conductor-oss 0.61.21 → 0.61.23

package/web/.next/standalone/node_modules/next/dist/lib/patch-incorrect-lockfile.js

@@ -72,7 +72,7 @@ async function fetchPkgInfo(pkg) {
         });
     }
     const data = await res.json();
-    const versionData = data.versions["16.2.6"];
+    const versionData = data.versions["16.2.11"];
     return {
         os: versionData.os,
         cpu: versionData.cpu,
@@ -100,7 +100,7 @@ async function patchIncorrectLockfile(dir) {
     const expectedSwcPkgs = Object.keys(_packagejson.optionalDependencies || {}).filter((pkg)=>pkg.startsWith('@next/swc-'));
     const patchDependency = (pkg, pkgData)=>{
         lockfileParsed.dependencies[pkg] = {
-            version: "16.2.6",
+            version: "16.2.11",
             resolved: pkgData.tarball,
             integrity: pkgData.integrity,
             optional: true
@@ -108,7 +108,7 @@ async function patchIncorrectLockfile(dir) {
     };
     const patchPackage = (pkg, pkgData)=>{
         lockfileParsed.packages[pkg] = {
-            version: "16.2.6",
+            version: "16.2.11",
             resolved: pkgData.tarball,
             integrity: pkgData.integrity,
             cpu: pkgData.cpu,

package/web/.next/standalone/node_modules/next/dist/server/app-render/action-handler.js

