Supabase
SUPABASE PATCHES SEARCH AND SECURITY GAPS ACROSS PLATFORM
Quote escaping fix closes critical search vulnerabilities while ETL and Realtime ship performance improvements that ripple across the stack.
read --wire →
$ tail -f topics/javascript.log
JavaScript news, every morning.
Daily updates from the JavaScript and TypeScript world - Node.js, React, Vue, Next.js, Vercel, and the platform layers built on them.
41 updates across 6 projects this week.
Your week in JavaScript, every Monday.
One calm review of what shipped across JavaScript - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top JavaScript projects - refine anytime. · Read a sample issue →
Recent wires
Node.js
NODE.JS 22.22.3 ROLLS TO DOCKER HUB
The latest Node.js patch landed in docker-node overnight, bringing it to your container pipelines without manual intervention.
read --wire →
Vue.js
SUPPLY CHAIN DEFENSE HARDENS ACROSS VUEJS CORE AND TEST-UTILS
Vue's core team is locking down dependency updates with new release-age gates while hardening CI permissions to block token creep.
read --wire →
Vercel
VERCEL CLI RENAMED, SDK BREAKING CHANGES, NEXT.JS CACHE OVERHAUL
The CLI's connect command sheds its beta name while two SDK releases stack breaking changes across projects, users, and teams—and Next.js is overhauling how fetch respects HTTP cache headers.
read --wire →
Shopify
CLI SWEEPS OUT DEPRECATED FLAGS AHEAD OF MAJOR RELEASE
Shopify/cli is systematically removing deprecated commands and flags in preparation for its next major version, while a critical fix to the breaking-change detection script stops false positives from tanking unrelated PRs.
read --wire →
Meta
REACT NATIVE FIXES CRITICAL IMAGE DIMENSION BUG, TYPESCRIPT 6 LANDS
Image.getSize has been returning wildly wrong dimensions on Android for months — a fix just shipped that reads the actual encoded image instead of Fresco's downsampled bitmap.
read --wire →
Supabase
REALTIME PATCHES CVE, STUDIO CONSOLIDATES LOGIN FLOWS
Supabase Realtime shipped a security update addressing published CVE vulnerabilities in Decimal and Postgrex dependencies, while the Studio team unified CLI authentication onto a shared interstitial pattern.
read --wire →
Node.js
NODE TEST RUNNER GETS TAG FILTERING — GYPTO TIGHTENS LICENSE COMPLIANCE
Node's test runner now supports tagging and filtering tests by label, while gyp-next patches license expression handling and macOS certificate enumeration gets fixed.
read --wire →
Vue.js
TEST-UTILS PATCHES COMPONENT TEXT RENDERING, TOOLCHAIN JUMPS TO PNPM 11
Test-utils v2.4.10 restores text() and html() for single-root components while the entire stack prepares for pnpm 11's Node 22 requirement.
read --wire →
Vercel
VERCEL CLI SHIPS BREAKING CHANGES — LOGS NOW REQUIRE --FOLLOW FLAG
The Vercel CLI is tightening its logs behavior: `vercel logs` targeting a deployment now requires an explicit `--follow` flag to stream live output, treating all deployment arguments as historical filters by default.
read --wire →
Shopify
CLI NOW BLOCKS DELETED APP DEV STORES FROM SELECTION
The Shopify CLI fixed a critical gap where `app dev --reset` could surface deleted or inactive development stores, letting developers accidentally reconnect to invalid environments.
read --wire →
Meta
REACT NATIVE PATCHES BABEL VULNERABILITY, AXES HERMES LEGACY CODE
React Native shipped a critical Babel fix overnight while gutting three releases worth of dead Hermes infrastructure code.
read --wire →
Supabase
FLY.IO SUNSET HITS DASHBOARD, CLI DROPS TIMEOUT BOTTLENECK
Supabase is surfacing the Fly.io May 31 suspension directly in Studio with per-project impact breakdown, while the CLI finally kills the 10-second upload timeout that was choking storage streaming.
read --wire →
Node.js
UNDICI PATCHES CHUNKED RESPONSE VALIDATION HOLE AS NODE-GYP PIVOTS TO v26
Undici fixed a critical gap where EOF on chunked HTTP/1.1 responses could slip through without validating the terminating chunk, while node-gyp simultaneously dropped v20 from CI and landed full v26 support.
read --wire →
Vue.js
CREATE-VUE TIGHTENS TOOLCHAIN AS OXLINT AND VITE SHIP UPDATES
The Vue scaffolding tool is marching through dependency updates across linting, formatting, and build infrastructure in a single coordinated push.
read --wire →
Vercel
NEXT.JS NUKES 327 INTEGRATION TESTS, CHAT SDK GAINS REAL SLACK EMULATOR, AI SDK BREAKS INSTRUCTION HANDLING
Next.js just migrated its entire legacy integration test suite to isolated tests and deleted 327 suites in one swing—the biggest test infrastructure shift in months—while chat and AI SDKs ship breaking changes that tighten their APIs.
read --wire →
Shopify
SHOPIFY CLI FIXES STOREFRONT API AUTH HEADACHE IN DEV PROXY
The dev proxy was rejecting every Storefront API request with a 401 — turns out it was injecting its own auth headers where it had no business being.
read --wire →
Supabase
DOCS SCHEMA FIX KILLS 230 SEARCH CONSOLE ERRORS, POSTGRES WRAPPERS ACROSS VERSIONS
Supabase eliminated critical Google Search Console errors plaguing the docs, while shipping five Postgres builds across 15, 17, and architecture variants.
read --wire →
Node.js
NODE CORE CLEANS HOUSE WHILE CHANGELOG-MAKER SHIPS PATCH BUMPS
Documentation standards tightened across Node.js core as inconsistencies in code snippets get rooted out, while changelog-maker 4.4.29 ships dependency updates.
read --wire →
Vue.js
AXIOS SHIPS SECURITY HARDENING FOR NODE HTTP ADAPTER
Axios 1.15.2 patches prototype pollution vulnerabilities and closes an SSRF vector that could let attackers escape sandbox constraints via Unix domain sockets.
read --wire →