next 15.3.0-canary.3 → 15.3.0-canary.4

package/dist/bin/next

@@ -79,7 +79,7 @@ const program = new NextRootCommand();
 program.name('next').description('The Next.js CLI allows you to develop, build, start your application, and more.').configureHelp({
     formatHelp: (cmd, helper)=>(0, _formatclihelpoutput.formatCliHelpOutput)(cmd, helper),
     subcommandTerm: (cmd)=>`${cmd.name()} ${cmd.usage()}`
-}).helpCommand(false).helpOption('-h, --help', 'Displays this message.').version(`Next.js v${"15.3.0-canary.3"}`, '-v, --version', 'Outputs the Next.js version.');
+}).helpCommand(false).helpOption('-h, --help', 'Displays this message.').version(`Next.js v${"15.3.0-canary.4"}`, '-v, --version', 'Outputs the Next.js version.');
 program.command('build').description('Creates an optimized production build of your application. The output displays information about each route.').argument('[directory]', `A directory on which to build the application. ${(0, _picocolors.italic)('If no directory is provided, the current directory will be used.')}`).option('-d, --debug', 'Enables a more verbose build output.').option('--no-lint', 'Disables linting.').option('--no-mangling', 'Disables mangling.').option('--profile', 'Enables production profiling for React.').option('--experimental-app-only', 'Builds only App Router routes.').addOption(new _commander.Option('--experimental-turbo').hideHelp()).addOption(new _commander.Option('--experimental-build-mode [mode]', 'Uses an experimental build mode.').choices([
     'compile',
     'generate'

package/dist/build/index.js

@@ -368,7 +368,7 @@ async function build(dir, reactProductionProfiling = false, debugOutput = false,
         const nextBuildSpan = (0, _trace.trace)('next-build', undefined, {
             buildMode: experimentalBuildMode,
             isTurboBuild: String(turboNextBuild),
-            version: "15.3.0-canary.3"
+            version: "15.3.0-canary.4"
         });
         _buildcontext.NextBuildContext.nextBuildSpan = nextBuildSpan;
         _buildcontext.NextBuildContext.dir = dir;
@@ -732,7 +732,7 @@ async function build(dir, reactProductionProfiling = false, debugOutput = false,
             // Files outside of the distDir can be "type": "module"
             await writeFileUtf8(_path.default.join(distDir, 'package.json'), '{"type": "commonjs"}');
             // These are written to distDir, so they need to come after creating and cleaning distDr.
-            await (0, _builddiagnostics.recordFrameworkVersion)("15.3.0-canary.3");
+            await (0, _builddiagnostics.recordFrameworkVersion)("15.3.0-canary.4");
             await (0, _builddiagnostics.updateBuildDiagnostics)({
                 buildStage: 'start'
             });

package/dist/build/swc/index.js

@@ -119,7 +119,7 @@ function _interop_require_wildcard(obj, nodeInterop) {
     }
     return newObj;
 }
-const nextVersion = "15.3.0-canary.3";
+const nextVersion = "15.3.0-canary.4";
 const ArchName = (0, _os.arch)();
 const PlatformName = (0, _os.platform)();
 function infoLog(...args) {

package/dist/build/webpack-config.js

@@ -1626,7 +1626,7 @@ async function getBaseWebpackConfig(dir, { buildId, encryptionKey, config, compi
             isClient && new _copyfileplugin.CopyFilePlugin({
                 // file path to build output of `@next/polyfill-nomodule`
                 filePath: require.resolve('./polyfills/polyfill-nomodule'),
-                cacheKey: "15.3.0-canary.3",
+                cacheKey: "15.3.0-canary.4",
                 name: `static/chunks/polyfills${dev ? '' : '-[hash]'}.js`,
                 minimize: false,
                 info: {
@@ -1803,7 +1803,7 @@ async function getBaseWebpackConfig(dir, { buildId, encryptionKey, config, compi
         //  - Next.js location on disk (some loaders use absolute paths and some resolve options depend on absolute paths)
         //  - Next.js version
         //  - next.config.js keys that affect compilation
-        version: `${__dirname}|${"15.3.0-canary.3"}|${configVars}`,
+        version: `${__dirname}|${"15.3.0-canary.4"}|${configVars}`,
         cacheDirectory: _path.default.join(distDir, 'cache', 'webpack'),
         // For production builds, it's more efficient to compress all cache files together instead of compression each one individually.
         // So we disable compression here and allow the build runner to take care of compressing the cache as a whole.

package/dist/client/app-bootstrap.js

@@ -13,7 +13,7 @@ Object.defineProperty(exports, "appBootstrap", {
         return appBootstrap;
     }
 });
-const version = "15.3.0-canary.3";
+const version = "15.3.0-canary.4";
 window.next = {
     version,
     appDir: true

package/dist/client/index.js

@@ -61,7 +61,7 @@ const _hooksclientcontextsharedruntime = require("../shared/lib/hooks-client-con
 const _onrecoverableerror = require("./react-client-callbacks/on-recoverable-error");
 const _tracer = /*#__PURE__*/ _interop_require_default._(require("./tracing/tracer"));
 const _isnextroutererror = require("./components/is-next-router-error");
-const version = "15.3.0-canary.3";
+const version = "15.3.0-canary.4";
 let router;
 const emitter = (0, _mitt.default)();
 const looseToArray = (input)=>[].slice.call(input);

