Severity
Reports at this severity, newest stored first.
When using Anthropic's compaction beta with LangChain agents, invoking with print_mode="messages" or streaming with stream_mode="messages" causes a BadRequestError because the message content includes an unsupported 'index' field in compaction blocks.
When optimisticRoutes is enabled and a path is rewritten (e.g., /team → /en/team), the client applies an optimistic navigation state based on the unrewritten URL. This incorrectly sets the locale (or other dynamic params) to the raw path segment instead of the rewritten value, leading to flashing 404s, wrong data fetching, or transient wrong locale rendering until the server response resolves.
When a deploymentId is configured, Server Action responses do not include the x-nextjs-deployment-id header, so stale clients cannot detect version skew and attempt to apply incompatible flight data, causing a Turbopack runtime crash.
PIIMiddleware's state hooks scan only the most recent message of each type, so PII in earlier human messages, tool results, or assistant messages is passed to the model unredacted and 'block' strategy does not raise. This can leak sensitive data when history is supplied by external systems or multi-agent handoffs.
The bundled mini-css-extract-plugin v2.4.4 in Next.js does not respect matchResource (`!=!`) in importModule, causing relative asset paths in CSS url() to resolve against the wrong directory. This breaks asset references for any webpack loader using matchResource to emit CSS. Fixed upstream in mini-css-extract-plugin v2.10.2.
With partialPrefetching enabled, dynamic pages are rendered four times per request (request, runtime prefetch, shell upgrade x2). Timers scheduled during each render capture AsyncLocalStorage context and retain large React Flight request and cache state, causing memory retention of ~3.8 MiB per request for a 10-minute timer, up to 45 GiB at 20 rps.
The HuggingFaceEndpoint class discards the explicitly provided huggingfacehub_api_token when endpoint_url points to a dedicated Inference Endpoint served from *.endpoints.huggingface.cloud, because the internal _is_huggingface_hosted_url check does not recognise this hostname. This causes requests to protected endpoints to be sent without an Authorization header, resulting in 401 Unauthorized, and may silently replace the explicit token with a cached or environment token if present.
The filesystem middleware reads and writes files using the system's locale encoding instead of UTF-8. On Windows and other non-UTF-8 locales, non-ASCII content such as accents or CJK characters raises UnicodeEncodeError/UnicodeDecodeError or silently writes files in a non-UTF-8 encoding, breaking interoperability and causing tool call failures.
ChatAnthropic._assert_valid_model_configuration() only rejects manual thinking for models starting with claude-opus-5. Anthropic also rejects manual thinking for claude-opus-4-7, claude-opus-4-8, and claude-sonnet-5, so LangChain forwards invalid requests and the API returns HTTP 400.
When Next.js is started with `-H 127.0.0.1` behind a reverse proxy that sets `X-Forwarded-Proto: https`, middleware rewrites targeting the same server are incorrectly treated as external and proxied over the network using the `https` scheme against the plain-HTTP port, resulting in `write EPROTO ... wrong version number` and a 500 response. The root cause is an asymmetric normalization of loopback hostnames between the router server's `initUrl` and the URL exposed to middleware.
When using HumanInTheLoopMiddleware with an async agent (agent.ainvoke), the middleware's aafter_model method delegates to synchronous after_model, which calls interrupt(). In the async execution path, the LangGraph config context variable is not set, causing get_config() to raise RuntimeError, breaking the approval flow.
A cancelled request to /_next/image leaves a stale in-flight promise in the image optimization cache, causing subsequent requests for the same image URL to hang indefinitely until server restart.
Next.js 16.3.x uses httpxy for rewrites with a shared keep-alive agent, which can reuse an idle socket at the same moment the upstream closes it, causing a race condition that intermittently returns 500 on the second socket connection.
ChatGroq.bind_tools() does not consult the resolved model profile's tool_calling capability. For models like allam-2-7b that LangChain's own profile marks as tool_calling=False, bind_tools still formats and sends tool definitions to the Groq API, which returns HTTP 400 with "tool calling is not supported with this model".
