Severity
Reports at this severity, newest stored first.
Supabase infrastructure uses an obsolete tzdata package that defines Africa/Casablanca as UTC+1 instead of the correct UTC+0, causing all timestamps for this timezone to be shifted by one hour, disrupting queries, jobs, and client syncs.
When a route with dynamicParams:false calls notFound(), it returns 200 with not-found UI if a root loading.tsx and a sibling dynamicParams:true route exist. The 404 status is lost during streaming; the incremental cache stores a 200 response.
The ModelRouterMiddleware directly indexes self.models with classifier-provided choice, causing an opaque KeyError if the choice is not a configured route. This occurs for malformed or unexpected classifier responses, preventing clear error handling.
When a slow RSC fetch for a route fails after the user has navigated to another page via client-side navigation, Next.js incorrectly performs a full page load to the abandoned route's URL, disrupting the user experience.
Next.js server fetch patch mutates the caller's RequestInit object by deleting the `next` and `cache` fields, causing subsequent fetches with the same options object to lose cache configuration. This leads to prerender errors and broken dev caching when Cache Components are enabled.
In Next.js App Router, when a `useServerInsertedHTML` callback returns an empty Fragment (or null, empty array), the server still performs an additional React render for each streamed chunk because the callback result is always wrapped in a keyed Fragment, preventing the existing empty-result optimization in `getServerInsertedHTML()`. This leads to significant performance overhead in streaming scenarios with many Suspense boundaries.
SharedCacheControls stores cache-control metadata for every ISR path in a static Map without any eviction or bound, causing heap memory to grow without limit in production next start servers that generate many distinct ISR paths.
In Next.js Pages Router, calling res.revalidate('/') after a content publish can return success while the next request still serves the pre-publish version. This occurs when a normal background ISR render is already in-flight and reads data before publication; the on-demand revalidation reuses that in-flight render, and the stale result is persisted with a fresh cache timestamp.
Intermittent 401 PGRST303 errors occur because the Supabase API gateway mints a short-lived JWT with an iat claim based on its own clock, which can be ahead of the PostgREST instance's clock by more than the default validation leeway, causing PostgREST to reject the token as issued in the future.
Next.js 16.3 introduced a regression where route handler modules are not eagerly evaluated at startup, causing the first request to a route handler to pay full module evaluation cost. This increases cold start latency and p99 for deployments.
When the stdout of `next dev` (Turbopack) is piped to a reader that exits early (e.g., `head -N`), subsequent requests hang forever and the process consumes CPU (~1.3 cores) in a native spin. The server stops responding while TCP connections are accepted but never answered.
Next.js 15.4.1 introduced a regression where redirects combined with dynamic 'force-static' cause duplicate Location and x-nextjs-stale-time response headers. This can lead to malformed redirect URLs (e.g., '/redirect,/redirect') depending on how clients process the duplicate header.
Embedded inserts return PGRST204 because the request omits the `select` return filter. When `Prefer: return=representation` is used without `select`, PostgREST 14.5 infers return columns from the JSON payload and resolves the relationship key as a column of the parent table, causing the schema-cache lookup to fail.
The Supabase hosted shared transaction pooler at aws-1-eu-west-2.pooler.supabase.com:6543 presents a certificate chain where the intermediate CA ('Supabase Intermediate 2021 CA') lacks a Key Usage extension. Python 3.13 enables VERIFY_X509_STRICT by default in ssl.create_default_context(), causing certificate verification to fail with error 92 at depth 1. This prevents database connections using asyncpg 0.31.0 and OpenSSL 3.6.3, even when the correct root CA is trusted. The issue is reproducible without credentials and occurs before authentication.
AppRouterAnnouncer crashes after Chrome browser translation when the route announcement becomes empty. Chrome's translation replaces the text node, and React's `removeChild` fails because the node is no longer a child. Wrapping the announcement in a `<span key={routeAnnouncement}>` stabilizes reconciliation and avoids the crash.
In mixed App Router and Pages Router applications, Pages Router links to App Router routes trigger erroneous `_next/data` prefetch requests that return 404, and App Router links to Pages Router routes send RSC prefetch requests that receive HTML documents instead of Flight data.
A Pro plan user's project enters an unrecoverable restart loop after egress usage limit triggers account suspension, leaving the project inaccessible for over a month despite support attempts.
In Next.js 16.0.0–16.3.5 with `output: 'export'`, the generated RSC payload files use a directory-based path (`__next/page/__PAGE__.txt`), but the browser requests a flat dotted filename (`__next.page.__PAGE__.txt`), leading to 404 errors during link prefetching on statically exported sites.
Redirects issued from proxy.ts via NextResponse.redirect lose the `_rsc` query parameter while retaining the RSC request header, leading to an extra 307 validation redirect and potential cache poisoning when a shared cache keys on the URL.
When a client ancestor of a streamed Suspense boundary (e.g., a root layout provider) calls setState on mount while the boundary is still pending, React discards the server-rendered HTML and mounts the boundary as client-rendered, causing visible flash and duplicate elements. startTransition does not mitigate the issue.
Next.js App Router does not emit `<link rel="preload" as="style">` hints before blocking stylesheets in the initial HTML, forcing the browser preload scanner to wait until the parser encounters each `<link rel="stylesheet">`, which delays FCP.
In Next.js 16.3.5 with Turbopack, the web worker bootstrap parses its configuration from the URL hash. In-app browsers like Facebook/Instagram append query parameters (e.g. ?fbclid=abc) after the fragment, making the hash value invalid JSON and causing JSON.parse to throw, preventing worker startup.
ChatAnthropic's message serialization for SystemMessage does not preserve additional_kwargs such as output_config and clear_at. This causes per-message effort changes to be silently ignored and turn-scoped instructions to become persistent across later turns. Claude Sonnet 5.5 is also not recognized by the message-level system message capability check.
A tool using `InjectedToolCallId` receives the wrong tool_call_id when the custom args_schema omits the injected field and the ToolCall args contain a key `tool_call_id`. The runtime ToolCall.id should always win, but currently the user-provided value from args is used, causing mismatch between tool body and ToolMessage.
The MarkdownListOutputParser in langchain-core uses a regex that only matches '-' and '*' as bullet markers, omitting '+'. As a result, parsing a Markdown list with '+' bullets returns an empty list instead of the expected items, causing silent data loss.
ChatOpenAI with use_responses_api=True sends temperature, top_p, and top_logprobs to the Responses API for gpt-6-astra, which does not support them, causing HTTP 400 errors. The issue is reproduced with langchain-openai==1.6.6.
When using langchain-openai with model o3 or o4-mini, passing a non-empty stop parameter results in a 400 error from OpenAI. The library does not validate unsupported parameters for these models.
When a static route's cache entry passes its `expire` time, Next.js sets `isOnDemandRevalidate = true` for the blocking regeneration. This causes `unstable_cache` to skip reading from the cache entirely, including the prerender resume data cache that was populated during the prospective prerender pass. As a result, the final pass fails with `NEXT_STATIC_GEN_BAILOUT` and returns HTTP 500.
Safari intermittently fails to fetch Supabase API endpoints because the CORS preflight response does not include the 'accept-profile' header (and possibly other custom headers) in Access-Control-Allow-Headers, causing the browser to reject the request with 'access control checks' errors.
On Vercel deployments, the root route's server-side usePathname() returns "/index" instead of "/", leading to React hydration error #418 and missing SSR output for client components that branch on pathname === "/".