Next.js 16.3.2

⚡ Next.js 16.3.2 is here — a backport-patch drop focused on squashing bugs without pulling in unfinished canary features. Stable, targeted, minimal. Just how a patch release should behave.

🐛 Bug Bashes

This one is all about correctness in the app directory and the Turbopack layer. Six focused fixes were backported from canary to keep production builds honest.

• App-entry export validation is now scoped strictly to files inside the app directory
• Catch-all index pages are no longer served for every other slug
• Turbopack stops tracing embedded WASM loader helpers
• Turbopack retains conditions when replacing resolve request keys
• Turbopack worker chunk loading works correctly with an asset prefix

🔐 Cache Cleansing

Turborepo remote caching now authenticates with OIDC instead of a static personal access token — a tucked-away security win for CI pipelines.

⬆️ Update Advice

If you are on the 16.3.x line, this is a safe, low-risk bump. Patch it in, run your test suite, deploy. Credits to the contributors who backported these fixes.