Next.js 15.4.6 represents a minor version update over 15.4.5, primarily focusing on internal dependency updates and potentially bug fixes to enhance the stability and performance of the React framework. Examining the package.json diff reveals changes in optional dependencies like @next/swc-*, corresponding to the built-in Rust-based compiler and optimizing the builds targeting diverse platforms and architectures, including Darwin (macOS) and Linux variants (GNU and Musl) and Windows, across both x64 and ARM64 architectures.
The core dependencies remain largely consistent, suggesting that this is not a feature release introducing new functionalities or significant API changes. Instead, the emphasis likely lies on refining existing features and ensuring compatibility with the latest underlying technologies. Developers should anticipate subtle improvements in build times or runtime behavior due to updated compiler components, as well as better compatibility with various system configurations.
The updated @next/react-refresh-utils is also part of the 15.4.6 package that should enable the Refresh Module, that allows faster cycles when you work inside the React environment, without the need of fully refreshing or reloading.
The fileCount in the dist information shows differences: next-15.4.6 has 7193, while next-15.4.5 has 7193; instead, the unpackedSize information confirms that the next-15.4.6 is greater than the next-15.4.5 meaning it contains more updates inside of it.
While the changes may appear incremental, such updates are essential for maintaining a robust and developer-friendly experience. Developers are recommended to upgrade to version 15.4.6 to benefit from the latest optimizations and ensure their applications remain up-to-date with the evolving Next.js ecosystem.
All the vulnerabilities related to the version 15.4.6 of the package
Next.js Improper Middleware Redirect Handling Leads to SSRF
A vulnerability in Next.js Middleware has been fixed in v14.2.32 and v15.4.7. The issue occurred when request headers were directly passed into NextResponse.next(). In self-hosted applications, this could allow Server-Side Request Forgery (SSRF) if certain sensitive headers from the incoming request were reflected back into the response.
All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() function.
More details at Vercel Changelog
