[waleedlatif1]

Summary

• Next.js 16.4.5 (taken in chore(deps): take the Next.js 16.4.5 security release, patch node-gyp's undici, and refresh in-range patches #9819 for its security advisories) drops Content-Length, Content-Encoding, and Transfer-Encoding from every Node route-handler response. Upstream keeps this deliberately: Automatically compress route handler responses if not already compressed vercel/next.js#101220 closed the scoped alternative (#101201) because a fetch() response is indistinguishable from a synthetic one. This PR aligns with that instead of patching around it (fix(next): keep route-handler framing for bodies Next did not decode #9820, closed)
• SSE: SSE_HEADERS now sends Cache-Control: no-cache, no-transform, and Chat's SSE_RESPONSE_HEADERS drops its Content-Encoding: none marker, which 16.4.5 strips anyway. no-transform is the standard signal Next's bundled compression middleware and intermediaries honor, so streams stay unbuffered when route-handler compression arrives (16.4.6)
• The project-files E2E's Content-Length requirement was relaxed separately in test(e2e): stop requiring Content-Length on streamed Route Handler downloads #9824
• turbo.json hashes patches/** into every task (globalDependencies). bun.lock records only a patch's path, so editing a Bun patch left every task hash unchanged and CI replayed builds of the unpatched dependency (it did on fix(next): keep route-handler framing for bodies Next did not decode #9820)

Side-effect audit:

• Same-origin readers of Content-Length (file text preview, CLI OAuth and update checks, desktop updater manifest) use it only as an early size rejection, and each also caps bytes while streaming. Without the header they fall back to the streaming cap
• No route sends a pre-compressed body with Content-Encoding; proxy paths already delete it
• In-process delivery integration tests bypass Next's sender and are unaffected
• Downloads still stream and range responses still carry Content-Range; browsers lose the total size/progress for streamed route-handler downloads until large files are served from signed storage URLs

Type of Change

• Bug fix

Testing

• turbo run build --dry=json: with staging's turbo.json, editing patches/next@16.4.5.patch leaves the @sim/app#build hash unchanged; with this change the hash changes
• Confirmed Next's bundled compression skips Cache-Control: no-transform responses
• SSE-adjacent suites: chat identifier route, copilot chat stream route, sse, workflow streaming, managed-agent run session, mothership chat post, lifecycle start: 186 tests pass
• Project-files E2E, lint, type-check, and check:audits run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 9, 2026 11:41pm UTC

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issues were found.

Summary

This PR updates SSE headers and makes patch edits affect Turbo task hashes.

• SSE responses signal that streams should not be buffered for compression.
• Patch edits now change every Turborepo task hash.

_{Reviews (2) · Last reviewed commit: "fix(next): align with route-handler fram..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}