@supabase/storage-js
Advanced tools
Guides · Reference Docs · TypeDoc
⚠️ Node.js 18 Deprecation Notice
Node.js 18 reached end-of-life on April 30, 2025. As announced in our deprecation notice, support for Node.js 18 was dropped on October 31, 2025.
⚠️ Node.js 20 Deprecation Notice
Node.js 20 reached end-of-life on April 30, 2026. As announced in our deprecation notice, support for Node.js 20 was dropped in v2.110.0.
npm install @supabase/storage-js
There are two ways to use the Storage SDK:
If you're already using @supabase/supabase-js, access storage through the client:
import { createClient } from '@supabase/supabase-js'
// Use publishable key for frontend applications
const supabase = createClient('https://<project_ref>.supabase.co', '<your-publishable-key>')
// Access storage
const storage = supabase.storage
// Access different bucket types
const regularBucket = storage.from('my-bucket')
const vectorBucket = storage.vectors.from('embeddings-bucket')
const analyticsBucket = storage.analytics // Analytics API
For backend applications or when you need to bypass Row Level Security:
import { StorageClient } from '@supabase/storage-js'
const STORAGE_URL = 'https://<project_ref>.supabase.co/storage/v1'
const SERVICE_KEY = '<your-secret-key>' // Use secret key for backend operations
const storageClient = new StorageClient(STORAGE_URL, {
apikey: SERVICE_KEY,
Authorization: `Bearer ${SERVICE_KEY}`,
})
// Access different bucket types
const regularBucket = storageClient.from('my-bucket')
const vectorBucket = storageClient.vectors.from('embeddings-bucket')
const analyticsBucket = storageClient.analytics // Analytics API
When to use each approach:
- Use
supabase.storagewhen working with other Supabase features (auth, database, etc.) in frontend applications- Use
new StorageClient()for backend applications, Edge Functions, or when you need to bypass RLS policies
Note: Refer to the Storage Access Control guide for detailed information on creating RLS policies.
Supabase Storage supports three types of buckets, each optimized for different use cases:
Standard buckets for storing files, images, videos, and other assets.
// Create regular storage bucket
const { data, error } = await storageClient.createBucket('my-files', {
public: false,
})
// Upload files
await storageClient.from('my-files').upload('avatar.png', file)
Use cases: User uploads, media assets, documents, backups
Specialized buckets for storing and querying high-dimensional vector embeddings.
// Create vector bucket
await storageClient.vectors.createBucket('embeddings-prod')
// Create index and insert vectors
const bucket = storageClient.vectors.from('embeddings-prod')
await bucket.createIndex({
indexName: 'documents',
dimension: 1536,
distanceMetric: 'cosine',
})
Use cases: Semantic search, AI-powered recommendations, similarity matching
See full Vector Embeddings documentation below
Specialized buckets using Apache Iceberg table format, optimized for analytical queries and large-scale data processing.
// Create analytics bucket
await storageClient.analytics.createBucket('analytics-data')
// List analytics buckets
const { data, error } = await storageClient.analytics.listBuckets()
// Delete analytics bucket
await storageClient.analytics.deleteBucket('analytics-data')
Use cases: Time-series data, analytical queries, data lakes, large-scale data processing, business intelligence
See full Analytics Buckets documentation below
Create a new Storage bucket:
const { data, error } = await storageClient.createBucket(
'test_bucket', // Bucket name (must be unique)
{ public: false } // Bucket options
)
Retrieve the details of an existing Storage bucket:
const { data, error } = await storageClient.getBucket('test_bucket')
Update a new Storage bucket:
const { data, error } = await storageClient.updateBucket(
'test_bucket', // Bucket name
{ public: false } // Bucket options
)
Remove all objects inside a single bucket:
const { data, error } = await storageClient.emptyBucket('test_bucket')
Delete an existing bucket (a bucket can't be deleted with existing objects inside it):
const { data, error } = await storageClient.deleteBucket('test_bucket')
Retrieve the details of all Storage buckets within an existing project:
// List all buckets
const { data, error } = await storageClient.listBuckets()
// List buckets with options (pagination, sorting, search)
const { data, error } = await storageClient.listBuckets({
limit: 10,
offset: 0,
sortColumn: 'created_at',
sortOrder: 'desc',
search: 'prod',
})
Upload a file to an existing bucket:
const fileBody = ... // load your file here
const { data, error } = await storageClient.from('bucket').upload('path/to/file', fileBody)
Note:
The path indata.Keyis prefixed by the bucket ID and is not the value which should be passed to thedownloadmethod in order to fetch the file.
