JS frameworks, React/Vue/Svelte, and runtime updates Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 10-2026bolt1 CRITICAL
article
Persistent XSS/RCE using WebSockets in Storybook (CVE-2026-27148)
TAG: SECURITY
CVE-2026-27148 (CVSS 8.9) affects Storybook versions 8.1.0 through 10.2.10, exploiting the unauthenticated WebSocket endpoint at ws://localhost:6006/storybook-server-channel introduced with the browser-based story editor in v8.1. The handlers createNewStoryfileRequest and saveStoryRequest pass a user-supplied componentFilePath unsanitized into generated story source files on disk, enabling JavaScript injection via string-context breakout. If the dev server is publicly exposed, exploitation requires no user interaction; locally, visiting a malicious page that opens a cross-origin WebSocket suffices. Because the payload is written to disk and can be committed to version control, escalation to RCE is straightforward in setups running Vitest with JSDOM — the injected code executes in Node.js with access to CI secrets and the filesystem. Patch immediately to 7.6.23, 8.6.17, 9.1.19, or 10.2.10, which add origin validation to the WebSocket server.
Node.js 22.22.1'Jod' (LTS), prepared by @aduh95 and released on 2026-03-05, is a large maintenance release with over 300 commits. Notable changes include stabilizing the --heapsnapshot-near-heap-limit CLI flag, updating root certificates to NSS 3.119, upgrading OpenSSL sources to 3.5.5, and updating SQLite to 3.51.2. Performance work spans Buffer.concat acceleration via TypedArray#set, console single-string logging optimization, and a fast path added to the URL decoder. Bug fixes cover fs.cperrorOnExist behavior for directory copies, HTTP rawHeaders exceeding maxHeadersCount, HTTP/2initialWindowSize validation, and a stream isErrored/isWritable regression for WritableStreams. Three new collaborators were added: Aviv Keller, Gürgün Dayıoğlu, and Renegade334. The vm.Module.evaluate() method gains a conditional synchronous execution mode.
Introducing TanStack Intent: Ship Agent Skills with your npm Packages | TanStack Blog
TAG: RELEASE
TanStack Intent (@tanstack/intent) is a new CLI that lets library maintainers generate, validate, and ship versioned Agent Skills directly inside their npm packages, targeting the open Agent Skills spec already supported by VS Code, GitHub Copilot, OpenAI Codex, Cursor, Claude Code, Goose, and Amp. The core problem: agent knowledge of library APIs is frozen at training cutoff and never updates through a maintainer-controlled channel, causing version confusion on every breaking change. A skill is a short YAML-fronted Markdown document that encodes correct usage patterns, common mistakes, and the source docs it was derived from — allowing npx @tanstack/intent stale to flag drift in CI. Developers run npx @tanstack/intent install to auto-wire all intent-enabled packages into their agent config (CLAUDE.md, .cursorrules, etc.). The feedback loop closes with npx @tanstack/intent feedback, routing user-reported failures back to maintainers. TanStack DB is the first library shipping skills, with other TanStack packages to follow.
READ_TIME: 5_MIN|BY: Co-Authored By Sarah Gerrard; Kyle Mathews
VoidZero's February 2026 recap covers the full Vite ecosystem. Oxfmt — the Rust-based formatter — reached beta after passing 100% of Prettier's JavaScript and TypeScript conformance tests at up to 36x faster speeds; beta stabilizes import sorting, Tailwind CSS class sorting, and embedded language formatting, with early adoption at Turborepo, Hugging Face, and Lichess. Vite 8 beta now exposes experimental devtools for inspecting the module graph and HMR timelines. Vitest 4.1 beta ships aroundEach and aroundAll hooks. Rolldown gained 9.6% speed from internal file path optimizations and tsdown added an --exe flag for Node.js single-executable bundling. Oxc's semantic analysis improved 4-6% via identifier hash precomputing, and Oxlint now supports 59 of 61 typescript-eslint rules via tsgolint.
React Compiler: Bye useMemo and useCallback | Alex Cloudstar
TAG: GUIDE
React Compiler v1.0, released in October 2025, is a build-time Babel or SWC plugin that automatically inserts useMemo, useCallback, and React.memo where needed, eliminating manual memoization boilerplate. It works by analyzing the full component at once to determine exact dependency relationships — something developers frequently get wrong. Next.js enables it with a single reactCompiler: true flag in next.config.js; Vite users install babel-plugin-react-compiler and add it to the @vitejs/plugin-react babel plugins list. The compiler strictly enforces the Rules of React — pure components, no conditional hooks, no state mutation — and skips or errors on non-conforming code. For gradual adoption, individual components can opt out with the "use no memo" directive. Manual optimization is still needed for react-window virtualization, useRef-driven imperative code, and third-party libraries with non-standard patterns.
