JavaScript Week 40: security patches, SvelteKit 3 and Vinext
Week 40 covers Next.js and TanStack Start security fixes, SvelteKit 3 migration, Vinext compatibility, ESLint types, and maintainable agent guidance. Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 40-2026bolt3 CRITICAL
article
TAG: FRAMEWORK UPDATEREAD_TIME: 3_MIN
September 2026 Security Release
Next.js released 16.3.8 for Active LTS and 15.5.27 for Maintenance LTS, addressing request forgery, cache poisoning, and information disclosure. CVE-2026-94483 affects image optimization when an attacker controls an allow-listed remote URL; applications without images.remotePatterns are unaffected by that issue. Other fixes cover self-hosted Pages Router caches, root catch-all routes, and webpack metadata-image routes that bypass dynamicParams, while the latter issue does not affect Turbopack. Cache Components also have separate root-parameter and Draft Mode leaks, including unpublished content reaching ordinary responses during an overlapping cache fill. Upgrade the relevant release line and check the advisory against your router, build tool, caching configuration, and development-server exposure rather than assuming every deployment has the same risk.
SvelteKit 3.0 moves framework configuration into vite.config.ts and replaces the $lib alias with #lib, using standard subpath imports. The migration command npx sv migrate sveltekit-3 --tasks all --confirm automates supported changes and leaves a TODO list for work it cannot finish. The release also revises environment variables, reduces service-worker boilerplate, and improves error handling while retaining the familiar framework model. Remote functions are still unfinished and require Async Svelte, which itself remains behind an experimental flag. Treat the major release as a migration with explicit follow-up checks, and keep adoption of experimentalclient-server features separate from the configuration and import changes.
TanStack disclosed a critical reflected XSS vulnerability in Start server-function responses, tracked as CVE-2026-102989. An unauthenticated attacker can craft a URL that causes attacker-controlled HTML to execute in the application's origin when a victim opens it. The advisory covers affected releases from 1.143.12 and fixes them in @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56. Update dependencies and the lockfile, then verify the resolved @tanstack/start-server-core is 1.169.39 or newer. Rebuild and redeploy the application: installing a patched package locally or relying on an edge mitigation does not replace updating the running server.
Intent 0.5 gives library maintainers a workflow for keeping packaged SKILL.md guidance aligned with the code it describes. Its validate command uses the TypeScript compiler to check fenced examples for missing exports, invalid options, syntax errors, and type mismatches without executing them. Skipped checks are reported explicitly when TypeScript or usable entry-point types are unavailable, so a green-looking run must not be mistaken for complete verification. Maintainer review maps source changes to guidance and records updated or unchanged decisions against source hashes. Combine these checks with CI and human review of proposed repairs: shipping instructions beside a library version improves traceability but does not by itself make those instructions correct.
Friendship ended with Deno, now Node is my best friend
David Bushell describes moving his static-site generator from Deno to Node 26.10.0, replacing filesystem and path APIs and using Hono's Node server adapter. He reports 15% faster builds in that project, but supplies no controlled cross-runtime benchmark, so the result is a migration anecdote rather than a general ranking. Node's type stripping does not cover TypeScript inside node_modules, which led him to bundle packaged code with tsdown. He also discusses package-release delays and dependency trust settings, including the resolution difficulties of a much longer waiting period. The useful decision is to audit your actual APIs, distribution format, and dependency policy before switching runtimes, then measure the same workload yourself.
ESLint 10.12.0 corrects the public types and documentation for SourceCode methods including getText, getLoc, and getRange. These methods already accepted nodes, tokens, and comments at runtime; the release makes their declared contracts reflect that behavior. TypeScript implementations and mocks may need broader signatures, even when ordinary callers continue to work unchanged. The update also aligns the language-plugin base interface and fixes edge cases in rules such as consistent-return, no-eval, and prefer-exponentiation-operator. Plugin maintainers should distinguish a corrected type contract from a new runtime capability, check custom implementations, and review changed diagnostics or autofixes against their own fixtures before upgrading shared lint configurations.
James Q Quick explains Vinext 1.0 as a Vite plugin that reimplements Next.js APIs, whereas OpenNext adapts Next.js build output for another runtime. The walkthrough covers App Router, Pages Router, server actions, route handlers, and incremental static regeneration. Cache Components and use cache are unsupported, and the cited compatibility percentage describes the tested feature set rather than every possible application. A cache-warming deployment flow prepares pages before production traffic switches, but the presenter does not establish its overall timing tradeoff. Because Quick discloses that he works at Cloudflare, treat this as a vendor-affiliated introduction and use your application's API inventory and deployment tests to assess portability.
Next.js released 16.3.8 for Active LTS and 15.5.27 for Maintenance LTS, addressing request forgery, cache poisoning, and information disclosure. CVE-2026-94483 affects image optimization when an attacker controls an allow-listed remote URL; applications without images.remotePatterns are unaffected by that issue. Other fixes cover self-hosted Pages Router caches, root catch-all routes, and webpack metadata-image routes that bypass dynamicParams, while the latter issue does not affect Turbopack. Cache Components also have separate root-parameter and Draft Mode leaks, including unpublished content reaching ordinary responses during an overlapping cache fill. Upgrade the relevant release line and check the advisory against your router, build tool, caching configuration, and development-server exposure rather than assuming every deployment has the same risk.
