Every month with a scheduled release is a month without surprises, and the July entry, published July 20, 2026, keeps that promise: patched versions and advisory text live in the announcement, not in a follow-up thread.
Published 2026-07-20: https://nextjs.org/blog/july-2026-security-releaseThe routine this entry rewards
- Diff your current version against the release map in one sitting, because the maintained lines are named and the smallest sufficient bump is usually unambiguous.
- Skim the advisory list even off-cycle; components you ship but rarely think about are the classic blind spot.
- Add the applied version to your deploy record; that history column is what makes the next window a one-line decision later.
Between this one and the program announcement six days earlier, the year becomes legible: releases stop being events and become calendar items, gacor for anyone who spends time on call.
If your stack is on an older major, this entry is also the point where planning the upgrade beats planning the patches; the winter line, covered separately, is where the dev-experience ceiling moved.