Update dependency @opennextjs/cloudflare to v1.20.2 - #14
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
web4 | 1277175 | Jul 21 2026, 06:52 PM |
Vulnerable Libraries (2)
More info on how to fix Vulnerable Libraries in JavaScript. 👉 Go to the dashboard for detailed results. 📥 Happy? Share your feedback with us. |
Update dependency @opennextjs/cloudflare to v1.19.7
🚨 Report Summary
For more details view the full report in OpenZeppelin Code Inspector |
a343c05 to
860ee11
Compare
|
860ee11 to
6188618
Compare
76d837a to
39a2640
Compare
39a2640 to
390c8ad
Compare
390c8ad to
71b5f2a
Compare
71b5f2a to
e66cbb3
Compare
e66cbb3 to
b341db1
Compare
a9e6634 to
5fee50c
Compare
5fee50c to
217f2b2
Compare
217f2b2 to
4da8f57
Compare
|
4da8f57 to
83a6790
Compare
4a7a367 to
a4cc940
Compare
a4cc940 to
17b2e32
Compare
17b2e32 to
74b5ae7
Compare
74b5ae7 to
b3785c8
Compare
b3785c8 to
106163a
Compare
106163a to
da67846
Compare
da67846 to
b1b1ac5
Compare
b1b1ac5 to
792d860
Compare
792d860 to
acbbfd3
Compare
acbbfd3 to
e0a72eb
Compare
e0a72eb to
fd6e9c3
Compare
fd6e9c3 to
260c38d
Compare
| }, | ||
| "dependencies": { | ||
| "@opennextjs/cloudflare": "1.3.1", | ||
| "@opennextjs/cloudflare": "1.15.1", |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
| }, | ||
| "dependencies": { | ||
| "@opennextjs/cloudflare": "1.3.1", | ||
| "@opennextjs/cloudflare": "1.16.0", |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
1 similar comment
|
|



This PR contains the following updates:
1.3.1→1.20.2Release Notes
opennextjs/opennextjs-cloudflare (@opennextjs/cloudflare)
v1.20.2Compare Source
Patch Changes
#1312
38ea40bThanks @james-elicx! - fix: handle encoded middleware and cache paths safelyUpgrade
@opennextjs/awsto prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.#1313
766eee9Thanks @james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11#1306
97ef330Thanks @james-elicx! - fix: normalize Windows paths when patching the Turbopack runtimeEnsure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.
v1.20.1Compare Source
Patch Changes
#1297
780a21cThanks @james-elicx! - fix: disable response compression for skew protection API requestsAvoid truncated compressed Cloudflare API responses causing worker version lookups to fail during deployment.
v1.20.0Compare Source
Minor Changes
#1290
46c50fcThanks @james-elicx! - feature: add opt-in batch upload viarclonefor fast R2 cache population.Key Changes:
Optional
rcloneUpload: Install the optionalrclone.jspeer dependency and pass--rcloneto opt in torclonebased batch uploads.R2_ACCESS_KEY_IDR2_SECRET_ACCESS_KEYCF_ACCOUNT_IDExplicit Opt-in: The existing worker-based population path remains the default.
rcloneis only loaded when--rcloneis used for a remote cache.Clear Errors: The CLI reports missing credentials or a missing
rclone.jsinstallation when the option is used.Usage:
Install
rclone.js, then add the secrets in a.env/.dev.varsfile in your project root:pnpm add rclone.js pnpm approve-builds # select rclone.js pnpm rebuild rclone.js R2_ACCESS_KEY_ID=your_key R2_SECRET_ACCESS_KEY=your_secret CF_ACCOUNT_ID=your_account opennextjs-cloudflare deploy --rcloneYou can also set the environment variables for CI builds.
Notes:
rclonemay not be supported on all platforms.Patch Changes
#1289
eef243fThanks @thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges runBucketCachePurge.alarm()passed its tag bindings toSqlStorage.execas asingle array.
exec(query, ...bindings)is variadic over its bindings, so for amulti-tag
DELETE ... WHERE tag IN (?, ?, …)the binding count (1) disagreedwith the placeholder count (N) and
execthrew "Wrong number of parameterbindings" on every flush. On-demand
revalidateTagpurges therefore neverreached the Cloudflare cache, and with
bypassTagCacheOnCacheHitenabled pagesserved stale until the ISR TTL expired.
