Security patches and platform shifts across the frameworks

Critical security updates for Next.js

The week's most pressing story came from Vercel, who released coordinated security patches for both Next.js v16.2.11 and v15.5.21 fixing four high-severity vulnerabilities. The advisories cover Denial of Service through App Router Server Actions, a middleware/proxy bypass in Turbopack single-locale applications, and Server-Side Request Forgery through both rewrites and Server Actions on custom servers. Five moderate-severity issues were also addressed, including cache confusion, image optimization DoS via SVG, and unauthenticated function endpoint disclosure. If you're running either version line, upgrade immediately — these are the kind of vulnerabilities that demand quick action.

Following the security releases, the team shipped v16.2.12 adding TypeScript 7 support, while the v15 line got v15.5.22 which proactively rejects TypeScript 7.0 with an actionable error message, preventing unexpected breakage for projects still on the stable v15 branch.

Expo product changes

Two significant product announcements came from Expo this week. The Expo Agent closed beta is winding down, with the web-based agent at agent.expo.dev shutting down after July 31, 2026. Users can export projects by downloading or pulling from GitHub, with guidance for continuing development using Claude Code, Codex, and the Expo MCP server. The team noted they've been applying lessons learned from the Agent across the SDK, CLI, and EAS ecosystem.

On a more positive note, EAS Observe is moving from public beta to general availability on August 20, 2026, with revised pricing that includes 90 days of data retention across all plans. Free-tier users get 100,000 events/month and the main dashboard, while Starter and above get 500,000 events/month and all dashboards, with overage at $5 per 1 million events.

The EAS CLI also saw steady improvements: v21.3.0 added TestFlight feedback and crash report commands, v21.2.0 introduced a simulator availability check, and v21.1.0 improved the simulator start command with platform selection prompts.

Framework evolution

Next.js's canary channel continued marching toward v16.3 with several notable changes. The experimental viewTransition flag was removed (now stable), and outputHashSalt and immutable static assets config moved out of experimental status. Multiple fixes addressed Windows path canonicalization in Turbopack and server actions body size limits in the Edge runtime.

SvelteKit's preview releases continued with @sveltejs/kit@3.0.0-next.12 introducing several breaking changes including renamed Pathname and Asset types, and erroring on event.url, event.params, and event.route access inside queries. The adapter ecosystem saw updates for Netlify, Cloudflare, Vercel, and Node, all bumping Rolldown to 1.2.0 and fixing race conditions in init.