changes
#1215
608893eThanks @vicb! - Factor large repeated values in manifestsThis reduce the size of the generated code.
#1218
f0d0226Thanks @314systems! - removeprocess.versionoverrideRemove process.version / process.versions.node overrides now that unjs/unenv#493 is merged and shipped in unenv@2.0.0-rc.16 (project uses 2.0.0-rc.24)
#1199
32594d6Thanks @SdSadat! - fix(cli): fail fast in non-TTY environments instead of hanging on config-creation promptsWhen
open-next.config.ts(orwrangler.(toml|json|jsonc)) is missing, the CLIprompts the user to auto-create it. In non-TTY environments (Cloudflare Workers
Builds, Docker, CI) the Enquirer prompt can't read stdin, so the build hangs or
fails with a truncated prompt and a cryptic exit code — the user sees
? Missing required open-next.config.ts file, do you want to create one? (Y/n)and then
ELIFECYCLE Command failed with exit code 13, with no hint at whatto do next.
Now, in non-interactive environments, both prompts throw an actionable error
with the exact template to paste (for
open-next.config.ts) or point at theexisting
--skipWranglerConfigCheck/SKIP_WRANGLER_CONFIG_CHECKescapehatch (for the wrangler config). Interactive behavior is unchanged.
v1.19.2Compare Source
Patch Changes
#1207
0958726Thanks @edmundhung! - bump@opennextjs/awsto 3.10.2See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.10.2
#1139
79b01b8Thanks @james-elicx! - Fix Turbopack external module resolution by dynamically discovering external imports at build time.When packages are listed in
serverExternalPackages, Turbopack externalizes them viaexternalImport()which uses dynamicawait import(id). The bundler (ESBuild) can't statically analyzeimport(id)with a variable, so these modules aren't included in the worker bundle.This patch:
.next/node_modules/symlinks (e.g.shiki-43d062b67f27bbdc→shiki)externalImport("shiki")) and subpath imports (e.g.shiki/engine/javascript)switch/caseentries so the bundler can statically resolve and include these modules#1203
6f02d12Thanks @314systems! - fix: exclude unsupported Next.js 16 releases from peer dependencies.The previous range allowed Next.js 16.0.0 through 16.2.2 without a peer dependency warning because
>=16.2.3was already covered by>=15.5.15.The range now explicitly supports Next.js 15.5.15 and above in the 15.x line, and Next.js 16.2.3 and above in the 16.x line.
#1200
7820ad0Thanks @NathanDrake2406! - fix: reuse sharded tag data when filling the regional cache.The sharded tag cache miss path already reads tag data from the Durable Object before answering the request. Reuse that fetched data when populating the regional cache so a shard miss does not immediately trigger a second identical Durable Object read.
#1206
585795dThanks @314systems! - fix: regression where getEnvFromPlatformProxy received wrong options typeThis fixes a regression introduced in 32ba91a where
getEnvFromPlatformProxycall sites passedOpenNextConfigeven though the function expects WranglerGetPlatformProxyOptions.The fix restores the pre-32ba91a argument shape by passing
{ configPath, environment }from CLI arguments, so env resolution follows the selected Wrangler config/environment.v1.19.1Compare Source
Patch Changes
#1270
802047eThanks @alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mappingWorker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing
/_next/static/*requests to return 404 on past deployments. Versions are now filtered to those withworkers/triggered_byin{upload, version_upload}.Closes #1230
v1.19.0Compare Source
Minor Changes
#1168
9a26846Thanks @conico974! - Add support for SWR (stale-while-revalidate) inrevalidateTagSee the AWS implementation for more details.
Patch Changes
#1184
c7d6425Thanks @vicb! - fix for Next.js CVE-2026-23869See the CVE-2026-23869 summary for details.
This CVE is fixed by bumping the minium Next.js release version to 15.5.15/16.2.3
#1177
e814a63Thanks @conico974! - Fixuse cachenot working as expected in Next 16+v1.18.1Compare Source
Patch Changes
#1176
2232651Thanks @conico974! - fix for OG with Next 16.2.2#1166
f89fba1Thanks @ash1day! - fix: sort.endsWith()checks by path length descending to prevent suffix collisions in dynamic requiresRoutes whose paths are suffixes of other routes (e.g.
