FeaturedPatch nowJS & TypeScript
Next.js 16.3.6 fixes a critical remote code execution flaw in next/og
The September 22 release fixes a critical RCE in the Node.js ImageResponse of next/og. Versions 16.2.0 up to 16.3.5 are affected.
Karlen Trimino ·
Blog
JS & TypeScript
JavaScript, TypeScript, React, Next.js, Node.js and npm: fixes, releases and deadlines.
Patch nowJS & TypeScript
Node.js July security releases fixed 11 CVEs, three rated High
The July 29 security releases (26.5.1, 24.18.1, 22.23.2) fixed 11 CVEs, three of them rated High.
PlanJS & TypeScript
npm 12 stops running dependency install scripts by default
npm v12 became the default on July 8. Dependency lifecycle scripts, Git dependencies and remote URL dependencies are now opt-in.
PlanJS & TypeScript
TypeScript 7 is native and 8 to 12 times faster, but not a drop-in
TypeScript 7.0, the native port written in Go, shipped July 8. It has no stable programmatic API yet, and its new defaults change your tsconfig.
PlanJS & TypeScript
npm's brutal year: the TanStack compromise and the ChainDrop worm
An attacker chained a pull_request_target workflow into 84 malicious TanStack versions, and a worm planted persistence in editor and AI tool config.
PlanJS & TypeScript
Next.js 16.3 is a free performance upgrade
Up to 90% less memory in long dev sessions, build caching on by default, and up to 22% more server-rendered requests under load.
PlanJS & TypeScript
Node 20 is end-of-life; Node 26 becomes LTS on October 28
Node 20 has been end-of-life since April 30, 2026. Node 24 moves to maintenance on October 20, and from Node 27 every release becomes LTS.
WatchJS & TypeScript
React 19.3 makes ViewTransition and Fragment refs stable
React 19.3 (September 9) makes two APIs stable, and React DOM adds use(browser()) and Trusted Types support.
WatchJS & TypeScript
ES2026 is approved: getOrInsert, Iterator.concat, RegExp.escape and more
ES2026 was approved on June 30. Temporal and explicit resource management (using) are slated for ES2027.