To fetch the file via thedownloadmethod, usedata.pathanddata.bucketIdas follows:const { data, error } = await storageClient.from('bucket').upload('/folder/file.txt', fileBody) // check for errors const { data2, error2 } = await storageClient.from(data.bucketId).download(data.path)
Note: The
uploadmethod also accepts a map of optional parameters. For a complete list see the Supabase API reference.
Download a file from an exisiting bucket:
const { data, error } = await storageClient.from('bucket').download('path/to/file')
List all the files within a bucket:
const { data, error } = await storageClient.from('bucket').list('folder')
Note: The
listmethod also accepts a map of optional parameters. For a complete list see the Supabase API reference.
Replace an existing file at the specified path with a new one:
const fileBody = ... // load your file here
const { data, error } = await storageClient
.from('bucket')
.update('path/to/file', fileBody)
Note: The
uploadmethod also accepts a map of optional parameters. For a complete list see the Supabase API reference.
Move an existing file:
const { data, error } = await storageClient
.from('bucket')
.move('old/path/to/file', 'new/path/to/file')
Delete files within the same bucket:
const { data, error } = await storageClient.from('bucket').remove(['path/to/file'])
Create signed URL to download file without requiring permissions:
const expireIn = 60
const { data, error } = await storageClient
.from('bucket')
.createSignedUrl('path/to/file', expireIn)
Retrieve URLs for assets in public buckets:
const { data, error } = await storageClient.from('public-bucket').getPublicUrl('path/to/file')
Supabase Storage provides specialized analytics buckets using Apache Iceberg table format, optimized for analytical workloads and large-scale data processing. These buckets are designed for data lake architectures, time-series data, and business intelligence applications.
Analytics buckets use the Apache Iceberg open table format, providing:
Use analytics buckets for:
Use regular storage buckets for:
You can access analytics functionality through the analytics property on your storage client:
import { createClient } from '@supabase/supabase-js'
const supabase = createClient('https://your-project.supabase.co', 'your-publishable-key')
// Access analytics operations
const analytics = supabase.storage.analytics
// Create an analytics bucket
const { data, error } = await analytics.createBucket('analytics-data')
if (error) {
console.error('Failed to create analytics bucket:', error.message)
} else {
console.log('Created bucket:', data.name)
}
import { StorageClient } from '@supabase/storage-js'
const storageClient = new StorageClient('https://your-project.supabase.co/storage/v1', {
apikey: 'YOUR_API_KEY',
Authorization: 'Bearer YOUR_TOKEN',
})
// Access analytics operations
const analytics = storageClient.analytics
// Create an analytics bucket
await analytics.createBucket('analytics-data')
Creates a new analytics bucket using Iceberg table format:
const { data, error } = await analytics.createBucket('my-analytics-bucket')
if (error) {
console.error('Error:', error.message)
} else {
console.log('Created bucket:', data)
}
Returns:
{
data: {
id: string
type: 'ANALYTICS'
format: string
created_at: string
updated_at: string
} | null
error: StorageError | null
}
Retrieves all analytics buckets in your project with optional filtering and pagination:
const { data, error } = await analytics.listBuckets({
limit: 10,
offset: 0,
sortColumn: 'created_at',
sortOrder: 'desc',
search: 'prod',
})
if (data) {
console.log(`Found ${data.length} analytics buckets`)
data.forEach((bucket) => {
console.log(`- ${bucket.id} (created: ${bucket.created_at})`)
})
}
Parameters:
limit?: number - Maximum number of buckets to returnoffset?: number - Number of buckets to skip (for pagination)sortColumn?: 'id' | 'name' | 'created_at' | 'updated_at' - Column to sort bysortOrder?: 'asc' | 'desc' - Sort directionsearch?: string - Search term to filter bucket namesReturns:
{
data: AnalyticBucket[] | null
error: StorageError | null
}
Example with Pagination:
// Fetch first page
const firstPage = await analytics.listBuckets({
limit: 100,
offset: 0,
sortColumn: 'created_at',
sortOrder: 'desc',
})
// Fetch second page
const secondPage = await analytics.listBuckets({
limit: 100,
offset: 100,
sortColumn: 'created_at',
sortOrder: 'desc',
})
Deletes an analytics bucket. The bucket must be empty before deletion.