@@ -125,7 +125,6 @@ function addRevalidationHeader(res, { workStore, requestStore }) {
 /**
  * Forwards a server action request to a separate worker. Used when the requested action is not available in the current worker.
  */ async function createForwardedActionResponse(req, res, host, workerPathname, basePath) {
-    var _getRequestMeta;
     if (!host) {
         throw Object.defineProperty(new Error('Invariant: Missing `host` header from a forwarded Server Actions request.'), "__NEXT_ERROR_CODE", {
             value: "E226",
@@ -138,13 +137,35 @@ function addRevalidationHeader(res, { workStore, requestStore }) {
     // we use this to skip rendering the flight tree so that we don't update the UI
     // with the response from the forwarded worker
     forwardedHeaders.set('x-action-forwarded', '1');
-    const proto = ((_getRequestMeta = (0, _requestmeta.getRequestMeta)(req, 'initProtocol')) == null ? void 0 : _getRequestMeta.replace(/:+$/, '')) || 'https';
-    // For standalone or the serverful mode, use the internal origin directly
-    // other than the host headers from the request.
-    const origin = process.env.__NEXT_PRIVATE_ORIGIN || `${proto}://${host.value}`;
+    // TODO: Remove __NEXT_PRIVATE_ORIGIN
+    let origin = process.env.__NEXT_PRIVATE_ORIGIN;
+    if (origin === undefined) {
+        const initUrl = (0, _requestmeta.getRequestMeta)(req, 'initURL');
+        if (initUrl !== undefined) {
+            try {
+                const parsedUrl = new URL(initUrl);
+                origin = parsedUrl.origin;
+            } catch (error) {
+                throw Object.defineProperty(new Error('Could not determine origin for forwarded Server Actions request. This can happen if port or hostname are not configured for this server.', {
+                    cause: error
+                }), "__NEXT_ERROR_CODE", {
+                    value: "E1148",
+                    enumerable: false,
+                    configurable: true
+                });
+            }
+        } else {
+            throw Object.defineProperty(new _invarianterror.InvariantError('Missing initURL'), "__NEXT_ERROR_CODE", {
+                value: "E1147",
+                enumerable: false,
+                configurable: true
+            });
+        }
+    }
     const fetchUrl = new URL(`${origin}${basePath}${workerPathname}`);
     try {
-        var _response_headers_get;
+        var _response_headers_get, // Since we aren't consuming the response body, we cancel it to avoid memory leaks
+        _response_body;
         let body;
         if (// The type check here ensures that `req` is correctly typed, and the
         // environment variable check provides dead code elimination.
@@ -188,10 +209,15 @@ function addRevalidationHeader(res, { workStore, requestStore }) {
                 }
             }
             return new _flightrenderresult.FlightRenderResult(response.body);
-        } else {
-            var // Since we aren't consuming the response body, we cancel it to avoid memory leaks
-            _response_body;
-            (_response_body = response.body) == null ? void 0 : _response_body.cancel();
+        }
+        (_response_body = response.body) == null ? void 0 : _response_body.cancel();
+        // Pass the action-not-found marker through so the client throws
+        // UnrecognizedActionError instead of a generic "unexpected response".
+        if (response.headers.get(_approuterheaders.NEXT_ACTION_NOT_FOUND_HEADER) === '1') {
+            res.setHeader(_approuterheaders.NEXT_ACTION_NOT_FOUND_HEADER, '1');
+            res.setHeader('content-type', 'text/plain');
+            res.statusCode = 404;
+            return _renderresult.default.fromStatic('Server action not found.', 'text/plain');
         }
     } catch (err) {
         // we couldn't stream the forwarded response, so we'll just return an empty response
@@ -239,7 +265,6 @@ async function createRedirectRenderResult(req, res, originalHost, redirectUrl, r
     // `basePath` we treat it as an app-relative redirect;
     const appRelativeRedirectUrl = getAppRelativeRedirectUrl(basePath, originalHost, redirectUrl, currentPathname);
     if (appRelativeRedirectUrl) {
-        var _getRequestMeta;
         if (!originalHost) {
             throw Object.defineProperty(new Error('Invariant: Missing `host` header from a forwarded Server Actions request.'), "__NEXT_ERROR_CODE", {
                 value: "E226",
@@ -249,10 +274,31 @@ async function createRedirectRenderResult(req, res, originalHost, redirectUrl, r
         }
         const forwardedHeaders = getForwardedHeaders(req, res);
         forwardedHeaders.set(_approuterheaders.RSC_HEADER, '1');
-        const proto = ((_getRequestMeta = (0, _requestmeta.getRequestMeta)(req, 'initProtocol')) == null ? void 0 : _getRequestMeta.replace(/:+$/, '')) || 'https';
-        // For standalone or the serverful mode, use the internal origin directly
-        // other than the host headers from the request.