package/dist/esm/build/index.js

@@ -300,7 +300,7 @@ export default async function build(dir, reactProductionProfiling = false, debug
         const nextBuildSpan = trace('next-build', undefined, {
             buildMode: experimentalBuildMode,
             isTurboBuild: String(turboNextBuild),
-            version: "15.3.0-canary.3"
+            version: "15.3.0-canary.4"
         });
         NextBuildContext.nextBuildSpan = nextBuildSpan;
         NextBuildContext.dir = dir;
@@ -664,7 +664,7 @@ export default async function build(dir, reactProductionProfiling = false, debug
             // Files outside of the distDir can be "type": "module"
             await writeFileUtf8(path.join(distDir, 'package.json'), '{"type": "commonjs"}');
             // These are written to distDir, so they need to come after creating and cleaning distDr.
-            await recordFrameworkVersion("15.3.0-canary.3");
+            await recordFrameworkVersion("15.3.0-canary.4");
             await updateBuildDiagnostics({
                 buildStage: 'start'
             });

package/dist/esm/build/swc/index.js

@@ -11,7 +11,7 @@ import { isDeepStrictEqual } from 'util';
 import { getDefineEnv } from '../webpack/plugins/define-env-plugin';
 import { getReactCompilerLoader } from '../get-babel-loader-config';
 import { TurbopackInternalError } from '../../shared/lib/turbopack/utils';
-const nextVersion = "15.3.0-canary.3";
+const nextVersion = "15.3.0-canary.4";
 const ArchName = arch();
 const PlatformName = platform();
 function infoLog(...args) {

package/dist/esm/build/webpack-config.js

@@ -1527,7 +1527,7 @@ export default async function getBaseWebpackConfig(dir, { buildId, encryptionKey
             isClient && new CopyFilePlugin({
                 // file path to build output of `@next/polyfill-nomodule`
                 filePath: require.resolve('./polyfills/polyfill-nomodule'),
-                cacheKey: "15.3.0-canary.3",
+                cacheKey: "15.3.0-canary.4",
                 name: `static/chunks/polyfills${dev ? '' : '-[hash]'}.js`,
                 minimize: false,
                 info: {
@@ -1704,7 +1704,7 @@ export default async function getBaseWebpackConfig(dir, { buildId, encryptionKey
         //  - Next.js location on disk (some loaders use absolute paths and some resolve options depend on absolute paths)
         //  - Next.js version
         //  - next.config.js keys that affect compilation
-        version: `${__dirname}|${"15.3.0-canary.3"}|${configVars}`,
+        version: `${__dirname}|${"15.3.0-canary.4"}|${configVars}`,
         cacheDirectory: path.join(distDir, 'cache', 'webpack'),
         // For production builds, it's more efficient to compress all cache files together instead of compression each one individually.
         // So we disable compression here and allow the build runner to take care of compressing the cache as a whole.

package/dist/esm/client/app-bootstrap.js

@@ -3,7 +3,7 @@
  * sure the following scripts are executed in the correct order:
  * - Polyfills
  * - next/script with `beforeInteractive` strategy
- */ const version = "15.3.0-canary.3";
+ */ const version = "15.3.0-canary.4";
 window.next = {
     version,
     appDir: true

package/dist/esm/client/index.js

@@ -26,7 +26,7 @@ import { SearchParamsContext, PathParamsContext } from '../shared/lib/hooks-clie
 import { onRecoverableError } from './react-client-callbacks/on-recoverable-error';
 import tracer from './tracing/tracer';
 import { isNextRouterError } from './components/is-next-router-error';
-export const version = "15.3.0-canary.3";
+export const version = "15.3.0-canary.4";
 export let router;
 export const emitter = mitt();
 const looseToArray = (input)=>[].slice.call(input);

package/dist/esm/server/dev/hot-reloader-turbopack.js

@@ -83,7 +83,7 @@ export async function createHotReloaderTurbopack(opts, serverFields, distDir, re
     }
     const hasRewrites = opts.fsChecker.rewrites.afterFiles.length > 0 || opts.fsChecker.rewrites.beforeFiles.length > 0 || opts.fsChecker.rewrites.fallback.length > 0;
     const hotReloaderSpan = trace('hot-reloader', undefined, {
-        version: "15.3.0-canary.3"
+        version: "15.3.0-canary.4"
     });
     // Ensure the hotReloaderSpan is flushed immediately as it's the parentSpan for all processing
     // of the current `next dev` invocation.

package/dist/esm/server/dev/hot-reloader-webpack.js

@@ -180,7 +180,7 @@ export default class HotReloaderWebpack {
         this.previewProps = previewProps;
         this.rewrites = rewrites;
         this.hotReloaderSpan = trace('hot-reloader', undefined, {
-            version: "15.3.0-canary.3"
+            version: "15.3.0-canary.4"
         });
         // Ensure the hotReloaderSpan is flushed immediately as it's the parentSpan for all processing
         // of the current `next dev` invocation.

package/dist/esm/server/lib/app-info-log.js

@@ -4,7 +4,7 @@ import { bold, purple } from '../../lib/picocolors';
 import { PHASE_DEVELOPMENT_SERVER, PHASE_PRODUCTION_BUILD } from '../../shared/lib/constants';
 import loadConfig, { getConfiguredExperimentalFeatures } from '../config';
 export function logStartInfo({ networkUrl, appUrl, envInfo, experimentalFeatures, maxExperimentalFeatures = Infinity }) {
-    Log.bootstrap(`${bold(purple(`${Log.prefixes.ready} Next.js ${"15.3.0-canary.3"}`))}${process.env.TURBOPACK ? ' (Turbopack)' : ''}`);
+    Log.bootstrap(`${bold(purple(`${Log.prefixes.ready} Next.js ${"15.3.0-canary.4"}`))}${process.env.TURBOPACK ? ' (Turbopack)' : ''}`);
     if (appUrl) {
         Log.bootstrap(`- Local:        ${appUrl}`);
     }

