Topic · JavaScript
Daily updates from the JavaScript and TypeScript world - Node.js, React, Vue, Next.js, Vercel, and the platform layers built on them.
Meta
React plugged a critical Fiber bug where singleton cleanup was nuking third-party attributes, while React Native dropped unused timing code from iOS binaries.
Read the wire →
Supabase
Supabase shipped five Postgres releases overnight across three build variants while the CLI ditched its Go binary proxy for native TypeScript in the local dev stack.
Read the wire →
Node.js
DNS tests now codify a breaking change in record lookup behavior, while the documentation pipeline abandons OXC for a WASM-based alternative after CI runner incompatibility.
Read the wire →
Vue.js
Vue's linter just caught a footgun developers didn't know they had: shadowing native HTML events in component emits.
Read the wire →
Vercel
Next.js extracted invariant app-page handlers into shared runtime modules while Workflow's stream write batching moves into core, eliminating per-token round trips on idle producers.
Read the wire →
Shopify
Shopify's CLI tooling now has comprehensive unit tests covering core theme utility functions, closing a coverage gap in the theme management layer.
Read the wire →
Meta
React's DevTools layer just got bulletproof: hoxyq landed four interconnected patches that eliminate silent state corruption, validate invariants before mutation, and handle extension reconnects with message buffering and handshakes.
Read the wire →
Supabase
The MCP server can point at alternative GraphQL endpoints for docs testing, while a critical fix stops Studio from leaking RLS-protected values during cell loads.
Read the wire →
Node.js
Node.js shipped critical fixes overnight for a use-after-free vulnerability in SQLite callbacks and a string buffer corruption bug in Fast FFI reentrant calls that could crash production systems.
Read the wire →
Vue.js
Language-tools switched to a TypeScript-native bridge fork and cut build, lint, and test performance in half across the board.
Read the wire →
Vercel
Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.
Read the wire →
Meta
React's Turbopack integration now supports an experimental array format that lets you dynamically merge or unmerge chunks based on what's already loaded in the browser.
Read the wire →
Supabase
Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.
Read the wire →
Node.js
Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics.
Read the wire →
Vue.js
Vue core pushes toward 3.6 stable while the tooling ecosystem upgrades its type foundation.
Read the wire →
Vercel
Workflow shipped its most ambitious beta yet with experimental token retention, while the AI SDK shipped five critical fixes across Gemini, Bedrock, and dynamic tool validation in a single push.
Read the wire →
Meta
React shipped performance wins across 19.0.8 and 19.1.9 while React Native patched a critical timeout bug that broke requestIdleCallback tasks.
Read the wire →
Supabase
Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.
Read the wire →
Node.js
Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.
Read the wire →
Vue.js
Vue's scaffolding tool flipped the switch on TypeScript adoption, making strict typing the path of least resistance for new projects.
Read the wire →
Vercel
Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.
Read the wire →
Shopify
Shopify CLI just implemented a seven-day cooldown on npm dependency updates, blocking Dependabot from proposing fresh packages before the ecosystem has time to validate them.
Read the wire →
Meta
React shipped a critical fix for useSyncExternalStore mutations being missed when subtrees toggle visibility, while React-Native plugged an Android keyboard that won't close on unmount.
Read the wire →
Supabase
Supabase shipped a coordinated push across Studio UI polish, accessibility compliance, and Realtime observability tooling overnight.
Read the wire →
Node.js
A circular symlink crash in recursive directory traversal just got patched, and permission audit mode finally stops throwing errors when it should only warn.
Read the wire →
Vue.js
Create-vue and its templates ship v3.23.0 in sync, while VitePress now logs Vite version on startup to cut troubleshooting friction.
Read the wire →
Vercel
The hook.resume() breakdown that tanked [email protected] has regression coverage in place [ref:1], and your performance dashboards just got a major readability upgrade [ref:2].
Read the wire →
Meta
React's server renderer now supports nested View Transition animations during Suspense reveals, closing a gap that forced SSR apps to choose between progressive enhancement and smooth animations.
Read the wire →
Supabase
ClickHouse is now a first-class replication destination in Studio, gated behind a private alpha flag and built with client-side validation that blocks insecure and internal URLs.
Read the wire →
Node.js
Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing.
Read the wire →
Vue.js
Vue's experimental Vapor compiler shipped v3.2.19 with critical fixes for slot forwarding and directive arrays, while VitePress finally documented the base path prefix feature developers have been asking for.
Read the wire →
Vercel
Next.js v16.3.0-canary.90 landed overnight with fresh React internals, while the Eve site got a ground-up design refresh that adds per-template pages.
Read the wire →
Meta
The automated translation update for React Native shipped its first batch across messaging and composer modules overnight, processing multiple Android resource files.
Read the wire →
Supabase
Supabase dropped CVE-2026-31431 mitigation across Postgres 15, 17, and OrioledB variants overnight, closing a critical vulnerability that could affect every deployment.
Read the wire →
Node.js
A regression in Node's stream handling silences data flow to working destinations when a sibling pipe errors, breaking multi-destination pipelines across all recent versions.
Read the wire →
Vue.js
VitePress shipped long-overdue markdown container support for note, important, and caution blocks while create-vue rolled through routine dependency updates and upgraded its GitHub Actions.
Read the wire →
Vercel
Passport ships identity token verification [ref:1], Eve stops failing turns on unsupported JSON Schemas [ref:6], and Workflow cuts port discovery overhead by 83% [ref:10].
Read the wire →