-        const origin = process.env.__NEXT_PRIVATE_ORIGIN || `${proto}://${originalHost.value}`;
+        // TODO: Remove __NEXT_PRIVATE_ORIGIN
+        let origin = process.env.__NEXT_PRIVATE_ORIGIN;
+        if (origin === undefined) {
+            const initUrl = (0, _requestmeta.getRequestMeta)(req, 'initURL');
+            if (initUrl !== undefined) {
+                try {
+                    const parsedUrl = new URL(initUrl);
+                    origin = parsedUrl.origin;
+                } catch (error) {
+                    throw Object.defineProperty(new Error('Could not determine origin for forwarded Server Actions request. This can happen if port or hostname are not configured for this server.', {
+                        cause: error
+                    }), "__NEXT_ERROR_CODE", {
+                        value: "E1148",
+                        enumerable: false,
+                        configurable: true
+                    });
+                }
+            } else {
+                throw Object.defineProperty(new _invarianterror.InvariantError('Missing initURL'), "__NEXT_ERROR_CODE", {
+                    value: "E1147",
+                    enumerable: false,
+                    configurable: true
+                });
+            }
+        }
         const fetchUrl = new URL(`${origin}${appRelativeRedirectUrl.pathname}${appRelativeRedirectUrl.search}`);
         if (workStore.pendingRevalidatedTags) {
             var _workStore_incrementalCache_prerenderManifest_preview, _workStore_incrementalCache_prerenderManifest, _workStore_incrementalCache;
@@ -364,7 +410,8 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
     }
     // If the app has no server actions at all, we can 404 early.
     if (!hasServerActions()) {
-        return handleUnrecognizedFetchAction(getActionNotFoundError(actionId));
+        const error = actionId !== null && !(0, _serverreferenceinfo.mightBeServerReferenceId)(actionId) ? (0, _manifestssingleton.getInvalidServerReferenceIdError)(actionId) : (0, _manifestssingleton.getActionNotFoundError)(actionId);
+        return handleUnrecognizedFetchAction(error);
     }
     if (workStore.isStaticGeneration) {
         throw Object.defineProperty(new Error("Invariant: server actions can't be handled during static rendering"), "__NEXT_ERROR_CODE", {
@@ -445,10 +492,14 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
     res.setHeader('Cache-Control', 'no-cache, no-store, max-age=0, must-revalidate');
     const { actionAsyncStorage } = ComponentMod;
     const actionWasForwarded = Boolean(req.headers['x-action-forwarded']);
-    if (actionId) {
+    // Only attempt to forward if this request has not already been forwarded.
+    // Otherwise middleware that rewrites the action POST can cause the receiving
+    // worker to forward again, looping indefinitely.
+    if (actionId && !actionWasForwarded) {
         const forwardedWorker = (0, _manifestssingleton.selectWorkerForForwarding)(actionId, page);
-        // If forwardedWorker is truthy, it means there isn't a worker for the action
-        // in the current handler, so we forward the request to a worker that has the action.
+        // If forwardedWorker is truthy, it means there isn't a worker for the
+        // action in the current handler, so we forward the request to a worker that
+        // has the action.
         if (forwardedWorker) {
             return {
                 type: 'done',
@@ -463,6 +514,10 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
             // We only use these for fetch actions -- MPA actions handle them inside `decodeAction`.
             let actionModId;
             let boundActionArguments = [];
+            const defaultBodySizeLimit = '1 MB';
+            const bodySizeLimit = (serverActions == null ? void 0 : serverActions.bodySizeLimit) ?? defaultBodySizeLimit;
+            const bodySizeLimitBytes = bodySizeLimit !== defaultBodySizeLimit ? require('next/dist/compiled/bytes').parse(bodySizeLimit) : 1024 * 1024 // 1 MB
+            ;
             if (// The type check here ensures that `req` is correctly typed, and the
             // environment variable check provides dead code elimination.
             process.env.NEXT_RUNTIME === 'edge' && (0, _helpers.isWebNextRequest)(req)) {
@@ -473,13 +528,48 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                         configurable: true
                     });
                 }
-                // TODO: add body limit
                 // Use react-server-dom-webpack/server
                 const { createTemporaryReferenceSet, decodeReply, decodeAction, decodeFormState } = ComponentMod;
                 temporaryReferences = createTemporaryReferenceSet();
                 if (isMultipartAction) {
                     // TODO-APP: Add streaming support
-                    const formData = await req.request.formData();
+                    // Read the body stream with size tracking to enforce bodySizeLimitBytes.
+                    // We cannot call req.request.formData() directly as that would bypass
