Severity
Reports at this severity, newest stored first.
When a route segment uses <Suspense fallback={null}> and the content suspends initially, the InnerScrollHandler effect in layout-router.tsx returns early because no client rects are available, preventing the expected scroll-to-top on navigation. The scroll only occurs on a later navigation. A ResizeObserver-based fix ensures the effect reruns once the suspended content lays out.
User reports that project hostname qxvnbmwhyrinsarnazkb.supabase.co returns NXDOMAIN from public DNS (8.8.8.8) and Chrome reports DNS_PROBE_FINISHED_NXDOMAIN, despite the project being active in the Supabase Dashboard. This indicates a missing DNS record for the project's subdomain in the supabase.co zone, likely due to a provisioning failure.
The default `use cache` handler stores `streamToBuffer` results that may be small slices of a shared Buffer pool slab. Long-lived cache entries therefore retain whole pool slabs (64 KiB on Node 26) while the LRU only counts the slice's bytes, causing actual memory usage to exceed `cacheMaxMemorySize` by up to 22x.
After rotating the database password in the Supabase Dashboard, connections through the Supavisor Session Pooler begin failing with 'password authentication failed for user "postgres"' despite using the correct new password. The issue is likely caused by Supavisor's secret synchronization not updating its cached credentials, as indicated by the repeated 'SecretChecker not started, using a one-off auth query connection' log message.
SummarizationMiddleware silently deletes conversation history and inserts the placeholder 'Previous conversation was too long to summarize.' when the only HumanMessage is outside the trimmed token window. The summary model is never called, and with a checkpointer the data loss is persisted.
When cacheComponents is enabled, the export worker serializes the entire batch of static pages' resume data caches into a single IPC message, exceeding Node's maximum string length. process.send throws RangeError: Invalid string length, which becomes an unhandledRejection, leaving the parent waiting indefinitely and causing the build to hang at 'Generating static pages'.
After logs.all removal, the unified logs table in the Management API endpoint does not expose source_name and returns backend error for basic SELECT * queries, blocking programmatic Edge Function log access.
When using ChatDeepSeek with default thinking mode enabled, bind_tools(tool_choice='any') (or True) gets normalized to tool_choice='required', which DeepSeek API rejects with HTTP 400. This is due to lack of validation in ChatDeepSeek for thinking mode constraints.
Next.js 16.2.0 and later respond with a 500 Internal Server Error when receiving an OPTIONS * request, whereas earlier versions correctly returned 400 Bad Request or another valid response. This regression affects both development and production servers.
Next.js cacheComponents span-creation exemption is applied after instrumentation.register() returns, but @vercel/otel FetchInstrumentation captures a concrete Tracer during register(); subsequent outgoing HTTP requests in prerender create spans through that unpatched tracer and trip the sync-IO guard, producing a Math.random() prerender error.
SSRFSafeTransport and SSRFSafeSyncTransport reconstruct pinned requests using request.content and hostname.encode('ascii'). This raises httpx.RequestNotRead for streaming bodies (generators, async generators, files, multipart) and UnicodeEncodeError for internationalized domain names, causing silent failures or crashes in URL-based utilities such as HTMLHeaderTextSplitter and ChatOpenAI token counting.
`InMemoryVectorStore` does not override `_select_relevance_score_fn`, so `similarity_search_with_relevance_scores` and the `similarity_score_threshold` retriever raise `NotImplementedError` even though the store computes cosine similarity internally.
SummarizationMiddleware invokes the summary model directly inside its before_model hook, bypassing the agent middleware pipeline. This means PIIMiddleware (including strategy='block') never inspects or redacts the summary prompt, allowing PII such as email addresses to be sent to an external summarization provider silently. The issue occurs regardless of middleware ordering in the affected versions unless external sanitization is added.
The langchain.mcp MCPAdapter lacks a supported path for externally managed bearer credentials to recover from HTTP 401 by re-reading tokens and retrying the same operation. The existing FastMCP/httpx2.Auth injection seam is undocumented and untested for this scenario, and terminal 401 errors are often swallowed or converted to generic errors by the MCP SDK, blocking classification. This issue requests a bounded, request-local retry mechanism and proper error propagation.
