JS & TypeScript
JavaScript, TypeScript, React, Next.js, Node.js and npm: fixes, releases and deadlines.
Next.js 16.3.6 fixes a critical remote code execution flaw in next/og
The September 22 release fixes a critical RCE in the Node.js ImageResponse of next/og. Versions 16.2.0 up to 16.3.5 are affected.
Node.js July security releases fixed 11 CVEs, three rated High
The July 29 security releases (26.5.1, 24.18.1, 22.23.2) fixed 11 CVEs, three of them rated High.
npm 12 stops running dependency install scripts by default
npm v12 became the default on July 8. Dependency lifecycle scripts, Git dependencies and remote URL dependencies are now opt-in.
TypeScript 7 is native and 8 to 12 times faster, but not a drop-in
TypeScript 7.0, the native port written in Go, shipped July 8. It has no stable programmatic API yet, and its new defaults change your tsconfig.
npm's brutal year: the TanStack compromise and the ChainDrop worm
An attacker chained a pull_request_target workflow into 84 malicious TanStack versions, and a worm planted persistence in editor and AI tool config.
Next.js 16.3 is a free performance upgrade
Up to 90% less memory in long dev sessions, build caching on by default, and up to 22% more server-rendered requests under load.
Node 20 is end-of-life; Node 26 becomes LTS on October 28
Node 20 has been end-of-life since April 30, 2026. Node 24 moves to maintenance on October 20, and from Node 27 every release becomes LTS.
React 19.3 makes ViewTransition and Fragment refs stable
React 19.3 (September 9) makes two APIs stable, and React DOM adds use(browser()) and Trusted Types support.
ES2026 is approved: getOrInsert, Iterator.concat, RegExp.escape and more
ES2026 was approved on June 30. Temporal and explicit resource management (using) are slated for ES2027.