+                    // the body size limit entirely.
+                    const edgeChunks = [];
+                    let edgeBodySize = 0;
+                    const edgeReader = req.body.getReader();
+                    while(true){
+                        const { done, value } = await edgeReader.read();
+                        if (done) break;
+                        edgeBodySize += value.byteLength;
+                        if (edgeBodySize > bodySizeLimitBytes) {
+                            const { ApiError } = require('../api-utils');
+                            throw Object.defineProperty(new ApiError(413, `Body exceeded ${bodySizeLimit} limit.\n` + `To configure the body size limit for Server Actions, see: https://nextjs.org/docs/app/api-reference/next-config-js/serverActions#bodysizelimit`), "__NEXT_ERROR_CODE", {
+                                value: "E394",
+                                enumerable: false,
+                                configurable: true
+                            });
+                        }
+                        edgeChunks.push(value);
+                    }
+                    // Reconstruct a Blob from the buffered chunks and parse formData from it.
+                    // Note: we must pass the original Content-Type as an explicit header
+                    // rather than relying on the Blob's `type`. The Blob constructor
+                    // normalizes `type` to ASCII lowercase per the File API spec, which
+                    // would lowercase the multipart boundary parameter (e.g.
+                    // `boundary=----WebKitFormBoundaryAbCdEf`). The body bytes contain the
+                    // original mixed-case boundary delimiter, so a lowercased boundary
+                    // would fail to match and `formData()` would throw. An explicit header
+                    // on the Request takes precedence over the Blob's normalized type.
+                    const edgeBodyBlob = new Blob(edgeChunks);
+                    const formData = await new Request('http://n/', {
+                        method: 'POST',
+                        headers: {
+                            'content-type': req.headers['content-type'] ?? ''
+                        },
+                        body: edgeBodyBlob
+                    }).formData();
                     if (isFetchAction) {
                         // A fetch action with a multipart body.
                         try {
@@ -537,12 +627,22 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                     // In practice, this happens if `encodeReply` returned a string instead of FormData,
                     // which can happen for very simple JSON-like values that don't need multiple flight rows.
                     const chunks = [];
+                    let nonMultipartBodySize = 0;
                     const reader = req.body.getReader();
                     while(true){
                         const { done, value } = await reader.read();
                         if (done) {
                             break;
                         }
+                        nonMultipartBodySize += value.byteLength;
+                        if (nonMultipartBodySize > bodySizeLimitBytes) {
+                            const { ApiError } = require('../api-utils');
+                            throw Object.defineProperty(new ApiError(413, `Body exceeded ${bodySizeLimit} limit.\n` + `To configure the body size limit for Server Actions, see: https://nextjs.org/docs/app/api-reference/next-config-js/serverActions#bodysizelimit`), "__NEXT_ERROR_CODE", {
+                                value: "E394",
+                                enumerable: false,
+                                configurable: true
+                            });
+                        }
                         chunks.push(value);
                     }
                     const actionData = Buffer.concat(chunks).toString('utf-8');
@@ -562,10 +662,6 @@ async function handleAction({ req, res, ComponentMod, generateFlight, workStore,
                 // state prefix in minimal mode), use it instead of req.body
                 const actionBodyFromMeta = (0, _requestmeta.getRequestMeta)(req, 'actionBody');
                 const body = actionBodyFromMeta ? Readable.from(actionBodyFromMeta) : req.body;
-                const defaultBodySizeLimit = '1 MB';
-                const bodySizeLimit = (serverActions == null ? void 0 : serverActions.bodySizeLimit) ?? defaultBodySizeLimit;
-                const bodySizeLimitBytes = bodySizeLimit !== defaultBodySizeLimit ? require('next/dist/compiled/bytes').parse(bodySizeLimit) : 1024 * 1024 // 1 MB
-                ;
                 let size = 0;
                 const sizeLimitTransform = new Transform({
                     transform (chunk, encoding, callback) {
@@ -917,7 +1013,6 @@ async function executeActionAndPrepareForRender(action, args, workStore, request