BaseCumulativeTransformOutputParser converts incoming AIMessage to BaseMessageChunk using chunk.model_dump(), but BaseMessageChunk lacks tool_calls, causing tool calls to be dropped. This results in empty stream/astream output for non-streaming chat models (e.g., disable_streaming="tool_calling") even though invoke works correctly.
在 next dev 使用 Turbopack 时，编辑经过 turbopack.rules 配置的 loader 处理的文件会触发 loader 链执行两次。第一次调用传入文件旧内容，第二次传入新内容。对于依赖文件 mtime 或自行读取文件系统的 loader（如 @tailwindcss/turbopack），可能导致缓存陈旧，最终输出滞后一个编辑版本。Webpack 模式无此问题。
next/jest transformer imports server runtime code that monkey-patches process event methods, causing test file process.on() calls to attach listeners to the real Jest process, leading to memory leaks across test files.
Starting Next.js in a new JavaScript realm (e.g., Jest test files) wraps shared crypto functions without idempotency checks, leading to wrapper chains that retain previous realms and leak ~7.7 MB per realm.
Supabase infrastructure uses an obsolete tzdata package that defines Africa/Casablanca as UTC+1 instead of the correct UTC+0, causing all timestamps for this timezone to be shifted by one hour, disrupting queries, jobs, and client syncs.
When a route with dynamicParams:false calls notFound(), it returns 200 with not-found UI if a root loading.tsx and a sibling dynamicParams:true route exist. The 404 status is lost during streaming; the incremental cache stores a 200 response.
The ModelRouterMiddleware directly indexes self.models with classifier-provided choice, causing an opaque KeyError if the choice is not a configured route. This occurs for malformed or unexpected classifier responses, preventing clear error handling.
When a slow RSC fetch for a route fails after the user has navigated to another page via client-side navigation, Next.js incorrectly performs a full page load to the abandoned route's URL, disrupting the user experience.
Next.js server fetch patch mutates the caller's RequestInit object by deleting the `next` and `cache` fields, causing subsequent fetches with the same options object to lose cache configuration. This leads to prerender errors and broken dev caching when Cache Components are enabled.
In Next.js App Router, when a `useServerInsertedHTML` callback returns an empty Fragment (or null, empty array), the server still performs an additional React render for each streamed chunk because the callback result is always wrapped in a keyed Fragment, preventing the existing empty-result optimization in `getServerInsertedHTML()`. This leads to significant performance overhead in streaming scenarios with many Suspense boundaries.
SharedCacheControls stores cache-control metadata for every ISR path in a static Map without any eviction or bound, causing heap memory to grow without limit in production next start servers that generate many distinct ISR paths.
In Next.js Pages Router, calling res.revalidate('/') after a content publish can return success while the next request still serves the pre-publish version. This occurs when a normal background ISR render is already in-flight and reads data before publication; the on-demand revalidation reuses that in-flight render, and the stale result is persisted with a fresh cache timestamp.
Intermittent 401 PGRST303 errors occur because the Supabase API gateway mints a short-lived JWT with an iat claim based on its own clock, which can be ahead of the PostgREST instance's clock by more than the default validation leeway, causing PostgREST to reject the token as issued in the future.
Next.js 16.3 introduced a regression where route handler modules are not eagerly evaluated at startup, causing the first request to a route handler to pay full module evaluation cost. This increases cold start latency and p99 for deployments.
When the stdout of `next dev` (Turbopack) is piped to a reader that exits early (e.g., `head -N`), subsequent requests hang forever and the process consumes CPU (~1.3 cores) in a native spin. The server stops responding while TCP connections are accepted but never answered.
Next.js 15.4.1 introduced a regression where redirects combined with dynamic 'force-static' cause duplicate Location and x-nextjs-stale-time response headers. This can lead to malformed redirect URLs (e.g., '/redirect,/redirect') depending on how clients process the duplicate header.