package/dist/esm/server/lib/router-utils/block-cross-site.js

@@ -1,6 +1,7 @@
 import { parseUrl } from '../../../lib/url';
 import net from 'net';
 import { warnOnce } from '../../../build/output/log';
+import { isCsrfOriginAllowed } from '../../app-render/csrf-protection';
 export const blockCrossSite = (req, res, allowedOrigins, activePort)=>{
     var _req_url;
     // only process _next URLs
@@ -14,7 +15,7 @@ export const blockCrossSite = (req, res, allowedOrigins, activePort)=>{
             res.statusCode = 403;
         }
         res.end('Unauthorized');
-        warnOnce(`Blocked cross-origin request to /_next/*. To allow this, configure "allowedDevOrigins" in next.config\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`);
+        warnOnce(`Blocked cross-origin request to /_next/*. Cross-site requests are blocked in "no-cors" mode.`);
         return true;
     }
     // ensure websocket requests from allowed origin
@@ -27,7 +28,7 @@ export const blockCrossSite = (req, res, allowedOrigins, activePort)=>{
             const isIpRequest = net.isIPv4(originLowerCase) || net.isIPv6(originLowerCase);
             if (// allow requests if direct IP and matching port and
             // allow if any of the allowed origins match
-            !(isIpRequest && isMatchingPort) && !allowedOrigins.some((allowedOrigin)=>allowedOrigin === originLowerCase)) {
+            !(isIpRequest && isMatchingPort) && !isCsrfOriginAllowed(originLowerCase, allowedOrigins)) {
                 if ('statusCode' in res) {
                     res.statusCode = 403;
                 }