Spread the bindings, normalise the
INSERTto the same variadic form, andtighten the drain loop's guard from
while (tags.length >= 0)(which neverexits via the condition) to
while (tags.length > 0).#1291
51439b1Thanks @james-elicx! - fix: disable response compression when provisioning R2 cache bucketsAvoid truncated compressed Cloudflare API responses causing R2 cache bucket provisioning to fail.
v1.19.11Compare Source
Patch Changes
#1270
802047eThanks @alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mappingWorker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing
/_next/static/*requests to return 404 on past deployments. Versions are now filtered to those withworkers/triggered_byin{upload, version_upload}.Closes #1230
v1.19.10Compare Source
Patch Changes
#1261
780dd4fThanks @vicb! - Allow populating R2 when the domain is protected by Cloudflare AccessYou need to:
v1.19.9Compare Source
Patch Changes
3b35c6eThanks @vicb! - chore: bump Next.js to 15.5.18 / 16.2.6 and @opennextjs/aws to 4.0.2v1.19.8Compare Source
Patch Changes
#1256
9696cd0Thanks @vicb! - bump@opennextjs/awsto 4.0.1See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.0.1
v1.19.7Compare Source
Patch Changes
#1252
29fe15dThanks @vicb! - bump the number of retries for r2 cache uploadsIncrease the retry count from 5 to 15 with a capped exponential backoff to improve resilience against transient R2 write failures during cache population.
#1255
364b7d9Thanks @vicb! - Bump react and nextv1.19.6Compare Source
Patch Changes
#1246
5d2014fThanks @vicb! - fix: do not log expected expected D1 errorsThe
populateCachecommand adds columns to the D1 tag cache for SWR support.This is required for older deployments made before those column were added.
SQLite errors when the columns exist and we should not log those errors.
#1244
01babceThanks @tahmid-23! - fix: drop streaming wasm calls in Turbopack runtimeTurbopack replaces wasm imports using
WebAssembly.compileStreamingandWebAssembly.instantiateStreaming. These functions are not available inthe workerd runtime.
We add a helper
loadWasmChunkFn. This is a generated switch statementthat contains an import for each wasm chunk. We use static strings for
all imports to ensure that all necessary wasm chunks will be detected
and bundled for the final build.
The Turbopack patcher replaces the invocations in
loadWebAssemblyandloadWebAssemblyModule, using the synchronousWebAssembly.instantiateand redirecting to
loadWasmChunkFn.#1243
1c815deThanks @tahmid-23! - fix: detect object-valued conditionsThe pre-existing build condition transform logic had subtle errors:
(e.g. "workerd": { "import": ..., "require": ... })
Now, we fully support object conditions. Furthermore, we prune siblings,
unless its subtree also contains the build condition.
v1.19.5Compare Source
Patch Changes
dd7de1dThanks @vicb! - fix: add missing git ignored files for the migrate commandv1.19.4Compare Source
Patch Changes
#1221
a2679bfThanks @mushan0x0! - Stop bundling@vercel/og(and its ~1.4 MiBresvg.wasm) when the app does not use it.Next.js's
externalImporthelper keeps a dynamicimport("next/dist/compiled/@vercel/og/index.edge.js")in the emitted handler even for apps that never useImageResponse/opengraph-image. Previously this module was marked asexternalwhenuseOgwasfalse, which left Wrangler to resolve and bundle it — pulling in ~800 KiB of JS plusresvg.wasmand pushing many Workers over the Cloudflare free-tier 3 MiB gzip limit.When
useOgisfalse, the edge entry is now aliased to the existingthrow.jsshim, so the unreachable dynamic import resolves to a tiny module and the real@vercel/oglibrary is no longer pulled into the Worker bundle.#1208
2c5b472Thanks @edmundhung! - UseOPEN_NEXT_BUILD_IDinstead ofNEXT_BUILD_IDin the cache keys.As of Next 16.2
NEXT_BUILD_IDis a fixed value when deploymentId is set explicitly.See opennextjs/opennextjs-aws#1144
#1193
1e8d232Thanks @conico974! - Fix tag cache stale logicv1.19.3Compare Source
Patch Changes
#1215
608893eThanks @vicb! - Factor large repeated values in manifestsThis reduce the size of the generated code.
