$ tail -f topics/javascript.log
Daily updates from the JavaScript and TypeScript world - Node.js, React, Vue, Next.js, Vercel, and the platform layers built on them.
41 updates across 6 projects this week.
One calm review of what shipped across JavaScript - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top JavaScript projects - refine anytime. · Read a sample issue →
Meta
React's Server Components framework shipped a critical fix for debug information leaking past error boundaries, while React-Native addressed multiple C++ crashes affecting animation and networking.
read --wire →
Supabase
A critical authorization bypass in gRPC 1.56 to 1.79.2 could let attackers bypass request validation, and Supabase is patching across benchmarks while shipping realtime improvements.
read --wire →
Node.js
Node.js runtime-deprecates calling Hmac.digest() multiple times in the same session, aligning its behavior with Hash.digest() and closing a consistency gap that has quietly shipped code across production.
read --wire →
Vue.js
Vue test-utils picked up a patch bump to pnpm/action-setup with no breaking changes or feature impact.
read --wire →
Vercel
Next.js just cut RawVc in half and CellId by a third, removing massive chunks of peak RAM from large apps.
read --wire →
Supabase
Dashboard loads now automatically wake hibernated projects, while the replicator stops crashing when ClickHouse claims port 9000.
read --wire →
Node.js
Amaro shipped SWC v1.15.41 overnight while Node's stream implementation gets surgical fixes for edge cases that broke pipeTo() transform handling.
read --wire →
Vue.js
Vue's Vapor compiler shipped a significant refactor that removes delegate events entirely, while the team walked back a controversial CI cutout.
read --wire →
Vercel
Vercel/chat ships WebClient configuration options for Slack adapters, while the AI SDK ecosystem closes SSE handling gaps and bumps dependencies across Vue, Svelte, React, and RSC frameworks.
read --wire →
Supabase
Realtime v2.107.2 improves observability into publication changes while self-hosted deployments align their shell execution layer.
read --wire →
Node.js
Node's test runner shed unused helpers while the debugger gained new probe termination controls, but the real urgency is undici's HTTP/2 fix for out-of-order stream completion that could leave requests dangling.
read --wire →
Vue.js
Vue's Vapor compiler just shed slot wrapping overhead while DevTools v8.1.3 corrects a package.json export that was pointing to the wrong file.
read --wire →
Vercel
Vercel shipped production-ready CLI commands for AI Gateway routing rules, while Next.js and Turborepo shipped fixes for cache handling and Windows PTY corruption that teams should pull immediately.
read --wire →
Shopify
Shopify/cli is extracting its GraphiQL server from the app package into cli-kit, making it available across other tools while shipping 40 dependency updates.
read --wire →
Meta
React is locking down modern Flow syntax across its ecosystem while React-Native promotes backgroundImage out of experimental mode, but breaking changes are coming for animation backends.
read --wire →
Supabase
The Supabase CLI just killed its last Go proxies, ported 13 database inspection commands to native TypeScript, and flipped pg-delta on for every new project.
read --wire →
Node.js
Undici shipped a critical websocket fragment limit to prevent remote OOM attacks, while Node core lands experimental package map support and a V8 API that cuts Buffer.copy overhead.
read --wire →
Vue.js
Vue core climbed three patch versions overnight, bringing bug fixes and stability improvements to the documentation repository.
read --wire →
Vercel
Turbopack's serialization pipeline now drops data proactively during persistence, cutting memory consumption from 16.74 GB to 15.69 GB on canary builds.
read --wire →
Shopify
A critical security vulnerability in theme dev could let malicious sites steal data through DNS rebinding attacks, and Shopify shipped the fix overnight.
read --wire →