package/dist/esm/server/lib/router-utils/block-cross-site.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/server/lib/router-utils/block-cross-site.ts"],"sourcesContent":["import type { Duplex } from 'stream'\nimport type { IncomingMessage, ServerResponse } from 'webpack-dev-server'\nimport { parseUrl } from '../../../lib/url'\nimport net from 'net'\nimport { warnOnce } from '../../../build/output/log'\n\nexport const blockCrossSite = (\n  req: IncomingMessage,\n  res: ServerResponse | Duplex,\n  allowedOrigins: string[],\n  activePort: string\n): boolean => {\n  // only process _next URLs\n  if (!req.url?.includes('/_next')) {\n    return false\n  }\n  // block non-cors request from cross-site e.g. script tag on\n  // different host\n  if (\n    req.headers['sec-fetch-mode'] === 'no-cors' &&\n    req.headers['sec-fetch-site'] === 'cross-site'\n  ) {\n    if ('statusCode' in res) {\n      res.statusCode = 403\n    }\n    res.end('Unauthorized')\n    warnOnce(\n      `Blocked cross-origin request to /_next/*. To allow this, configure \"allowedDevOrigins\" in next.config\\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`\n    )\n    return true\n  }\n\n  // ensure websocket requests from allowed origin\n  const rawOrigin = req.headers['origin']\n\n  if (rawOrigin) {\n    const parsedOrigin = parseUrl(rawOrigin)\n\n    if (parsedOrigin) {\n      const originLowerCase = parsedOrigin.hostname.toLowerCase()\n      const isMatchingPort = parsedOrigin.port === activePort\n      const isIpRequest =\n        net.isIPv4(originLowerCase) || net.isIPv6(originLowerCase)\n\n      if (\n        // allow requests if direct IP and matching port and\n        // allow if any of the allowed origins match\n        !(isIpRequest && isMatchingPort) &&\n        !allowedOrigins.some(\n          (allowedOrigin) => allowedOrigin === originLowerCase\n        )\n      ) {\n        if ('statusCode' in res) {\n          res.statusCode = 403\n        }\n        res.end('Unauthorized')\n        warnOnce(\n          `Blocked cross-origin request from ${originLowerCase}. To allow this, configure \"allowedDevOrigins\" in next.config\\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`\n        )\n        return true\n      }\n    }\n  }\n\n  return false\n}\n"],"names":["parseUrl","net","warnOnce","blockCrossSite","req","res","allowedOrigins","activePort","url","includes","headers","statusCode","end","rawOrigin","parsedOrigin","originLowerCase","hostname","toLowerCase","isMatchingPort","port","isIpRequest","isIPv4","isIPv6","some","allowedOrigin"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,mBAAkB;AAC3C,OAAOC,SAAS,MAAK;AACrB,SAASC,QAAQ,QAAQ,4BAA2B;AAEpD,OAAO,MAAMC,iBAAiB,CAC5BC,KACAC,KACAC,gBACAC;QAGKH;IADL,0BAA0B;IAC1B,IAAI,GAACA,WAAAA,IAAII,GAAG,qBAAPJ,SAASK,QAAQ,CAAC,YAAW;QAChC,OAAO;IACT;IACA,4DAA4D;IAC5D,iBAAiB;IACjB,IACEL,IAAIM,OAAO,CAAC,iBAAiB,KAAK,aAClCN,IAAIM,OAAO,CAAC,iBAAiB,KAAK,cAClC;QACA,IAAI,gBAAgBL,KAAK;YACvBA,IAAIM,UAAU,GAAG;QACnB;QACAN,IAAIO,GAAG,CAAC;QACRV,SACE,CAAC,mMAAmM,CAAC;QAEvM,OAAO;IACT;IAEA,gDAAgD;IAChD,MAAMW,YAAYT,IAAIM,OAAO,CAAC,SAAS;IAEvC,IAAIG,WAAW;QACb,MAAMC,eAAed,SAASa;QAE9B,IAAIC,cAAc;YAChB,MAAMC,kBAAkBD,aAAaE,QAAQ,CAACC,WAAW;YACzD,MAAMC,iBAAiBJ,aAAaK,IAAI,KAAKZ;YAC7C,MAAMa,cACJnB,IAAIoB,MAAM,CAACN,oBAAoBd,IAAIqB,MAAM,CAACP;YAE5C,IACE,oDAAoD;YACpD,4CAA4C;YAC5C,CAAEK,CAAAA,eAAeF,cAAa,KAC9B,CAACZ,eAAeiB,IAAI,CAClB,CAACC,gBAAkBA,kBAAkBT,kBAEvC;gBACA,IAAI,gBAAgBV,KAAK;oBACvBA,IAAIM,UAAU,GAAG;gBACnB;gBACAN,IAAIO,GAAG,CAAC;gBACRV,SACE,CAAC,kCAAkC,EAAEa,gBAAgB,2JAA2J,CAAC;gBAEnN,OAAO;YACT;QACF;IACF;IAEA,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../../../src/server/lib/router-utils/block-cross-site.ts"],"sourcesContent":["import type { Duplex } from 'stream'\nimport type { IncomingMessage, ServerResponse } from 'webpack-dev-server'\nimport { parseUrl } from '../../../lib/url'\nimport net from 'net'\nimport { warnOnce } from '../../../build/output/log'\nimport { isCsrfOriginAllowed } from '../../app-render/csrf-protection'\n\nexport const blockCrossSite = (\n  req: IncomingMessage,\n  res: ServerResponse | Duplex,\n  allowedOrigins: string[],\n  activePort: string\n): boolean => {\n  // only process _next URLs\n  if (!req.url?.includes('/_next')) {\n    return false\n  }\n  // block non-cors request from cross-site e.g. script tag on\n  // different host\n  if (\n    req.headers['sec-fetch-mode'] === 'no-cors' &&\n    req.headers['sec-fetch-site'] === 'cross-site'\n  ) {\n    if ('statusCode' in res) {\n      res.statusCode = 403\n    }\n    res.end('Unauthorized')\n    warnOnce(\n      `Blocked cross-origin request to /_next/*. Cross-site requests are blocked in \"no-cors\" mode.`\n    )\n    return true\n  }\n\n  // ensure websocket requests from allowed origin\n  const rawOrigin = req.headers['origin']\n\n  if (rawOrigin) {\n    const parsedOrigin = parseUrl(rawOrigin)\n\n    if (parsedOrigin) {\n      const originLowerCase = parsedOrigin.hostname.toLowerCase()\n      const isMatchingPort = parsedOrigin.port === activePort\n      const isIpRequest =\n        net.isIPv4(originLowerCase) || net.isIPv6(originLowerCase)\n\n      if (\n        // allow requests if direct IP and matching port and\n        // allow if any of the allowed origins match\n        !(isIpRequest && isMatchingPort) &&\n        !isCsrfOriginAllowed(originLowerCase, allowedOrigins)\n      ) {\n        if ('statusCode' in res) {\n          res.statusCode = 403\n        }\n        res.end('Unauthorized')\n        warnOnce(\n          `Blocked cross-origin request from ${originLowerCase}. To allow this, configure \"allowedDevOrigins\" in next.config\\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`\n        )\n        return true\n      }\n    }\n  }\n\n  return false\n}\n"],"names":["parseUrl","net","warnOnce","isCsrfOriginAllowed","blockCrossSite","req","res","allowedOrigins","activePort","url","includes","headers","statusCode","end","rawOrigin","parsedOrigin","originLowerCase","hostname","toLowerCase","isMatchingPort","port","isIpRequest","isIPv4","isIPv6"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,mBAAkB;AAC3C,OAAOC,SAAS,MAAK;AACrB,SAASC,QAAQ,QAAQ,4BAA2B;AACpD,SAASC,mBAAmB,QAAQ,mCAAkC;AAEtE,OAAO,MAAMC,iBAAiB,CAC5BC,KACAC,KACAC,gBACAC;QAGKH;IADL,0BAA0B;IAC1B,IAAI,GAACA,WAAAA,IAAII,GAAG,qBAAPJ,SAASK,QAAQ,CAAC,YAAW;QAChC,OAAO;IACT;IACA,4DAA4D;IAC5D,iBAAiB;IACjB,IACEL,IAAIM,OAAO,CAAC,iBAAiB,KAAK,aAClCN,IAAIM,OAAO,CAAC,iBAAiB,KAAK,cAClC;QACA,IAAI,gBAAgBL,KAAK;YACvBA,IAAIM,UAAU,GAAG;QACnB;QACAN,IAAIO,GAAG,CAAC;QACRX,SACE,CAAC,4FAA4F,CAAC;QAEhG,OAAO;IACT;IAEA,gDAAgD;IAChD,MAAMY,YAAYT,IAAIM,OAAO,CAAC,SAAS;IAEvC,IAAIG,WAAW;QACb,MAAMC,eAAef,SAASc;QAE9B,IAAIC,cAAc;YAChB,MAAMC,kBAAkBD,aAAaE,QAAQ,CAACC,WAAW;YACzD,MAAMC,iBAAiBJ,aAAaK,IAAI,KAAKZ;YAC7C,MAAMa,cACJpB,IAAIqB,MAAM,CAACN,oBAAoBf,IAAIsB,MAAM,CAACP;YAE5C,IACE,oDAAoD;YACpD,4CAA4C;YAC5C,CAAEK,CAAAA,eAAeF,cAAa,KAC9B,CAAChB,oBAAoBa,iBAAiBT,iBACtC;gBACA,IAAI,gBAAgBD,KAAK;oBACvBA,IAAIM,UAAU,GAAG;gBACnB;gBACAN,IAAIO,GAAG,CAAC;gBACRX,SACE,CAAC,kCAAkC,EAAEc,gBAAgB,2JAA2J,CAAC;gBAEnN,OAAO;YACT;QACF;IACF;IAEA,OAAO;AACT,EAAC"}

