Next.js is moving to a formal security release process