James Q Quick explains Vinext 1.0 as a Vite plugin that reimplements Next.js APIs, whereas OpenNext adapts Next.js build output for another runtime. The walkthrough covers App Router, Pages Router, server actions, route handlers, and incremental static regeneration. Cache Components and use cache are unsupported, and the cited compatibility percentage describes the tested feature set rather than every possible application. A cache-warming deployment flow prepares pages before production traffic switches, but the presenter does not establish its overall timing tradeoff. Because Quick discloses that he works at Cloudflare, treat this as a vendor-affiliated introduction and use your application's API inventory and deployment tests to assess portability.
SvelteKit 3.0 moves framework configuration into vite.config.ts and replaces the $lib alias with #lib, using standard subpath imports. The migration command npx sv migrate sveltekit-3 --tasks all --confirm automates supported changes and leaves a TODO list for work it cannot finish. The release also revises environment variables, reduces service-worker boilerplate, and improves error handling while retaining the familiar framework model. Remote functions are still unfinished and require Async Svelte, which itself remains behind an experimental flag. Treat the major release as a migration with explicit follow-up checks, and keep adoption of experimentalclient-server features separate from the configuration and import changes.
TanStack disclosed a critical reflected XSS vulnerability in Start server-function responses, tracked as CVE-2026-102989. An unauthenticated attacker can craft a URL that causes attacker-controlled HTML to execute in the application's origin when a victim opens it. The advisory covers affected releases from 1.143.12 and fixes them in @tanstack/react-start 1.168.60, @tanstack/solid-start 1.168.57, and @tanstack/vue-start 1.168.56. Update dependencies and the lockfile, then verify the resolved @tanstack/start-server-core is 1.169.39 or newer. Rebuild and redeploy the application: installing a patched package locally or relying on an edge mitigation does not replace updating the running server.
Intent 0.5 gives library maintainers a workflow for keeping packaged SKILL.md guidance aligned with the code it describes. Its validate command uses the TypeScript compiler to check fenced examples for missing exports, invalid options, syntax errors, and type mismatches without executing them. Skipped checks are reported explicitly when TypeScript or usable entry-point types are unavailable, so a green-looking run must not be mistaken for complete verification. Maintainer review maps source changes to guidance and records updated or unchanged decisions against source hashes. Combine these checks with CI and human review of proposed repairs: shipping instructions beside a library version improves traceability but does not by itself make those instructions correct.
Friendship ended with Deno, now Node is my best friend
David Bushell describes moving his static-site generator from Deno to Node 26.10.0, replacing filesystem and path APIs and using Hono's Node server adapter. He reports 15% faster builds in that project, but supplies no controlled cross-runtime benchmark, so the result is a migration anecdote rather than a general ranking. Node's type stripping does not cover TypeScript inside node_modules, which led him to bundle packaged code with tsdown. He also discusses package-release delays and dependency trust settings, including the resolution difficulties of a much longer waiting period. The useful decision is to audit your actual APIs, distribution format, and dependency policy before switching runtimes, then measure the same workload yourself.
ESLint 10.12.0 corrects the public types and documentation for SourceCode methods including getText, getLoc, and getRange. These methods already accepted nodes, tokens, and comments at runtime; the release makes their declared contracts reflect that behavior. TypeScript implementations and mocks may need broader signatures, even when ordinary callers continue to work unchanged. The update also aligns the language-plugin base interface and fixes edge cases in rules such as consistent-return, no-eval, and prefer-exponentiation-operator. Plugin maintainers should distinguish a corrected type contract from a new runtime capability, check custom implementations, and review changed diagnostics or autofixes against their own fixtures before upgrading shared lint configurations.
Framework maintenance starts with two different security actions this week. Next.js patches vary by image configuration, router, bundler, and cache behavior, while TanStack Start's reflected XSS fix requires checking the resolved server package and redeploying. Patch the affected runtime before treating a dependency update as complete.
Migration boundaries matter just as much as release labels. SvelteKit 3 automates configuration and import changes but leaves follow-up work, and its remote-function story still depends on experimentalAsync Svelte. Vinext offers another route to Next.js API compatibility, with unsupported caching features and a vendor-affiliated demonstration that calls for application-specific tests.
Tooling contracts connect the remaining stories. ESLint corrects types that custom implementations must honor, Intent checks whether packaged guidance still matches source code, and a Deno-to-Nodemigration exposes distribution-format and dependency-policy costs. Treat reported speedups and automated checks as scoped evidence, then verify the assumptions your own application relies on.
Key Takeaways
Verify patched versions in the running application, including TanStack Start's resolved server dependency and redeployment.
Separate stable migration work from experimental features and untested compatibility claims.
Check typed interfaces, packaged examples, and runtime distribution constraints against the actual project.