package/dist/esm/server/lib/start-server.js

@@ -43,7 +43,7 @@ export async function getRequestHandlers({ dir, port, isDev, onDevServerCleanup,
 export async function startServer(serverOptions) {
     const { dir, isDev, hostname, minimalMode, allowRetry, keepAliveTimeout, selfSignedCertificate } = serverOptions;
     let { port } = serverOptions;
-    process.title = `next-server (v${"15.3.0-canary.3"})`;
+    process.title = `next-server (v${"15.3.0-canary.4"})`;
     let handlersReady = ()=>{};
     let handlersError = ()=>{};
     let handlersPromise = new Promise((resolve, reject)=>{

package/dist/esm/shared/lib/canary-only.js

@@ -1,6 +1,6 @@
 export function isStableBuild() {
     var _process_env___NEXT_VERSION;
-    return !((_process_env___NEXT_VERSION = "15.3.0-canary.3") == null ? void 0 : _process_env___NEXT_VERSION.includes('canary')) && !process.env.__NEXT_TEST_MODE && !process.env.NEXT_PRIVATE_LOCAL_DEV;
+    return !((_process_env___NEXT_VERSION = "15.3.0-canary.4") == null ? void 0 : _process_env___NEXT_VERSION.includes('canary')) && !process.env.__NEXT_TEST_MODE && !process.env.NEXT_PRIVATE_LOCAL_DEV;
 }
 export class CanaryOnlyError extends Error {
     constructor(arg){

package/dist/server/dev/hot-reloader-turbopack.js

@@ -139,7 +139,7 @@ async function createHotReloaderTurbopack(opts, serverFields, distDir, resetFetc
     }
     const hasRewrites = opts.fsChecker.rewrites.afterFiles.length > 0 || opts.fsChecker.rewrites.beforeFiles.length > 0 || opts.fsChecker.rewrites.fallback.length > 0;
     const hotReloaderSpan = (0, _trace.trace)('hot-reloader', undefined, {
-        version: "15.3.0-canary.3"
+        version: "15.3.0-canary.4"
     });
     // Ensure the hotReloaderSpan is flushed immediately as it's the parentSpan for all processing
     // of the current `next dev` invocation.

package/dist/server/dev/hot-reloader-webpack.js

@@ -256,7 +256,7 @@ class HotReloaderWebpack {
         this.previewProps = previewProps;
         this.rewrites = rewrites;
         this.hotReloaderSpan = (0, _trace.trace)('hot-reloader', undefined, {
-            version: "15.3.0-canary.3"
+            version: "15.3.0-canary.4"
         });
         // Ensure the hotReloaderSpan is flushed immediately as it's the parentSpan for all processing
         // of the current `next dev` invocation.

package/dist/server/lib/app-info-log.js

@@ -67,7 +67,7 @@ function _interop_require_wildcard(obj, nodeInterop) {
     return newObj;
 }
 function logStartInfo({ networkUrl, appUrl, envInfo, experimentalFeatures, maxExperimentalFeatures = Infinity }) {
-    _log.bootstrap(`${(0, _picocolors.bold)((0, _picocolors.purple)(`${_log.prefixes.ready} Next.js ${"15.3.0-canary.3"}`))}${process.env.TURBOPACK ? ' (Turbopack)' : ''}`);
+    _log.bootstrap(`${(0, _picocolors.bold)((0, _picocolors.purple)(`${_log.prefixes.ready} Next.js ${"15.3.0-canary.4"}`))}${process.env.TURBOPACK ? ' (Turbopack)' : ''}`);
     if (appUrl) {
         _log.bootstrap(`- Local:        ${appUrl}`);
     }

package/dist/server/lib/router-utils/block-cross-site.js

@@ -11,6 +11,7 @@ Object.defineProperty(exports, "blockCrossSite", {
 const _url = require("../../../lib/url");
 const _net = /*#__PURE__*/ _interop_require_default(require("net"));
 const _log = require("../../../build/output/log");
+const _csrfprotection = require("../../app-render/csrf-protection");
 function _interop_require_default(obj) {
     return obj && obj.__esModule ? obj : {
         default: obj
@@ -29,7 +30,7 @@ const blockCrossSite = (req, res, allowedOrigins, activePort)=>{
             res.statusCode = 403;
         }
         res.end('Unauthorized');
-        (0, _log.warnOnce)(`Blocked cross-origin request to /_next/*. To allow this, configure "allowedDevOrigins" in next.config\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`);
+        (0, _log.warnOnce)(`Blocked cross-origin request to /_next/*. Cross-site requests are blocked in "no-cors" mode.`);
         return true;
     }
     // ensure websocket requests from allowed origin
@@ -42,7 +43,7 @@ const blockCrossSite = (req, res, allowedOrigins, activePort)=>{
             const isIpRequest = _net.default.isIPv4(originLowerCase) || _net.default.isIPv6(originLowerCase);
             if (// allow requests if direct IP and matching port and
             // allow if any of the allowed origins match
-            !(isIpRequest && isMatchingPort) && !allowedOrigins.some((allowedOrigin)=>allowedOrigin === originLowerCase)) {
+            !(isIpRequest && isMatchingPort) && !(0, _csrfprotection.isCsrfOriginAllowed)(originLowerCase, allowedOrigins)) {
                 if ('statusCode' in res) {
                     res.statusCode = 403;
                 }