const { data, error } = await analytics.deleteBucket('old-analytics-bucket')
if (error) {
console.error('Failed to delete:', error.message)
} else {
console.log('Bucket deleted:', data.message)
}
Returns:
{
data: { message: string } | null
error: StorageError | null
}
Note: A bucket cannot be deleted if it contains data. You must empty the bucket first.
For advanced operations like creating tables, namespaces, and querying Iceberg metadata, use the from() method to get a configured iceberg-js client:
// Get an Iceberg REST Catalog client for your analytics bucket
const catalog = analytics.from('analytics-data')
// Create a namespace
await catalog.createNamespace({ namespace: ['default'] }, { properties: { owner: 'data-team' } })
// Create a table with schema
await catalog.createTable(
{ namespace: ['default'] },
{
name: 'events',
schema: {
type: 'struct',
fields: [
{ id: 1, name: 'id', type: 'long', required: true },
{ id: 2, name: 'timestamp', type: 'timestamp', required: true },
{ id: 3, name: 'user_id', type: 'string', required: false },
],
'schema-id': 0,
'identifier-field-ids': [1],
},
'partition-spec': {
'spec-id': 0,
fields: [],
},
'write-order': {
'order-id': 0,
fields: [],
},
properties: {
'write.format.default': 'parquet',
},
}
)
// List tables in namespace
const tables = await catalog.listTables({ namespace: ['default'] })
console.log(tables) // [{ namespace: ['default'], name: 'events' }]
// Load table metadata
const table = await catalog.loadTable({ namespace: ['default'], name: 'events' })
// Update table properties
await catalog.updateTable(
{ namespace: ['default'], name: 'events' },
{ properties: { 'read.split.target-size': '134217728' } }
)
// Drop table
await catalog.dropTable({ namespace: ['default'], name: 'events' })
// Drop namespace
await catalog.dropNamespace({ namespace: ['default'] })
Returns: IcebergRestCatalog instance from iceberg-js
Note: The
from()method returns an Iceberg REST Catalog client that provides full access to the Apache Iceberg REST API. For complete documentation of available operations, see the iceberg-js documentation.
Analytics buckets use the same error handling pattern as the rest of the Storage SDK:
const { data, error } = await analytics.createBucket('my-bucket')
if (error) {
console.error('Error:', error.message)
console.error('Status:', error.status)
console.error('Status Code:', error.statusCode)
// Handle error appropriately
}
You can configure the client to throw errors instead of returning them:
const analytics = storageClient.analytics
analytics.throwOnError()
try {
const { data } = await analytics.createBucket('my-bucket')
// data is guaranteed to be present
console.log('Success:', data)
} catch (error) {
if (error instanceof StorageApiError) {
console.error('API Error:', error.statusCode, error.message)
}
}
The library exports TypeScript types for analytics buckets:
import type { AnalyticBucket, BucketType, StorageError } from '@supabase/storage-js'
// AnalyticBucket type
interface AnalyticBucket {
id: string
type: 'ANALYTICS'
format: string
created_at: string
updated_at: string
}
async function bucketExists(bucketName: string): Promise<boolean> {
const { data, error } = await analytics.listBuckets({
search: bucketName,
})
if (error) {
console.error('Error checking bucket:', error.message)
return false
}
return data?.some((bucket) => bucket.id === bucketName) ?? false
}
async function ensureAnalyticsBucket(bucketName: string) {
// Try to create the bucket
const { data, error } = await analytics.createBucket(bucketName)
if (error) {
// Check if bucket already exists (conflict error)
if (error.statusCode === '409') {
console.log(`Bucket '${bucketName}' already exists`)
return { success: true, created: false }
}
// Other error occurred
console.error('Failed to create bucket:', error.message)
return { success: false, error }
}
console.log(`Created new bucket: '${bucketName}'`)
return { success: true, created: true, data }
}
async function getAllAnalyticsBuckets() {
const allBuckets: AnalyticBucket[] = []
let offset = 0
const limit = 100
while (true) {
const { data, error } = await analytics.listBuckets({
limit,
offset,
sortColumn: 'created_at',
sortOrder: 'desc',
})
if (error) {
console.error('Error fetching buckets:', error.message)
break
}
if (!data || data.length === 0) {
break
}
allBuckets.push(...data)
// If we got fewer results than the limit, we've reached the end
if (data.length < limit) {
break
}
offset += limit
}
return allBuckets
}
Supabase Storage provides built-in support for storing and querying high-dimensional vector embeddings, powered by S3 Vectors. This enables semantic search, similarity matching, and AI-powered applications without needing a separate vector database.