#1218
f0d0226Thanks @314systems! - removeprocess.versionoverrideRemove process.version / process.versions.node overrides now that unjs/unenv#493 is merged and shipped in [email protected] (project uses 2.0.0-rc.24)
#1199
32594d6Thanks @SdSadat! - fix(cli): fail fast in non-TTY environments instead of hanging on config-creation promptsWhen
open-next.config.ts(orwrangler.(toml|json|jsonc)) is missing, the CLIprompts the user to auto-create it. In non-TTY environments (Cloudflare Workers
Builds, Docker, CI) the Enquirer prompt can't read stdin, so the build hangs or
fails with a truncated prompt and a cryptic exit code — the user sees
? Missing required open-next.config.ts file, do you want to create one? (Y/n)and then
ELIFECYCLE Command failed with exit code 13, with no hint at whatto do next.
Now, in non-interactive environments, both prompts throw an actionable error
with the exact template to paste (for
open-next.config.ts) or point at theexisting
--skipWranglerConfigCheck/SKIP_WRANGLER_CONFIG_CHECKescapehatch (for the wrangler config). Interactive behavior is unchanged.
v1.19.2Compare Source
Patch Changes
#1207
0958726Thanks @edmundhung! - bump@opennextjs/awsto 3.10.2See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.10.2
#1139
79b01b8Thanks @james-elicx! - Fix Turbopack external module resolution by dynamically discovering external imports at build time.When packages are listed in
serverExternalPackages, Turbopack externalizes them viaexternalImport()which uses dynamicawait import(id). The bundler (ESBuild) can't statically analyzeimport(id)with a variable, so these modules aren't included in the worker bundle.This patch:
.next/node_modules/symlinks (e.g.shiki-43d062b67f27bbdc→shiki)externalImport("shiki")) and subpath imports (e.g.shiki/engine/javascript)switch/caseentries so the bundler can statically resolve and include these modules#1203
6f02d12Thanks @314systems! - fix: exclude unsupported Next.js 16 releases from peer dependencies.The previous range allowed Next.js 16.0.0 through 16.2.2 without a peer dependency warning because
>=16.2.3was already covered by>=15.5.15.The range now explicitly supports Next.js 15.5.15 and above in the 15.x line, and Next.js 16.2.3 and above in the 16.x line.
#1200
7820ad0Thanks @NathanDrake2406! - fix: reuse sharded tag data when filling the regional cache.The sharded tag cache miss path already reads tag data from the Durable Object before answering the request. Reuse that fetched data when populating the regional cache so a shard miss does not immediately trigger a second identical Durable Object read.
#1206
585795dThanks @314systems! - fix: regression where getEnvFromPlatformProxy received wrong options typeThis fixes a regression introduced in 32ba91a where
getEnvFromPlatformProxycall sites passedOpenNextConfigeven though the function expects WranglerGetPlatformProxyOptions.The fix restores the pre-32ba91a argument shape by passing
{ configPath, environment }from CLI arguments, so env resolution follows the selected Wrangler config/environment.v1.19.1Compare Source
Patch Changes
236ce14Thanks @fatihy101! - fix(tag-cache): forwardisStale()inwithFilterv1.19.0Compare Source
Minor Changes
#1168
9a26846Thanks @conico974! - Add support for SWR (stale-while-revalidate) inrevalidateTagSee the AWS implementation for more details.
Patch Changes
#1184
c7d6425Thanks @vicb! - fix for Next.js CVE-2026-23869See the CVE-2026-23869 summary for details.
This CVE is fixed by bumping the minium Next.js release version to 15.5.15/16.2.3
#1177
e814a63Thanks @conico974! - Fixuse cachenot working as expected in Next 16+v1.18.1Compare Source
Patch Changes
#1176
2232651Thanks @conico974! - fix for OG with Next 16.2.2#1166
f89fba1Thanks @ash1day! - fix: sort.endsWith()checks by path length descending to prevent suffix collisions in dynamic requiresRoutes whose paths are suffixes of other routes (e.g.