package/dist/server/lib/router-utils/block-cross-site.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/server/lib/router-utils/block-cross-site.ts"],"sourcesContent":["import type { Duplex } from 'stream'\nimport type { IncomingMessage, ServerResponse } from 'webpack-dev-server'\nimport { parseUrl } from '../../../lib/url'\nimport net from 'net'\nimport { warnOnce } from '../../../build/output/log'\n\nexport const blockCrossSite = (\n  req: IncomingMessage,\n  res: ServerResponse | Duplex,\n  allowedOrigins: string[],\n  activePort: string\n): boolean => {\n  // only process _next URLs\n  if (!req.url?.includes('/_next')) {\n    return false\n  }\n  // block non-cors request from cross-site e.g. script tag on\n  // different host\n  if (\n    req.headers['sec-fetch-mode'] === 'no-cors' &&\n    req.headers['sec-fetch-site'] === 'cross-site'\n  ) {\n    if ('statusCode' in res) {\n      res.statusCode = 403\n    }\n    res.end('Unauthorized')\n    warnOnce(\n      `Blocked cross-origin request to /_next/*. To allow this, configure \"allowedDevOrigins\" in next.config\\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`\n    )\n    return true\n  }\n\n  // ensure websocket requests from allowed origin\n  const rawOrigin = req.headers['origin']\n\n  if (rawOrigin) {\n    const parsedOrigin = parseUrl(rawOrigin)\n\n    if (parsedOrigin) {\n      const originLowerCase = parsedOrigin.hostname.toLowerCase()\n      const isMatchingPort = parsedOrigin.port === activePort\n      const isIpRequest =\n        net.isIPv4(originLowerCase) || net.isIPv6(originLowerCase)\n\n      if (\n        // allow requests if direct IP and matching port and\n        // allow if any of the allowed origins match\n        !(isIpRequest && isMatchingPort) &&\n        !allowedOrigins.some(\n          (allowedOrigin) => allowedOrigin === originLowerCase\n        )\n      ) {\n        if ('statusCode' in res) {\n          res.statusCode = 403\n        }\n        res.end('Unauthorized')\n        warnOnce(\n          `Blocked cross-origin request from ${originLowerCase}. To allow this, configure \"allowedDevOrigins\" in next.config\\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`\n        )\n        return true\n      }\n    }\n  }\n\n  return false\n}\n"],"names":["blockCrossSite","req","res","allowedOrigins","activePort","url","includes","headers","statusCode","end","warnOnce","rawOrigin","parsedOrigin","parseUrl","originLowerCase","hostname","toLowerCase","isMatchingPort","port","isIpRequest","net","isIPv4","isIPv6","some","allowedOrigin"],"mappings":";;;;+BAMaA;;;eAAAA;;;qBAJY;4DACT;qBACS;;;;;;AAElB,MAAMA,iBAAiB,CAC5BC,KACAC,KACAC,gBACAC;QAGKH;IADL,0BAA0B;IAC1B,IAAI,GAACA,WAAAA,IAAII,GAAG,qBAAPJ,SAASK,QAAQ,CAAC,YAAW;QAChC,OAAO;IACT;IACA,4DAA4D;IAC5D,iBAAiB;IACjB,IACEL,IAAIM,OAAO,CAAC,iBAAiB,KAAK,aAClCN,IAAIM,OAAO,CAAC,iBAAiB,KAAK,cAClC;QACA,IAAI,gBAAgBL,KAAK;YACvBA,IAAIM,UAAU,GAAG;QACnB;QACAN,IAAIO,GAAG,CAAC;QACRC,IAAAA,aAAQ,EACN,CAAC,mMAAmM,CAAC;QAEvM,OAAO;IACT;IAEA,gDAAgD;IAChD,MAAMC,YAAYV,IAAIM,OAAO,CAAC,SAAS;IAEvC,IAAII,WAAW;QACb,MAAMC,eAAeC,IAAAA,aAAQ,EAACF;QAE9B,IAAIC,cAAc;YAChB,MAAME,kBAAkBF,aAAaG,QAAQ,CAACC,WAAW;YACzD,MAAMC,iBAAiBL,aAAaM,IAAI,KAAKd;YAC7C,MAAMe,cACJC,YAAG,CAACC,MAAM,CAACP,oBAAoBM,YAAG,CAACE,MAAM,CAACR;YAE5C,IACE,oDAAoD;YACpD,4CAA4C;YAC5C,CAAEK,CAAAA,eAAeF,cAAa,KAC9B,CAACd,eAAeoB,IAAI,CAClB,CAACC,gBAAkBA,kBAAkBV,kBAEvC;gBACA,IAAI,gBAAgBZ,KAAK;oBACvBA,IAAIM,UAAU,GAAG;gBACnB;gBACAN,IAAIO,GAAG,CAAC;gBACRC,IAAAA,aAAQ,EACN,CAAC,kCAAkC,EAAEI,gBAAgB,2JAA2J,CAAC;gBAEnN,OAAO;YACT;QACF;IACF;IAEA,OAAO;AACT"}
