[pull] canary from vercel:canary

crates/next-api/src/next_server_nft.rs

@@ -237,8 +237,7 @@ impl Asset for ServerNftJsonAsset {
                     .get_relative_path_to(&module_path)
                     .context("failed to compute relative path for server NFT JSON")?,
                 module_path
-                    .read()
-                    .hash(hash_salt, HashAlgorithm::Xxh3Hash128Hex)
+                    .hash_file(hash_salt, HashAlgorithm::Xxh3Hash128Hex)
                     .await?,
             ));
 
@@ -258,8 +257,7 @@ impl Asset for ServerNftJsonAsset {
                         base_dir
                             .get_relative_path_to(file)
                             .context("failed to compute relative path for server NFT JSON")?,
-                        file.read()
-                            .hash(hash_salt, HashAlgorithm::Xxh3Hash128Hex)
+                        file.hash_file(hash_salt, HashAlgorithm::Xxh3Hash128Hex)
                             .await?,
                     ))
                 }

crates/next-api/src/nft_json.rs

@@ -241,8 +241,7 @@ impl Asset for NftJsonAsset {
                             relative_path,
                             Either::Left(
                                 file_path
-                                    .read()
-                                    .hash(hash_salt, HashAlgorithm::Xxh3Hash128Hex)
+                                    .hash_file(hash_salt, HashAlgorithm::Xxh3Hash128Hex)
                                     .await?,
                             ),
                         ))

docs/01-app/02-guides/authentication.mdx

@@ -100,7 +100,7 @@ export async function signup(formData) {}
 
 #### 2. Validate form fields on the server
 
-Use the Server Action to validate the form fields on the server. If your authentication provider doesn't provide form validation, you can use a schema validation library like [Zod](https://zod.dev/) or [Yup](https://github.com/jquense/yup).
+Use the Server Action to validate the form fields on the server. If your authentication provider doesn't provide form validation, you can use a schema validation library like [Zod](https://zod.dev/), [Valibot](https://valibot.dev/) or [Yup](https://github.com/jquense/yup).
 
 Using Zod as an example, you can define a form schema with appropriate error messages:
 

docs/01-app/02-guides/forms.mdx

@@ -131,7 +131,7 @@ export async function updateUser(userId, formData) {}
 Forms can be validated on the client or server.
 
 - For **client-side validation**, you can use the HTML attributes like `required` and `type="email"` for basic validation.
-- For **server-side validation**, you can use a library like [zod](https://zod.dev/) to validate the form fields. For example:
+- For **server-side validation**, you can use a schema validation library like [Zod](https://zod.dev/) or [Valibot](https://valibot.dev/) to validate the form fields. For example:
 
 ```tsx filename="app/actions.ts" switcher
 'use server'

docs/01-app/03-api-reference/04-functions/permanentRedirect.mdx

@@ -12,8 +12,6 @@ When used in a streaming context, this will insert a meta tag to emit the redire
 
 If a resource doesn't exist, you can use the [`notFound` function](/docs/app/api-reference/functions/not-found) instead.
 
-> **Good to know**: If you prefer to return a 307 (Temporary) HTTP redirect instead of 308 (Permanent), you can use the [`redirect` function](/docs/app/api-reference/functions/redirect) instead.
-
 ## Parameters
 
 The `permanentRedirect` function accepts two arguments:
@@ -45,6 +43,11 @@ The `type` parameter has no effect when used in Server Components.
 
 `permanentRedirect` does not return a value.
 
+## Behavior
+
+- In Server Actions and Route Handlers, `permanentRedirect` should be called **outside** the `try` block when using `try/catch` statements because it throws an error.
+- If you prefer to return a 307 (Temporary) HTTP redirect instead of 308 (Permanent), you can use the [`redirect` function](/docs/app/api-reference/functions/redirect) instead.
+
 ## Example
 
 Invoking the `permanentRedirect()` function throws a `NEXT_REDIRECT` error and terminates rendering of the route segment in which it was thrown.

docs/02-pages/02-guides/forms.mdx

@@ -96,7 +96,7 @@ export default function Page() {
 
 We recommend using HTML validation like `required` and `type="email"` for basic client-side form validation.
 
-For more advanced server-side validation, you can use a schema validation library like [zod](https://zod.dev/) to validate the form fields before mutating the data:
+For more advanced server-side validation, you can use a schema validation library like [Zod](https://zod.dev/) or [Valibot](https://valibot.dev/) to validate the form fields before mutating the data:
 
 ```ts filename="pages/api/submit.ts" switcher
 import type { NextApiRequest, NextApiResponse } from 'next'

packages/next/src/build/templates/app-page-runtime.ts

@@ -50,7 +50,6 @@ import {
   NEXT_IS_PRERENDER_HEADER,
   NEXT_DID_POSTPONE_HEADER,
   RSC_CONTENT_TYPE_HEADER,
-  NEXT_HMR_REFRESH_HEADER,
 } from '../../client/components/app-router-headers' with { 'turbopack-transition': 'next-server-utility' }
 import { getBotType } from '../../shared/lib/router/utils/is-bot' with { 'turbopack-transition': 'next-server-utility' }
 import {
@@ -1623,21 +1622,14 @@ export function createAppPageEntrypoint({
           )
         }
 
-        // Dev responses use `no-cache` so the browser can restore them from the
-        // HTTP cache on back/forward instead of reloading. HMR refresh responses
-        // opt out into `no-store` because a superseded refresh's fetch is aborted
-        // mid-write: under `no-cache` the response is stored, so the abort leaves
-        // the cache entry shared with the superseding refresh (same URL)
-        // half-written; Chromium then discards it and reissues the superseding
-        // refresh on a second connection as a duplicate request. `no-store` keeps
-        // that entry from being created.
+        // Documents and RSC payloads must not be stored in development.
+        // Browsers reuse a stored response for a history navigation without
+        // revalidating it, so a back navigation would restore a page from
+        // before the latest edit. Static assets never reach this code. They
+        // keep a revalidatable `Cache-Control`, so the browser caches them
+        // between page loads.
         if (routeModule.isDev) {
-          res.setHeader(
-            'Cache-Control',
-            req.headers[NEXT_HMR_REFRESH_HEADER] === '1'
-              ? 'no-store'
-              : 'no-cache, must-revalidate'
-          )
+          res.setHeader('Cache-Control', 'no-store')
         }
 
         if (!cacheEntry) {