Nuxt security patches, SvelteKit 3 nears stable, and Next.js sharpens turbopack

Emergency security patches across Nuxt

The biggest story this week is Nuxt v3.21.10 and v4.5.1, both security releases that fix a cluster of critically-rated vulnerabilities. Server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure are all patched. The Nuxt team recommends upgrading immediately with npx nuxt upgrade --dedupe. If you're on the devtools side, refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE. The v4.5.1 release also includes a fix for cross-user payload disclosure on cached pages — a subtle but dangerous issue in shared hosting environments.

SvelteKit 3 previews and breaking changes

The Svelte ecosystem continues its march toward SvelteKit 3 with @sveltejs/kit@3.0.0-next.13. This week's preview introduces three breaking changes worth noting if you're testing the next major. The noScroll and keepFocus options of goto are replaced by a single reset option, and the data-sveltekit-noscroll and data-sveltekit-keepfocus attributes are consolidated into data-sveltekit-reset. The error(status, {...}) signature is deprecated in favor of error(status, message, {...}), making error messages more explicit. Shallow routing is now baked into goto itself, with the old pushState approach deprecated. Meanwhile, the adapter suite is getting aligned: @sveltejs/adapter-vercel@7.0.0-next.4 drops support for edge and Node 20 runtimes, and @sveltejs/adapter-static@4.0.0-next.2 fixes prerendered redirect handling to match the Vercel adapter's behavior. A minor @sveltejs/kit@2.70.2 patch on the stable line fixes quadratic backtracking in Accept header content negotiation.

A steady week of Next.js turbopack and runtime refinements

The Next.js canary channel saw a half-dozen releases this week, none individually breaking but collectively tightening the developer experience. v16.3.0-canary.100 adds import.meta.env support in Turbopack and improves root detection to handle worktrees, more workspaces, and stray lockfiles. v16.3.0-canary.101 aggregates Turbopack server HMR updates into a single subscription instead of broadcasting complete graph clears on every change — a welcome perf improvement for large projects. v16.3.0-canary.102 removes loader calls for dropped dynamic imports, reducing unnecessary work in Turbopack. v16.3.0-canary.103 fixes PPR rendering for configured HTML bots and stops fragment-scroll navigation from triggering blur events. v16.3.0-canary.104 ensures htmlLimitedBots is respected in cache components without buffering the full response — a meaningful fix for SEO-crawler handling. The v16.3.0-preview.10 release is the most substantial of the week, unifying allow-runtime with Partial Prefetching, attempting static prefetch before falling back to runtime, and rewriting edge server source map handling in Rust. It also replaces the vendored http-proxy with httpxy and adds Instant Insights request timing. Finally, v16.3.0-canary.105 enables turbopack file system cache for builds by default and adds a new experimental.turbopackChunking configuration option. The v16.3.0-canary.106 rounds out the week by deprecating experimental.useCache and fixing hybrid Pages/App Router not-found rendering with adapters.

Expo simulator tooling

EAS CLI v21.4.0 adds an experimental eas simulator:events command for viewing remote simulator events, plus --name support for eas simulator:start. Bug fixes include applying --session-id in observe:events summary mode.