(BUSAN.SASHIMI)
terminal
Weekly Digest // JS_FRAMEWORKS — Week 27-2026
codeWeekly Report

JavaScript — 2026 Week 27

JS frameworks, React/Vue/Svelte, and runtime updates

calendar_todaysummarizeWeek 27-2026
TOOLCHAIN

Announcing Vite+ Beta

VoidZero has released the beta of Vite+, a unified open-source toolchain under the MIT license that bundles Vite, Vitest, Rolldown, tsdown, Oxlint, and Oxfmt behind a single vp CLI. Developers get six consistent commands — vp dev, vp check, vp test, vp build, vp pack, and vp run — replacing the per-project tool assembly that has long fragmented web workflows. Since the alpha, the team has merged over 500 pull requests, delivering smarter build caching via automatic data tracking, an improved vp migrate that now generates agent-friendly migration prompts, enterprise organization templates, and cross-platform hardening. Underlying tools have also progressed: Vite 8.1 shipped experimental full-bundle mode, Rolldown 1.0 introduced a new plugin system, and Oxlint gained native React Compiler lint rules. Over 1,300 public repositories already depend on vite-plus, with notable adopters including Dify, BlockNote, and Inkline. The 1.0 roadmap includes remote caching for Vite Task, GitLab CI/CD support via setup-vp, and broader framework compatibility.

Announcing Vite+ Beta
Read Articlearrow_forward
Article · SECURITYREAD TIME: 2m

June 2026 Security Releases: Express.js

The Express team has released multer 2.2.0 and morgan 1.11.0 to address three CVEs affecting multipart parsing and access logging. CVE-2026-5079 (High) in multer affects versions 1.0.0 through 2.1.x: the append-field dependency parses bracket-notation field names like a[b][c] without limiting nesting depth, allowing an attacker to cause denial of service through excessive memory and CPU consumption via deeply nested multipart fields. CVE-2026-5038 (Medium) in multer's diskStorage engine allows aborted or malformed uploads to leave orphaned partial files on disk, eventually exhausting disk space. CVE-2026-5078 (Medium) in morgan 1.2.0 through 1.10.1 permits log forging: the :remote-user token writes the Basic auth username to the log stream without sanitizing CR/LF characters, enabling attackers to inject forged log lines. All users of the affected multer and morgan versions should upgrade immediately.

READ_FULL_LOGarrow_forward
Article · GITREAD TIME: 14m

Highlights from Git 2.55

Git 2.55, contributed by over 100 developers, ships several notable features. The headline addition is incremental multi-pack index (MIDX) support in git repack: combining --write-midx=incremental with --geometric=2 keeps layer counts logarithmic in total object count while minimizing rewrites, controlled by repack.midxSplitFactor and repack.midxNewLayerThreshold. The experimental git history fixup subcommand folds staged changes directly into an earlier commit and replays descendants, making the fixup-then-autosquash workflow more intent-driven. Config-based hooks from 2.54 now support parallel execution (hook.jobs), benefiting projects with independent pre-commit tasks like linting and tests. The built-in fsmonitor daemon gains Linux support via inotify. Bitmap generation time on large repositories dropped from ~612 seconds to ~294 seconds through tree-recursion avoidance and bitmap sorting. git log gains --graph-lane-limit for wide-graph readability and --max-count-oldest for selecting the oldest n commits. Sideband control character masking prevents terminal-escape injection from malicious remotes.

READ_FULL_LOGarrow_forward
Article · REACTREAD TIME: 9m

I Let React Compiler Handle Memoization: Here's What Actually Broke

Isaac Okoro documents enabling React Compiler v1.0 on a production Next.js codebase and catalogues what broke. The most serious failure was a live-preview freeze in a form that used React Hook Form's watch() function: the compiler's memoization of internal references made watch() stop triggering re-renders, a known incompatibility the linter surfaces as react-hooks/incompatible-library. The fix was wrapping useForm in a compatibility shim with a use no memo directive. A second issue involved a Chart.js click handler where removing useCallback exposed a stale-closure timing bug that useCallback had been inadvertently masking. Okoro also clarifies the DevTools Memo badge: it means the compiler processed the component, not that optimization succeeded — components that violated rules like direct prop mutation (orders.sort() in render) still showed the badge. The recommended migration order is: upgrade eslint-plugin-react-hooks to v7+, enable react-hooks/unsupported-syntax and incompatible-library as errors, fix violations, then enable the compiler. Libraries like TanStack Table, TanStack Virtual, and MobX currently require use no memo wrappers.

