A sourced fix-playbook workspace for AI and agent engineers. Find the root cause, the affected version, the rollback-safe next step, and edge-case audits.
When Next.js is invoked from a directory other than the project root, relative imports in next.config.ts are resolved against the current working directory instead of the configuration file's own directory, leading to module resolution failures or loading incorrect files.
When Next.js is invoked from a directory other than the project root (e.g., `node app/node_modules/next/dist/bin/next build app`), relative imports in `next.config.ts` are resolved against `process.cwd()` instead of the config file's directory. This causes builds to fail with `Cannot find module` or silently load a wrong file if a similarly named file exists in the cwd. The issue affects the default SWC transpilation path and has been present since Next.js 15.0.0.
When building a Next.js project with next.config.ts from a working directory different from the project root, relative imports inside next.config.ts are resolved relative to process.cwd() rather than the config file's location. This causes module-not-found errors or, worse, silently loads a file with the same relative path from the current working directory, potentially applying unintended configuration.
The Table Editor's updateTable function incorrectly compares primary key column names in display order against the primary_keys array (which is in key order). This false mismatch causes the primary key constraint to be dropped and re-added, leading to save failures when foreign keys reference the primary key, or silent reordering of composite primary keys.
updateTable compares PK column names in display order with primary_keys from the database (key order), causing a name change or an out-of-order composite PK to be treated as a PK change. Studio then drops and re-adds the PK in separate transactions, which fails when foreign keys reference it or silently reorders the PK.
Feature request to add SiaMeshTool that scrapes web content via a third-party endpoint using x402 Solana USDC micro-payments. The endpoint is not officially vetted and could expose users to prompt injection, SSRF, or financial loss if compromised.
updateTable compares primary key column names in display order with the backend's primary_keys array (which comes back in key order). A rename or an out-of-order composite primary key like (b, a) is falsely detected as a PK change, causing Studio to drop and re-add the constraint in separate transactions. This fails when a foreign key references the primary key, blocking unrelated edits, or silently rebuilds the constraint and reorders columns when no FK exists.
The feature request proposes adding a SiaMeshTool that uses x402 micropayments and sanitized scraping. Without proper validation, error handling, and security review, this could expose agents to malicious endpoints, prompt injection, and payment interception.
The feature request proposes adding a SiaMeshTool that scrapes URLs via a hardcoded third-party endpoint with x402 micro-payments. If implemented naively, it exposes LangChain agents to SSRF attacks aimed at internal services and allows unauthorized micro-payments.
After upgrading to Next.js 16.3.8, deployments that patch the existing .next directory in place (rather than recreating it) leave stale route-cache entries, causing 404s for CSS/JS assets. The root cause is that the route-cache key no longer includes a build identifier, so cached entries from the previous build remain valid after a new deploy.
Next.js 16.3.8 introduced a regression where the route-cache key no longer depends on the build ID. In non-atomic in-place deployments that patch the .next directory without clearing .next/server/route-cache, stale cache entries reference old hashed assets, causing 404s for CSS and JS files after deployment.
After an in-place deployment that patches the .next directory without clearing runtime caches, Next.js 16.3.8 and 16.4.0-canary.60 reuse stale route-cache entries, causing 404s for CSS and JS assets. The regression is linked to PR #99482, which changed the route cache key to no longer depend on the build output.
User reports project gcizehgpcztmqtqhveng is healthy in dashboard but its default supabase.co hostname resolves to NXDOMAIN; DNS record missing or not propagated.
When using next/font/google with adjustFontFallback: false, the generated CSS still includes the automatic fallback font family, causing the fallback to always be applied. This is a regression from Next.js 14.
Google Fonts occasionally returns extensionless URLs with a format('woff2') hint. Next.js font loaders assume a file extension in the URL, causing webpack to crash with a null regex match and Turbopack to split the URL query on '&', resulting in intermittent build failures.