  * the action came from a different deployment. It could also simply be an invalid POST request that is not a server action.
  * In either case, we'll throw an error to be handled by the caller.
  */ function getActionModIdOrError(actionId, serverModuleMap) {
-    var _serverModuleMap_actionId;
     // if we're missing the action ID header, we can't do any further processing
     if (!actionId) {
         throw Object.defineProperty(new _invarianterror.InvariantError("Missing 'next-action' header."), "__NEXT_ERROR_CODE", {
@@ -926,28 +1021,28 @@ async function executeActionAndPrepareForRender(action, args, workStore, request
             configurable: true
         });
     }
-    const actionModId = (_serverModuleMap_actionId = serverModuleMap[actionId]) == null ? void 0 : _serverModuleMap_actionId.id;
-    if (!actionModId) {
-        throw getActionNotFoundError(actionId);
+    const entry = serverModuleMap[actionId];
+    if (entry == null) {
+        // The proxy throws for malformed IDs and IDs that are missing from the
+        // manifest. It only returns undefined when the ID collides with a
+        // well-known property name (e.g. `toString`) that the proxy excludes from
+        // server reference validation so that framework reflection probes don't
+        // throw. Next.js never produces such an ID, so this is almost certainly a
+        // probe with a known-bad ID. Repeat the manifest's throw logic here so the
+        // caller gets a diagnosable error instead of a `TypeError`.
+        throw (0, _serverreferenceinfo.mightBeServerReferenceId)(actionId) ? (0, _manifestssingleton.getActionNotFoundError)(actionId) : (0, _manifestssingleton.getInvalidServerReferenceIdError)(actionId);
     }
-    return actionModId;
-}
-function getActionNotFoundError(actionId) {
-    return Object.defineProperty(new Error(`Failed to find Server Action${actionId ? ` "${actionId}"` : ''}. This request might be from an older or newer deployment.\nRead more: https://nextjs.org/docs/messages/failed-to-find-server-action`), "__NEXT_ERROR_CODE", {
-        value: "E974",
-        enumerable: false,
-        configurable: true
-    });
+    return entry.id;
 }
 const $ACTION_ = '$ACTION_';
 const $ACTION_REF_ = '$ACTION_REF_';
 const $ACTION_ID_ = '$ACTION_ID_';
-const ACTION_ID_EXPECTED_LENGTH = 42;
 /**
  * This function mirrors logic inside React's decodeAction and should be kept in sync with that.
  * It pre-parses the FormData to ensure that any action IDs referred to are actual action IDs for
  * this Next.js application.
  */ function areAllActionIdsValid(mpaFormData, serverModuleMap) {
+    let seenActionRefs = 0;
     let hasAtLeastOneAction = false;
     // Before we attempt to decode the payload for a possible MPA action, assert that all
     // action IDs are valid IDs. If not we should disregard the payload
@@ -962,6 +1057,12 @@ const ACTION_ID_EXPECTED_LENGTH = 42;
             }
             hasAtLeastOneAction = true;
         } else if (key.startsWith($ACTION_REF_)) {
+            if (++seenActionRefs > 2) {
+                // We only expect to see at most 2 $ACTION_REF_ fields in the form data:
+                // one from <form action="..." method="post">
+                // and one from <input action="..." type="submit">
+                return false;
+            }
             // Bound args case
             const actionDescriptorField = $ACTION_ + key.slice($ACTION_REF_.length) + ':0';
             const actionFields = mpaFormData.getAll(actionDescriptorField);
@@ -986,10 +1087,13 @@ function isInvalidStringActionDescriptor(actionDescriptor, serverModuleMap) {
         return true;
     }
     const from = ACTION_DESCRIPTOR_ID_PREFIX.length;
-    const to = from + ACTION_ID_EXPECTED_LENGTH;
+    const to = actionDescriptor.indexOf('"', from);
+    if (to === -1) {
+        return true;
+    }
     // We expect actionDescriptor to be '{"id":"<actionId>",...}'
     const actionId = actionDescriptor.slice(from, to);
-    if (actionId.length !== ACTION_ID_EXPECTED_LENGTH || actionDescriptor[to] !== '"') {
+    if (!(0, _serverreferenceinfo.mightBeServerReferenceId)(actionId)) {
         return true;
     }
     const entry = serverModuleMap[actionId];
@@ -1002,11 +1106,12 @@ function isInvalidActionIdFieldName(actionIdFieldName, serverModuleMap) {
     // The field name must always start with $ACTION_ID_ but since it is
     // the id is extracted from the key of the field we have already validated
     // this before entering this function
-    if (actionIdFieldName.length !== $ACTION_ID_.length + ACTION_ID_EXPECTED_LENGTH) {
+    const actionId = actionIdFieldName.slice($ACTION_ID_.length);
+    if (!(0, _serverreferenceinfo.mightBeServerReferenceId)(actionId)) {
         // this field name has too few or too many characters
+        // or it is otherwise in the wrong format
         return true;
     }
-    const actionId = actionIdFieldName.slice($ACTION_ID_.length);
     const entry = serverModuleMap[actionId];
     if (entry == null) {
         return true;

