code · pull · Apr 27, 2026 · Apr 27, 2026 · Apr 27, 2026 · Apr 27, 2026
diff --git a/.github/workflows/build_and_deploy.yml b/.github/workflows/build_and_deploy.yml
@@ -548,10 +548,20 @@ jobs:
           merge-multiple: true
           path: crates/wasm
 
+      - name: Create GitHub App token
+        id: release-app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.RELEASE_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_GITHUB_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: next.js
+          permission-contents: write
+
       - run: ./scripts/publish-native.js
       - run: ./scripts/publish-release.js
         env:
-          RELEASE_BOT_GITHUB_TOKEN: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
+          RELEASE_GITHUB_TOKEN: ${{ steps.release-app-token.outputs.token }}
 
   buildPassed:
     needs: ['deploy-target', 'build', 'build-wasm', 'build-native']

diff --git a/.github/workflows/create_release_branch.yml b/.github/workflows/create_release_branch.yml
@@ -11,10 +11,6 @@ on:
         type: string
         required: true
 
-    secrets:
-      RELEASE_BOT_GITHUB_TOKEN:
-        required: true
-
 name: Create Release Branch
 
 env:
@@ -39,13 +35,33 @@ jobs:
           node-version: 20
           check-latest: true
 
+      - name: Create GitHub App token
+        id: release-app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.RELEASE_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_GITHUB_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: next.js
+          permission-contents: write
+          permission-environments: write
+          permission-workflows: write
+
+      - name: Get GitHub App user ID
+        id: release-app-user
+        run: |
+          user_id="$(gh api "/users/${{ steps.release-app-token.outputs.app-slug }}[bot]" --jq .id)"
+          echo "user-id=$user_id" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.release-app-token.outputs.token }}
+
       - name: Clone Next.js repository
         run: git clone https://github.com/vercel/next.js.git --depth=25 --single-branch --branch ${GITHUB_REF_NAME:-canary} .
 
       - name: Check token
         run: gh auth status
         env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.release-app-token.outputs.token }}
 
       # https://github.com/actions/virtual-environments/issues/1187
       - name: tune linux network
@@ -72,6 +88,8 @@ jobs:
 
       - run: node ./scripts/create-release-branch.js --branch-name "${INPUT_BRANCHNAME}" --tag-name "${INPUT_TAGNAME}"
         env:
-          RELEASE_BOT_GITHUB_TOKEN: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
+          RELEASE_GITHUB_TOKEN: ${{ steps.release-app-token.outputs.token }}
+          RELEASE_GITHUB_APP_SLUG: ${{ steps.release-app-token.outputs.app-slug }}
+          RELEASE_GITHUB_APP_USER_ID: ${{ steps.release-app-user.outputs.user-id }}
           INPUT_BRANCHNAME: ${{ github.event.inputs.branchName }}
           INPUT_TAGNAME: ${{ github.event.inputs.tagName }}
diff --git a/.github/workflows/sync_backport_canary_release.yml b/.github/workflows/sync_backport_canary_release.yml
@@ -84,11 +84,23 @@ jobs:
         if: steps.precheck.outputs.should_evaluate == 'true'
         run: pnpm install --frozen-lockfile --ignore-scripts
 
+      - name: Create GitHub App token
+        id: release-app-token
+        if: steps.precheck.outputs.should_evaluate == 'true'
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.RELEASE_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_GITHUB_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: next.js
+          permission-actions: read
+          permission-contents: read
+
       - name: Evaluate backport release
         id: evaluate
         if: steps.precheck.outputs.should_evaluate == 'true'
         env:
-          RELEASE_BOT_GITHUB_TOKEN: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
+          RELEASE_GITHUB_TOKEN: ${{ steps.release-app-token.outputs.token }}
           WORKFLOW_RUN_ID: ${{ github.event_name == 'workflow_dispatch' && inputs.workflowRunId || github.event.workflow_run.id }}
           HEAD_SHA: ${{ github.event_name == 'workflow_dispatch' && inputs.headSha || github.event.workflow_run.head_sha }}
           HEAD_COMMIT_MESSAGE: ${{ github.event_name == 'workflow_dispatch' && '' || github.event.workflow_run.head_commit.message }}
@@ -108,9 +120,19 @@ jobs:
     if: ${{ needs.evaluate.outputs.should_dispatch == 'true' && ((github.event_name == 'workflow_dispatch' && inputs.dispatch) || (github.event_name == 'workflow_run' && vars.ENABLE_BACKPORT_CANARY_SYNC == 'true')) }}
     runs-on: ubuntu-latest
     steps:
+      - name: Create GitHub App token
+        id: release-app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.RELEASE_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_GITHUB_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: next.js
+          permission-actions: write
+
       - uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
+          github-token: ${{ steps.release-app-token.outputs.token }}
           script: |
             await github.request(
               "POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches",

