Uh oh!
There was an error while loading. Please reload this page.
[FlightReply] Don't drop FormData entries in decodeReplyFromBusboy - #36468
Merged
Conversation
unstubbableforce-pushed
the
fix-form-data-regression
branch
from
May 13, 2026 22:22
350689b to
d94bedcComparegnoff
reviewed
May 13, 2026
Uh oh!
There was an error while loading. Please reload this page.
gnoff
reviewed
May 13, 2026
gnoff
left a comment
Collaborator
There was a problem hiding this comment.
could store queueFields on the file entry. always push to the top pendingFile.
Then you only flush when you get data an end even on value and you flush each file followed by it's queueFields until you hit the next pending file. splice the files array to eliminate flushed files and fields
unstubbableforce-pushed
the
fix-form-data-regression
branch
from
May 13, 2026 23:26
d94bedc to
393e3aaCompareFixes a regression from react#36425 where referenced `FormData` entries can be dropped by `decodeReplyFromBusboy` when files are interleaved with text fields in the payload. `decodeReplyFromBusboy` queues text fields that arrive while a file is being streamed and flushes them after the last file's `'end'`, working around busboy emitting `'end'` deferred relative to subsequent `'field'` events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until react#36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced through `useActionState` actions that return the submitted `FormData` as part of their state. This replaces the tail-flush with a positionally-tagged buffer drained in arrival order. `flush()` walks from a monotonic index pointer, resolving text immediately and files once their `'end'` has fired, and holding later entries when the cursor lands on a still-streaming file. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new tests cover the multi-file interleave. fixesvercel/next.js#93822
unstubbableforce-pushed
the
fix-form-data-regression
branch
from
May 13, 2026 23:40
76b9503 to
5978b45Compareunstubbable
marked this pull request as ready for review
May 14, 2026 00:13
gnoff
approved these changes
May 14, 2026
Uh oh!
There was an error while loading. Please reload this page.
gnoff
reviewed
May 14, 2026
Uh oh!
There was an error while loading. Please reload this page.
gnoff
reviewed
May 14, 2026
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
github-actionsBot
pushed a commit
to code/lib-react
that referenced
this pull request
May 17, 2026
…eact#36468) Fixes a regression from react#36425 where referenced `FormData` entries can be dropped by `decodeReplyFromBusboy` when files are interleaved with text fields in the payload. `decodeReplyFromBusboy` queues text fields that arrive while a file is being streamed and flushes them after the last file's `'end'`, working around busboy emitting `'end'` deferred relative to subsequent `'field'` events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until react#36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced through `useActionState` actions that return the submitted `FormData` as part of their state. This replaces the tail-flush with a linked list of pending files. Text fields that arrive while a file is in flight are queued on the tail file's `queuedFields`; fields that arrive when the list is empty resolve immediately. `flush()` walks from the head, resolving each completed file followed by its queued fields, and stops at the first file that hasn't ended yet. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new tests cover the multi-file interleave. fixesvercel/next.js#93822 DiffTrain build for [b91823e](react@b91823e)
github-actionsBot
pushed a commit
to code/lib-react
that referenced
this pull request
May 17, 2026
…eact#36468) Fixes a regression from react#36425 where referenced `FormData` entries can be dropped by `decodeReplyFromBusboy` when files are interleaved with text fields in the payload. `decodeReplyFromBusboy` queues text fields that arrive while a file is being streamed and flushes them after the last file's `'end'`, working around busboy emitting `'end'` deferred relative to subsequent `'field'` events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until react#36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced through `useActionState` actions that return the submitted `FormData` as part of their state. This replaces the tail-flush with a linked list of pending files. Text fields that arrive while a file is in flight are queued on the tail file's `queuedFields`; fields that arrive when the list is empty resolve immediately. `flush()` walks from the head, resolving each completed file followed by its queued fields, and stops at the first file that hasn't ended yet. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new tests cover the multi-file interleave. fixesvercel/next.js#93822 DiffTrain build for [b91823e](react@b91823e)