package/web/.next/standalone/node_modules/next/dist/server/app-render/manifests-singleton.js

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", {
     value: true
 });
 0 && (module.exports = {
+    getActionNotFoundError: null,
     getClientReferenceManifest: null,
+    getInvalidServerReferenceIdError: null,
     getServerActionsManifest: null,
     getServerModuleMap: null,
     selectWorkerForForwarding: null,
@@ -16,9 +18,15 @@ function _export(target, all) {
     });
 }
 _export(exports, {
+    getActionNotFoundError: function() {
+        return getActionNotFoundError;
+    },
     getClientReferenceManifest: function() {
         return getClientReferenceManifest;
     },
+    getInvalidServerReferenceIdError: function() {
+        return getInvalidServerReferenceIdError;
+    },
     getServerActionsManifest: function() {
         return getServerActionsManifest;
     },
@@ -36,7 +44,36 @@ const _invarianterror = require("../../shared/lib/invariant-error");
 const _apppaths = require("../../shared/lib/router/utils/app-paths");
 const _pathhasprefix = require("../../shared/lib/router/utils/path-has-prefix");
 const _removepathprefix = require("../../shared/lib/router/utils/remove-path-prefix");
+const _serverreferenceinfo = require("../../shared/lib/server-reference-info");
+const _reflectutils = require("../../shared/lib/utils/reflect-utils");
 const _workasyncstorageexternal = require("./work-async-storage.external");
+function getActionNotFoundError(actionId) {
+    return Object.defineProperty(new Error(`Failed to find Server Action${actionId ? ` "${actionId}"` : ''}. This request might be from an older or newer deployment.\nRead more: https://nextjs.org/docs/messages/failed-to-find-server-action`), "__NEXT_ERROR_CODE", {
+        value: "E974",
+        enumerable: false,
+        configurable: true
+    });
+}
+function getInvalidServerReferenceIdError(id) {
+    // `id` is arbitrary client-provided input. Unlike the not-found case, it has
+    // not passed the length gate and can reach this error via a malformed server
+    // reference in an action payload, so it may be of any length and contain
+    // control characters. `JSON.stringify` escapes newlines and quotes so it
+    // can't forge log lines, and truncating overly long ids prevents log
+    // flooding. Ids at or below the cap are logged in full so that we only add an
+    // ellipsis to ids that are meaningfully longer than the truncated length.
+    const encoded = JSON.stringify(id.length > MAX_LOGGED_SERVER_REFERENCE_ID_LENGTH ? id.slice(0, TRUNCATED_SERVER_REFERENCE_ID_LENGTH) + '…' : id);
+    return Object.defineProperty(new Error(`The Server Reference ID did not match the expected format. Received ${encoded}.\nRead more: https://nextjs.org/docs/messages/failed-to-find-server-action`), "__NEXT_ERROR_CODE", {
+        value: "E1144",
+        enumerable: false,
+        configurable: true
+    });
+}
+// Ids at or below the cap are logged in full. Longer ids are truncated to the
+// shorter length and marked with an ellipsis, so the cap leaves headroom over
+// the truncated length rather than ellipsizing ids that are barely too long.
+const MAX_LOGGED_SERVER_REFERENCE_ID_LENGTH = 100;
+const TRUNCATED_SERVER_REFERENCE_ID_LENGTH = 90;
 // This is a global singleton that is, among other things, also used to
 // encode/decode bound args of server function closures. This can't be using a
 // AsyncLocalStorage as it might happen at the module level.
@@ -148,12 +185,23 @@ function createProxiedClientReferenceManifest(clientReferenceManifestsPerRoute)
  * our manifest contains a lot of internal Next.js data that are relevant to the
  * runtime, workers, etc. that React doesn't need to know.
  */ function createServerModuleMap() {
-    return new Proxy({}, {
-        get: (_, id)=>{
+    return new Proxy(Object.create(null), {
+        get: (target, id, receiver)=>{
             var _getServerActionsManifest__id, _getServerActionsManifest_;
+            // React's debug serialization can probe the module map like a plain object.
+            // These probes are not server reference lookups.
+            if (typeof id !== 'string') {
+                return Reflect.get(target, id, receiver);
+            }
+            if (_reflectutils.wellKnownProperties.has(id)) {
+                return Reflect.get(target, id, receiver);
+            }
+            if (!(0, _serverreferenceinfo.mightBeServerReferenceId)(id)) {
+                throw getInvalidServerReferenceIdError(id);
+            }
             const workers = (_getServerActionsManifest_ = getServerActionsManifest()[process.env.NEXT_RUNTIME === 'edge' ? 'edge' : 'node']) == null ? void 0 : (_getServerActionsManifest__id = _getServerActionsManifest_[id]) == null ? void 0 : _getServerActionsManifest__id.workers;
             if (!workers) {
-                return undefined;
+                throw getActionNotFoundError(id);
             }
             const workStore = _workasyncstorageexternal.workAsyncStorage.getStore();
             let workerEntry;
@@ -170,7 +218,7 @@ function createProxiedClientReferenceManifest(clientReferenceManifestsPerRoute)
                 workerEntry = Object.values(workers).at(0);
             }
             if (!workerEntry) {
-                return undefined;
+                throw getActionNotFoundError(id);
             }
             const { moduleId, async } = workerEntry;
             return {

