# Next.js Style Guide: changelog

> Every revision of the Next.js Style Guide, newest first, with the rules each one added, removed or changed. Pinned URLs (https://style.chopper.dev/nextjs@<revision>/rules.md) never change; unpinned ones always serve the latest text.

## Unreleased

Edits served at https://style.chopper.dev/nextjs/llms.txt that are not in a pinned revision yet.

The appendix configs now match what the template ships and what the guide's own lint and format rules accept, so a project copied from them passes `pnpm lint` and `pnpm format:check`:

- `tsconfig.json` (B) adds `allowJs`, `esModuleInterop` and `.next/dev/types/**/*.ts`, which `next dev` and `next typegen` otherwise write into the file on first run.
- `eslint.config.mjs` (C) allows default exports from `*.config.mts` too, for the Vitest config section 19 asks for.
- `prettier.config.mjs` (D) exports a named `config`, which `import/no-anonymous-default-export` asks for, and wraps `importOrder`, which went past the 100-column `printWidth`.
- `babel.config.js` and `postcss.config.js` (E) disable `@typescript-eslint/no-require-imports` on their one `require()` line, with a reason (NEXTJS-05.1), as the template does.
- `next.config.ts` (A) says why `images.remotePatterns` is set, as NEXTJS-19.1 asks of every option, and wraps the pattern to fit 100 columns. The template's `next.config.ts` also comments its `headers()` option.
- `next.config.ts` (A) now sends the static security headers NEXTJS-15.11 requires (`X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, and `Strict-Transport-Security` in production builds) from `headers()`, as the template does. The Content Security Policy needs a fresh nonce per request, so `src/proxy.ts` sends it.
- The template braces its one-line `if` bodies in `src/features/auth/schemas.ts`, as the formatting table in section 5 asks.
- `src/proxy.ts` (now H) sends the nonce-based Content Security Policy NEXTJS-15.11 requires, built by a new `src/lib/csp.ts` (G), so the appendix covers the whole rule by itself. Both match the template's files. Its matcher now covers every page except Route Handlers, build assets and prefetches, and the sign-in redirect checks the signed-in prefixes itself. "Starting a new project" moves to I.
- `eslint.config.mjs` (C) and the template turn on `curly: ['error', 'all']`, so ESLint enforces section 5's "always braced" rule.

No rule changes since 2026.10 (prose, examples or formatting only).

## 2026.10 (released 2026-10-19)

- Web: https://style.chopper.dev/nextjs@2026.10
- Full guide: https://style.chopper.dev/nextjs@2026.10/llms.txt
- Rules digest: https://style.chopper.dev/nextjs@2026.10/rules.md

The first pinned revision: the text published as rev. 2026.10 before guides were versioned. From this revision on, `/nextjs@<revision>` URLs never change.

Initial revision: 192 rules.