Composables vs. Provide/Inject vs. Pinia — When to Use What - Vue School Articles
TAG: GUIDE
This Vue School guide by Daniel Kelly maps out exactly when to reach for each of Vue's three state-sharing mechanisms. Composables (functions using ref, computed, watch) give each caller its own isolated state — ideal for reusable logic like mouse tracking or form validation; shared state is possible by lifting refs to module scope but loses devtools support and risks SSR state bleed. Provide/inject targets prop-drilling avoidance within a component subtree and shines in tightly coupled component pairs like Tabs/Tab or Form/FormField; using typed InjectionKey<T> symbols eliminates the fragile string-key problem. Pinia is the right choice for global application state (auth, cart, feature flags) that needs devtools time-travel, SSR safety, and built-in getters and actions. The article closes with a decision flowchart and warns against three common mistakes: over-relying on Pinia for local state, using provide/inject as a global store, and using module-level shared composables for complex state in SSR environments.
Web Dev Simplified's Kyle walks through the specific scenarios where explicit return types in TypeScript genuinely improve code quality, rather than recommending them universally. The one non-negotiable case is recursive functions — TypeScript cannot infer the return type and defaults to any. Beyond that, explicit return types serve as a contract for library-grade code or widely-used helper functions: if you accidentally change the inferred type (e.g., returning undefined instead of null), downstream callers break silently without the annotation. Two more practical cases are covered: using tuple return types instead of as const for more flexible typing, and discriminated union returns where TypeScript's inferred type produces confusing undefined overlaps that a hard-coded union resolves cleanly. The overall recommendation is to default to no return types and add them selectively — for recursive functions, library/shared utilities, and complex discriminated unions.
Persistent XSS/RCE using WebSockets in Storybook (CVE-2026-27148)
CVE-2026-27148 (CVSS 8.9) affects Storybook versions 8.1.0 through 10.2.10, exploiting the unauthenticated WebSocket endpoint at ws://localhost:6006/storybook-server-channel introduced with the browser-based story editor in v8.1. The handlers createNewStoryfileRequest and saveStoryRequest pass a user-supplied componentFilePath unsanitized into generated story source files on disk, enabling JavaScript injection via string-context breakout. If the dev server is publicly exposed, exploitation requires no user interaction; locally, visiting a malicious page that opens a cross-origin WebSocket suffices. Because the payload is written to disk and can be committed to version control, escalation to RCE is straightforward in setups running Vitest with JSDOM — the injected code executes in Node.js with access to CI secrets and the filesystem. Patch immediately to 7.6.23, 8.6.17, 9.1.19, or 10.2.10, which add origin validation to the WebSocket server.
Web Dev Simplified's Kyle walks through the specific scenarios where explicit return types in TypeScript genuinely improve code quality, rather than recommending them universally. The one non-negotiable case is recursive functions — TypeScript cannot infer the return type and defaults to any. Beyond that, explicit return types serve as a contract for library-grade code or widely-used helper functions: if you accidentally change the inferred type (e.g., returning undefined instead of null), downstream callers break silently without the annotation. Two more practical cases are covered: using tuple return types instead of as const for more flexible typing, and discriminated union returns where TypeScript's inferred type produces confusing undefined overlaps that a hard-coded union resolves cleanly. The overall recommendation is to default to no return types and add them selectively — for recursive functions, library/shared utilities, and complex discriminated unions.
Node.js 22.22.1'Jod' (LTS), prepared by @aduh95 and released on 2026-03-05, is a large maintenance release with over 300 commits. Notable changes include stabilizing the --heapsnapshot-near-heap-limit CLI flag, updating root certificates to NSS 3.119, upgrading OpenSSL sources to 3.5.5, and updating SQLite to 3.51.2. Performance work spans Buffer.concat acceleration via TypedArray#set, console single-string logging optimization, and a fast path added to the URL decoder. Bug fixes cover fs.cperrorOnExist behavior for directory copies, HTTP rawHeaders exceeding maxHeadersCount, HTTP/2initialWindowSize validation, and a stream isErrored/isWritable regression for WritableStreams. Three new collaborators were added: Aviv Keller, Gürgün Dayıoğlu, and Renegade334. The vm.Module.evaluate() method gains a conditional synchronous execution mode.
Introducing TanStack Intent: Ship Agent Skills with your npm Packages | TanStack Blog
TanStack Intent (@tanstack/intent) is a new CLI that lets library maintainers generate, validate, and ship versioned Agent Skills directly inside their npm packages, targeting the open Agent Skills spec already supported by VS Code, GitHub Copilot, OpenAI Codex, Cursor, Claude Code, Goose, and Amp. The core problem: agent knowledge of library APIs is frozen at training cutoff and never updates through a maintainer-controlled channel, causing version confusion on every breaking change. A skill is a short YAML-fronted Markdown document that encodes correct usage patterns, common mistakes, and the source docs it was derived from — allowing npx @tanstack/intent stale to flag drift in CI. Developers run npx @tanstack/intent install to auto-wire all intent-enabled packages into their agent config (CLAUDE.md, .cursorrules, etc.). The feedback loop closes with npx @tanstack/intent feedback, routing user-reported failures back to maintainers. TanStack DB is the first library shipping skills, with other TanStack packages to follow.
