https://webprg.com/en A weekly, source-linked publication for full-stack developers: what to patch, plan and watch in PHP, Laravel, React, TypeScript and Node.js. en https://webprg.com/en/issues/1 https://webprg.com/en/issues/1 Wed, 23 Sep 2026 00:00:00 GMT What to patch, plan and watch this month in PHP, Laravel, React, TypeScript and Node.js: three Next.js security releases, npm 12, TypeScript 7 and PHP 8.6. https://webprg.com/en/news/nextjs-16-3-6-next-og-rce https://webprg.com/en/news/nextjs-16-3-6-next-og-rce Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript The September 22 release fixes a critical RCE in the Node.js ImageResponse of next/og. Versions 16.2.0 up to 16.3.5 are affected. https://webprg.com/en/news/php-pg-functions-sql-injection https://webprg.com/en/news/php-pg-functions-sql-injection Wed, 23 Sep 2026 00:00:00 GMT PHP & Laravel CVE-2026-17543 (High) is an SQL injection in pg_insert, pg_update, pg_select and pg_delete. It was fixed in the July 30 releases. https://webprg.com/en/news/nodejs-july-2026-security-releases https://webprg.com/en/news/nodejs-july-2026-security-releases Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript The July 29 security releases (26.5.1, 24.18.1, 22.23.2) fixed 11 CVEs, three of them rated High. https://webprg.com/en/news/npm-12-install-scripts https://webprg.com/en/news/npm-12-install-scripts Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript npm v12 became the default on July 8. Dependency lifecycle scripts, Git dependencies and remote URL dependencies are now opt-in. https://webprg.com/en/news/typescript-7-native https://webprg.com/en/news/typescript-7-native Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript TypeScript 7.0, the native port written in Go, shipped July 8. It has no stable programmatic API yet, and its new defaults change your tsconfig. https://webprg.com/en/news/laravel-13-support https://webprg.com/en/news/laravel-13-support Wed, 23 Sep 2026 00:00:00 GMT PHP & Laravel Laravel 12 stopped receiving bug fixes on August 13, 2026. Laravel 13 supports PHP 8.3 to 8.5, with security fixes until March 17, 2028. https://webprg.com/en/news/php-8-6-partial-function-application https://webprg.com/en/news/php-8-6-partial-function-application Wed, 23 Sep 2026 00:00:00 GMT PHP & Laravel RC1 lands on September 24 and general availability on November 19. Leave ? or ... in place of arguments and you get a closure back. https://webprg.com/en/news/composer-2-10-3 https://webprg.com/en/news/composer-2-10-3 Wed, 23 Sep 2026 00:00:00 GMT PHP & Laravel Versions 2.10.2 and 2.10.3 fixed a run of CVEs, from path traversal through package bin paths to command injection through malicious Perforce URLs. https://webprg.com/en/news/laravel-summer-advisories https://webprg.com/en/news/laravel-summer-advisories Wed, 23 Sep 2026 00:00:00 GMT PHP & Laravel Three framework advisories landed this summer, including a High-severity CRLF injection in the default email validation rule. https://webprg.com/en/news/npm-supply-chain-2026 https://webprg.com/en/news/npm-supply-chain-2026 Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript An attacker chained a pull_request_target workflow into 84 malicious TanStack versions, and a worm planted persistence in editor and AI tool config. https://webprg.com/en/news/nextjs-16-3-performance https://webprg.com/en/news/nextjs-16-3-performance Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript Up to 90% less memory in long dev sessions, build caching on by default, and up to 22% more server-rendered requests under load. https://webprg.com/en/news/nodejs-release-calendar https://webprg.com/en/news/nodejs-release-calendar Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript Node 20 has been end-of-life since April 30, 2026. Node 24 moves to maintenance on October 20, and from Node 27 every release becomes LTS. https://webprg.com/en/news/react-19-3 https://webprg.com/en/news/react-19-3 Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript React 19.3 (September 9) makes two APIs stable, and React DOM adds use(browser()) and Trusted Types support. https://webprg.com/en/news/php-support-calendar https://webprg.com/en/news/php-support-calendar Wed, 23 Sep 2026 00:00:00 GMT PHP & Laravel PHP 8.2's security fixes end on December 31, 2026, the same day PHP 8.4's active support ends. https://webprg.com/en/news/laracon-us-2026 https://webprg.com/en/news/laracon-us-2026 Wed, 23 Sep 2026 00:00:00 GMT PHP & Laravel The July 29 announcements worth your time, from Blade formatting in Pint to human approval of tool calls in the AI SDK. https://webprg.com/en/news/es2026-approved https://webprg.com/en/news/es2026-approved Wed, 23 Sep 2026 00:00:00 GMT JS & TypeScript ES2026 was approved on June 30. Temporal and explicit resource management (using) are slated for ES2027. https://webprg.com/en/news/jetbrains-ai-agents-survey https://webprg.com/en/news/jetbrains-ai-agents-survey Wed, 23 Sep 2026 00:00:00 GMT AI Tools JetBrains surveyed more than 15,000 professional developers from May to July 2026, and 68% use AI coding agents daily. https://webprg.com/en/news/copilot-usage-billing https://webprg.com/en/news/copilot-usage-billing Wed, 23 Sep 2026 00:00:00 GMT AI Tools "AI Credits" replace premium requests, each plan includes credits equal to its price, and code completions stay free. https://webprg.com/en/news/laravel-mcp-1-0 https://webprg.com/en/news/laravel-mcp-1-0 Wed, 23 Sep 2026 00:00:00 GMT AI Tools With 100 tools, the tool definitions drop from 58,585 bytes to 1,431, which is 97.6% smaller. https://webprg.com/en/news/mcp-spec-stateless https://webprg.com/en/news/mcp-spec-stateless Wed, 23 Sep 2026 00:00:00 GMT AI Tools With no initialize handshake and no session IDs, MCP servers can sit behind an ordinary load balancer. https://webprg.com/en/news/software-job-postings https://webprg.com/en/news/software-job-postings Wed, 23 Sep 2026 00:00:00 GMT Careers Indeed's US software development job postings index was 76.62 on September 11, 2026 (February 2020 = 100). https://webprg.com/en/news/bls-developer-outlook https://webprg.com/en/news/bls-developer-outlook Wed, 23 Sep 2026 00:00:00 GMT Careers That is about 174,700 new jobs, down from the 15.8% it projected for 2024 to 2034.