READ_FULL_LOGarrow_forward
Article · FRAMEWORKREAD TIME: 6m

Turbopack: What's New in Next.js 16.3

Next.js 16.3 delivers significant Turbopack compiler performance improvements, most notably a reduction in dev server memory usage of up to 90% achieved by evicting cached results from RAM to the persistent filesystem cache introduced in 16.1. Build-time persistent disk caching is now enabled by default and shows 2.3x to 5.5x faster cold-to-cached build times in benchmarks; CI pipelines can exploit this by reusing the .next directory between runs. An experimental Rust port of the React Compiler (turbopackRustReactCompiler) showed 20-50% compilation gains on large apps like v0, complementing the stable Babel-based React Compiler support that shipped in Next.js 16.0. Turbopack also gains the Vite-compatible import.meta.glob API for dynamic module loading with full file-watcher integration, and a 15%-plus reduction in dev server cold-start time from streamlined HMR chunk tracking. Additional improvements include per-package PostCSS config resolution for monorepos and a smaller runtime bundle that omits WebAssembly and worker bootstrap code when unused.

READ_FULL_LOGarrow_forward
Article · REACTREAD TIME: 16m

How to Fix RSC Hydration Mismatches in Next.js

Nelson Michael provides a production-focused guide to diagnosing and preventing React Server Component hydration mismatches in Next.js App Router applications. The six most common root causes are: browser-only API access (window, document, localStorage) during server render, timezone or locale differences causing divergent date output from Date and Intl, auth state gaps where cookies() opts routes into dynamic rendering (Next.js 16 fully removes synchronous cookie/header access), browser-repaired invalid HTML from CMS content, DOM mutations by browser extensions or CDN transforms, and CSS-in-JS class name ordering differences under streaming. The guide recommends setting up production telemetry using instrumentation-client.ts to capture error codes #418 and #425 with navigator.sendBeacon, always testing with next build and next start rather than next dev, and using Suspense boundary wrapping as a binary-search technique to isolate the failing subtree. Key prevention patterns include rendering server-safe baselines and deferring browser-dependent state to useEffect, and running Playwright hydration smoke tests against production builds in CI.

READ_FULL_LOGarrow_forward
Article · SVELTEREAD TIME: 5m

What's New in Svelte: July 2026

July 2026 brought a configuration consolidation to SvelteKit: starting with version 2.62.0, the SvelteKit config can live directly inside vite.config.js, making svelte.config.js optional and previewing the architecture planned for Kit 3. Version 2.63.0 introduced experimental explicit environment variables that will eventually replace the $env/* module system. Remote function commands can now receive File objects directly without manual FormData wrapping (2.64.0), and remote queries can refresh related queries after a mutation (2.65.0). On the CLI and language-tools side, sv 0.16.0 adds support for the new Svelte 5 const declaration tag across the demo template, scaffolding, and add-ons, while svelte-check 4.7.0 introduces an experimental tsgo (TypeScript Go) backend for faster type checking on large codebases. The Svelte language server can now read config from vite.config.js/ts directly, keeping tooling in sync with the new SvelteKit configuration model.

READ_FULL_LOGarrow_forward
summarizeDigest_Summary

The JavaScript toolchain landscape saw two major consolidations this week. VoidZero released the beta of Vite+, a unified MIT-licensed toolchain that wraps Vite, Vitest, Rolldown, tsdown, Oxlint, and Oxfmt behind a single vp CLI with six consistent commands. Since alpha, over 500 pull requests landed, bringing smarter build caching, an improved vp migrate, and Rolldown 1.0's new plugin system. Meanwhile, Next.js 16.3 shipped Turbopack improvements that cut dev server memory usage by up to 90% via filesystem caching, enabled persistent disk cache by default (2.3x–5.5x faster cold builds), and added an experimental Rust React Compiler showing 20–50% gains on large apps like v0.

On the React side, a production post-mortem on React Compiler v1.0 revealed real-world incompatibilities: React Hook Form's watch() stopped triggering re-renders due to memoization of internal references, surfaced by the react-hooks/incompatible-library rule. Libraries like TanStack Table and MobX require use no memo wrappers. A complementary guide tackled RSC hydration mismatches in Next.js App Router, cataloguing six root causes including browser-only API access, timezone divergence, and CSS-in-JS ordering under streaming. Security also demanded attention: Express released multer 2.2.0 and morgan 1.11.0 to patch three CVEs — a denial-of-service via deeply nested multipart fields (CVE-2026-5079), orphaned disk files from aborted uploads (CVE-2026-5038), and log forging via unsanitized CR/LF in the :remote-user token (CVE-2026-5078).

Git 2.55 rounded out the week with incremental multi-pack index support in git repack, an experimental git history fixup subcommand, parallel config-based hook execution via hook.jobs, Linux fsmonitor support via inotify, and bitmap generation time cut from ~612 to ~294 seconds on large repositories.

Key Takeaways
  • Vite+ beta unifies six tools (Vite, Vitest, Rolldown, tsdown, Oxlint, Oxfmt) under a single vp CLI — over 1,300 repos already depend on it.
  • React Compiler v1.0 has real library incompatibilities: React Hook Form, TanStack Table, and MobX need use no memo wrappers; upgrade eslint-plugin-react-hooks to v7+ before enabling.
  • Express users must upgrade to multer 2.2.0 and morgan 1.11.0 immediately to patch CVE-2026-5079 (DoS via nested fields), CVE-2026-5038 (disk exhaustion), and CVE-2026-5078 (log forging).