Note: Vector embeddings functionality is available in
@supabase/storage-jsv2.76 and later.
You can access vector functionality in three ways, depending on your use case:
If you're using the full Supabase client:
import { createClient } from '@supabase/supabase-js'
const supabase = createClient('https://your-project.supabase.co', 'your-publishable-key')
// Access vector operations through storage
const vectors = supabase.storage.vectors
// Create a vector bucket
await vectors.createBucket('embeddings-prod')
// Create an index
const bucket = vectors.from('embeddings-prod')
await bucket.createIndex({
indexName: 'documents-openai',
dataType: 'float32',
dimension: 1536,
distanceMetric: 'cosine',
})
// Insert vectors
const index = bucket.index('documents-openai')
await index.putVectors({
vectors: [
{
key: 'doc-1',
data: { float32: [0.1, 0.2, 0.3 /* ...1536 dimensions */] },
metadata: { title: 'Introduction', category: 'docs' },
},
],
})
// Query similar vectors
const { data, error } = await index.queryVectors({
queryVector: { float32: [0.15, 0.25, 0.35 /* ...1536 dimensions */] },
topK: 5,
returnDistance: true,
returnMetadata: true,
})
if (data) {
data.matches.forEach((match) => {
console.log(`${match.key}: distance=${match.distance}`)
console.log('Metadata:', match.metadata)
})
}
If you're using the standalone StorageClient for storage operations, access vectors through the vectors property:
import { StorageClient } from '@supabase/storage-js'
const storageClient = new StorageClient('https://your-project.supabase.co/storage/v1', {
apikey: 'YOUR_API_KEY',
Authorization: 'Bearer YOUR_TOKEN',
})
// Access vector operations
const vectors = storageClient.vectors
// Use the same API as shown in Option 1
await vectors.createBucket('embeddings-prod')
const bucket = vectors.from('embeddings-prod')
// ... rest of operations
For vector-only applications that don't need regular file storage operations:
import { StorageVectorsClient } from '@supabase/storage-js'
// Initialize standalone vector client
const vectorClient = new StorageVectorsClient('https://your-project.supabase.co/storage/v1', {
headers: { Authorization: 'Bearer YOUR_TOKEN' },
})
// Use the same API as shown in Option 1
await vectorClient.createBucket('embeddings-prod')
const bucket = vectorClient.from('embeddings-prod')
// ... rest of operations
When to use each approach:
- Option 1: When using other Supabase features (auth, database, realtime)
- Option 2: When working with both file storage and vectors
- Option 3: For dedicated vector-only applications without file storage
const vectorClient = new StorageVectorsClient(url, options?)
Options:
headers?: Record<string, string> - Custom HTTP headers (e.g., Authorization)fetch?: Fetch - Custom fetch implementationVector buckets are top-level containers for organizing vector indexes.
const { data, error } = await vectorClient.createBucket('my-bucket')
const { data, error } = await vectorClient.getBucket('my-bucket')
console.log('Created at:', new Date(data.vectorBucket.creationTime! * 1000))
const { data, error } = await vectorClient.listBuckets({
prefix: 'prod-',
maxResults: 100,
})
// Pagination
if (data?.nextToken) {
const next = await vectorClient.listBuckets({ nextToken: data.nextToken })
}
// Bucket must be empty (all indexes deleted first)
const { error } = await vectorClient.deleteBucket('my-bucket')
Vector indexes define the schema for embeddings including dimension and distance metric.