MaxwellCohen pushed a commit
to MaxwellCohen/react
that referenced
this pull request
May 26, 2026
…eact#36468) Fixes a regression from react#36425 where referenced `FormData` entries can be dropped by `decodeReplyFromBusboy` when files are interleaved with text fields in the payload. `decodeReplyFromBusboy` queues text fields that arrive while a file is being streamed and flushes them after the last file's `'end'`, working around busboy emitting `'end'` deferred relative to subsequent `'field'` events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until react#36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced through `useActionState` actions that return the submitted `FormData` as part of their state. This replaces the tail-flush with a linked list of pending files. Text fields that arrive while a file is in flight are queued on the tail file's `queuedFields`; fields that arrive when the list is empty resolve immediately. `flush()` walks from the head, resolving each completed file followed by its queued fields, and stops at the first file that hasn't ended yet. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new tests cover the multi-file interleave. fixesvercel/next.js#93822
MaxwellCohen pushed a commit
to MaxwellCohen/react
that referenced
this pull request
May 26, 2026
…eact#36468) Fixes a regression from react#36425 where referenced `FormData` entries can be dropped by `decodeReplyFromBusboy` when files are interleaved with text fields in the payload. `decodeReplyFromBusboy` queues text fields that arrive while a file is being streamed and flushes them after the last file's `'end'`, working around busboy emitting `'end'` deferred relative to subsequent `'field'` events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until react#36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced through `useActionState` actions that return the submitted `FormData` as part of their state. This replaces the tail-flush with a linked list of pending files. Text fields that arrive while a file is in flight are queued on the tail file's `queuedFields`; fields that arrive when the list is empty resolve immediately. `flush()` walks from the head, resolving each completed file followed by its queued fields, and stops at the first file that hasn't ended yet. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new tests cover the multi-file interleave. fixesvercel/next.js#93822
This was referenced May 28, 2026
This was referenced May 28, 2026
15 tasks
mohamedasem318 added a commit
to mohamedasem318/Serenify
that referenced
this pull request
Jul 27, 2026
…ange reaching P6/P7 (#176) (#180) * chore(deps): bump next 16.2.6 -> 16.2.11 for nine security advisories All nine advisories behind the 18 open Dependabot `next` alerts are fixed in 16.2.11, confirmed from the 16.2.11 release notes (which link all nine GHSAs) and cross-checked against each advisory's own affected range. Four are High: DoS in App Router Server Actions (GHSA-m99w-x7hq-7vfj), middleware/proxy bypass with Turbopack + single locale (GHSA-6gpp-xcg3-4w24), SSRF in rewrites (GHSA-p9j2-gv94-2wf4), SSRF in Server Actions on custom servers (GHSA-89xv-2m56-2m9x). Two of the nine are reachable in this app as configured: the Server Actions DoS and the Server Function endpoint disclosure (GHSA-955p-x3mx-jcvp). The other seven need config this app does not have -- no `i18n`, no rewrites, no custom server, no edge runtime, no `images.remotePatterns`, and no `fetch(Request, init)` mismatched-init call sites. Bumped ahead of P6 deliberately. P6 reads the Next 16 routing guides out of `node_modules/next/dist/docs/` (T079) and performs a root-route takeover (T086); 16.2.10 ships a docs backport (#94935) that corrects `03-layouts-and-pages.md` and `02-project-structure.md` -- the two files that answer T079's mandated question about `app/page.tsx` vs `app/(public)/page.tsx`. Bumping first means P6 is built and documented against what actually ships. Nothing in 16.2.7-16.2.11 touches route groups or root `page.tsx` resolution, and `next/image` sizing is unchanged, so P6/P7 are unaffected by the bump itself. 16.2.8/16.2.9/16.2.10 carry no code at all (dist-tag repair x2, and republishing @next/swc-wasm-web). One behaviour change lands in P4's path and is favourable: 16.2.7 carries `Don't drop FormData entries` (#94240, a sync of react/react#36468). 