/test/appvs/) were resolved incorrectly because the shorter path matched first in the generated.endsWith()chain. Sorting by path length descending ensures more specific (longer) paths are always checked first.Fixes #1156.
v1.18.0Compare Source
Minor Changes
#1159
75f5f0aThanks @edmundhung! - Use remote dev for R2 cache populationUsing remote dev is not subject to the Cloudflare API rate limit of 1,200 requests per 5 minutes that caused failures for large applications with thousands of prerendered pages.
v1.17.3Compare Source
Patch Changes
#1160
161e726Thanks @matthewvolk! - fix(patches): includeprefetch-hints.jsonin loadManifest build-time inliningNext.js 16.2.0 introduced
prefetch-hints.jsonas a new server manifest loaded unconditionallyby
NextNodeServer.getPrefetchHints(). The file exists in the build output but wasn't matched bythe glob pattern
*-manifest.json, causing the patchedloadManifest()to throw at runtime.v1.17.2Compare Source
Patch Changes
#1151
a143282Thanks @nathanschram! - fix: handle known optional manifests gracefully in loadManifest/evalManifest patchesNext.js loads certain manifests with
handleMissing: true(returning{}when the file doesn'texist). The adapter's build-time glob scan doesn't find these files when they're conditionally
generated, so the patched function threw at runtime, crashing dynamic routes with 500.
Instead of a blanket catch-all, handle only the specific optional manifests from Next.js
route-module.ts:react-loadable-manifest(Turbopack per-route, not all routes have dynamic imports)subresource-integrity-manifest(only whenexperimental.sriconfigured)server-reference-manifest(App Router only)dynamic-css-manifest(Pages Router + Webpack only)fallback-build-manifest(only for/_errorpage)prefetch-hints(new in Next.js 16.2)_client-reference-manifest.js(optional for static metadata routes, evalManifest)Manifest matching strips
.jsonbefore comparison since some Next.js constants omitthe extension (
SUBRESOURCE_INTEGRITY_MANIFEST,DYNAMIC_CSS_MANIFEST, etc.).Unknown manifests still throw to surface genuine errors.
Fixes #1141.
v1.17.1Compare Source
Patch Changes
f5bd138Thanks @vicb! - make dev /cdn-cgi/image behaves like prod for consistencyv1.17.0Compare Source
Minor Changes
25d5835Thanks @dario-piotrowicz! - Update themigratecommand to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.v1.16.6Compare Source
Patch Changes
4487f1fThanks @james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.v1.16.5Compare Source
Patch Changes
#1127
2b437f1Thanks @dario-piotrowicz! - In themigratecommand, add an initial step to create a Next.js config file (required by open-next) if it doesn't exist#1126
8c3a36eThanks @alex-all3dp! - fix: prevent Worker hang on HEAD requests to static assetsv1.16.4Compare Source
Patch Changes
#1122
6c94a4aThanks @dario-piotrowicz! - Inmigratecommand, avoid adding unnecessary newlines when creating files#1122
6c94a4aThanks @dario-piotrowicz! - fixmigratecommand incorrectly erroring if the target application doesn't have apublicdirectory#1122
6c94a4aThanks @dario-piotrowicz! - Bump@opennextjs/awsto 3.9.16migratecommand not updating Next.js config filesSee details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.16
#1097
fea645fThanks @dario-piotrowicz! - Add--helpand--versionto theopennextjs-cloudflareCLIImprove the
opennextjs-cloudflareCLI by:opennextjs-cloudflare foo) display a clear and helpful error message-h|--helpflag to display the CLI's help message-v|--versionflag to display the package's versionv1.16.3Compare Source
Patch Changes
#1113
09c41f1Thanks @anonrig! - bump@opennextjs/awsto 3.9.15See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.15
v1.16.2Compare Source
Patch Changes
e6938a0Thanks @vicb! - allow using a regional cache with KVv1.16.1Compare Source
Patch Changes
8676c78Thanks @vicb! - EmptyNextNodeServer#handleNextImageRequestto avoid pulling unneeded deps (in #1098)v1.16.0Compare Source
Minor Changes
#1083
b062597Thanks @dario-piotrowicz! - feature: addmigratecommand to set up OpenNext for Cloudflare adapterThis command helps users migrate existing Next.js applications to the OpenNext Cloudflare adapter by automatically setting up all necessary configuration files, dependencies, and scripts.
To use the command simply run:
npx opennextjs-cloudflare migratePatch Changes
#1092
4279043Thanks @vicb! - Check for supported Next versionThe build will now error for unsupported Next version which may contain unpatched security vulnerabilities.
You can bypass the check using the
--dangerouslyUseUnsupportedNextVersionflag.v1.15.1Compare Source
Patch Changes
74302ecThanks @vicb! - fix the detection of the runtime (webpack vs turbopack)v1.15.0Compare Source
Minor Changes
ae3d43dThanks @vicb! - Next 16 is now supportedPatch Changes
#1076
c99eefdThanks @vicb! - fix: do not bundle og when not usedThis saves ~500kB when og is not used
#1079
6ac789aThanks @vicb! - fix: use the correct runtime (i.e. webpack or turbopack)#1078
249f738Thanks @vicb! - drop unused react-dom modulesThis saves ~500kB on the output bundle
v1.14.10Compare Source
Patch Changes
#1071
886c742Thanks @vicb! - fix: patch Next config for missing fields.There was a regression in Next 16.1.0 (vercel/next.js#86830) and some fields were missing in the config.
