Frontend Frameworks

The frameworks behind modern web UIs — full-stack React to fine-grained reactivity.

This week's digestOct 12 – 18, 2026

Next.js races to patch critical RCEs as Expo SDK 58 arrives

Next.js shipped emergency patches for two critical unauthenticated remote code execution flaws, while Expo released SDK 58 with day-one iOS 27 support, App Intents, and React Native 0.88.

Read the digest16 releases covered

In this issue

01Security first: Next.js RCE patches

Next.js4 releases 02Expo SDK 58 lands with iOS 27 and Apple Intelligence

Expo2 releases 03EAS CLI: simulator control for agents

Expo5 releases 04SvelteKit hardens CSP, Nuxt cleans up routing

SvelteKit

Nuxt5 releases

EarlierOct 5Next.js 16.4 lands as Turbopack, GC, and crash reporting harden the stack Sep 28Next.js patches critical SSRF and cache flaws as SvelteKit 3 lands All digests →

Week of Oct 1215 releases

DigestNext.js races to patch critical RCEs as Expo SDK 58 arrivesRead →

SatOct 17, 20261 release

Daily summary

EAS CLI adds remote iOS simulator control; Next.js tunes Turbo prefetching

EAS CLI gained an eas simulator:control command for driving remote iOS simulator sessions with file upload and download, while Next.js improved Turbo's prefetching of multi-page SST blocks.

EAS CLI's new eas simulator:control command runs serve-sim actions, including file upload and download, against remote iOS simulator sessions, and now lets serve-sim boot, install, and launch agent-device iOS sessions behind the local-egress guard.
Next.js prefetches multi-page SST blocks with MADV_WILLNEED in Turbo persistence, a low-level performance tweak rather than a user-facing feature.

Expo1

EAS CLIv25.2.0

FriOct 16, 20262 releases

Daily summary

Nuxt hardens server routing as Next.js reworks Server Action rendering

Nuxt fixed head sanitization on server islands and case-insensitive route rule matching, while Next.js began passing Server Action request metadata into App rendering and reverting a middleware telemetry change.

Nuxt applied useHeadSafe rules to server island head output and now matches server route rules case-insensitively unless sensitive routing is configured, alongside fixes for aborted-navigation error state and shared-context route types
Next.js passes Server Action request metadata into App rendering and reverts the middleware OpenTelemetry trace consolidation that had merged requests into a single trace
EAS CLI device run session jobs now call the worker API exclusively, dropping their GraphQL fallbacks

Expo1

EAS CLIv25.1.1

Nuxt1

Nuxtv4.6.2

ThuOct 15, 20263 releases

Daily summary

Expo SDK 58 lands iOS 27 support and App Intents alpha

Expo SDK 58 rebuilt for iOS 27 with React Native 0.88 and an alpha expo-app-intents package for Siri, Shortcuts, and Apple Intelligence, while EAS CLI made authenticated simulator preview links the default and Next.js shipped a Turbopack backport plus navigation refactors.

Expo SDK 58 targets iOS 27, which requires the UIKit scene-based life cycle and makes iPhone apps resizable, and bundles React Native 0.88.
Expo's alpha expo-app-intents package exposes app actions to Siri, Shortcuts, Spotlight, and Apple Intelligence, alongside expo-hinge for foldables and expo-device-hub for streaming simulators in the browser.
EAS CLI now defaults new simulator sessions to authenticated preview links and strips preview credentials from private output, with public sharing opt-in via simulator:start --public-link.
Next.js backported Turbopack Pages Router dev module graph chaining and snapshot/GC fixes to v16.4.2, and refactored navigation fetch and decode layering in the v16.5 canary.

Expo2

iOS 27 and React Native 0.88; App Intents for Siri

Expo SDK 58 is built for iOS 27, which requires the UIKit scene-based life cycle and makes iPhone apps resizable, and includes React Native 0.88. It adds the alpha expo-app-intents package for exposing app actions to Siri, Shortcuts, Spotlight, and Apple Intelligence, expo-hinge for foldable hinge state, and expo-device-hub for streaming simulators in the browser.

Details

EAS CLIv25.0.0

Vercel1

Next.jsv16.4.2

WedOct 14, 20268 releases

Daily summary

Critical RCE patches dominate a Next.js security day

Next.js shipped fixes for two critical unauthenticated remote code execution flaws across its 16.4 and 15.5 lines, while SvelteKit added CSP hash reporting and endpoint tracing and Expo redesigned its settings navigation.

Next.js patched two critical unauthenticated RCE vulnerabilities — in use cache functions returning typed arrays and in the Image Optimization API with SVG files — plus a high-severity App Router denial of service, across both the 16.4.1 and 15.5.28 lines.
SvelteKit added report-sha256/384/512 CSP hash-reporting keywords and now emits a sveltekit.endpoint span for +server handlers when server tracing is enabled.
SvelteKit fixed server-only module detection for projects nested in a server directory, component types emitted for the installed Svelte version, and adapter startup on runtimes like Deno.
Expo redesigned expo.dev settings into dedicated user, account, and project pages with a consistent sidebar for billing, tokens, credentials, and hosting.