16.2.6 predates it, and `app/(auth)/signup/actions.ts` reads `terms_privacy_version` off FormData, which `handle_new_user()` requires before it writes a consent row. Refs #176. Co-authored-by: Fatma-Alzahraaa <fatmaalzahraa.emad@gmail.com> Co-authored-by: gehaddmohamedd <gehadmohamed2412@gmail.com> Co-authored-by: hebatullah003 <hebatullahelgazoly@gmail.com> * chore(deps): lock next 16.2.11 and its nine @next/* sub-packages Regenerated by `npm install` from the manifest pin in the previous commit. Nothing else was run -- no `npm update`, no `npm audit fix`. Exactly ten packages move, and every one of them is next or a next-owned sub-package: `next`, `@next/env`, and the eight `@next/swc-*` platform binaries. Zero packages added, zero removed. No unrelated transitive dependency was forced to move -- next@16.2.11 declares byte-identical dependencies and peer ranges to 16.2.6, React's range included. `postcss` deliberately does not move and is worth stating plainly, because it is the reason this bump does not clear the whole alert list: next pins `postcss: "8.4.31"` as a hard dependency at 16.2.11 exactly as it did at 16.2.6, so `node_modules/next/node_modules/postcss` stays at 8.4.31 and the top-level copy stays at 8.5.14. Both open postcss advisories (which want 8.5.12 and 8.5.18) survive this change, as does sharp@0.34.5 (wants 0.35.0). 18 of the 21 open alerts clear; 3 remain. Refs #176. Co-authored-by: Fatma-Alzahraaa <fatmaalzahraa.emad@gmail.com> Co-authored-by: gehaddmohamedd <gehadmohamed2412@gmail.com> Co-authored-by: hebatullah003 <hebatullahelgazoly@gmail.com> * docs(backlog): log the undocumented e2e service-role key (#179) Found while recording the pre-bump Playwright baseline for #176: a clean checkout cannot run the e2e suite at all. `globalSetup` dies immediately with `Error: supabaseKey is required.` because `tests/e2e/setup/admin-client.ts:22` builds its admin client from `SUPABASE_SERVICE_ROLE_KEY`, and nothing documents that the key must be set. Cost one full aborted suite run before it was diagnosed. Logged rather than fixed, and the entry is explicit about why the obvious fix is wrong: `.env.local.example` is the runtime env example, and the service-role key is deliberately not part of the runtime surface. #142 removed the runtime service-role path, and `tests/unit/runtime-secret-posture.test.ts` actively guards that removal -- it fails if the literal token appears anywhere under `app/` or `lib/`, and asserts `lib/supabase/admin.ts` does not exist. Adding the key there would advertise a capability the codebase has deliberately deleted and invite the exact regression that test exists to catch. It is e2e test infrastructure and belongs in e2e setup documentation. Filed 1:1 as issue #179 per Principle VIII. Not implemented here -- this PR bumps `next` and nothing else, and where the documentation belongs is its own decision. Co-authored-by: Fatma-Alzahraaa <fatmaalzahraa.emad@gmail.com> Co-authored-by: gehaddmohamedd <gehadmohamed2412@gmail.com> Co-authored-by: hebatullah003 <hebatullahelgazoly@gmail.com> * docs(013): record the P8 pre-deploy consent-row count prompted by the FormData fix Note only -- no task's acceptance criteria are changed, and nothing runs now. Next 16.2.6 carries a FormData-dropping bug, fixed in 16.2.7 by #94240 (a sync of react/react#36468) and shipped here by the 16.2.6 -> 16.2.11 bump. `app/(auth)/signup/actions.ts:33` reads `terms_privacy_version` off FormData, and `handle_new_user()` writes a `user_consents` row only when the signup metadata carries that key. A dropped entry is therefore a silently missing consent row rather than an error, which is exactly the failure mode nobody notices. So before the P8 deploy, a READ-ONLY count on hosted of `auth.users` rows with no `terms_privacy` consent row is worth recording. Explicitly a measurement: FR-041 forbids backfill and T137 separately asserts `user_consents` is empty post-migration, so a non-zero result is a finding to report, not something to repair in P8. Placed in the P8 phase preamble rather than folded into T135's or T137's "Done when", so it does not quietly redefine what those tasks require. Co-authored-by: Fatma-Alzahraaa <fatmaalzahraa.emad@gmail.com> Co-authored-by: gehaddmohamedd <gehadmohamed2412@gmail.com> Co-authored-by: hebatullah003 <hebatullahelgazoly@gmail.com> --------- Co-authored-by: Fatma-Alzahraaa <fatmaalzahraa.emad@gmail.com> Co-authored-by: gehaddmohamedd <gehadmohamed2412@gmail.com> Co-authored-by: hebatullah003 <hebatullahelgazoly@gmail.com>
MaxwellCohen pushed a commit
to MaxwellCohen/react
that referenced
this pull request
Jul 27, 2026
…eact#36468) Fixes a regression from react#36425 where referenced `FormData` entries can be dropped by `decodeReplyFromBusboy` when files are interleaved with text fields in the payload. `decodeReplyFromBusboy` queues text fields that arrive while a file is being streamed and flushes them after the last file's `'end'`, working around busboy emitting `'end'` deferred relative to subsequent `'field'` events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until react#36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced through `useActionState` actions that return the submitted `FormData` as part of their state. This replaces the tail-flush with a linked list of pending files. Text fields that arrive while a file is in flight are queued on the tail file's `queuedFields`; fields that arrive when the list is empty resolve immediately. `flush()` walks from the head, resolving each completed file followed by its queued fields, and stops at the first file that hasn't ended yet. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new tests cover the multi-file interleave. fixesvercel/next.js#93822
