JS frameworks, React/Vue/Svelte, and runtime updates Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 22-2026bolt1 CRITICAL
article
May 2026 Security Releases: Express.js multiparty 4.3.0
TAG: SECURITY
The Express team released multiparty 4.3.0 to patch three high-severity denial-of-service vulnerabilities affecting all versions up to 4.2.3. CVE-2026-8159 allows a crafted multipart upload with an approximately 8 KB header to trigger catastrophic regex backtracking in the Content-Disposition filename parser, blocking the Node.js event loop. CVE-2026-8161 exploits prototype pollution: a field name matching an Object.prototype property such as __proto__ or constructor causes an uncaught TypeError that crashes the process. CVE-2026-8162 crashes the process by passing a malformed percent-encoded filename* parameter to decodeURI without a try/catch. Any service accepting multipart uploads via multiparty is affected and should upgrade to 4.3.0 immediately.
Astro 6.4: Pluggable Markdown Pipeline and Rust-Based Processor
TAG: FRAMEWORK
Astro 6.4 ships three headline features. A new markdown.processor API lets you replace the default unified (remark/rehype) pipeline entirely, while keeping existing plugins working unchanged. The existing top-level markdown.remarkPlugins and markdown.rehypePlugins options are deprecated in favour of configuring them directly on the processor, with removal planned for Astro 8.0. A new @astrojs/markdown-satteri package introduces Sätteri, a Markdown and MDX pipeline written in Rust that is significantly faster than unified; switching the Astro and Cloudflare documentation sites to Sätteri shaved over a minute off each build. Finally, the @astrojs/cloudflare adapter gains a cf() helper that wires up SESSION KV bindings, the ASSETS binding, locals.cfContext, client address, waitUntil, and prerendered error pages for projects using experimental advanced routing.
Ember 7.0 Released: Deprecation Cleanup and Embroider+Vite Default
TAG: FRAMEWORK
Ember 7.0 is a cleanup major release that removes APIs deprecated during the 6.x cycle with no new public API additions. Key removals include import Ember from 'ember', AMD bundle publication from ember-source, and the old inject import from @ember/service (replaced by service). The 6.x series that preceded 7.0 delivered substantial modernisation: Embroider and Vite became the default build system in 6.8, strict-mode template-tag component authoring became the default, and tracked native collection types (trackedArray, trackedMap, trackedSet, and others) were added. Upgrading from 6.12 with zero deprecation warnings should allow a seamless move to 7.0, and the previous 6.12 release is now designated an LTS version. Codemods for template-tag and Vite migration are available.
Protecting Next.js Applications in the Era of Server Actions
TAG: SECURITY
Server Actions in Next.js App Router are remotely callable endpoints, not private helpers, so they must be hardened like any production API. The article covers five layered defenses: runtime input validation with Zod (TypeScript types vanish after compilation), explicit session authentication and resource-level authorization to prevent ID enumeration attacks, DTO boundaries and the server-only package to prevent sensitive data leaking from Server Components to the client, React 19's experimental taintUniqueValue and taintObjectReference APIs for runtime enforcement, and secure cookie flags (httpOnly, secure, sameSite: strict) combined with Content Security Policy nonces and rate limiting via sliding-window middleware. The next-safe-action library is introduced as a way to standardise authentication, validation, and typed responses across all actions. Centralised RBAC and per-action rate limits for high-risk operations (password reset, billing, delete) complete the layered model.
TanStack Router and Query: Combining Route Loaders with a Global Cache
TAG: DATA FETCHING
TanStack Router ships its own stale-while-revalidate route cache, but that cache is per-route and inaccessible across routes. TanStack Query's QueryCache is global and keyed by queryKey, making it the better fit for shared data like user profiles. The recommended pattern is to fire ensureQueryData inside route loaders so fetches start as early as possible — even before the component bundle downloads — while the component reads data with useSuspenseQuery or useQuery. Router caching should be disabled (defaultPreloadStaleTime set to 0) when Query handles caching to avoid two players controlling stale logic. For TanStack Start, setupRouterSsrQueryIntegration automatically dehydrates server-fetched data and streams it to the client cache, enabling full SSR on first load and SPA-style client navigations thereafter. Using useLoaderData alongside Query is discouraged because it bypasses Query observers, preventing automatic refetches and garbage collection.
Stop Writing Rules in AGENTS.md: Use Agent Hooks and nano-staged Instead
TAG: AI TOOLING
Evil Martians argues that encoding code-quality rules in AGENTS.md is unreliable because LLMs frequently forget them, whereas automation scripts are deterministic and cheaper in tokens. The recommended setup takes five minutes: install nano-staged (zero dependencies versus 24 for lint-staged), wire a .nano-staged.json config to run oxfmt and oxlint on changed files, then register a Claude Code Stop hook in .claude/settings.json that runs nano-staged --unstaged --quiet --bail and exits with code 2 to block the agent until linting passes. oxlint and oxfmt run 5 to 10 times faster than ESLint and Prettier, and oxlint supports existing ESLint custom JS plugins. A guard script using jq to check the stop_hook_active flag prevents the agent from entering an infinite loop when it cannot fix a lint error autonomously. The broader principle: every rule encoded as a tool is a rule the LLM cannot forget.