diff --git a/.github/workflows/trigger_release.yml b/.github/workflows/trigger_release.yml
@@ -52,6 +52,24 @@ jobs:
           node-version: 20
           check-latest: true
 
+      - name: Create GitHub App token
+        id: release-app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          client-id: ${{ vars.RELEASE_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_GITHUB_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: next.js
+          permission-contents: write
+
+      - name: Get GitHub App user ID
+        id: release-app-user
+        run: |
+          user_id="$(gh api "/users/${{ steps.release-app-token.outputs.app-slug }}[bot]" --jq .id)"
+          echo "user-id=$user_id" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ steps.release-app-token.outputs.token }}
+
       - name: Clone Next.js repository
         run: git clone https://github.com/vercel/next.js.git --depth=25 --single-branch --branch ${GITHUB_REF_NAME:-canary} .
 
@@ -61,10 +79,13 @@ jobs:
         # Ignoring failures for now to check if a failure truly implies a failed publish.
         continue-on-error: true
         env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.release-app-token.outputs.token }}
 
       - name: Get commit of the latest tag
-        run: echo "LATEST_TAG_COMMIT=$(git rev-list -n 1 $(git describe --tags --abbrev=0))" >> $GITHUB_ENV
+        run: |
+          git fetch --tags --force --deepen=1000 origin
+          latest_tag="$(git describe --tags --abbrev=0)"
+          echo "LATEST_TAG_COMMIT=$(git rev-list -n 1 "$latest_tag")" >> $GITHUB_ENV
 
       - name: Get latest commit
         run: echo "LATEST_COMMIT=$(git rev-parse HEAD)" >> $GITHUB_ENV
@@ -102,6 +123,8 @@ jobs:
 
