Repository navigation
[16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 - #97949
Merged
Merged
Conversation
Contributor
Stats from current PR🔴 1 regression, 3 improvements
📊 All Metrics📖 Metrics GlossaryDev Server Metrics:
Build Metrics:
Change Thresholds:
⚡ Dev Server
📦 Dev Server (Webpack) (Legacy)📦 Dev Server (Webpack)
⚡ Production Builds
📦 Production Builds (Webpack) (Legacy)📦 Production Builds (Webpack)
📦 Bundle SizesBundle Sizes⚡ TurbopackClient Main Bundles
Server Middleware
Build DetailsBuild Manifests
Build Cache
📦 WebpackClient Main Bundles
Polyfills
Pages
Server Edge SSR
Middleware
Build DetailsBuild Manifests
Build Cache
🔄 Shared (bundler-independent)Runtimes
📝 Changed Files (33 files)Files with changes:
View diffsapp-page-exp..ntime.dev.jsfailed to diffapp-page-exp..time.prod.jsfailed to diffapp-page-tur..ntime.dev.jsfailed to diffapp-page-tur..time.prod.jsfailed to diffapp-page-tur..ntime.dev.jsfailed to diffapp-page-tur..time.prod.jsfailed to diffapp-page.runtime.dev.jsfailed to diffapp-page.runtime.prod.jsfailed to diffapp-route-ex..ntime.dev.jsDiff too large to display app-route-ex..time.prod.jsDiff too large to display app-route-tu..ntime.dev.jsDiff too large to display app-route-tu..time.prod.jsDiff too large to display app-route-tu..ntime.dev.jsDiff too large to display app-route-tu..time.prod.jsDiff too large to display app-route.runtime.dev.jsDiff too large to display app-route.ru..time.prod.jsDiff too large to display dev-validati..ntime.dev.jsfailed to diffdev-validati..ntime.dev.jsfailed to diffdev-validati..ntime.dev.jsfailed to diffdev-validati..ntime.dev.jsfailed to diffpages-api-tu..ntime.dev.jsDiff too large to display pages-api-tu..time.prod.jsDiff too large to display pages-api.runtime.dev.jsDiff too large to display pages-api.ru..time.prod.jsDiff too large to display pages-turbo...ntime.dev.jsDiff too large to display pages-turbo...time.prod.jsDiff too large to display pages.runtime.dev.jsDiff too large to display pages.runtime.prod.jsDiff too large to display server.runtime.prod.jsDiff too large to display use-cache-pr..ntime.dev.jsDiff too large to display use-cache-pr..ntime.dev.jsDiff too large to display use-cache-pr..ntime.dev.jsDiff too large to display use-cache-pr..ntime.dev.jsDiff too large to display 📎 Tarball URLCommit: c09d784 |
Contributor
Tests PassedCommit: 9bcdbf9 |
styfle
approved these changes
Aug 26, 2026
eps1lon
marked this pull request as ready for review
August 26, 2026 20:24
eps1lon
force-pushed
the
sebbie/backport-97931-to-next-16-3
branch
from
August 31, 2026 09:24
c09d784 to
9bcdbf9
Compare
elstonyth
added a commit
to elstonyth/Polycards
that referenced
this pull request
Sep 2, 2026
Both are pinned to an exact version in package.json and are moved together, so eslint-config-next never lints against a Next it does not match — the same lockstep reasoning .github/dependabot.yml applies to react/react-dom. 16.3.4 is a backport release on top of 16.3.3. It re-enables AVIF image optimization (vercel/next.js#97949) and backports three fixes: infinite recursion in the testmode passthrough fetch, a build error when aliasing typescript to @typescript/typescript6, and an unset crossOrigin in Turbopack manifests. The AVIF change does not alter this storefront's output. next.config.ts sets no images.formats, so the default applies either way; 16.3.4 restores a capability rather than flipping a default. Kept out of the grouped in-range sweep on purpose: dependabot.yml excludes next from grouped bumps so a framework change stays individually reviewable. Verified: `npm run build` succeeds (clean .next), `tsc --noEmit` passes. `npm run lint` reports 141 problems / 2 errors, which is byte-identical to the same command on master at 16.3.3 — pre-existing, not introduced here, and not part of the CI quality gate. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
steffen74
pushed a commit
to eduhub-org/eduhub
that referenced
this pull request
Sep 8, 2026
16.3.4 was published 2026-08-31 20:00 UTC and became eligible under the playbook's 7-day cool-down at 2026-09-07 20:00 UTC. It re-enables AVIF image optimization (vercel/next.js#97949) and raises its sharp floor from ^0.35.3 to ^0.35.4, so it must not reach a branch that has not already taken sharp 0.35.4 — on 0.35.3 it would re-open GHSA-2xp9-vwfh-vxw4, the critical unauthenticated AVIF RCE. This branch resolves sharp 0.35.4 (libheif 1.23.2), so the re-enable lands on the fixed codec. Verified: yarn install --immutable, build, lint, test all pass, and an AVIF encode/decode/re-optimize round-trip succeeds on the installed native binary. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
10 of 12 tasks
1 task
This was referenced Sep 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports #97931
Part of Part of https://linear.app/vercel/issue/VOC-34654/