javascript

Astro 7.3.8 and companion packages replace direct esbuild use with Vite's Oxc transform and Rolldown, while create-astro stops writing pnpm install-script approvals.

Node.js 26.11.0 renames DatabaseSync and StatementSync to Database and Statement with aliases kept, adds --process-timeout, and 26.11.1 reverts three commits.

Nuxt 4.6 ships a server-agnostic nuxt/server import surface, interop support for Vue 3.6 Vapor Mode and a root app secret, alongside Nuxt CLI v4.

React 19.3, released September 9, stabilizes the ViewTransition component and Fragment Refs and adds a browser() API for opting components out of server rendering.

Angular's maintainers published four GitHub advisories between September 23 and October 1 covering router and platform-server flaws in server-side rendering, three rated High.

SvelteKit 3.0 was released October 1, moving configuration into vite.config.ts, replacing $lib with #lib, and requiring Vite 8, TypeScript 6 and Node 22.17.

Vercel's Next.js team released 16.3.8 and 15.5.27 fixing one high, five medium and one low severity flaw; a critical and a high fix were postponed over upstream delays.

Mozilla released Firefox 156 on September 15, 2026, with scheduler and Promise.try fixes, TLS group removals, a roughly 45% faster PDF viewer startup and new enterprise policies.

Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.

Node.js 26.9.0 adds a global Worker class implementing the WHATWG Web Worker API and enables the experimental node:ffi module by default.

The indexed-btree npm package evades npm v12's install-script blocking by hiding its malware loader inside a runtime method instead, Checkmarx reports.

htmx skipped version 3 and shipped 4.0, replacing XMLHttpRequest with fetch(), building in morphing swaps, and requiring an :inherited suffix for attribute inheritance.