package/web/.next/standalone/node_modules/next/dist/server/config-schema.js

@@ -257,7 +257,6 @@ const experimentalSchema = {
     imgOptTimeoutInSeconds: _zod.z.number().int().optional(),
     imgOptMaxInputPixels: _zod.z.number().int().optional(),
     imgOptSequentialRead: _zod.z.boolean().optional().nullable(),
-    imgOptSkipMetadata: _zod.z.boolean().optional().nullable(),
     isrFlushToDisk: _zod.z.boolean().optional(),
     largePageDataBytes: _zod.z.number().optional(),
     linkNoTouchStart: _zod.z.boolean().optional(),
@@ -363,6 +362,7 @@ const experimentalSchema = {
     turbopackImportTypeText: _zod.z.boolean().optional(),
     turbopackUseBuiltinBabel: _zod.z.boolean().optional(),
     turbopackUseBuiltinSass: _zod.z.boolean().optional(),
+    turbopackLocalPostcssConfig: _zod.z.boolean().optional(),
     turbopackModuleIds: _zod.z.enum([
         'named',
         'deterministic'

package/web/.next/standalone/node_modules/next/dist/server/config-shared.js

@@ -207,7 +207,6 @@ const defaultConfig = Object.freeze({
         imgOptTimeoutInSeconds: 7,
         imgOptMaxInputPixels: 268402689,
         imgOptSequentialRead: null,
-        imgOptSkipMetadata: null,
         isrFlushToDisk: true,
         workerThreads: false,
         proxyTimeout: undefined,
@@ -313,7 +312,6 @@ function getNextConfigRuntime(config) {
         imgOptConcurrency: ex.imgOptConcurrency,
         imgOptMaxInputPixels: ex.imgOptMaxInputPixels,
         imgOptSequentialRead: ex.imgOptSequentialRead,
-        imgOptSkipMetadata: ex.imgOptSkipMetadata,
         imgOptTimeoutInSeconds: ex.imgOptTimeoutInSeconds,
         proxyClientMaxBodySize: ex.proxyClientMaxBodySize,
         proxyTimeout: ex.proxyTimeout,

package/web/.next/standalone/node_modules/next/dist/server/config.js

@@ -1106,7 +1106,7 @@ async function applyModifyConfig(config, phase, silent) {
             }
             config = await adapterMod.modifyConfig(config, {
                 phase,
-                nextVersion: "16.2.6"
+                nextVersion: "16.2.11"
             });
         }
     }

package/web/.next/standalone/node_modules/next/dist/server/dev/hot-reloader-turbopack.js

@@ -240,7 +240,7 @@ async function createHotReloaderTurbopack(opts, serverFields, distDir, resetFetc
     }
     const hasRewrites = opts.fsChecker.rewrites.afterFiles.length > 0 || opts.fsChecker.rewrites.beforeFiles.length > 0 || opts.fsChecker.rewrites.fallback.length > 0;
     const hotReloaderSpan = (0, _trace.trace)('hot-reloader', undefined, {
-        version: "16.2.6"
+        version: "16.2.11"
     });
     // Ensure the hotReloaderSpan is flushed immediately as it's the parentSpan for all processing
     // of the current `next dev` invocation.
@@ -294,7 +294,7 @@ async function createHotReloaderTurbopack(opts, serverFields, distDir, resetFetc
         writeRoutesHashesManifest: false,
         currentNodeJsVersion,
         isPersistentCachingEnabled: (0, _utils2.isFileSystemCacheEnabledForDev)(opts.nextConfig),
-        nextVersion: "16.2.6",
+        nextVersion: "16.2.11",
         serverHmr: serverFastRefresh
     }, {
         memoryLimit: (_opts_nextConfig_experimental = opts.nextConfig.experimental) == null ? void 0 : _opts_nextConfig_experimental.turbopackMemoryLimit,

package/web/.next/standalone/node_modules/next/dist/server/dev/hot-reloader-webpack.js