The Next team fixed that in 16.1.4 (vercel/next.js#88733).
This PR introduce a patch for 16.1.0-16.1.3
v1.14.9Compare Source
Patch Changes
#1070
f7c6b3aThanks @vicb! - bump@opennextjs/awsto 3.9.8See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.8
#1057
0230cbeThanks @vicb! - Do not inject setImmediate/clearImmediate in the global scope#1069
4ee4ba3Thanks @vicb! - Check that wrangler is >= 4.59.2 when building Next 16.1+.To ensure
workerdhas a required fix tosetImmediatev1.14.8Compare Source
Patch Changes
9222070Thanks @vicb! - fix r2 bulk put to respect bucket jurisdictionv1.14.7Compare Source
Patch Changes
d447125Thanks @vicb! - Support composable cache in Next 16v1.14.6Compare Source
Patch Changes
#1043
c83cb83Thanks @vicb! - fix for CVE-2025-67779See https://nextjs.org/blog/security-update-2025-12-11
v1.14.5Compare Source
Patch Changes
#1042
763c4ecThanks @vicb! - Bump Next, React, and @opennextjs/aws to fix vulnerabilities (CVE-2025-55184 and CVE-2025-55183)See https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components
See https://nextjs.org/blog/security-update-2025-12-11
See https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.5
#1034
721bff0Thanks @james-elicx! - output more wrangler command logs when the command fails#1023
a4a2f02Thanks @dario-piotrowicz! - When runningwrangler deployadd aOPEN_NEXT_DEPLOYenvironment variable to let wrangler know that it is being run by open-nextv1.14.4Compare Source
Patch Changes
#1020
07919d8Thanks @dario-piotrowicz! - Add missing WORKER_SELF_REFERENCE service binding in the wrangler.jsonc that the CLI creates#1032
1de4899Thanks @vicb! - fix(images): allow any local path when no localPatterns are specifiedv1.14.3Compare Source
Patch Changes
#1025
c3aba94Thanks @vicb! - bump@opennextjs/awsto 3.9.4See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.4
#1025
c3aba94Thanks @vicb! - Bump Nextv1.14.2Compare Source
Patch Changes
#1021
250aba2Thanks @vicb! - bump@opennextjs/awsto 3.9.3See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.3
#1021
250aba2Thanks @vicb! - Bump Nextv1.14.1Compare Source
Patch Changes
#1016
2200b4bThanks @vicb! - Update e2e tests to Next 16 (webpack)#1015
e8971cdThanks @vicb! - memory queue: retrieve the preview ID fromprocess.env#1012
5f6c0a6Thanks @pilcrowonpaper! - Add image binding to Wrangler configuration template file#1017
a6904a4Thanks @vicb! - fix:response.validatewith the turbo pages runtime#1014
f4b53b9Thanks @vicb! - bump@opennextjs/awsto 3.9.1See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.1
#1019
2a3ee86Thanks @vicb! - awaitheaders()v1.14.0Compare Source
Minor Changes
50d7427Thanks @pilcrowonpaper! - feat: support image optimization using the image bindingv1.13.1Compare Source
Patch Changes
#1001
fdf61b4Thanks @vicb! - Bump wrangler to ^4.49.1#998
f69787cThanks @vicb! - Warn when using Next 16v1.13.0Compare Source
Minor Changes
b95e7caThanks @vicb! - usewrangler r2 bulk putfor R2 cache populationPatch Changes
#994
ab2d805Thanks @vicb! - bump@opennextjs/awsto 3.9.0See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.0
v1.12.0Compare Source
Minor Changes
#973
8cb7669Thanks @petebacondarwin! - Add standard Next template generated from create-next-app that will be used by create-cloudflare going forward#983
68aed26Thanks @vicb! - feat: turbopack supportv1.11.1Compare Source
Patch Changes
#968
ddb0589Thanks @rgembalik! - fix: Compiled config is now imported usingpathToFileURLto avoid crashes on Windows.#958
7edf91cThanks [@vicb](https:/Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
This change is