+{"version":3,"sources":["../../../../src/server/lib/router-utils/block-cross-site.ts"],"sourcesContent":["import type { Duplex } from 'stream'\nimport type { IncomingMessage, ServerResponse } from 'webpack-dev-server'\nimport { parseUrl } from '../../../lib/url'\nimport net from 'net'\nimport { warnOnce } from '../../../build/output/log'\nimport { isCsrfOriginAllowed } from '../../app-render/csrf-protection'\n\nexport const blockCrossSite = (\n  req: IncomingMessage,\n  res: ServerResponse | Duplex,\n  allowedOrigins: string[],\n  activePort: string\n): boolean => {\n  // only process _next URLs\n  if (!req.url?.includes('/_next')) {\n    return false\n  }\n  // block non-cors request from cross-site e.g. script tag on\n  // different host\n  if (\n    req.headers['sec-fetch-mode'] === 'no-cors' &&\n    req.headers['sec-fetch-site'] === 'cross-site'\n  ) {\n    if ('statusCode' in res) {\n      res.statusCode = 403\n    }\n    res.end('Unauthorized')\n    warnOnce(\n      `Blocked cross-origin request to /_next/*. Cross-site requests are blocked in \"no-cors\" mode.`\n    )\n    return true\n  }\n\n  // ensure websocket requests from allowed origin\n  const rawOrigin = req.headers['origin']\n\n  if (rawOrigin) {\n    const parsedOrigin = parseUrl(rawOrigin)\n\n    if (parsedOrigin) {\n      const originLowerCase = parsedOrigin.hostname.toLowerCase()\n      const isMatchingPort = parsedOrigin.port === activePort\n      const isIpRequest =\n        net.isIPv4(originLowerCase) || net.isIPv6(originLowerCase)\n\n      if (\n        // allow requests if direct IP and matching port and\n        // allow if any of the allowed origins match\n        !(isIpRequest && isMatchingPort) &&\n        !isCsrfOriginAllowed(originLowerCase, allowedOrigins)\n      ) {\n        if ('statusCode' in res) {\n          res.statusCode = 403\n        }\n        res.end('Unauthorized')\n        warnOnce(\n          `Blocked cross-origin request from ${originLowerCase}. To allow this, configure \"allowedDevOrigins\" in next.config\\nRead more: https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins`\n        )\n        return true\n      }\n    }\n  }\n\n  return false\n}\n"],"names":["blockCrossSite","req","res","allowedOrigins","activePort","url","includes","headers","statusCode","end","warnOnce","rawOrigin","parsedOrigin","parseUrl","originLowerCase","hostname","toLowerCase","isMatchingPort","port","isIpRequest","net","isIPv4","isIPv6","isCsrfOriginAllowed"],"mappings":";;;;+BAOaA;;;eAAAA;;;qBALY;4DACT;qBACS;gCACW;;;;;;AAE7B,MAAMA,iBAAiB,CAC5BC,KACAC,KACAC,gBACAC;QAGKH;IADL,0BAA0B;IAC1B,IAAI,GAACA,WAAAA,IAAII,GAAG,qBAAPJ,SAASK,QAAQ,CAAC,YAAW;QAChC,OAAO;IACT;IACA,4DAA4D;IAC5D,iBAAiB;IACjB,IACEL,IAAIM,OAAO,CAAC,iBAAiB,KAAK,aAClCN,IAAIM,OAAO,CAAC,iBAAiB,KAAK,cAClC;QACA,IAAI,gBAAgBL,KAAK;YACvBA,IAAIM,UAAU,GAAG;QACnB;QACAN,IAAIO,GAAG,CAAC;QACRC,IAAAA,aAAQ,EACN,CAAC,4FAA4F,CAAC;QAEhG,OAAO;IACT;IAEA,gDAAgD;IAChD,MAAMC,YAAYV,IAAIM,OAAO,CAAC,SAAS;IAEvC,IAAII,WAAW;QACb,MAAMC,eAAeC,IAAAA,aAAQ,EAACF;QAE9B,IAAIC,cAAc;YAChB,MAAME,kBAAkBF,aAAaG,QAAQ,CAACC,WAAW;YACzD,MAAMC,iBAAiBL,aAAaM,IAAI,KAAKd;YAC7C,MAAMe,cACJC,YAAG,CAACC,MAAM,CAACP,oBAAoBM,YAAG,CAACE,MAAM,CAACR;YAE5C,IACE,oDAAoD;YACpD,4CAA4C;YAC5C,CAAEK,CAAAA,eAAeF,cAAa,KAC9B,CAACM,IAAAA,mCAAmB,EAACT,iBAAiBX,iBACtC;gBACA,IAAI,gBAAgBD,KAAK;oBACvBA,IAAIM,UAAU,GAAG;gBACnB;gBACAN,IAAIO,GAAG,CAAC;gBACRC,IAAAA,aAAQ,EACN,CAAC,kCAAkC,EAAEI,gBAAgB,2JAA2J,CAAC;gBAEnN,OAAO;YACT;QACF;IACF;IAEA,OAAO;AACT"}

