$ tail -f topics/javascript.log
Daily updates from the JavaScript and TypeScript world - Node.js, React, Vue, Next.js, Vercel, and the platform layers built on them.
41 updates across 6 projects this week.
One calm review of what shipped across JavaScript - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top JavaScript projects - refine anytime. · Read a sample issue →
Meta
React DevTools just patched a critical lifecycle race that crashes during browser back/forward cache navigation, while React DOM gains a new browser() API for server-side suspense boundaries.
read --wire →
Supabase
Three new legal agreement versions ship across the marketing site while the evals framework tightens postgres best-practices detection and realtime patches a hot-path performance leak.
read --wire →
Node.js
The Node.js website monorepo split broke Vercel CI, but OpenNext is passing - and a critical FFI buffer conversion bug is now fixed.
read --wire →
Vue.js
VitePress shipped three performance fixes targeting the markdown pipeline, capping unbounded caches that were crushing memory usage on large documentation sites.
read --wire →
Vercel
Anthony Shew landed five major refactors removing ecosystem-provenance routing from Turborepo's task system, while Next.js shipped fixes for static fallback hydration and killed obsolete render options.
read --wire →
Shopify
Alfonso Noriega shipped three connected fixes for the store-auth session reuse regression that broke theme commands for OAuth users, then added irreversible deletion safeguards to prevent accidental store wipes.
read --wire →
Meta
React added traversal guards to Flight Client to defend against prototype pollution attacks, while a separate fix ensures Fragment refs properly blur nested focused elements.
read --wire →
Supabase
The Go CLI patched three production gotchas overnight: SELinux now stops blocking pg-delta, debug mode no longer silently kills TLS, and sslmode flags finally stick.
read --wire →
Node.js
Docker Node shipped 26.5.1 overnight while the release pipeline fixed a broken changelog maker that was cascading failures through branch-diff and commit-stream.
read --wire →
Vue.js
VitePress shipped a major internal restructuring across search, markdown rendering, and build tracking that forces one API change on scaffold implementations.
read --wire →
Vercel
The CLI now manages repository permissions and AI Gateway budgets directly from the command line, while Turborepo completes its Phase 4 refactor to eliminate legacy external-resolution state.
read --wire →
Shopify
Shopify CLI finishes gutting vestigial Partners infrastructure with the final sweep of a three-part refactor, while Hydrogen locks down local debugger access to prevent network-level attacks.
read --wire →
Meta
React shipped an emergency fix for a critical hang that freezes apps when updates hit hidden server-rendered boundaries before hydration completes.
read --wire →
Supabase
Supabase Postgres rolled out nojit builds across 15.14, 17.6, and the new 17.9 OrioleDB track overnight, while the JavaScript SDK's v2.111.0 solves a critical auth bug where simultaneous OAuth or password recovery flows would collide.
read --wire →
Node.js
Node.js ships a promise-based net API that eliminates hand-wired event listeners, while the July security release slips for the second time.
read --wire →
Vue.js
VitePress patched a broken robots.txt endpoint while Test-Utils pushed six dependency updates across the stack in a quiet 24 hours.
read --wire →
Vercel
Workflow 5.0.0-beta.37 removes the setAttributes deprecation aliases you've been warned about, while Turborepo cuts stored credentials entirely from its release pipeline.
read --wire →
Shopify
The CLI now lets developers specify store country at creation time, unifying a flag across dev and preview environments.
read --wire →
Meta
React's Fiber engine fixed a critical dev-mode bug where HostSingletons were being incorrectly released during effect validation, while React Native is systematically removing legacy RCT_EXPORT_METHOD macros across core TurboModules.
read --wire →
Supabase
A critical UI bug that hammered the platform API into rate limiting has been squashed, while the auth team surfaces JWT expiration controls where developers can actually find them.
read --wire →
