Severity
Reports at this severity, newest stored first.
When a client component inside a Suspense boundary uses synchronous IO (e.g., Math.random or Date.now) during server rendering, the resumed segment omits the host elements rendered before the sync IO call. This causes a hydration mismatch (React error #418) and the boundary's fallback is replaced with an incomplete subtree.
When a server component calls notFound() inside a dynamic route, the SSR response contains an empty HTML shell with <html id="__next_error__"> instead of rendering the root layout and not-found.tsx content. This occurs because the not-found error is thrown during server rendering and caught by the outer app-render catch, which generates a minimal error document rather than re-rendering the tree with the not-found boundary active.
When a module using next/dynamic is imported by both Pages Router and App Router, ReactLoadablePlugin writes the App Router webpack module id into react-loadable-manifest.json, causing Pages Router client bundle to request the wrong dynamic chunk id and fail hydration with React error #418.
Client-side navigation to ISR pages can serve stale RSC payloads from browser cache without contacting the server, leading to mixed module versions and runtime errors after redeployment.
User reports that all saved SQL queries disappeared from Supabase Studio after a Supabase service incident and page refresh, but database functions remain. This suggests queries were stored in a non-persistent or less redundant location compared to functions.
When multiple SWC plugins are configured and Turbopack's persistent file system cache is enabled (default since Next.js 16.3.0), a restored cache can pair plugin modules with the wrong configuration objects, causing SWC plugin panics and build/dev failures.
File-system-cache `set()` omits the `.rsc` file for PPR routes, causing `get()` to treat the entry as missing after restart or eviction. This results in fallback shell re-rendering and stale RSC payloads for client navigation, leading to data inconsistency.
NomicEmbeddings.embed_image passes self.vision_model=None unconditionally to nomic.embed.image, overriding the SDK's default 'nomic-embed-vision-v1.5'; the SDK's response model assertion then fails with an empty AssertionError. The constructor overloads also omit vision_model, causing mypy call-overload errors.
In langchain-core v3 streaming, tool-call argument deltas are emitted as full snapshots of accumulated state, leading to O(n^2) event sizes for large arguments. This causes severe performance degradation and memory overhead in LangGraph Server and any consumer of the event stream.
Constructing ChatOllama, Ollama, or OllamaEmbeddings with a non-empty `client_kwargs` dict mutates that dict and its nested `headers` dict by injecting an `Authorization` header derived from base_url credentials. This leaks credentials into caller-owned objects and causes credentials from one URL to be sent to other hosts when the same dict is reused.
When a route is marked `dynamic = 'force-dynamic'`, fetches with `next: { revalidate: false }` are treated as uncached (revalidate: 0) due to a truthiness check in patch-fetch.ts, so each request hits the origin instead of using the Data Cache.
Creating or deleting a Send Email hook in the Supabase dashboard silently nullifies all custom SMTP fields and resets rate_limit_email_sent to default, leading to complete silent auth email failure when the hook is later disabled.
Supabase Studio's database password inputs (Reset database password and new project database password) only set autoComplete="off", which password managers like LastPass ignore. This allows the user's Supabase account password to be autofilled into the database password field, creating a credential reuse vulnerability and potential accidental database password exposure.
In Next.js 16.4.0 dev with Turbopack, Pages Router pages crash during hydration because required client modules are not included in any chunk. The regression was introduced by #97664, which seeded availability info from the _app chunk group into page chunk groups; in dev each entry has its own module graph, so availability items from _app are wrongly treated as already available, causing modules like a-page-only and b-boundary to be skipped.
On cold load with a delayed client component chunk, Next.js App Router repeatedly retries root hydration causing thousands of empty commits and significant main thread time. The issue is triggered by `useDeferredValue` calls in `Head` and `InnerLayoutRouter` that pass the current RSC value as the initial value even when no prefetch data exists during initial hydration. This leads to React scheduling deferred work that commits an empty tree, making hydration eligible to retry in a loop.