/test/appvs/) were resolved incorrectly because the shorter path matched first in the generated.endsWith()chain. Sorting by path length descending ensures more specific (longer) paths are always checked first.Fixes #1156.
v1.18.0Compare Source
Minor Changes
#1159
75f5f0aThanks @edmundhung! - Use remote dev for R2 cache populationUsing remote dev is not subject to the Cloudflare API rate limit of 1,200 requests per 5 minutes that caused failures for large applications with thousands of prerendered pages.
v1.17.3Compare Source
Patch Changes
#1160
161e726Thanks @matthewvolk! - fix(patches): includeprefetch-hints.jsonin loadManifest build-time inliningNext.js 16.2.0 introduced
prefetch-hints.jsonas a new server manifest loaded unconditionallyby
NextNodeServer.getPrefetchHints(). The file exists in the build output but wasn't matched bythe glob pattern
*-manifest.json, causing the patchedloadManifest()to throw at runtime.v1.17.2Compare Source
Patch Changes
#1151
a143282Thanks @nathanschram! - fix: handle known optional manifests gracefully in loadManifest/evalManifest patchesNext.js loads certain manifests with
handleMissing: true(returning{}when the file doesn'texist). The adapter's build-time glob scan doesn't find these files when they're conditionally
generated, so the patched function threw at runtime, crashing dynamic routes with 500.
Instead of a blanket catch-all, handle only the specific optional manifests from Next.js
route-module.ts:react-loadable-manifest(Turbopack per-route, not all routes have dynamic imports)subresource-integrity-manifest(only whenexperimental.sriconfigured)server-reference-manifest(App Router only)dynamic-css-manifest(Pages Router + Webpack only)fallback-build-manifest(only for/_errorpage)prefetch-hints(new in Next.js 16.2)_client-reference-manifest.js(optional for static metadata routes, evalManifest)Manifest matching strips
.jsonbefore comparison since some Next.js constants omitthe extension (
SUBRESOURCE_INTEGRITY_MANIFEST,DYNAMIC_CSS_MANIFEST, etc.).Unknown manifests still throw to surface genuine errors.
Fixes #1141.
v1.17.1Compare Source
Patch Changes
f5bd138Thanks @vicb! - make dev /cdn-cgi/image behaves like prod for consistencyv1.17.0Compare Source
Minor Changes
25d5835Thanks @dario-piotrowicz! - Update themigratecommand to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.v1.16.6Compare Source
Patch Changes
4487f1fThanks @james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.v1.16.5Compare Source
Patch Changes
#1127
2b437f1Thanks @dario-piotrowicz! - In themigratecommand, add an initial step to create a Next.js config file (required by open-next) if it doesn't exist#1126
8c3a36eThanks @alex-all3dp! - fix: prevent Worker hang on HEAD requests to static assetsv1.16.4Compare Source
Patch Changes
#1122
6c94a4aThanks @dario-piotrowicz! - Inmigratecommand, avoid adding unnecessary newlines when creating files#1122
6c94a4aThanks @dario-piotrowicz! - fixmigratecommand incorrectly erroring if the target application doesn't have apublicdirectory#1122
6c94a4aThanks @dario-piotrowicz! - Bump@opennextjs/awsto 3.9.16migratecommand not updating Next.js config filesSee details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.16
#1097
fea645fThanks @dario-piotrowicz! - Add--helpand--versionto theopennextjs-cloudflareCLIImprove the
opennextjs-cloudflareCLI by:opennextjs-cloudflare foo) display a clear and helpful error message-h|--helpflag to display the CLI's help message-v|--versionflag to display the package's versionv1.16.3Compare Source
Patch Changes
#1113
09c41f1Thanks @anonrig! - bump@opennextjs/awsto 3.9.15See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.15
v1.16.2Compare Source
Patch Changes
e6938a0Thanks @vicb! - allow using a regional cache with KVv1.16.1Compare Source
Patch Changes
8676c78Thanks @vicb! - EmptyNextNodeServer#handleNextImageRequestto avoid pulling unneeded deps (in #1098)v1.16.0Compare Source
Minor Changes
#1083
b062597Thanks @dario-piotrowicz! - feature: addmigratecommand to set up OpenNext for Cloudflare adapterThis command helps users migrate existing Next.js applications to the OpenNext Cloudflare adapter by automatically setting up all necessary configuration files, dependencies, and scripts.
