[waleedlatif1]

Summary

• Next.js 16.4.5 (taken in chore(deps): take the Next.js 16.4.5 security release, patch node-gyp's undici, and refresh in-range patches #9819 for GHSA-pc58-hwjq-p385 and six other advisories) drops Content-Length, Content-Encoding, and Transfer-Encoding from every Node route-handler response. Upstream's target is a fetched response returned unchanged: fetch decodes the body but keeps the original coding and length, so forwarding them misframes the body
• Dropping them from every response also strips the declared length from file downloads, so a 100 MB download arrives chunked with no size. The project-files E2E large-download check fails on staging for this reason. The Chat SSE route's Content-Encoding: none no-compression marker is dropped too
• Narrowed the rule in our existing next@16.4.5 patch: the CommonJS and ESM sendResponse builds and the copy prebundled into compiled/next-server/server.runtime.prod.js:
  • A response whose Content-Encoding names a real coding keeps upstream's behavior; its length and coding are dropped
  • A response with no coding, or with identity/none, was not decoded, so its Content-Length and coding are forwarded
  • Transfer-Encoding is never forwarded
• Documented the patch in patches/README.md
• turbo.json now hashes patches/** into every task (globalDependencies). bun.lock records only a patch's path, so editing a patch left the app build hash unchanged and CI replayed a cached build of unpatched Next; the first CI run of this PR did exactly that. With the change, editing the patch changes the @sim/app#build hash, and restoring the file restores it

Type of Change

• Bug fix

Testing

• test:headers:e2e sends real responses through both builds of sendResponse over loopback HTTP; 26/26 pass
  • The unencoded, identity, and none checks fail against unpatched 16.4.5
  • The decoded-body and transfer-coding checks fail when their guards are removed; forwarding a decoded body's stale length leaves the client unable to parse the connection
• Reinstalled next from the committed patch file and reran the suite
• turbo run build --dry=json: the @sim/app#build hash was unchanged by a patch edit before the turbo.json change and changes with it
• The project-files E2E (100 MB download through the running app, asserting its declared length) runs in CI and currently fails on staging

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Nov 9, 2026 11:14pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Restores route-handler response headers when Content-Encoding is absent, identity, or none.

• Node route handlers keep framing headers for undecoded bodies.

No actionable issues were found. Tests were inspected but not run.

_{Reviews (1) · Last reviewed commit: "fix(next): keep route-handler framing fo..." · Reviewed by Greptile}

[greptile-apps]

Your organization has run out of review credits. Add credits to resume code reviews.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

Superseded. Next.js upstream deliberately strips Content-Length/Content-Encoding from route-handler responses (#101220 closed the equivalent scoped approach, #101201, because a fetch() response is indistinguishable from a synthetic one). The narrowed patch also cannot rely on a length-mismatch guard under Bun. Replaced by a fresh PR that aligns with upstream: hash patches/** into turbo tasks, mark SSE responses no-transform instead of Content-Encoding: none, and stop asserting a route-forwarded Content-Length in the project-files E2E.