Next.js @latest causes AlphaTab to Crash - Action required: upgrade Next.js immediately- CVE-2025-55182 #2420
-
|
Hello, I usually update all by using the @latest and in this case I was using the 15.3.3 When I ran npm install next@latest, it installed Next.js 16.0.7 - That's a major version jump from 15.3.3 and explains why AlphaTab broke. Here's the deal: Turbopack as the default bundler So technically, npm install next@latest correctly installed the latest version (16.0.7), but Next.js 16 has significant architectural changes that break compatibility with many existing libraries like AlphaTab. You needed a security patch So just wanted to bring this to attention of anyone using Next.js since the warning just came out today. |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 1 reply
-
|
Can you share any details what seems to break with alphaTab on the latest next.js version? One key problem is typically in the bundlers and if they (again) invented some new toolchain this could be to blame. I have an eye on the new Rolldown/Vite+/Turbopack etc. initiatives on bundlers but haven't invested yet much efforts in ensuring these bundlers have proper alphaTab plugins. |
Beta Was this translation helpful? Give feedback.
-
|
Right now what happens is that the canvas does not load at all, just a
blank empty canvas when the Next.js is updated to the 16.0.7
And then in the console logs is shows the 404
And when I tested in both desktop and PWA mobile on iPhone 16 Pro Max
Each songs I switched to (I have 8 guitar pro files from the
Ultimate-Guitar.com) none of the scores or staves would load. All just
blank empty canvas.
But after finding a patch 15.x. That was considered stable I was able to
restore everything again.
…On Sat, Dec 6, 2025 at 2:20 AM Daniel Kuschny ***@***.***> wrote:
Can you share any details *what* seems to break with alphaTab on the
latest next.js version? One key problem is typically in the bundlers and if
they (again) invented some new toolchain this could be to blame.
I have an eye on the new Rolldown/Vite+/Turbopack etc. initiatives on
bundlers but haven't invested yet much efforts in ensuring these bundlers
have proper alphaTab plugins.
—
Reply to this email directly, view it on GitHub
<#2420 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/BNLESQDLTCGBUGVAL7JUI6L4AKUWZAVCNFSM6AAAAACOHIRH6GVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMJXHEZDIMI>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
Thanks for sharing. Would still need to dive into this more detailed to understand what exactly is not working. https://nextjs.org/docs/app/guides/upgrading/version-16#opting-out-of-turbopack is definitely one one thing you need to do. Turbopack does not provide compatibility with WebPack plugins. You need to ensure you use classical webpack. https://nextjs.org/docs/app/api-reference/turbopack#will-we-be-able-to-use-webpack-plugins I haven't seen any bundler in the market having proper support for WebWorkers and Audio Worklets. That's one of the main reasons why the alphaTab bundler plugins need to exist 😞 |
Beta Was this translation helpful? Give feedback.
-
|
The problem in Next.js lies purely in their default-use of their new bundler Turbopack. You need to force the use of WebPack together with the plugin: https://github.com/CoderLine/alphaTabSamplesWeb/tree/main/src/webpack-nextjs-16 Turbopack has neither a plugin system, nor support for what we need. Everyone inventing their fancy bundlers and toolkits without taking care of the need for Audio Worklets (and partly even proper web workers with dependencies) 😞 |
Beta Was this translation helpful? Give feedback.
The problem in Next.js lies purely in their default-use of their new bundler Turbopack. You need to force the use of WebPack together with the plugin:
https://github.com/CoderLine/alphaTabSamplesWeb/tree/main/src/webpack-nextjs-16
Turbopack has neither a plugin system, nor support for what we need. Everyone inventing their fancy bundlers and toolkits without taking care of the need for Audio Worklets (and partly even proper web workers with dependencies) 😞