To use the command simply run:
npx opennextjs-cloudflare migratePatch Changes
#1092
4279043Thanks @vicb! - Check for supported Next versionThe build will now error for unsupported Next version which may contain unpatched security vulnerabilities.
You can bypass the check using the
--dangerouslyUseUnsupportedNextVersionflag.v1.15.1Compare Source
Patch Changes
74302ecThanks @vicb! - fix the detection of the runtime (webpack vs turbopack)v1.15.0Compare Source
Minor Changes
ae3d43dThanks @vicb! - Next 16 is now supportedPatch Changes
#1076
c99eefdThanks @vicb! - fix: do not bundle og when not usedThis saves ~500kB when og is not used
#1079
6ac789aThanks @vicb! - fix: use the correct runtime (i.e. webpack or turbopack)#1078
249f738Thanks @vicb! - drop unused react-dom modulesThis saves ~500kB on the output bundle
v1.14.10Compare Source
Patch Changes
#1071
886c742Thanks @vicb! - fix: patch Next config for missing fields.There was a regression in Next 16.1.0 (vercel/next.js#86830) and some fields were missing in the config.
The Next team fixed that in 16.1.4 (vercel/next.js#88733).
This PR introduce a patch for 16.1.0-16.1.3
v1.14.9Compare Source
Patch Changes
#1070
f7c6b3aThanks @vicb! - bump@opennextjs/awsto 3.9.8See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.8
#1057
0230cbeThanks @vicb! - Do not inject setImmediate/clearImmediate in the global scope#1069
4ee4ba3Thanks @vicb! - Check that wrangler is >= 4.59.2 when building Next 16.1+.To ensure
workerdhas a required fix tosetImmediatev1.14.8Compare Source
Patch Changes
9222070Thanks @vicb! - fix r2 bulk put to respect bucket jurisdictionv1.14.7Compare Source
Patch Changes
d447125Thanks @vicb! - Support composable cache in Next 16v1.14.6Compare Source
Patch Changes
#1043
c83cb83Thanks @vicb! - fix for CVE-2025-67779See https://nextjs.org/blog/security-update-2025-12-11
v1.14.5Compare Source
Patch Changes
#1042
763c4ecThanks @vicb! - Bump Next, React, and @opennextjs/aws to fix vulnerabilities (CVE-2025-55184 and CVE-2025-55183)See https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
See https://nextjs.org/blog/security-update-2025-12-11
See https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.5
#1034
721bff0Thanks @james-elicx! - output more wrangler command logs when the command fails#1023
a4a2f02Thanks @dario-piotrowicz! - When runningwrangler deployadd aOPEN_NEXT_DEPLOYenvironment variable to let wrangler know that it is being run by open-nextv1.14.4Compare Source
Patch Changes
#1020
07919d8Thanks @dario-piotrowicz! - Add missing WORKER_SELF_REFERENCE service binding in the wrangler.jsonc that the CLI creates#1032
1de4899Thanks @vicb! - fix(images): allow any local path when no localPatterns are specifiedv1.14.3Compare Source
Patch Changes
#1025
c3aba94Thanks @vicb! - bump@opennextjs/awsto 3.9.4See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.4
#1025
c3aba94Thanks @vicb! - Bump Nextv1.14.2Compare Source
Patch Changes
#1021
250aba2Thanks @vicb! - bump@opennextjs/awsto 3.9.3See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.3
#1021
250aba2Thanks @vicb! - Bump Next[
v1.14.1](https://redirect.github.com/opennextjs/opennextConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.