       - run: node ./scripts/start-release.js --release-type "${INPUT_RELEASETYPE}" --semver-type "${INPUT_SEMVERTYPE}"
         env:
-          RELEASE_BOT_GITHUB_TOKEN: ${{ secrets.RELEASE_BOT_GITHUB_TOKEN }}
+          RELEASE_GITHUB_TOKEN: ${{ steps.release-app-token.outputs.token }}
+          RELEASE_GITHUB_APP_SLUG: ${{ steps.release-app-token.outputs.app-slug }}
+          RELEASE_GITHUB_APP_USER_ID: ${{ steps.release-app-user.outputs.user-id }}
           INPUT_RELEASETYPE: ${{ github.event.inputs.releaseType || 'canary' }}
           INPUT_SEMVERTYPE: ${{ github.event.inputs.semverType }}
diff --git a/lerna.json b/lerna.json
@@ -15,5 +15,5 @@
       "registry": "https://registry.npmjs.org/"
     }
   },
-  "version": "16.3.0-canary.2"
+  "version": "16.3.0-canary.3"
 }
diff --git a/packages/create-next-app/package.json b/packages/create-next-app/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-next-app",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "keywords": [
     "react",
     "next",
@@ -50,4 +50,4 @@
   "engines": {
     "node": ">=20.9.0"
   }
-}
+}
diff --git a/packages/eslint-config-next/package.json b/packages/eslint-config-next/package.json
@@ -1,6 +1,6 @@
 {
   "name": "eslint-config-next",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "description": "ESLint configuration used by Next.js.",
   "license": "MIT",
   "repository": {
@@ -12,7 +12,7 @@
     "dist"
   ],
   "dependencies": {
-    "@next/eslint-plugin-next": "16.3.0-canary.2",
+    "@next/eslint-plugin-next": "16.3.0-canary.3",
     "eslint-import-resolver-node": "^0.3.6",
     "eslint-import-resolver-typescript": "^3.5.2",
     "eslint-plugin-import": "^2.32.0",
@@ -60,4 +60,4 @@
       "default": "./dist/parser.js"
     }
   }
-}
+}
diff --git a/packages/eslint-plugin-internal/package.json b/packages/eslint-plugin-internal/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@next/eslint-plugin-internal",
   "private": true,
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "description": "ESLint plugin for working on Next.js.",
   "exports": {
     ".": "./src/eslint-plugin-internal.js"
@@ -18,4 +18,4 @@
     "eslint": "9.37.0"
   },
   "scripts": {}
-}
+}
diff --git a/packages/eslint-plugin-next/package.json b/packages/eslint-plugin-next/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@next/eslint-plugin-next",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "description": "ESLint plugin for Next.js.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -25,4 +25,4 @@
     "types": "tsc --project tsconfig.json --skipLibCheck --declaration --emitDeclarationOnly --esModuleInterop --declarationDir dist",
     "prepublishOnly": "cd ../../ && turbo run build"
   }
-}
+}
diff --git a/packages/font/package.json b/packages/font/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@next/font",
   "private": true,
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "repository": {
     "url": "vercel/next.js",
     "directory": "packages/font"
@@ -27,4 +27,4 @@
     "fontkit": "2.0.2",
     "typescript": "6.0.2"
   }
-}
+}
diff --git a/packages/next-bundle-analyzer/package.json b/packages/next-bundle-analyzer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@next/bundle-analyzer",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "main": "index.js",
   "types": "index.d.ts",
   "license": "MIT",
@@ -14,4 +14,4 @@
   "scripts": {
     "pack-for-isolated-tests": "pnpm pack --out ./packed.tgz"
   }
-}
+}
diff --git a/packages/next-codemod/package.json b/packages/next-codemod/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@next/codemod",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -42,4 +42,4 @@
     "@types/semver": "7.3.1",
     "typescript": "6.0.2"
   }
-}
+}
diff --git a/packages/next-env/package.json b/packages/next-env/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@next/env",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "keywords": [
     "react",
     "next",
@@ -34,4 +34,4 @@
     "dotenv": "16.3.1",
     "dotenv-expand": "10.0.0"
   }
-}
+}
diff --git a/packages/next-mdx/package.json b/packages/next-mdx/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@next/mdx",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "main": "index.js",
   "license": "MIT",
   "repository": {
@@ -25,4 +25,4 @@
   "scripts": {
     "pack-for-isolated-tests": "pnpm pack --out ./packed.tgz"
   }
-}
+}
diff --git a/packages/next-playwright/package.json b/packages/next-playwright/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@next/playwright",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "repository": {
     "url": "vercel/next.js",
     "directory": "packages/next-playwright"
@@ -29,4 +29,4 @@
     "@playwright/test": "1.58.2",
     "typescript": "6.0.2"
   }
-}
+}
diff --git a/packages/next-plugin-storybook/package.json b/packages/next-plugin-storybook/package.json
@@ -1,9 +1,9 @@
 {
   "name": "@next/plugin-storybook",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "repository": {
     "url": "vercel/next.js",
     "directory": "packages/next-plugin-storybook"
   },
   "scripts": {}
-}
+}
diff --git a/packages/next-polyfill-module/package.json b/packages/next-polyfill-module/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@next/polyfill-module",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "description": "A standard library polyfill for ES Modules supporting browsers (Edge 16+, Firefox 60+, Chrome 61+, Safari 10.1+)",
   "main": "dist/polyfill-module.js",
   "license": "MIT",
@@ -16,4 +16,4 @@
   "devDependencies": {
     "microbundle": "0.15.0"
   }
-}
+}
diff --git a/packages/next-polyfill-nomodule/package.json b/packages/next-polyfill-nomodule/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@next/polyfill-nomodule",
-  "version": "16.3.0-canary.2",
+  "version": "16.3.0-canary.3",
   "description": "A polyfill for non-dead, nomodule browsers.",
   "main": "dist/polyfill-nomodule.js",
   "license": "MIT",
@@ -19,4 +19,4 @@
     "object-assign": "4.1.1",
     "whatwg-fetch": "3.0.0"
   }
-}
+}