Next.js formalizes its security release cadence

September 30 brought a scheduled security release on a published calendar; the era of surprise emergency patches is over.

Published September 30, 20263 min readHandmade on the workshop bench

Open weekly planner with a pen on a desk

Photo: freestocks.org / flickr

The September 30 security release went out on the announced date. Paired with July's announcement of a formal security release program, Next.js now patches supported lines on a plan that is public weeks ahead.

What a cadence buys a small team

One recurring calendar slot per release, so the bump-test-deploy decision is made once, not argued every time.
Announcements arrive days early, which means your upgrade branch can be prebuilt.
In-between emergencies stay rare because the scheduled path actually gets used.

The boring version of security is a calendar entry. Sites that keep the hour at their desk spend an hour; sites that skip it spend a weekend with a postmortem.

Next.js formalizes its security release cadence

What a cadence buys a small team

Keep reading