A sourced fix-playbook workspace for AI and agent engineers. Find the root cause, the affected version, the rollback-safe next step, and edge-case audits.
Users with Pro accounts are unable to log in because Supabase Auth repeatedly requests a second factor (TOTP) despite no MFA factors being enrolled for the user. This locks the account in a loop after email/password authentication.
Next.js 16 Turbopack builds fail to include module IDs for ssr:true dynamic components declared in pages/_app.tsx in the __NEXT_DATA__.dynamicIds array. This causes client-side hydration mismatches, discarding server-rendered markup for persistent site chrome (header/footer/cookie banner) and breaking SSR/SEO for those sections.
Supabase transaction pooler (port 6543) intermittently hangs on trivial indexed SELECTs, leaving backend connections in active ClientRead until client timeout, causing 300s+ request stalls and production outages. Direct/session pooler (5432) remains reliable.
The pg-meta schemas update and remove methods construct DO blocks with fixed $$ dollar-quote delimiters. If any interpolated identifier (schema name, new name, or owner) contains the byte sequence '$$', the PostgreSQL parser prematurely closes the dollar quote, leading to a syntax error and potential SQL injection if the truncation leaves executable statements.
Calling an RPC function without EXECUTE privilege for the anonymous role causes a backend crash and database restart in Supabase's Postgres 17.6.1.111, allowing unauthenticated denial-of-service. The crash is caused by the PostgreSQL configuration parameter exit_on_error being enabled, which forces the backend to terminate on any ERROR instead of returning a normal error response.
Production database on us-east-2 became unreachable after a compute resize, with no Postgres logs. Management API incorrectly reports ACTIVE_HEALTHY while the restore-to-new-project hangs in COMING_UP because a backup from image 17.6.1.104 was restored onto image 17.11.0.002. Urgent support tickets have not been answered for 12+ hours.
Next.js 16 with Turbopack generates external module references with content-based hashes that depend on the node_modules directory structure at build time. When deploying to a different environment and reinstalling dependencies (especially with pnpm symlinks), the hashes no longer match the installed packages, causing the production server to fail to start with 'Cannot find module' errors.
When a compile pipeline change (e.g. turbopack.rules loader, reactCompiler) invalidates most of the module graph, `next build` over an existing `.next/cache` is significantly slower and uses more memory than a cold build, often causing OOM on constrained CI. The persistent cache retains stale entries during rebuild and lacks mass-invalidation fallback.
Project wwxjopfybrfomtealpjc on Supabase us-east-1 experiences complete database query outage due to connection timeouts through the managed pooler. PostgREST root responds but data queries hang or return 503, while direct database connections succeed intermittently, indicating pooler layer failure after maintenance.
A disk-full event during a migration caused PostgreSQL to crash with SQLSTATE 53100. After expanding disk to 8GB, crash recovery checkpoint completed and read-only mode ended, but all connection methods (Supavisor, direct, REST, SQL Editor) remain timed out, indicating the PostgreSQL backend is not accepting connections or is stuck in a state that prevents normal operation.
When middleware adds Set-Cookie headers to a response for a prerendered static page, Next.js preserves the page's original Cache-Control: s-maxage=31536000. Shared CDNs that obey s-maxage may cache and serve the response including sensitive Set-Cookie headers to other users, causing cross-user authentication token leakage.
Turbopack dev server consumes ~16 MB × number of previously compiled pages for each subsequent route handler compilation. Ordering matters: requesting handlers before pages avoids the blow-up. Regression introduced in 16.3.0-canary.101.
With default settings, ToolRetryMiddleware retries all tools on ambiguous transport errors (e.g., httpx.ReadTimeout) that may have already committed external effects, leading to duplicate irreversible side effects. After exhausting retries, it instructs the model to 'Please try again,' compounding the risk.
Studio's formatTableRowsToSQL builds INSERT column list from table metadata but VALUES from JavaScript object enumeration. Integer-like column names are enumerated before other keys, causing values to be placed in wrong columns, silently corrupting exported data. The same code also deletes 'idx' unconditionally, causing missing values if 'idx' is a real column.
In langchain 1.4.0, the HumanInTheLoopMiddleware records pending tool calls before interrupting. Any other after_model middleware that returns the documented {"jump_to": "tools"} outcome routes the graph directly to the tool node, skipping the HITL middleware entirely. This allows previously rejected (or not-yet-reviewed) tool calls to execute with user authority, silently defeating human-in-the-loop approval.