The documented Docker network host binding to 127.0.0.1 does not restrict access on macOS because Docker Desktop runs Docker inside a Linux VM, causing local Supabase services to remain reachable from other devices on the same LAN.
When a CSS file is imported by both a page and a component loaded with next/dynamic and kept mounted via _app, the stylesheet link is incorrectly marked with data-n-p and removed during client-side navigation. This happens because the dynamic CSS manifest is not loaded correctly in the route module and not passed to _document.
Regression in Next.js 16.0.3: detached-flush child spawned on dev server shutdown hangs after submitting telemetry when next.config leaves a live handle, causing orphaned processes to accumulate and consume large memory/CPU.
When using Next.js 16 with Turbopack (default bundler), importing a native Node addon (built with napi-rs) from a separate package in a pnpm workspace during server-side prerendering results in `TypeError: (void 0) is not a function`. The package is added to `serverExternalPackages`, but Turbopack still bundles or mishandles the native module, causing the imported binding to be undefined.
Manual mocks in Jest are no longer resolved automatically after upgrading to Next.js 13.2.4; the next/jest preset appears to have broken Jest's default __mocks__ lookup.
The fourth ALTER DEFAULT PRIVILEGES statement in the Supabase 'Securing your API' docs uses IN SCHEMA public to revoke EXECUTE on functions from PUBLIC, but schema-qualified default ACLs merge with PostgreSQL's built-in default instead of replacing it, so new functions remain callable by anon.
Next.js App Router client-side Link navigation to a route whose shared layout calls redirect triggers infinite RSC fetch loop; direct destination navigation works. Reproduced on Next 15.1.7 through 16.4.0-canary.57 with both webpack and Turbopack.
With pnpm v11's enableGlobalVirtualStore enabled, node_modules/next is a symlink to a global store outside the project root. Turbopack's filesystem resolution restricts access to the project root, causing 'Couldn't find the Next.js package' in dev mode. Webpack works; this is a Turbopack-specific limitation.
In Next.js 16.3.0 and later with optimisticRouting enabled by default, navigation from a dynamic segment to another dynamic route can fail to reset scroll position. This occurs when the app has a root parallel slot with a catch-all page returning null, alongside a sibling dynamic route. Predicted route trees reify stale params, causing a server mismatch and retry that consumes the scroll-ref on an empty catch-all leaf, so the new page retains the previous scroll offset.
When cacheComponents is true and htmlLimitedBots matches all bots, using runtime data (e.g. await connection()) inside generateMetadata causes Next.js 16 dev server to log 'did not produce a static shell and Next.js was unable to determine a reason', disrupting development and potentially affecting build/start.
In Next.js 15.5.4, metadata defined via 'export const metadata' is incorrectly rendered inside <body> instead of <head>, breaking Open Graph, Twitter Cards, and SEO. Downgrading to 15.2.4 restores correct behavior.
When reactCompiler and turbopackRustReactCompiler are enabled, the Rust React Compiler runs in the preprocess stage before user-registered swcPlugins, so macro plugins like @lingui/swc-plugin see compiler-hoisted JSX and emit incorrect message IDs, causing silent translation fallback and client/server mismatch.
revalidateTag or revalidatePath called after a Route Handler returns a streaming Response is queued but never executed, causing stale cache entries with no warning.
The v1 message converters in langchain-groq and langchain-mistralai do not filter out invalid_tool_call blocks, causing them to be passed to Groq and Mistral APIs. These providers may reject such blocks when replaying partial or malformed tool-call history, leading to runtime errors. Other providers (OpenAI, Anthropic, Fireworks) already filter these blocks.
When configuring Turbopack rules to treat `.css?url` imports as asset type, importing from a Server Component fails with 'css client asset is not css chunk placeable'. The same configuration works from Client Components and for other asset types like SVG.
Clicking a client-side <Link> to a route that calls redirect() never navigates and spins at ~100% CPU when the route builds as fully dynamic (ƒ) under cacheComponents=true. The redirect is caught by RedirectBoundary but never commits, so router.replace is never called. Direct visits work; only production client navigations are affected.