Vercel
TWO CRITICAL SECURITY PATCHES LAND IN WORKFLOW AND EVE OVERNIGHT
Next 16.2.11 and PostCSS 8.5.12 patches ship across workflow to seal CVE vulnerabilities, while Eve locks down workflow failure visibility.
read --wire →
$ tail -f topics/javascript.log
JavaScript news, every morning.
Daily updates from the JavaScript and TypeScript world - Node.js, React, Vue, Next.js, Vercel, and the platform layers built on them.
41 updates across 6 projects this week.
Your week in JavaScript, every Monday.
One calm review of what shipped across JavaScript - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top JavaScript projects - refine anytime. · Read a sample issue →
Recent wires
Meta
REACT SERVER DOM TURBOPACK GETS DYNAMIC CHUNK MERGING
React's Turbopack integration now supports an experimental array format that lets you dynamically merge or unmerge chunks based on what's already loaded in the browser.
read --wire →
Supabase
CLICKHOUSE SCHEMA CORRUPTION FIX LANDS ACROSS ETL STACK
Supabase shipped a critical fix that prevents ClickHouse from destroying newer columns during CDC replay restarts, then propagated the same safety logic across Pulumi and Terraform tooling.
read --wire →
Node.js
NODE.JS STRIPS DEPRECATED API CALLS, FIXES FFI BOOL REGRESSION
Antoine du Hamel landed two critical cleanups in core this cycle, removing deprecated function calls and custom DOM polyfills while the FFI layer gets a precision fix that restores uint8 semantics.
read --wire →
Vue.js
VUE 3.6 RC ARRIVES AS LANGUAGE TOOLS JUMPS TO TYPESCRIPT 7
Vue core pushes toward 3.6 stable while the tooling ecosystem upgrades its type foundation.
read --wire →
Vercel
WORKFLOW 5.0 BETA ARRIVES WITH HOOK TOKEN RETENTION, AI SDK FIXES GEMINI AND BEDROCK HALLUCINATIONS
Workflow shipped its most ambitious beta yet with experimental token retention, while the AI SDK shipped five critical fixes across Gemini, Bedrock, and dynamic tool validation in a single push.
read --wire →
Meta
React 19 Cuts Server Component Decoding Time, React Native Fixes requestIdleCallback Regression
React shipped performance wins across 19.0.8 and 19.1.9 while React Native patched a critical timeout bug that broke requestIdleCallback tasks.
read --wire →
Supabase
PIPELINES HITS PUBLIC ALPHA, REALTIME SQUASHES RACE CONDITION
Supabase Pipelines moves out of private alpha with full schema change support, while the realtime stack hardens against clustering edge cases.
read --wire →
Node.js
NODE CORE HARDENS CRYPTO AND FFI, UNDICI PATCHES HEADER INJECTION
Node's crypto layer just got faster and safer, while undici plugged a CRLF injection hole that only matters if your app trusts untrusted function objects as headers.
read --wire →
Vue.js
CREATE-VUE 3.23.0 SHIPS WITH TYPESCRIPT ENABLED BY DEFAULT
Vue's scaffolding tool flipped the switch on TypeScript adoption, making strict typing the path of least resistance for new projects.
read --wire →
Vercel
NEXT.JS PATCHES FIVE SECURITY HOLES OVERNIGHT WHILE VERCEL CLI GAINS AI GATEWAY BUDGET CONTROLS
Five security advisories dropped across Next.js in the last 24 hours, ranging from origin validation on internal redirects to fetch cache key collisions that could leak cached responses between requests.
read --wire →
Shopify
SHOPIFY CLI CUTS SUPPLY-CHAIN RISK WITH SEVEN-DAY DEPENDABOT HOLD
Shopify CLI just implemented a seven-day cooldown on npm dependency updates, blocking Dependabot from proposing fresh packages before the ecosystem has time to validate them.
read --wire →
Meta
REACT PATCHES HIDDEN COMPONENT STATE BUG, REACT-NATIVE FIXES KEYBOARD TRAP
React shipped a critical fix for useSyncExternalStore mutations being missed when subtrees toggle visibility, while React-Native plugged an Android keyboard that won't close on unmount.
read --wire →
Supabase
STUDIO ACCESSIBILITY DEBT CLEARED, REALTIME INSPECTOR LEVELED UP
Supabase shipped a coordinated push across Studio UI polish, accessibility compliance, and Realtime observability tooling overnight.
read --wire →
Node.js
NODE FIXES STACK OVERFLOW IN RECURSIVE READDIR, PATCHES PERMISSION AUDIT MODE
A circular symlink crash in recursive directory traversal just got patched, and permission audit mode finally stops throwing errors when it should only warn.
read --wire →
Vue.js
CREATE-VUE ROLLS TO 3.23.0, VITEPRESS SURFACES BUILD DIAGNOSTICS
Create-vue and its templates ship v3.23.0 in sync, while VitePress now logs Vite version on startup to cut troubleshooting friction.
read --wire →
Vercel
WORKFLOW BETA REGRESSION FIXED, BENCHMARKS NOW SHOW WHAT MATTERS
The hook.resume() breakdown that tanked workflow@5.0.0-beta.26 has regression coverage in place [ref:1], and your performance dashboards just got a major readability upgrade [ref:2].
read --wire →
Meta
REACT FIZZ UNLOCKS NESTED ANIMATIONS FOR STREAMING SERVERS
React's server renderer now supports nested View Transition animations during Suspense reveals, closing a gap that forced SSR apps to choose between progressive enhancement and smooth animations.
read --wire →
Supabase
SUPABASE SHIPS CLICKHOUSE REPLICATION AND HARDENS CUSTOM AUTH
ClickHouse is now a first-class replication destination in Studio, gated behind a private alpha flag and built with client-side validation that blocks insecure and internal URLs.
read --wire →
Node.js
NODE PLUGS TIMER MEMORY LEAK, FIXES FFI SIGNATURE DOUBLE-EVALUATION
Node's garbage collector was holding onto timer references it shouldn't have, and a critical FFI vulnerability let native functions receive different signatures than JavaScript thought it was passing.
read --wire →