package/dist/server/lib/start-server.js

@@ -111,7 +111,7 @@ async function getRequestHandlers({ dir, port, isDev, onDevServerCleanup, server
 async function startServer(serverOptions) {
     const { dir, isDev, hostname, minimalMode, allowRetry, keepAliveTimeout, selfSignedCertificate } = serverOptions;
     let { port } = serverOptions;
-    process.title = `next-server (v${"15.3.0-canary.3"})`;
+    process.title = `next-server (v${"15.3.0-canary.4"})`;
     let handlersReady = ()=>{};
     let handlersError = ()=>{};
     let handlersPromise = new Promise((resolve, reject)=>{

package/dist/shared/lib/canary-only.js

@@ -22,7 +22,7 @@ _export(exports, {
 });
 function isStableBuild() {
     var _process_env___NEXT_VERSION;
-    return !((_process_env___NEXT_VERSION = "15.3.0-canary.3") == null ? void 0 : _process_env___NEXT_VERSION.includes('canary')) && !process.env.__NEXT_TEST_MODE && !process.env.NEXT_PRIVATE_LOCAL_DEV;
+    return !((_process_env___NEXT_VERSION = "15.3.0-canary.4") == null ? void 0 : _process_env___NEXT_VERSION.includes('canary')) && !process.env.__NEXT_TEST_MODE && !process.env.NEXT_PRIVATE_LOCAL_DEV;
 }
 class CanaryOnlyError extends Error {
     constructor(arg){

package/dist/telemetry/anonymous-meta.js

@@ -81,7 +81,7 @@ function getAnonymousMeta() {
         isWsl: _iswsl.default,
         isCI: _ciinfo.isCI,
         ciName: _ciinfo.isCI && _ciinfo.name || null,
-        nextVersion: "15.3.0-canary.3"
+        nextVersion: "15.3.0-canary.4"
     };
     return traits;
 }

package/dist/telemetry/events/session-stopped.js

@@ -11,11 +11,11 @@ Object.defineProperty(exports, "eventCliSessionStopped", {
 const EVENT_VERSION = 'NEXT_CLI_SESSION_STOPPED';
 function eventCliSessionStopped(event) {
     // This should be an invariant, if it fails our build tooling is broken.
-    if (typeof "15.3.0-canary.3" !== 'string') {
+    if (typeof "15.3.0-canary.4" !== 'string') {
         return [];
     }
     const payload = {
-        nextVersion: "15.3.0-canary.3",
+        nextVersion: "15.3.0-canary.4",
         nodeVersion: process.version,
         cliCommand: event.cliCommand,
         durationMilliseconds: event.durationMilliseconds,

package/dist/telemetry/events/version.js

@@ -36,12 +36,12 @@ function hasBabelConfig(dir) {
 function eventCliSession(dir, nextConfig, event) {
     var _nextConfig_experimental_staleTimes, _nextConfig_experimental_staleTimes1, _nextConfig_experimental_reactCompiler, _nextConfig_experimental_reactCompiler1;
     // This should be an invariant, if it fails our build tooling is broken.
-    if (typeof "15.3.0-canary.3" !== 'string') {
+    if (typeof "15.3.0-canary.4" !== 'string') {
         return [];
     }
     const { images, i18n } = nextConfig || {};
     const payload = {
-        nextVersion: "15.3.0-canary.3",
+        nextVersion: "15.3.0-canary.4",
         nodeVersion: process.version,
         cliCommand: event.cliCommand,
         isSrcDir: event.isSrcDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next",
-  "version": "15.3.0-canary.3",
+  "version": "15.3.0-canary.4",
   "description": "The React Framework",
   "main": "./dist/server/next.js",
   "license": "MIT",
@@ -100,7 +100,7 @@
     ]
   },
   "dependencies": {
-    "@next/env": "15.3.0-canary.3",
+    "@next/env": "15.3.0-canary.4",
     "@swc/counter": "0.1.3",
     "@swc/helpers": "0.5.15",
     "busboy": "1.6.0",
@@ -132,14 +132,14 @@
   },
   "optionalDependencies": {
     "sharp": "^0.33.5",
-    "@next/swc-darwin-arm64": "15.3.0-canary.3",
-    "@next/swc-darwin-x64": "15.3.0-canary.3",
-    "@next/swc-linux-arm64-gnu": "15.3.0-canary.3",
-    "@next/swc-linux-arm64-musl": "15.3.0-canary.3",
-    "@next/swc-linux-x64-gnu": "15.3.0-canary.3",
-    "@next/swc-linux-x64-musl": "15.3.0-canary.3",
-    "@next/swc-win32-arm64-msvc": "15.3.0-canary.3",
-    "@next/swc-win32-x64-msvc": "15.3.0-canary.3"
+    "@next/swc-darwin-arm64": "15.3.0-canary.4",
+    "@next/swc-darwin-x64": "15.3.0-canary.4",
+    "@next/swc-linux-arm64-gnu": "15.3.0-canary.4",
+    "@next/swc-linux-arm64-musl": "15.3.0-canary.4",
+    "@next/swc-linux-x64-gnu": "15.3.0-canary.4",
+    "@next/swc-linux-x64-musl": "15.3.0-canary.4",
+    "@next/swc-win32-arm64-msvc": "15.3.0-canary.4",
+    "@next/swc-win32-x64-msvc": "15.3.0-canary.4"
   },
   "devDependencies": {
     "@ampproject/toolbox-optimizer": "2.8.3",
@@ -172,11 +172,11 @@
     "@jest/types": "29.5.0",
     "@mswjs/interceptors": "0.23.0",
     "@napi-rs/triples": "1.2.0",
-    "@next/font": "15.3.0-canary.3",
-    "@next/polyfill-module": "15.3.0-canary.3",
-    "@next/polyfill-nomodule": "15.3.0-canary.3",
-    "@next/react-refresh-utils": "15.3.0-canary.3",
-    "@next/swc": "15.3.0-canary.3",
+    "@next/font": "15.3.0-canary.4",
+    "@next/polyfill-module": "15.3.0-canary.4",
+    "@next/polyfill-nomodule": "15.3.0-canary.4",
+    "@next/react-refresh-utils": "15.3.0-canary.4",
+    "@next/swc": "15.3.0-canary.4",
     "@opentelemetry/api": "1.6.0",
     "@playwright/test": "1.41.2",
     "@storybook/addon-a11y": "8.6.0",