Supabase
SUPABASE HARDENS CORS AND SHIPS PROMPT-INJECTION EVALS
A config hardening for self-hosted envoy plus four new security evals signal Supabase is closing attack surfaces on both the infrastructure and AI agent fronts.
read --wire →
$ tail -f topics/javascript.log
JavaScript news, every morning.
Daily updates from the JavaScript and TypeScript world - Node.js, React, Vue, Next.js, Vercel, and the platform layers built on them.
41 updates across 6 projects this week.
Your week in JavaScript, every Monday.
One calm review of what shipped across JavaScript - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top JavaScript projects - refine anytime. · Read a sample issue →
Recent wires
Node.js
NODE FFI HARDENS AGAINST CONSTRUCTOR ABUSE
Node's FFI bindings just got safer, and a security release in the download pipeline demands your attention.
read --wire →
Vue.js
vue-tsc fix unblocks rspack plugin type checking
Copilot patched a vue-tsc crash that was breaking the TypeScript API path used by ts-checker-rspack-plugin.
read --wire →
Vercel
AI SDK fixes Gemini 3.7 Flash as chat and Eve harden core flows
Gemini 3.7 Flash just broke for minimal reasoning, and the fix that landed overnight says more about the AI SDK's trajectory than any feature release.
read --wire →
Meta
JEST TEARS DOWN WORKER FARMS BEFORE THEY LEAK, REACT NATIVE COMPILES PLATFORM CHECKS FASTER
Jest shipped three critical fixes to worker lifecycle management and snapshot handling that prevent resource leaks and test corruption.
read --wire →
Supabase
SUPABASE STUDIO TIGHTENS PRIVATELINK UX ACROSS FOUR COMMITS
Four linked PRs ship clarity to PrivateLink configuration and MFA backup flows, replacing ambiguous copy with resource IDs and clearer field ordering.
read --wire →
Node.js
JS-YAML SECURITY FIX SHIPS IN NODEJS-DIST-INDEXER 1.8.24
The distribution indexer bumped js-yaml to 4.3.1, patching a quadratic complexity vulnerability in YAML omap duplicate key detection that could enable DoS attacks.
read --wire →
Vue.js
CREATE-VUE ROLLS OUT DEPENDENCY REFRESH ACROSS TOOLCHAIN
Five dependency updates hit create-vue overnight, anchored by eslint-plugin-cypress jumping to v7 and oxc tooling gaining ground on linting performance.
read --wire →
Vercel
NEXT.JS TURBO LAYER GETS GARBAGE COLLECTION PLUMBING, AI PACKAGE FIXES PROVIDER USAGE DATA
Next.js is laying the foundation for task garbage collection across its persistence layer while fixing a critical gap in how OpenAI-compatible providers report token usage.
read --wire →
Meta
JEST FIXES ES MODULE RESOLVER LOADING
Jest can now load custom resolvers written as ES modules, closing a gap that forced developers back to CommonJS workarounds.
read --wire →
Supabase
SUPABASE CLI FIXES MEMORY BLOWUP ON LARGE DB DUMPS
The CLI was buffering entire piped outputs in memory instead of respecting backpressure, turning a routine `supabase db dump` into an OOM killer on large databases.
read --wire →
Node.js
WEBSTREAMS PROMISE CHURN CRUSHED, SQLITE DIAGNOSTICS LAND
Matteo Collina's twelfth round of pure-JS webstreams optimization cuts promise overhead by redesigning microtask handling on hot paths, while Node adds DatabaseSync diagnostic channels for production visibility.
read --wire →
Vue.js
VUE VAPOR REARCHITECTS EVENT DELEGATION, SHIPS BREAKING CHANGES
Vue's experimental Vapor compiler just broke event handling to make it faster: event delegation is now opt-in, not automatic.
read --wire →
Vercel
NEXT.JS ROUTER ARCHITECTURE SHIFTS INTO CONCURRENT MODE
The Next.js team is laying foundation for a concurrent-rendering-aware router rewrite, while simultaneously cleaning up years of structural debt across the client-side codebase.
read --wire →
Shopify
CLI LATENCY DROPS, THROTTLING FIXED, HYDROGEN OAUTH HARDENS
Shopify's CLI is shipping background analytics to eliminate command blocking, while three critical authentication fixes land across the platform.
read --wire →
Meta
REACT FLIPS PARALLEL TRANSITIONS BY DEFAULT, JEST FIXES ESM NAMESPACE COLLISIONS
Parallel transitions move from experimental to standard across React and React Native, while Jest patches critical bugs in module resolution and test serialization.
read --wire →
Supabase
CLI UNLOCKS ORIOLEDB PROJECTS, EVALS MOVES TO VERCEL SANDBOXES
Supabase CLI now exposes the experimental flags needed to spin up OrioleDB managed projects, while the evals system abandons GitHub Actions for faster, sandboxed test execution.
read --wire →
Node.js
UNDICI FIXES ABORT HANDLING BUGS THAT HANG REQUESTS
Two critical fixes land in undici for abort signals that were silently ignored during retry backoff and request deduplication, leaving callers hanging indefinitely.
read --wire →
Vue.js
LANGUAGE TOOLS 3.3.10 LANDS WITH TEMPLATE TYPE FIXES, CORE RC.4 STAGED
Vue's dev tooling gets a stability push while the core team readies the next minor release candidate.
read --wire →
Vercel
WORKFLOW SHIPS RESILIENT STEP DISPATCH, NEXT.JS FIXES PAGES RUNTIME BREAKAGE
Workflow@5.0.0-beta.42 lands parallel queue publishing with transient failure recovery, while Next.js patches a critical Pages API adapter bug that breaks when routes import next/head.
read --wire →