const bucket = vectorClient.from('my-bucket')
await bucket.createIndex({
indexName: 'my-index',
dataType: 'float32',
dimension: 1536,
distanceMetric: 'cosine', // 'cosine' | 'euclidean' | 'dotproduct'
metadataConfiguration: {
nonFilterableMetadataKeys: ['raw_text', 'internal_id'],
},
})
Distance Metrics:
cosine - Cosine similarity (normalized dot product)euclidean - Euclidean distance (L2 norm)dotproduct - Dot product similarityconst { data, error } = await bucket.getIndex('my-index')
console.log('Dimension:', data?.index.dimension)
console.log('Distance metric:', data?.index.distanceMetric)
const { data, error } = await bucket.listIndexes({
prefix: 'documents-',
maxResults: 100,
})
// Deletes index and all its vectors
await bucket.deleteIndex('my-index')
const index = vectorClient.from('my-bucket').index('my-index')
await index.putVectors({
vectors: [
{
key: 'unique-id-1',
data: {
float32: [
/* 1536 numbers */
],
},
metadata: {
title: 'Document Title',
category: 'technical',
page: 1,
},
},
// ... up to 500 vectors per request
],
})
Limitations:
const { data, error } = await index.getVectors({
keys: ['doc-1', 'doc-2', 'doc-3'],
returnData: true, // Include embeddings
returnMetadata: true, // Include metadata
})
data?.vectors.forEach((v) => {
console.log(v.key, v.metadata)
})
const { data, error } = await index.queryVectors({
queryVector: {
float32: [
/* 1536 numbers */
],
},
topK: 10,
filter: {
category: 'technical',
published: true,
},
returnDistance: true,
returnMetadata: true,
})
// Results ordered by similarity
data?.matches.forEach((match) => {
console.log(`${match.key}: distance=${match.distance}`)
})
Filter Syntax:
The filter parameter accepts arbitrary JSON for metadata filtering. Non-filterable keys (configured at index creation) cannot be used in filters but can still be returned.
// Simple pagination
let nextToken: string | undefined
do {
const { data } = await index.listVectors({
maxResults: 500,
nextToken,
returnMetadata: true,
})
console.log('Batch:', data?.vectors.length)
nextToken = data?.nextToken
} while (nextToken)
// Parallel scanning (4 workers)
const workers = [0, 1, 2, 3].map(async (segmentIndex) => {
const { data } = await index.listVectors({
segmentCount: 4,
segmentIndex,
returnMetadata: true,
})
return data?.vectors || []
})
const results = await Promise.all(workers)
const allVectors = results.flat()
Limitations:
maxResults: 1-1000 (default: 500)segmentCount: 1-16await index.deleteVectors({
keys: ['doc-1', 'doc-2', 'doc-3'],
// ... up to 500 keys per request
})
The library uses a consistent error handling pattern:
const { data, error } = await vectorClient.createBucket('my-bucket')
if (error) {
console.error('Error:', error.message)
console.error('Status:', error.status)
console.error('Code:', error.statusCode)
}
| Code | HTTP | Description |
|---|---|---|
InternalError | 500 | Internal server error |
S3VectorConflictException | 409 | Resource already exists |
S3VectorNotFoundException | 404 | Resource not found |
S3VectorBucketNotEmpty | 400 | Bucket contains indexes |
S3VectorMaxBucketsExceeded | 400 | Bucket quota exceeded |
S3VectorMaxIndexesExceeded | 400 | Index quota exceeded |
You can configure the client to throw errors instead:
const vectorClient = new StorageVectorsClient(url, options)
vectorClient.throwOnError()
try {
const { data } = await vectorClient.createBucket('my-bucket')
// data is guaranteed to be present
} catch (error) {
if (error instanceof StorageVectorsApiError) {
console.error('API Error:', error.statusCode)
}
}
Create scoped clients for cleaner code:
// Bucket-scoped operations
const bucket = vectorClient.from('embeddings-prod')
await bucket.createIndex({
/* ... */
})
await bucket.listIndexes()
// Index-scoped operations
const index = bucket.index('documents-openai')
await index.putVectors({
/* ... */
})
await index.queryVectors({
/* ... */
})
Provide a custom fetch implementation:
import { StorageVectorsClient } from '@supabase/storage-js'
const vectorClient = new StorageVectorsClient(url, {
fetch: customFetch,
headers: {
/* ... */
},
})
Process large datasets in batches:
async function insertLargeDataset(vectors: VectorObject[]) {
const batchSize = 500
for (let i = 0; i < vectors.length; i += batchSize) {
const batch = vectors.slice(i, i + batchSize)
await index.putVectors({ vectors: batch })
console.log(`Inserted ${i + batch.length}/${vectors.length}`)
}
}
Ensure vectors are properly normalized to float32:
import { normalizeToFloat32 } from '@supabase/storage-js'
const vector = normalizeToFloat32([0.1, 0.2, 0.3 /* ... */])
The library exports comprehensive TypeScript types:
import type {
VectorBucket,
VectorIndex,
VectorData,
VectorObject,
VectorMatch,
VectorMetadata,
DistanceMetric,
ApiResponse,
StorageVectorsError,
} from '@supabase/storage-js'
This package is part of the Supabase JavaScript monorepo. To work on this package:
# Build the package
pnpm nx build storage-js
# Watch mode for development
pnpm nx build storage-js --watch
# Generate documentation
pnpm nx docs storage-js
Important: The storage-js tests require a local Supabase stack running via the Supabase CLI. Docker must be running since the Supabase CLI uses it internally.
