Tags
No item matches the filter.
Ryan Dahl announced on October 9, 2026 that the whole Deno team is moving to Cloudflare. The Deno runtime will get monthly fixes for one more year before development ends, and Deno Deploy will shut down after six months. JSR keeps running.
Denoverified
Vercel shipped Next.js 16.4 on October 6, 2026. Cache Components, the opt-in caching model built over the 16.x line, is now the recommended choice for every app and the default in new projects. The release adds a way to force a route to stay static, two APIs that keep content out of prefetches, an agent-driven upgrade command, React 19.3, and a smaller Turbopack cache.
Next.js Blogverified
Next.js published its September security release on September 30, 2026. Versions 16.3.8 and 15.5.27 close one high, five medium, and one low severity vulnerability, from server-side request forgery in image optimization to cache poisoning on self-hosted sites. Two more fixes, one critical and one high, are held for a later release while an upstream dependency catches up. If you self-host, most of the list applies to you.
Next.js Blogverified
The Next.js team announced on September 23, 2026 that versions 16.3.7 and 15.5.27 will ship on September 30, 2026. The release addresses nine vulnerabilities, one of them rated critical. The advisories that describe them appear only with the release. It follows the out-of-band 16.3.6 by eight days, so many projects will upgrade twice in the same month.
Next.jsverified
The out-of-band release is available as 16.3.6 on Active LTS and 15.5.26 on Maintenance LTS. Versions from 16.2.0 up to but not including 16.3.6 are affected through the Node.js ImageResponse implementation in next/og, where improper escaping in Satori's SVG output can lead to remote code execution. Applications on the Edge implementation are not affected, and Next.js 15.x does not carry the remote code execution issue at all. The fix works by upgrading the upstream dependencies, Satori among them.
Next.jsverified
The release arrived on September 22, 2026 and contains no security fixes. Both new functions return a promise for whatever the wrapped function produced, accept an AbortSignal, and say exactly what happens to a call they decide not to run. Throttle also carries a concurrency limit, a queue depth and a choice between queueing the overflow and rejecting it. Nine further changes are marked semver-minor, among them a synchronous openAsBlob and a way to hand a bound socket to a worker thread.
Node.jsverified
Vercel says a critical security issue has been found in a package that Next.js pulls in. Patched releases 16.3.6 and 15.5.26 are due in an out-of-band update on September 22, 2026. The advisory that spells out impact and affected versions appears only alongside those releases. Until it does, nobody running the framework can size up their own exposure.
Next.jsverified
The preview build came out on September 11, 2026 and covers WebKit changes between 319252@main and 320112@main. Eleven features are new, and two of them extend the same job: how a stylesheet, and then a script, finds out what the engine underneath can do. The named-feature() function asks about a behavior that has no syntax of its own, and the registry behind it holds exactly two entries today. SVG also gained external resources, so the url() reference can finally point at a filter, mask or gradient stored in another document.
WebKitverified
The call for Interop 2027 Focus Area proposals opened on September 3, 2026 and closes on September 23, 2026. Proposals are filed as issues on the web-platform-tests/interop repository, and two conditions decide almost everything: the technology must already have a mature standard, and it must be testable, because the test results are what the dashboard scores. Anything that fails the second condition is steered toward an Interop Investigation instead. Twenty days is the whole window, and the evidence a good proposal needs takes longer than an evening to assemble.
WebKitverified
WebKit published the fix on September 2, 2026. Dynamic imports of a module that uses top-level await could complete out of order in Safari, and an importer that ran early hit an error about accessing a value before initialization. The cause was a module loader built on the abandoned WHATWG Loader proposal rather than on the algorithms in the ECMAScript standard. WebKit rewrote the loader from self-hosted JavaScript into native C++, and the result ships in Safari 27 and in Safari Technology Preview 251.
WebKitverified
The @huggingface/kernels package downloads one GPU operation from the Hub and runs it in a browser that supports WebGPU. All 207 kernels are Apache-2.0, and each one is published with its interface contract, correctness cases, and benchmark cases in the same repository. Hugging Face compared them with ONNX Runtime Web 1.30.0 on an Apple M4 GPU and reports a 2.57x geometric mean speedup across 809 comparable cases. The timings cover work on the GPU alone, for single operations rather than whole models.
Hugging Faceverified
Twelve new CSS features and eleven JavaScript ones landed in the preview build on August 26. The one that changes how you write CSS is not the rounded-corner property everyone will notice, but at-rule() inside supports, which lets a stylesheet ask whether an at-rule exists before relying on it. Until now there was no way to do that. This is a preview build, so nothing here is shippable, and none of it moves Baseline.
WebKitverified
Vercel published the date before the fix. Versions 16.3.3 and 15.5.24 were announced for August 26 with a full advisory, and the announcement exists so teams can schedule the upgrade instead of discovering it from a CVE feed.
Next.js Blogverified
The August 18 release adds three CSS features you can use right away. sibling-index() and sibling-count() give an element's position among its siblings and their total, directly in CSS and without a line of JavaScript, which ends the need to hand-write variables like --i for staggered animation delays. Alongside them come text-box-edge, text-box-trim, and the text-box shorthand, which remove the extra space above and below text so headings finally sit in the grid the way they look in the design. On the JavaScript side, includes(), join(), chunks(), and windows() were added to the iterator prototype.
MDNverified
The edition published on August 10 moves Intl.Locale into newly available — a standard way to parse, modify, and inspect Unicode language and region tags, useful anywhere dates, numbers, and currencies are formatted without an extra library. Array.fromAsync(), which turns asynchronous data streams into an array, and the CSS rect() function, which describes rectangular shapes for clip-path and offset-path far more readably than going through polygon(), both moved to widely available. An updated MDN guide to choosing image formats shipped alongside the digest.
web.devverified
Jad Joubran gives a practical method for auditing package.json: which libraries can be dropped today because the browser does the same job natively. The piece explains Baseline's three states — limited availability, newly available, and widely available — and shows how to use them as a measure instead of a feeling. The gap between the claim that something needs a library and the fact that the browser already does it closes faster than most projects track.
Smashing Magazineverified
Aaron T. Grogg assembled a survey of common JavaScript patterns that today are solved with plain HTML and CSS, with no script at all, or the smallest one possible. The collection pairs well with the Baseline piece: first check what the platform already does, then drop the dependency. The result is a lighter page and better Core Web Vitals numbers.
GitHubverified