VoidZero's February 2026 recap covers the full Vite ecosystem. Oxfmt — the Rust-based formatter — reached beta after passing 100% of Prettier's JavaScript and TypeScript conformance tests at up to 36x faster speeds; beta stabilizes import sorting, Tailwind CSS class sorting, and embedded language formatting, with early adoption at Turborepo, Hugging Face, and Lichess. Vite 8 beta now exposes experimental devtools for inspecting the module graph and HMR timelines. Vitest 4.1 beta ships aroundEach and aroundAll hooks. Rolldown gained 9.6% speed from internal file path optimizations and tsdown added an --exe flag for Node.js single-executable bundling. Oxc's semantic analysis improved 4-6% via identifier hash precomputing, and Oxlint now supports 59 of 61 typescript-eslint rules via tsgolint.
React Compiler: Bye useMemo and useCallback | Alex Cloudstar
React Compiler v1.0, released in October 2025, is a build-time Babel or SWC plugin that automatically inserts useMemo, useCallback, and React.memo where needed, eliminating manual memoization boilerplate. It works by analyzing the full component at once to determine exact dependency relationships — something developers frequently get wrong. Next.js enables it with a single reactCompiler: true flag in next.config.js; Vite users install babel-plugin-react-compiler and add it to the @vitejs/plugin-react babel plugins list. The compiler strictly enforces the Rules of React — pure components, no conditional hooks, no state mutation — and skips or errors on non-conforming code. For gradual adoption, individual components can opt out with the "use no memo" directive. Manual optimization is still needed for react-window virtualization, useRef-driven imperative code, and third-party libraries with non-standard patterns.
Composables vs. Provide/Inject vs. Pinia — When to Use What - Vue School Articles
This Vue School guide by Daniel Kelly maps out exactly when to reach for each of Vue's three state-sharing mechanisms. Composables (functions using ref, computed, watch) give each caller its own isolated state — ideal for reusable logic like mouse tracking or form validation; shared state is possible by lifting refs to module scope but loses devtools support and risks SSR state bleed. Provide/inject targets prop-drilling avoidance within a component subtree and shines in tightly coupled component pairs like Tabs/Tab or Form/FormField; using typed InjectionKey<T> symbols eliminates the fragile string-key problem. Pinia is the right choice for global application state (auth, cart, feature flags) that needs devtools time-travel, SSR safety, and built-in getters and actions. The article closes with a decision flowchart and warns against three common mistakes: over-relying on Pinia for local state, using provide/inject as a global store, and using module-level shared composables for complex state in SSR environments.
The week's most urgent story is CVE-2026-27148, a CVSS 8.9 XSS/RCE vulnerability in Storybook versions 8.1.0 through 10.2.9 that exploits an unauthenticated WebSocket endpoint introduced with the browser-based story editor. Because attacker payloads are written to disk and can be committed to version control, the path to full remote code execution is straightforward in any Vitest/JSDOM setup. Patch immediately to 7.6.23, 8.6.17, 9.1.19, or 10.2.10.
Beyond the security headline, the VoidZero ecosystem shipped notable progress: Oxfmt reached beta after passing 100% of Prettier's JavaScript and TypeScript conformance tests at up to 36x faster speeds, Vite 8 beta landed experimental devtools for module graph inspection, and Node.js 22.22.1 LTS arrived with over 300 commits including OpenSSL 3.5.5 and Buffer.concat acceleration. TanStack Intent also launched, letting npm library authors ship versioned Agent Skills alongside their packages so AI coding agents always consume current API documentation.
On the framework side, React Compiler v1.0 eliminates manual useMemo and useCallback boilerplate at build time, while a practical Vue guide demystifies when to reach for composables versus Pinia versus provide/inject. A TypeScript video rounds out the week with a clear-headed take on when explicit return types actually earn their keep.
Key Takeaways
Patch Storybook immediately to 7.6.23 / 8.6.17 / 9.1.19 / 10.2.10 — CVE-2026-27148 enables RCE via an unauthenticated WebSocket endpoint in any exposed or Vitest-backed dev server.
Oxfmt beta and Vite 8 devtools signal that the VoidZero toolchain is maturing fast; both are worth evaluating for build pipeline upgrades.
React Compiler v1.0 is production-ready for conforming codebases, but manual memoization is still required for virtualized lists, imperative refs, and third-party libraries with non-standard patterns.
