Week 30 is defined by a single seismic tooling event: TypeScript 7, Anders Hejlsberg's complete rewrite of the compiler and language service in Go, ships as the biggest TypeScript release in a decade. The 10× average build speedup — half from native execution, half from shared-memory concurrency that saturates all available cores — collapses a 50-second VS Code compile to 4.5 seconds and makes the language server restart in under two seconds. The lone caveat is that projects using compiler APIs (Vue, Astro, Svelte, Volar) must stay on TypeScript 6 until a native API lands in 7.1.
The bundler side of the JS ecosystem is equally busy. Webpack 5.109, one of the project's largest minor releases, flips its built-in CSS, HTML, TypeScript, and WebAssembly support to an "auto" default that enables zero-config imports without breaking existing loader setups. Vite-compatible APIs — import.meta.glob, import.meta.env, import.meta.resolve, and ?raw/?url/?inline suffixes — land natively, and CommonJS module concatenation (scope hoisting) extends past ESM to statically-analyzable CJS modules for the first time.
The RSC debate runs through the issue from two angles. Tanner Linsley documents TanStack.com's exit from React Server Components: after @tanstack/markdown and @tanstack/highlight shrank the old 358 KiB Shiki stack to ~27 KiB transferred, the recurring Flight payload cost per navigation outweighed the one-time client renderer, and the RSC boundary machinery — special files, serialization, bundler config — stopped earning its keep. Aurora Scharff offers the counterpoint with three non-obvious patterns from her Next.js 16.3 app Drop: URL-driven pagination that lets the server stream each page into its own Suspense boundary, a static-shell search field that seeds its value before hydration via an inline script, and a Server Function returning JSX to render a Shiki-highlighted draft preview without shipping the highlighter to the browser. Together, the two RSC pieces illustrate that the technology's value is proportional to the weight of the server-only dependency it keeps out of the bundle — a useful litmus test before reaching for the architecture.
Security requires immediate attention: the Next.js July 2026 Security Release patches eight vulnerabilities across App Router in v15.5.21 and v16.2.11. Four are High severity — a Server Action DoS via CPU exhaustion, a Turbopack i18n middleware/proxy bypass enabling auth bypass, and two SSRF vectors (attacker-controlled rewrite hostnames and Server Actions on custom servers). The four Medium issues include SVG-triggered image optimization DoS, unbounded Edge runtime payloads, unauthenticated endpoint ID disclosure, and cache-confusion bugs in server-side fetch with bodies. All teams running affected versions should patch before the week ends. Finally, Angular 22 closes its two-year signals arc: resource(), rxResource(), httpResource(), and the new debounced() utility graduate to stable, letting teams stay entirely within the signal graph from state through HTTP fetching without mixing RxJS paradigms.