The Wire · Showcase
NEXT.JS TURBOPACK CSS CHUNKING CUTS LOAD TIMES, CLI GOES NATIVE
By RepoJournal · Filed · About Vercel
13 people shipped this
Elvis Pranskevichus
@elprans
2 cited
lukesandberg
@lukesandberg
1 cited
sokra
@sokra
1 cited
Jeff See
@jeffsee55
1 cited
dnukumamras
@dnukumamras
1 cited
eps1lon
@eps1lon
icyJoseph
@icyJoseph
Chris
@chriswdmr
github-actions
@github-actions
aayush-kapoor
@aayush-kapoor
kkdawkins
@kkdawkins
ctgowrie
@ctgowrie
AndrewBarba
@AndrewBarba
Next.js shipped a measurable performance win for CSS module ordering while the Vercel CLI prepares its first native binary layer, and AI SDK closes critical URL validation gaps across provider responses.
The Turbopack team cracked CSS chunking efficiency by reordering module placement during linearization [1]. Instead of breaking ties with weight sorting, the graph now prefers modules that share the most chunk groups with their neighbors, so commonly-loaded modules end up adjacent and split into better-aligned chunks. This measurably lowers modeled chunk-loading on real-world examples. Meanwhile, Next.js hardened the experimental TypeScript CLI checker with two fixes [2]: `tsc` now respects interruption signals (Ctrl-C no longer leaves CPU-heavy processes alive), and the NFT error messages got sharper about which function needs annotation, reducing false positives on nearby calls like `path.join`. The Vercel CLI is laying groundwork for native binaries [3]. Part 1 of a two-phase rollout adds native-aware resolution in the bin entry point with JS fallback; this release is a no-op since no optional dependencies wire the native binary yet, but it confirms the JS path works unaffected at scale before part 2 ships the actual binaries. On the security front, AI SDK now validates URLs fetched from provider response bodies [4]. `getFromApi` in `provider-utils` was routing untrusted image, audio, and video download URLs with no scheme, host, or IP checks. A new opt-in `validateUrl` flag runs them through the same `fetchWithValidatedRedirects` guard that `downloadBlob` uses, rejecting private, loopback, and link-local addresses. The Python queue SDK tightened error tolerance and auth recovery [5], [6]. Lease renewal and acknowledgment calls now retry on transient network errors and tolerate 404s in case previous acks reached the server. Thread-spawned work (lease renewal, Celery timers) now falls back to a process-wide cached OIDC token instead of capturing snapshots at every call site.
Action items
- → Test CSS chunk loading on production builds; this Turbopack ordering change should improve metrics but needs real-world validation vercel/next.js [monitor]
- → Update experimental TypeScript CLI to latest; interrupt handling fix prevents orphaned tsc processes on Ctrl-C vercel/next.js [plan]
- → Review AI SDK provider integrations; enable validateUrl flag on getFromApi calls fetching untrusted response URLs vercel/ai [plan]
- → Upgrade vercel-queue Python SDK before next deployment to production; lease renewal error handling is critical for queue reliability vercel/vercel-py [plan]
References
- [1] Turbopack: order CSS modules by chunk-group co-occurrence in linearize ↗ vercel/next.js
- [2] Fix termination handling ↗ vercel/next.js
- [3] feat(cli): native trampoline with JS fallback, drop postinstall (#17011) vercel/vercel
- [4] fix(provider-utils): route provider-response URLs through the download-URL guard (#16971) vercel/ai
- [5] vercel-queue: Increase tolerance to errors on msg lease updates (#173) vercel/vercel-py
- [6] Fix background-thread queue auth and error recovery (#174) vercel/vercel-py