pnpm exec supabase| Script | Description | What it does |
|---|---|---|
test:storage | Complete test workflow | Runs the full test cycle: clean → start infra → run tests → clean |
test:suite | Jest tests only | Runs Jest tests with coverage (requires infra to be running) |
test:infra | Start test infrastructure | Starts Supabase CLI stack (PostgreSQL, Storage API, Kong, etc.) |
test:clean-post | Stop and clean infrastructure | Stops the Supabase CLI stack |
This handles everything automatically - starting infrastructure, running tests, and cleaning up:
# From monorepo root
pnpm nx test:storage storage-js
This command will:
Useful for development when you want to run tests multiple times without restarting Docker:
# Step 1: Start the test infrastructure
# From root
pnpm nx test:infra storage-js
# This starts: PostgreSQL, Storage API, Kong Gateway, and imgproxy
# Step 2: Run tests (can run multiple times)
pnpm nx test:suite storage-js
# Step 3: When done, clean up the infrastructure
pnpm nx test:clean-post storage-js
For actively developing and debugging tests:
# Start infrastructure once (from root)
pnpm nx test:infra storage-js
# Run tests in watch mode
pnpm nx test:suite storage-js --watch
# Clean up when done
pnpm nx test:clean-post storage-js
The test infrastructure is managed via the Supabase CLI (pnpm exec supabase start --workdir test), which starts a local Supabase stack defined by the config in test/. This includes PostgreSQL, the Storage API, Kong Gateway, and supporting services.
| Issue | Solution |
|---|---|
| Port conflicts | Another service is using a required port. Run pnpm nx test:clean-post storage-js then try again |
| "request failed, reason:" errors | Infrastructure isn't running. Run pnpm nx test:infra storage-js first |
| Tests fail with connection errors | Ensure Docker is running (Supabase CLI requires Docker) |
| Stack already running | Run pnpm nx test:clean-post storage-js to stop it before restarting |
We welcome contributions! Please see our Contributing Guide for details on how to get started.
For major changes or if you're unsure about something, please open an issue first to discuss your proposed changes.
The AWS SDK for JavaScript provides a comprehensive set of tools for interacting with AWS services, including S3 for storage. It offers more extensive features and integrations compared to @supabase/storage-js, but it can be more complex to set up and use.
The Firebase Admin SDK allows you to manage your Firebase services programmatically. It includes functionality for Firebase Storage, which is similar to Supabase Storage. Firebase offers a broader range of services and integrations, but it may be overkill if you only need storage capabilities.
FAQs
Isomorphic storage client for Supabase.
The npm package @supabase/storage-js receives a total of 16,144,581 weekly downloads. As such, @supabase/storage-js popularity was classified as popular.
We found that @supabase/storage-js demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical software.
Security News
A Shai-Hulud infection exposed Suno's source code, which shows the AI music startup stream-ripped tracks to train its models.
Security News
Vercel is formalizing a monthly release program for Next.js. The change follows React2Shell and a sharp rise in AI-assisted vulnerability discovery.