It's Time to Talk About Signals — Julian Burr at NDC Sydney 2026
Julian Burr traces the history of web rendering from server-side pull (PHP templates, full-page re-renders) through jQuery's push-to-DOM approach and frameworks like Knockout, Vue, Svelte, and Solid to explain why fine-grained reactive variables — signals — emerged. Signals let the runtime track dependencies automatically: a computed value re-runs only when its upstream signals change, and effects fire when signals they read are dirtied. Burr live-codes a minimal signal, computed, and effect implementation in about 30 lines of JavaScript to demystify the subscription model. He contrasts this with React's pull-based virtual-DOM and memoisation approach (use memo, use callback, the new compiler), noting the React team has experimented with signals but is doubling down on making re-renders cheaper instead. The talk closes with the TC39 Signals proposal (currently Stage 1), which aims to standardise the primitive across frameworks so browsers can optimise it natively.
May 2026 Security Releases: Express.js multiparty 4.3.0
The Express team released multiparty 4.3.0 to patch three high-severity denial-of-service vulnerabilities affecting all versions up to 4.2.3. CVE-2026-8159 allows a crafted multipart upload with an approximately 8 KB header to trigger catastrophic regex backtracking in the Content-Disposition filename parser, blocking the Node.js event loop. CVE-2026-8161 exploits prototype pollution: a field name matching an Object.prototype property such as __proto__ or constructor causes an uncaught TypeError that crashes the process. CVE-2026-8162 crashes the process by passing a malformed percent-encoded filename* parameter to decodeURI without a try/catch. Any service accepting multipart uploads via multiparty is affected and should upgrade to 4.3.0 immediately.
It's Time to Talk About Signals — Julian Burr at NDC Sydney 2026
Julian Burr traces the history of web rendering from server-side pull (PHP templates, full-page re-renders) through jQuery's push-to-DOM approach and frameworks like Knockout, Vue, Svelte, and Solid to explain why fine-grained reactive variables — signals — emerged. Signals let the runtime track dependencies automatically: a computed value re-runs only when its upstream signals change, and effects fire when signals they read are dirtied. Burr live-codes a minimal signal, computed, and effect implementation in about 30 lines of JavaScript to demystify the subscription model. He contrasts this with React's pull-based virtual-DOM and memoisation approach (use memo, use callback, the new compiler), noting the React team has experimented with signals but is doubling down on making re-renders cheaper instead. The talk closes with the TC39 Signals proposal (currently Stage 1), which aims to standardise the primitive across frameworks so browsers can optimise it natively.
Astro 6.4: Pluggable Markdown Pipeline and Rust-Based Processor
Astro 6.4 ships three headline features. A new markdown.processor API lets you replace the default unified (remark/rehype) pipeline entirely, while keeping existing plugins working unchanged. The existing top-level markdown.remarkPlugins and markdown.rehypePlugins options are deprecated in favour of configuring them directly on the processor, with removal planned for Astro 8.0. A new @astrojs/markdown-satteri package introduces Sätteri, a Markdown and MDX pipeline written in Rust that is significantly faster than unified; switching the Astro and Cloudflare documentation sites to Sätteri shaved over a minute off each build. Finally, the @astrojs/cloudflare adapter gains a cf() helper that wires up SESSION KV bindings, the ASSETS binding, locals.cfContext, client address, waitUntil, and prerendered error pages for projects using experimental advanced routing.
Ember 7.0 Released: Deprecation Cleanup and Embroider+Vite Default
Ember 7.0 is a cleanup major release that removes APIs deprecated during the 6.x cycle with no new public API additions. Key removals include import Ember from 'ember', AMD bundle publication from ember-source, and the old inject import from @ember/service (replaced by service). The 6.x series that preceded 7.0 delivered substantial modernisation: Embroider and Vite became the default build system in 6.8, strict-mode template-tag component authoring became the default, and tracked native collection types (trackedArray, trackedMap, trackedSet, and others) were added. Upgrading from 6.12 with zero deprecation warnings should allow a seamless move to 7.0, and the previous 6.12 release is now designated an LTS version. Codemods for template-tag and Vite migration are available.
