JavaScript, TypeScript, React, Next.js, Node.js and npm: fixes, releases and deadlines.
FeaturedPatch nowJS & TypeScript
On September 30 Next.js released 16.3.8 and 15.5.27. The high-severity fix is an SSRF in Image Optimization, and a critical fix was postponed.
Karlen Trimino ·
Patch nowJS & TypeScript
actions-cool/issues-helper and actions-cool/maintain-one-comment became available again on September 16 with their malicious tags still in place.
Patch nowJS & TypeScript
On September 23 compromised releases of a MemTensor npm plugin and of MemoryOS on PyPI bundled a Go binary that searches $HOME for credentials.
PlanJS & TypeScript
Since September 23, JavaScript actions run on Node 24 and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out no longer works.
WatchJS & TypeScript
The 7.1 beta, planned for October 6, is being pushed back about two weeks to allow more API testing.
WatchJS & TypeScript
Vite+ 1.0 (September 28) is an MIT-licensed vp command that puts the VoidZero tool chain behind one config.
PlanJS & TypeScript
Since September 30, npm trusted publishing can manage dist-tags with short-lived OIDC credentials, behind an opt-in permission.
WatchJS & TypeScript
The OpenJS Foundation's Security Stewardship Program, launched September 25, funds bug bounties and maintainers' patch and release work.
Patch nowJS & TypeScript
The September 22 release fixes a critical RCE in the Node.js ImageResponse of next/og. Versions 16.2.0 up to 16.3.5 are affected.
Patch nowJS & TypeScript
The July 29 security releases (26.5.1, 24.18.1, 22.23.2) fixed 11 CVEs, three of them rated High.