Announced October 27 for November 3: Next.js continues its formal security release calendar. The announcement gives teams a week to prepare an upgrade branch while the previous cycle's dust settles.
What a published calendar changes
- The decision is made once, not argued every time a CVE lands: second and third Tuesday-style slots mean bump-test-deploy is a standing task.
- Announcements arrive early, so your CI can compile the upgrade before the patch exists.
- Between slots there is still the out-of-band path for critical holes, and it stays documented rather than improvised.
The October cycle showed both lanes working: the scheduled release shipped September 30, and a critical upstream hole still got an out-of-band update on October 14. The lesson for any project: a boring calendar beats a heroic scramble, every quarter.