Svelte4

Expo2

Settings get dedicated, consistent pages across expo.dev

User, account, and project settings on expo.dev have been redesigned with dedicated pages and a consistent sidebar. Account Billing, Receipts, Access Tokens, and Notifications moved into the account settings sidebar, while project Credentials, Hosting, and GitHub moved into the project settings sidebar.

Details

EAS CLIv24.14.0

Vercel2

MonOct 12, 20261 release

Daily summary

EAS CLI adds AI agent build step as Next.js fixes Windows canary

EAS CLI introduced an eas/run_agent build step that drives Claude Code or Codex against the Expo MCP server and deprecated Node.js 20, while Next.js canary fixed root params detection on Windows and let durable use cache exclude context from its hashes.

EAS CLI's new eas/run_agent build step runs Claude Code or Codex connected to the Expo MCP server, with sandbox file reads and artifact uploads
EAS CLI deprecates Node.js 20 with a runtime warning; a future release will require Node.js 22
Next.js fixes root params detection on Windows and makes turbopackGc disableable
Next.js durable use cache now excludes context from path and code hashes

Expo1

EAS CLIv24.13.0

Week of Oct 55 releases

Weekly digest

Next.js 16.4 lands as Turbopack, GC, and crash reporting harden the stack

Next.js shipped its 16.4 stable release alongside a rapid canary burst that enables garbage collection by default, Nuxt rolled out a rebuilt interactive dev terminal with its CLI v4, and Expo's EAS Observe began capturing native crashes on Android and iOS.

Read the digest →

FriOct 9, 20261 release

Daily summary

Next.js relands custom webpack support as Nuxt ships a patch

Next.js restored experimental custom webpack support alongside Turbopack diagnostics fixes, while Nuxt 4.6.1 landed a small set of Vite and Nitro correctness fixes.

Next.js brought back experimental custom webpack support after an earlier revert, and Turbopack now surfaces an actionable error when Node.js child processes can't connect.
Next.js fixed registration of chunked chunk groups and classification of collapsed generated paths from child routes, reducing build tree view allocations.
Nuxt fixed Vite 8.1+ optimizer message matching, baseURL handling for named fetch response types, and nitropack/types resolution under nodenext.

Nuxt1

Nuxtv4.6.1

ThuOct 8, 20261 release

Daily summary

Next.js quiets noisy telemetry and watcher warnings on Node.js 24

Next.js restored telemetry delivery on Node.js 24 and replaced the deprecated React.FormEvent type with SubmitEvent, while EAS CLI stopped orphaned simulator sessions left behind by an interrupted create.

Next.js telemetry works again on Node.js 24, the deprecated React.FormEvent type is replaced with SubmitEvent, and the upgrade eval fixtures pick up a next bump for CVE-2026-94483
Next.js quieted unactionable Turbopack and filesystem watcher warnings, including NotFound watcher errors and "stopping failed" reports
EAS CLI stops the server-created simulator session when Ctrl+C lands during an eas simulator create (v24.12.1)

Expo1

EAS CLIv24.12.1

WedOct 7, 20263 releases

Daily summary

Expo brings native crash reporting to EAS Observe

Expo's EAS Observe began capturing native Android and iOS crashes alongside JavaScript errors, while EAS CLI added an embedded-bundle upload step for custom builds and Next.js canary work landed on scaffolding defaults and clearer Turbopack font-fetch errors.

EAS Observe now records native crashes — uncaught Java and Kotlin exceptions and OS crash records on Android, Mach exceptions, Unix signals, and uncaught Objective-C and Swift exceptions on iOS — with no setup required, via expo-observe 57.0.21 or later on SDK 57
EAS CLI added the eas/upload_embedded_bundle step so custom eas/build configurations can upload their embedded bundle, and eas update:view --json now returns signed assetMapUrl and sourceMapUrl values
Next.js create-next-app now writes an agent feedback block to AGENTS.md when enabled and scaffolds new projects with ESLint 10, alongside a new turbo-trace-size CLI and a no-memory flag for Turbopack tracing
Turbopack now reports next/font/google fetch failures directly instead of the misleading "Module not found" error

Expo2

EAS Observe now records native crashes

EAS Observe records native crashes alongside JavaScript errors with no setup, covering uncaught Java and Kotlin exceptions and OS crash records on Android plus Mach exceptions, Unix signals, and uncaught Objective-C and Swift exceptions on iOS. Requires updating to expo-observe 57.0.21 or later on SDK 57; error reporting is in preview.

Details

EAS CLIv24.12.0

Vercel1

Next.jsv16.4.0