When a page calls notFound(), Next.js serves a minimal error shell (`__next_error__`) in the server HTML, omitting the root layout, `<html lang>` attribute, and the nearest not-found UI. This breaks accessibility, no-JS clients, and dynamic root layouts, and is inconsistent with the hydrated result. Affects App Router across multiple Next.js versions.
With default experimental.turbopackSharedRuntime enabled and cacheComponents true, the prerendered shell includes inline scripts for chunk bootstrap and performance timing that lack a nonce attribute, causing browser to block them under a strict nonce-based CSP. This prevents client-side hydration and interactivity.
The @next/codemod agents-md command computes the docs root path relative to the current working directory rather than the directory of the `--output` AGENTS.md file. In monorepos where the output file is at a different location (e.g. repo root) and Next.js is installed only in a workspace package, the generated root path is broken, causing agent tools to read nonexistent documentation paths.
When using ChatOllama with tool calling, ToolMessages are sent without the required tool_name field, so Ollama renders them as coming from an unknown tool. This breaks tool result matching for models that rely on the name, like Gemma 4.
ShellToolMiddleware currently defaults to HostExecutionPolicy, allowing arbitrary shell commands with only LLM guardrails. This feature request proposes an allow_list parameter to restrict executable commands, mitigating the risk of dangerous operations.
Project zvusdpixljxkxlxrrauj (Pro) experiences 5xx/504 errors on /auth/v1/* during weekday business hours, primarily affecting token refresh and user lookup endpoints. The issue is likely caused by database connection pool exhaustion in the GoTrue auth service under concurrent load, leading to requests exceeding the 60-second timeout.
When a native form POST (no JavaScript) targets a partially prerendered page, the Server Action executes but the response is only inlined Flight data with no HTML shell, leaving a blank page.
The LinkedIn OIDC provider builds its OAuth authorization and token URLs against api.linkedin.com instead of LinkedIn's documented www.linkedin.com endpoint, causing users with an active linkedin.com session to be forced to log in again on every sign-in attempt.
When Next.js is invoked from a directory other than the project root, relative imports in next.config.ts are resolved against the current working directory instead of the configuration file's own directory, leading to module resolution failures or loading incorrect files.
When Next.js is invoked from a directory other than the project root (e.g., `node app/node_modules/next/dist/bin/next build app`), relative imports in `next.config.ts` are resolved against `process.cwd()` instead of the config file's directory. This causes builds to fail with `Cannot find module` or silently load a wrong file if a similarly named file exists in the cwd. The issue affects the default SWC transpilation path and has been present since Next.js 15.0.0.
When building a Next.js project with next.config.ts from a working directory different from the project root, relative imports inside next.config.ts are resolved relative to process.cwd() rather than the config file's location. This causes module-not-found errors or, worse, silently loads a file with the same relative path from the current working directory, potentially applying unintended configuration.
The Table Editor's updateTable function incorrectly compares primary key column names in display order against the primary_keys array (which is in key order). This false mismatch causes the primary key constraint to be dropped and re-added, leading to save failures when foreign keys reference the primary key, or silent reordering of composite primary keys.
updateTable compares PK column names in display order with primary_keys from the database (key order), causing a name change or an out-of-order composite PK to be treated as a PK change. Studio then drops and re-adds the PK in separate transactions, which fails when foreign keys reference it or silently reorders the PK.
Feature request to add SiaMeshTool that scrapes web content via a third-party endpoint using x402 Solana USDC micro-payments. The endpoint is not officially vetted and could expose users to prompt injection, SSRF, or financial loss if compromised.
updateTable compares primary key column names in display order with the backend's primary_keys array (which comes back in key order). A rename or an out-of-order composite primary key like (b, a) is falsely detected as a PK change, causing Studio to drop and re-add the constraint in separate transactions. This fails when a foreign key references the primary key, blocking unrelated edits, or silently rebuilds the constraint and reorders columns when no FK exists.