Turbopack's static analysis incorrectly treats the first argument of child_process.fork() as a module import, causing build failures when the argument is a dynamic path or absolute literal.
Next.js output: 'standalone' file tracing fails to include shared libraries loaded at runtime via dlopen by native addons, causing production crashes (e.g., sharp's libvips). Build succeeds silently; failure occurs only at runtime.
The standard sandbox integration test in langchain-tests expects glob() to return directories (with is_dir=True), but the deepagents BackendProtocol.glob() documentation and all implementations (FilesystemBackend and BaseSandbox) explicitly return only regular files. This causes the test to fail for every sandbox backend implementation.
When a shell command times out, ShellSession.execute restarts the shell but ShellToolMiddleware does not re-run startup_commands. Any shell hardening (ulimit, umask, exported variables, readonly tokens) and working directory are silently lost, while the model is not informed that the session was reset.
When a route that calls redirect() behind Suspense is retained in a hidden React Activity (with cacheComponents enabled), the streamed __next-page-redirect DOM marker remains in the document. The navigate-reducer uses a document-wide getElementById check, so any subsequent same-origin Link click from the active route triggers a hard navigation instead of an SPA transition.
In Next.js 16.2.10, when using `next start`, page renders are correctly compressed by the built-in `compression` middleware, but all Route Handler responses (including static/prerendered metadata routes and dynamic route handlers) are sent without any `Content-Encoding`. This occurs even when the response body is well above the 1KB compression threshold and the content type is compressible (e.g., `application/xml`). The issue violates the official documentation's promise that Next.js compresses "rendered content and static files" by default, leading to wasted bandwidth and degraded performance for sitemaps, JSON APIs, and other large Route Handler responses in self-hosted environments.
Non-atomic writes in MultiFileWriter.append() can leave partial or invalid JSON in .next/cache/fetch-cache under concurrent writes; fix by writing to a temporary file and atomically renaming it into place.
When using a nonce-based strict CSP, Next.js App Router fails to add the nonce attribute to the parser-inserted <script> tag for Suspense boundary chunks (loading.tsx, template.tsx, error.tsx). This causes the script to be blocked by 'strict-dynamic' on full page loads, leading to console violations and potentially broken client-side functionality.
The default gtmScriptUrl in @next/third-parties uses https://www.googletagmanager.com/gtm.js, which Google is deprecating. Users relying on the default will experience GTM container load failures after the deprecation date.
When htmlLimitedBots is set to /.*/ and cacheComponents/partialPrefetching are enabled, RSC prefetch responses bypass the PPR shell (no x-nextjs-postponed). The client still chooses the PPR fetch strategy, stores the full concrete page under a param-blind shell vary path, and sibling prefetches overwrite each other. Soft navigation then renders the wrong sibling page (e.g., /item/alpha shows Item delta). Affects Next.js 16.3.3 production; not reproducible on 16.4.0-canary.0.
When a Server Action is bound with .bind() inside a Client Component and used as a form action, submitting the form with JavaScript disabled leaves the browser pending indefinitely. The server executes the action, but the returned state is never rendered. Binding the action in a Server Component and passing it as a prop works correctly.
The credit card detector in PIIMiddleware uses a regex that only matches 16-digit card numbers, so valid 13-15 digit cards (Amex, Diners Club, legacy Visa) pass through undetected, potentially leaking PII to the model.
The PII detectors for email, IP, and MAC addresses use \b word boundaries which are Unicode-aware. Non-ASCII letters (CJK, Cyrillic, Arabic, accented Latin) are treated as word characters, so the boundary does not trigger between them and an ASCII PII token. This allows PII to pass through unredacted, unblocked, or unmasked.
A never-settling RSC fetch promise stored in the segment cache during a stalled navigation poisons subsequent navigations to the same route. With staleTimes.dynamic > 0, the poisoned entry suppresses all requests for the stale window, and even after recovery the navigation remains dead due to React staying suspended on the stale thenable. Requires full page reload.
Calling `after()` arms the current work-unit store, causing the `phase` to be flipped to `'after'` on response close. If the page component later resumes from an await and calls `headers()` or `cookies()`, it gets rejected with E1378, even though the request data is still available. The error is non-deterministic and depends on a race between client disconnect and async continuation.
LangChain, LlamaIndex, and Pydantic
Pinecone, Chroma, Weaviate, Qdrant, and neighboring stores
Next.js, Supabase, and the surrounding app stack