The grep_search method in FilesystemFileSearchMiddleware fails to fall back to the Python search when ripgrep exits with an error (return code 2), because _ripgrep_search returns an empty dict instead of None when ripgrep rejects the regex pattern. This leads to a false 'No matches found' response for valid Python regexes like look-ahead/look-behind. Additionally, the max_file_size_mb parameter is not applied to the ripgrep command, causing inconsistent results between ripgrep and Python fallback paths.
When a client that has loaded a page from Next.js 16.1 performs a soft navigation (Link click) after the server is upgraded to 16.2, the old-format router state header sent by the client cannot be parsed by the new server, causing a 500 error. The issue only occurs when dynamic rendering is involved (e.g., using cookies()) because such requests always hit the server for RSC payload validation.
In Next.js 16.3.6 and 16.3.8, a render error during an in-flight server action causes the shell to suspend repeatedly, eventually throwing minified React error #482 and replacing the page with 'This page couldn't load' instead of rendering error.js.
The default `text_format='string'` path in `convert_to_openai_messages` directly accesses `block["type"]` while collapsing content blocks, causing a `KeyError` for legitimate Bedrock Converse content blocks that lack a `type` key. The same blocks pass through correctly when `text_format='block'` is used, violating the promise of `pass_through_unknown_blocks=True`.
Soft navigation breaks with a 500 error when a client that loaded a 16.1 app navigates after a server upgrade to 16.2, because the router state header format/encoding changed and the new server parser throws instead of falling back to a full navigation. The issue only occurs when at least one layout or page is dynamically rendered (e.g., uses cookies()).
After upgrading from Next.js 16.1 to 16.2, clients holding stale router state from the previous deployment send a header that the newer server cannot parse, causing a 500 error and failed soft navigation on dynamic routes/pages.
When using custom header patterns (e.g., **, ***) and strip_headers=False, nested custom headers are split into separate chunks instead of being merged into a single chunk like standard Markdown headers. This creates a header-only chunk for the parent header, which can degrade downstream processing.
自托管Supabase的Edge Functions测试面板始终返回通用错误消息，因为Studio期望error键，但自托管worker返回message键。修复将worker错误响应键从msg改为error，与平台对齐。
next/font/google currently throws a build error when axes are combined with a discrete weight (e.g., weight: ['700']) on a variable font, even though Google Fonts supports this request shape. The fix removes the overly strict validation.
When a page calls notFound(), the server-rendered HTML includes correct metadata from not-found.tsx, but after client hydration the metadata is replaced by the root layout's metadata because the Flight payload lacks the fallback's metadata. This causes incorrect document head and can harm SEO.
The `IQueryModifier` interface in pg-meta declares `toSql()` with no parameters, but the `QueryModifier` class and internal callers require an optional `options` argument. This type mismatch can cause TypeScript compile errors for consumers using the interface.
The MarketingForm component's handleSubmit logic incorrectly enforces groupRequired only among checkboxes that themselves have groupRequired: true, and skips individual required validation for grouped checkboxes. This causes a false validation failure when a group mixes groupRequired flags and silently drops required enforcement for grouped checkboxes with required: true.
In the Supabase dashboard Extensions table, longer descriptions are rendered without wrapping or max-width constraints, causing text to overflow behind the sticky 'Enabled' toggle column. This impacts readability and usability.
Next.js 16.3.0-canary.97 dev server logs a Network URL that is immediately blocked for hot reload due to cross-origin restrictions because the resolved networkHostname is not included in the default allowedDevOrigins.
The Supabase RLS documentation instructs users to grant SELECT/INSERT/UPDATE/DELETE to anon/authenticated after creating tables in the public schema, but these privileges are already granted by default. The actual required action—revoking the overbroad default grants—is missing. Additionally, TRUNCATE is included in the default grant and is not blocked by RLS, creating a silent security gap where authenticated or anonymous roles could wipe table data if a direct database path is available.
LangChain, LlamaIndex, and Pydantic
Pinecone, Chroma, Weaviate, Qdrant, and neighboring stores
Next.js, Supabase, and the surrounding app stack