--- collection: frontend-frameworks collection_name: Frontend Frameworks week_start: 2026-07-20 title: Security patches and platform shifts across the frameworks release_count: 27 generated: 2026-07-27 canonical: https://releases.sh/collections/frontend-frameworks/digest/2026-07-20 --- # Security patches and platform shifts across the frameworks Next.js issued urgent security patches for both v15 and v16 fixing high-severity SSRF, DoS, and middleware bypass vulnerabilities, while Expo wound down its Agent product and moved EAS Observe to GA. ### Critical security updates for Next.js The week's most pressing story came from Vercel, who released coordinated security patches for both Next.js [v16.2.11](/release/rel_o9NeJTd9V-4U4e5yZt-Mq-next-js-v16-2-11-patches-high-severity-ssrf-dos-and-middleware-bypass) and [v15.5.21](/release/rel_x3urtEfPxuCbjFmkvHM85-next-js-v15-5-21-patches-high-severity-ssrf-dos-and-middleware-bypass) fixing four high-severity vulnerabilities. The advisories cover Denial of Service through App Router Server Actions, a middleware/proxy bypass in Turbopack single-locale applications, and Server-Side Request Forgery through both rewrites and Server Actions on custom servers. Five moderate-severity issues were also addressed, including cache confusion, image optimization DoS via SVG, and unauthenticated function endpoint disclosure. If you're running either version line, **upgrade immediately** — these are the kind of vulnerabilities that demand quick action. Following the security releases, the team shipped [v16.2.12](/release/rel_n1qIHhCdYT9NPw7PBBbfl-next-js-v16-2-12-adds-typescript-7-support-and-fixes-docs) adding TypeScript 7 support, while the v15 line got [v15.5.22](/release/rel_STFHkKgYWdm2Qx2dwmgH4-next-js-v15-5-22-rejects-typescript-7-0-with-actionable-error) which proactively rejects TypeScript 7.0 with an actionable error message, preventing unexpected breakage for projects still on the stable v15 branch. ### Expo product changes Two significant product announcements came from Expo this week. The [Expo Agent](/release/rel_stuKlmeVYzmjRBZvf_jMD-expo-agent-closed-beta-ending-project-winding-down-after-july-31-2026) closed beta is winding down, with the web-based agent at agent.expo.dev shutting down after July 31, 2026. Users can export projects by downloading or pulling from GitHub, with guidance for continuing development using Claude Code, Codex, and the Expo MCP server. The team noted they've been applying lessons learned from the Agent across the SDK, CLI, and EAS ecosystem. On a more positive note, [EAS Observe](/release/rel_LwAFV021omG47Ea5kq8MF-expo-eas-observe-moves-to-ga-on-august-20-with-new-pricing) is moving from public beta to general availability on August 20, 2026, with revised pricing that includes 90 days of data retention across all plans. Free-tier users get 100,000 events/month and the main dashboard, while Starter and above get 500,000 events/month and all dashboards, with overage at $5 per 1 million events. The EAS CLI also saw steady improvements: [v21.3.0](/release/rel_SdEOxzG3I9EvrbSsgC98u-eas-cli-v21-3-0-adds-testflight-feedback-and-crash-report-commands) added TestFlight feedback and crash report commands, [v21.2.0](/release/rel_CQ_TYLR6AzkSszsmzJOPn-eas-cli-v21-2-0-adds-simulator-availability-check) introduced a simulator availability check, and [v21.1.0](/release/rel_nlWmtT2wqIdG68PNW996v-eas-cli-v21-1-0-adds-platform-selection-prompt-for-simulator-start) improved the simulator start command with platform selection prompts. ### Framework evolution Next.js's canary channel continued marching toward v16.3 with several notable changes. The [experimental `viewTransition` flag was removed](/release/rel_eHrDQECWkdHXLAOj-k6Wq-next-js-v16-3-0-canary-95-removes-experimental-viewtransition-flag-throws-for) (now stable), and `outputHashSalt` and immutable static assets config [moved out of experimental status](/release/rel_EFL4EQjZilTVEp2WHcutj-next-js-v16-3-0-canary-91-moves-outputhashsalt-and-static-assets-config-out-of). Multiple fixes addressed Windows path canonicalization in Turbopack and server actions body size limits in the Edge runtime. SvelteKit's preview releases continued with [@sveltejs/kit@3.0.0-next.12](/release/rel_80FYBS-wuJYGO0gOTo9P1-sveltejs-kit-3-0-0-next-12) introducing several breaking changes including renamed `Pathname` and `Asset` types, and erroring on `event.url`, `event.params`, and `event.route` access inside queries. The adapter ecosystem saw updates for [Netlify](/release/rel_AdU0PzGbXa09NKyXaEzot-sveltejs-adapter-netlify-7-0-0-next-4), [Cloudflare](/release/rel_Hcxf-25aTAS6nZSE573z9-sveltejs-adapter-cloudflare-8-0-0-next-3), [Vercel](/release/rel_oblNbD85l8Rn6OHkMWPfh-sveltejs-adapter-vercel-7-0-0-next-3), and [Node](/release/rel_XUEvlnO0eieoHvKhzmI4s-sveltejs-adapter-node-6-0-0-next-6), all bumping Rolldown to 1.2.0 and fixing race conditions in `init`. ## Releases covered ### Expo - [Expo Agent closed beta ending, project winding down after July 31, 2026](https://releases.sh/release/rel_stuKlmeVYzmjRBZvf_jMD-expo-agent-winding-down-export-instructions-provided) - [Expo EAS Observe moves to GA on August 20 with new pricing](https://releases.sh/release/rel_LwAFV021omG47Ea5kq8MF-eas-observe-goes-ga-august-20-with-per-event-pricing) - [EAS CLI v21.3.0 adds TestFlight feedback and crash report commands](https://releases.sh/release/rel_SdEOxzG3I9EvrbSsgC98u-testflight-feedback-and-crash-reports-from-cli-icon-upload-init-flags) - [EAS CLI v21.2.0 adds simulator availability check](https://releases.sh/release/rel_CQ_TYLR6AzkSszsmzJOPn-eas-simulator-availability-check-per-account) - [EAS CLI v21.1.0 adds platform selection prompt for simulator start](https://releases.sh/release/rel_nlWmtT2wqIdG68PNW996v-eas-cli-v21-1-0-adds-platform-selection-prompt-for-simulator-start) ### Svelte - [@sveltejs/kit@3.0.0-next.12](https://releases.sh/release/rel_80FYBS-wuJYGO0gOTo9P1-sveltejs-kit-3-0-0-next-12) - [@sveltejs/adapter-netlify@7.0.0-next.4](https://releases.sh/release/rel_AdU0PzGbXa09NKyXaEzot-sveltejs-adapter-netlify-7-0-0-next-4) - [@sveltejs/adapter-cloudflare@8.0.0-next.3](https://releases.sh/release/rel_Hcxf-25aTAS6nZSE573z9-sveltejs-adapter-cloudflare-8-0-0-next-3) - [@sveltejs/adapter-vercel@7.0.0-next.3](https://releases.sh/release/rel_oblNbD85l8Rn6OHkMWPfh-sveltejs-adapter-vercel-7-0-0-next-3) - [@sveltejs/adapter-node@6.0.0-next.6](https://releases.sh/release/rel_XUEvlnO0eieoHvKhzmI4s-sveltejs-adapter-node-6-0-0-next-6) ### Vercel - [Next.js v16.2.11 patches high-severity SSRF, DoS, and middleware bypass](https://releases.sh/release/rel_o9NeJTd9V-4U4e5yZt-Mq-four-high-severity-cves-patched-all-deployments-should-upgrade) - [Next.js v15.5.21 patches high-severity SSRF, DoS, and middleware bypass vulnerabilities](https://releases.sh/release/rel_x3urtEfPxuCbjFmkvHM85-four-high-severity-security-flaws-patched) - [Next.js v16.2.12 adds TypeScript 7 support and fixes docs](https://releases.sh/release/rel_n1qIHhCdYT9NPw7PBBbfl-typescript-7-support-docs-fixes) - [Next.js v15.5.22 rejects TypeScript 7.0 with actionable error](https://releases.sh/release/rel_STFHkKgYWdm2Qx2dwmgH4-typescript-7-0-now-rejected-with-actionable-error) - [Next.js v16.3.0-canary.95 removes experimental viewTransition flag, throws for invalid generateStaticParams](https://releases.sh/release/rel_eHrDQECWkdHXLAOj-k6Wq-viewtransition-flag-removed-generatestaticparams-validation-hardened) - [Next.js v16.3.0-canary.91 moves outputHashSalt and static assets config out of experimental](https://releases.sh/release/rel_EFL4EQjZilTVEp2WHcutj-outputhashsalt-and-static-assets-config-graduate-from-experimental)