Protecting Next.js Applications in the Era of Server Actions
Server Actions in Next.js App Router are remotely callable endpoints, not private helpers, so they must be hardened like any production API. The article covers five layered defenses: runtime input validation with Zod (TypeScript types vanish after compilation), explicit session authentication and resource-level authorization to prevent ID enumeration attacks, DTO boundaries and the server-only package to prevent sensitive data leaking from Server Components to the client, React 19's experimental taintUniqueValue and taintObjectReference APIs for runtime enforcement, and secure cookie flags (httpOnly, secure, sameSite: strict) combined with Content Security Policy nonces and rate limiting via sliding-window middleware. The next-safe-action library is introduced as a way to standardise authentication, validation, and typed responses across all actions. Centralised RBAC and per-action rate limits for high-risk operations (password reset, billing, delete) complete the layered model.
TanStack Router and Query: Combining Route Loaders with a Global Cache
TanStack Router ships its own stale-while-revalidate route cache, but that cache is per-route and inaccessible across routes. TanStack Query's QueryCache is global and keyed by queryKey, making it the better fit for shared data like user profiles. The recommended pattern is to fire ensureQueryData inside route loaders so fetches start as early as possible — even before the component bundle downloads — while the component reads data with useSuspenseQuery or useQuery. Router caching should be disabled (defaultPreloadStaleTime set to 0) when Query handles caching to avoid two players controlling stale logic. For TanStack Start, setupRouterSsrQueryIntegration automatically dehydrates server-fetched data and streams it to the client cache, enabling full SSR on first load and SPA-style client navigations thereafter. Using useLoaderData alongside Query is discouraged because it bypasses Query observers, preventing automatic refetches and garbage collection.
Stop Writing Rules in AGENTS.md: Use Agent Hooks and nano-staged Instead
Evil Martians argues that encoding code-quality rules in AGENTS.md is unreliable because LLMs frequently forget them, whereas automation scripts are deterministic and cheaper in tokens. The recommended setup takes five minutes: install nano-staged (zero dependencies versus 24 for lint-staged), wire a .nano-staged.json config to run oxfmt and oxlint on changed files, then register a Claude Code Stop hook in .claude/settings.json that runs nano-staged --unstaged --quiet --bail and exits with code 2 to block the agent until linting passes. oxlint and oxfmt run 5 to 10 times faster than ESLint and Prettier, and oxlint supports existing ESLint custom JS plugins. A guard script using jq to check the stop_hook_active flag prevents the agent from entering an infinite loop when it cannot fix a lint error autonomously. The broader principle: every rule encoded as a tool is a rule the LLM cannot forget.
Security dominated the JavaScript category this week with two critical advisories. The Express team released multiparty 4.3.0 to patch three high-severity denial-of-service CVEs (CVE-2026-8159, CVE-2026-8161, CVE-2026-8162) affecting all versions up to 4.2.3 — covering catastrophic regex backtracking, prototype pollution via __proto__ field names, and an unguarded decodeURI crash. Any service accepting multipart uploads must upgrade immediately. Separately, a deep-dive on Next.js Server Actions reminded developers that these endpoints are publicly callable — requiring Zod validation, session auth, server-only boundaries, React 19 taint APIs, and rate limiting via next-safe-action to prevent ID enumeration, data leakage, and abuse.
On the framework side, Astro 6.4 shipped a pluggable markdown.processor API, deprecated the top-level remarkPlugins and rehypePlugins options, and introduced the Rust-based Sätteri pipeline via @astrojs/markdown-satteri, which cut over a minute off Astro and Cloudflare docs build times. The @astrojs/cloudflare adapter also gained a cf() helper for SESSION KV and ASSETS bindings. Ember 7.0 arrived as a clean deprecation-removal release, with Embroider and Vite now the default build system following the 6.8 modernisation cycle and 6.12 designated as LTS.
Two architectural pieces rounded out the week. TanStack Router and Query author Dominik Dorfmeister laid out the canonical integration pattern — fire ensureQueryData in route loaders, read with useSuspenseQuery, and set defaultPreloadStaleTime to 0 to avoid dual cache ownership. Evil Martians argued for replacing AGENTS.md rules with nano-staged Claude Code Stop hooks running oxlint and oxfmt, which are 5 to 10 times faster than ESLint and Prettier. Julian Burr's NDC Sydney talk explained fine-grained signals from first principles and previewed the TC39 Signals proposal currently at Stage 1.
Key Takeaways
Upgrade multiparty to 4.3.0 immediately — CVE-2026-8159, CVE-2026-8161, and CVE-2026-8162 allow unauthenticated denial-of-service on any Node.js service that accepts multipart uploads.
Next.js Server Actions are public endpoints: layer Zod validation, session auth, server-only imports, and next-safe-action rate limiting to close the most common attack vectors.
Astro 6.4's Rust-based Sätteri Markdown pipeline cut build times by over a minute on real documentation sites — the unified pipeline and its top-level plugin options are deprecated ahead of Astro 8.0.