@@ -234,7 +234,7 @@ class HotReloaderWebpack {
         this.previewProps = previewProps;
         this.rewrites = rewrites;
         this.hotReloaderSpan = (0, _trace.trace)('hot-reloader', undefined, {
-            version: "16.2.6"
+            version: "16.2.11"
         });
         // Ensure the hotReloaderSpan is flushed immediately as it's the parentSpan for all processing
         // of the current `next dev` invocation.

package/web/.next/standalone/node_modules/next/dist/server/image-optimizer.js

@@ -292,7 +292,7 @@ async function deleteFromCacheDir(cacheDir, cacheKey) {
         _log.error(`Failed to delete cache key ${cacheKey}`, err);
     });
 }
-async function detectContentType(buffer, skipMetadata, concurrency) {
+async function detectContentType(buffer) {
     if (buffer.byteLength === 0) {
         return null;
     }
@@ -465,21 +465,12 @@ async function detectContentType(buffer, skipMetadata, concurrency) {
     ].every((b, i)=>buffer[i] === b)) {
         return JP2;
     }
-    let format;
-    format = (0, _detector.detector)(buffer);
-    if (!format && !skipMetadata) {
-        const sharp = getSharp(concurrency);
-        const meta = await sharp(buffer).metadata().catch((_)=>null);
-        format = meta == null ? void 0 : meta.format;
-    }
+    const format = (0, _detector.detector)(buffer.subarray(0, 1024));
     switch(format){
-        case 'avif':
-            return AVIF;
         case 'webp':
             return WEBP;
         case 'png':
             return PNG;
-        case 'jpeg':
         case 'jpg':
             return JPEG;
         case 'gif':
@@ -492,28 +483,14 @@ async function detectContentType(buffer, skipMetadata, concurrency) {
         case 'jp2':
             return JP2;
         case 'tiff':
-        case 'tif':
             return TIFF;
-        case 'pdf':
-            return PDF;
         case 'bmp':
             return BMP;
         case 'ico':
             return ICO;
         case 'icns':
             return ICNS;
-        case 'dcraw':
-        case 'dz':
-        case 'exr':
-        case 'fits':
         case 'heif':
-        case 'input':
-        case 'magick':
-        case 'openslide':
-        case 'ppm':
-        case 'rad':
-        case 'raw':
-        case 'v':
         case 'cur':
         case 'dds':
         case 'j2c':
@@ -522,8 +499,12 @@ async function detectContentType(buffer, skipMetadata, concurrency) {
         case 'psd':
         case 'tga':
         case undefined:
+            return null // unsupported formats
+            ;
         default:
-            return null;
+            format; // exhaustive check
+            return null // impossible to reach
+            ;
     }
 }
 class ImageOptimizerCache {
@@ -1072,7 +1053,7 @@ async function imageOptimizer(imageUpstream, paramsResult, nextConfig, opts) {
     const { href, quality, width, mimeType } = paramsResult;
     const { buffer: upstreamBuffer, etag: upstreamEtag } = imageUpstream;
     const maxAge = Math.max(nextConfig.images.minimumCacheTTL, getMaxAge(imageUpstream.cacheControl));
-    const upstreamType = await detectContentType(upstreamBuffer, nextConfig.experimental.imgOptSkipMetadata, nextConfig.experimental.imgOptConcurrency);
+    const upstreamType = await detectContentType(upstreamBuffer);
     if (!upstreamType || !upstreamType.startsWith('image/') || upstreamType.includes(',')) {
         if (!opts.silent) {
             _log.error("The requested resource isn't a valid image for", href, 'received', upstreamType);

package/web/.next/standalone/node_modules/next/dist/server/lib/app-info-log.js

@@ -85,7 +85,7 @@ function logStartInfo({ networkUrl, appUrl, envInfo, logBundler }) {
     if (parts.length > 0) {
         versionSuffix = ` (${parts.join(', ')})`;
     }
-    _log.bootstrap(`${(0, _picocolors.bold)((0, _picocolors.purple)(`${_log.prefixes.ready} Next.js ${"16.2.6"}`))}${versionSuffix}`);
+    _log.bootstrap(`${(0, _picocolors.bold)((0, _picocolors.purple)(`${_log.prefixes.ready} Next.js ${"16.2.11"}`))}${versionSuffix}`);
     if (appUrl) {
         _log.bootstrap(`- Local:         ${appUrl}`);
     }