SyMind pushed a commit
to SyMind/react
that referenced
this pull request
Aug 11, 2026
* [Flight] Restore standard React version placeholder * [Flight Reply] Early bailout if backing entry for Blob deserialization is not a Blob (react#36055) Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de> (cherry picked from commit 12ba7d8) * [Flight] Avoid consuming cyclic models multiple times Co-authored-by: "Sebastian \"Sebbie\" Silbermann" <sebastian.silbermann@vercel.com> (cherry picked from commit 672b242) * [FlightReply] Type hardening and performance improvements Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de> (cherry picked from commit 795203e) * [FlightReply] Don't drop FormData entries in `decodeReplyFromBusboy` (react#36468) Fixes a regression from react#36425 where referenced `FormData` entries can be dropped by `decodeReplyFromBusboy` when files are interleaved with text fields in the payload. `decodeReplyFromBusboy` queues text fields that arrive while a file is being streamed and flushes them after the last file's `'end'`, working around busboy emitting `'end'` deferred relative to subsequent `'field'` events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until react#36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced through `useActionState` actions that return the submitted `FormData` as part of their state. This replaces the tail-flush with a linked list of pending files. Text fields that arrive while a file is in flight are queued on the tail file's `queuedFields`; fields that arrive when the list is empty resolve immediately. `flush()` walks from the head, resolving each completed file followed by its queued fields, and stops at the first file that hasn't ended yet. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new tests cover the multi-file interleave. fixesvercel/next.js#93822 (cherry picked from commit b91823e) * [FlightReply] Performance improvements when decoding (react#37087) This fixes security vulnerabilities in Server Functions. (cherry picked from commit 1dd4ecb) * [Flight Reply] Align Rspack decoders with upstream changes Mirror the selected Reply changes into the Rspack-owned browser, edge, and Node adapters after the dependency-closed upstream backports. Forward caller-provided array size limits, preserve multipart field/file order, and settle failed async iterators without recursive error re-entry. Add public behavior coverage across every Rspack decoder, action-selection path, cyclic collection type, iterator settlement, and Busboy ordering direction. This is a tactical source-parity change for the existing proposal branch; it does not make that branch current with React main. --------- Co-authored-by: Sebastian "Sebbie" Silbermann <sebastian.silbermann@vercel.com> Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes a regression from #36425 where referenced
FormDataentries can be dropped bydecodeReplyFromBusboywhen files are interleaved with text fields in the payload.decodeReplyFromBusboyqueues text fields that arrive while a file is being streamed and flushes them after the last file's'end', working around busboy emitting'end'deferred relative to subsequent'field'events. With multiple files interleaved with text, this loses the relative order of the affected text entries. The reorder was a long-standing but invisible issue — entries came back in the wrong order but were all present — until #36425 tightened how referenced FormData entries are collected from the backing store to rely on them being contiguous. With that assumption violated, referenced FormDatas can now come back with some entries dropped. The pattern is most easily surfaced throughuseActionStateactions that return the submittedFormDataas part of their state.This replaces the tail-flush with a linked list of pending files. Text fields that arrive while a file is in flight are queued on the tail file's
queuedFields; fields that arrive when the list is empty resolve immediately.flush()walks from the head, resolving each completed file followed by its queued fields, and stops at the first file that hasn't ended yet. The backing FormData now matches the payload's order, restoring the contiguity assumption (and fixing the long-standing reorder as a side effect). The same change is applied to all five copies inreact-server-dom-{webpack,turbopack,parcel,esm,unbundled}. Two new tests cover the multi-file interleave.fixesvercel/next.js#93822