{"collection":{"slug":"frontend-frameworks","name":"Frontend Frameworks"},"digest":{"id":"cwd_WDboRDgwgjlC1aHs2xB43","weekStart":"2026-07-27","title":"Nuxt security patches, SvelteKit 3 nears stable, and Next.js sharpens turbopack","intro":"Nuxt shipped emergency security releases for both v3 and v4 fixing server-side RCE and other critical vulnerabilities, while SvelteKit 3 previews continue rolling toward a stable release and Next.js published a steady stream of turbopack and runtime improvements.","body":"### Emergency security patches across Nuxt\n\nThe biggest story this week is [Nuxt v3.21.10 and v4.5.1](/release/rel_FN7Bo8seDCquWCK20W3gx-v3-21-10), both security releases that fix a cluster of critically-rated vulnerabilities. Server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure are all patched. The Nuxt team recommends upgrading immediately with `npx nuxt upgrade --dedupe`. If you're on the devtools side, refreshing your lockfile also pulls in `@nuxt/devtools@3.3.1`, which fixes a separate critical development-only RCE. The [v4.5.1 release](/release/rel_cBx_3Tl60oIaJh9Cs3CfK-v4-5-1) also includes a fix for cross-user payload disclosure on cached pages — a subtle but dangerous issue in shared hosting environments.\n\n### SvelteKit 3 previews and breaking changes\n\nThe Svelte ecosystem continues its march toward SvelteKit 3 with [@sveltejs/kit@3.0.0-next.13](/release/rel_-RiqZj87p5iBzVyeLfzQ5-sveltejs-kit-3-0-0-next-13). This week's preview introduces three breaking changes worth noting if you're testing the next major. The `noScroll` and `keepFocus` options of `goto` are replaced by a single `reset` option, and the `data-sveltekit-noscroll` and `data-sveltekit-keepfocus` attributes are consolidated into `data-sveltekit-reset`. The `error(status, {...})` signature is deprecated in favor of `error(status, message, {...})`, making error messages more explicit. Shallow routing is now baked into `goto` itself, with the old `pushState` approach deprecated. Meanwhile, the adapter suite is getting aligned: [@sveltejs/adapter-vercel@7.0.0-next.4](/release/rel_MNWk4YhBikgP9ck5eYtVl-sveltejs-adapter-vercel-7-0-0-next-4) drops support for edge and Node 20 runtimes, and [@sveltejs/adapter-static@4.0.0-next.2](/release/rel_pyYAYTR2wz4VG9g9CsR84-sveltejs-adapter-static-4-0-0-next-2) fixes prerendered redirect handling to match the Vercel adapter's behavior. A minor [@sveltejs/kit@2.70.2](/release/rel_SEymWnBs0lIZjdKY6vpQ6-sveltejs-kit-2-70-2) patch on the stable line fixes quadratic backtracking in `Accept` header content negotiation.\n\n### A steady week of Next.js turbopack and runtime refinements\n\nThe Next.js canary channel saw a half-dozen releases this week, none individually breaking but collectively tightening the developer experience. [v16.3.0-canary.100](/release/rel_F0oqqLl6wpg1mWXm1Iz1K-next-js-v16-3-0-canary-100-supports-import-meta-env-in-turbopack-and-improves) adds `import.meta.env` support in Turbopack and improves root detection to handle worktrees, more workspaces, and stray lockfiles. [v16.3.0-canary.101](/release/rel_lPGCH2aE7OAOFIbMLK1O5-next-js-v16-3-0-canary-101-aggregates-turbopack-server-hmr-into-one-subscription) aggregates Turbopack server HMR updates into a single subscription instead of broadcasting complete graph clears on every change — a welcome perf improvement for large projects. [v16.3.0-canary.102](/release/rel_t28BI8h1Sr-Osz4TuWX6y-next-js-v16-3-0-canary-102-removes-loader-calls-for-dropped-dynamic-imports) removes loader calls for dropped dynamic imports, reducing unnecessary work in Turbopack. [v16.3.0-canary.103](/release/rel_o6lm1hvAxlTY9xWNWywM4-next-js-v16-3-0-canary-103-fixes-ppr-bot-rendering-and-fragment-scroll-blur) fixes PPR rendering for configured HTML bots and stops fragment-scroll navigation from triggering blur events. [v16.3.0-canary.104](/release/rel_OJo0NNtJWFrXzP4ClNA47-next-js-v16-3-0-canary-104-respects-htmllimitedbots-in-cache-components-without) ensures `htmlLimitedBots` is respected in cache components without buffering the full response — a meaningful fix for SEO-crawler handling. The [v16.3.0-preview.10](/release/rel_9NLgwN_XRds_diuQ1a8-J-next-js-v16-3-0-preview-10-optimizes-prefetching-source-maps-and-route-caching) release is the most substantial of the week, unifying allow-runtime with Partial Prefetching, attempting static prefetch before falling back to runtime, and rewriting edge server source map handling in Rust. It also replaces the vendored `http-proxy` with `httpxy` and adds Instant Insights request timing. Finally, [v16.3.0-canary.105](/release/rel_92SmzEHBShCclQthAcQQP-next-js-v16-3-0-canary-105-enables-turbopack-file-system-cache-by-default) enables turbopack file system cache for builds by default and adds a new `experimental.turbopackChunking` configuration option. The [v16.3.0-canary.106](/release/rel_ZuOgm9J8MhXnZdEZjsdVC-next-js-v16-3-0-canary-106-deprecates-experimental-usecache-and-fixes-hybrid) rounds out the week by deprecating `experimental.useCache` and fixing hybrid Pages/App Router not-found rendering with adapters.\n\n### Expo simulator tooling\n\n[EAS CLI v21.4.0](/release/rel_zAaZgXCBcHtAsTWgOQhOh-eas-cli-v21-4-0-adds-experimental-simulator-events-command) adds an experimental `eas simulator:events` command for viewing remote simulator events, plus `--name` support for `eas simulator:start`. Bug fixes include applying `--session-id` in observe:events summary mode.","releaseIds":["rel_FN7Bo8seDCquWCK20W3gx","rel_cBx_3Tl60oIaJh9Cs3CfK","rel_-RiqZj87p5iBzVyeLfzQ5","rel_MNWk4YhBikgP9ck5eYtVl","rel_pyYAYTR2wz4VG9g9CsR84","rel_SEymWnBs0lIZjdKY6vpQ6","rel_F0oqqLl6wpg1mWXm1Iz1K","rel_lPGCH2aE7OAOFIbMLK1O5","rel_t28BI8h1Sr-Osz4TuWX6y","rel_o6lm1hvAxlTY9xWNWywM4","rel_OJo0NNtJWFrXzP4ClNA47","rel_9NLgwN_XRds_diuQ1a8-J","rel_92SmzEHBShCclQthAcQQP","rel_ZuOgm9J8MhXnZdEZjsdVC","rel_zAaZgXCBcHtAsTWgOQhOh"],"releaseCount":18,"generatedAt":"2026-08-03T06:18:27.593Z","releases":[{"id":"rel_FN7Bo8seDCquWCK20W3gx","title":"v3.21.10","path":"/release/rel_FN7Bo8seDCquWCK20W3gx-v3-21-10","org":{"slug":"nuxt","name":"Nuxt"},"importance":null},{"id":"rel_cBx_3Tl60oIaJh9Cs3CfK","title":"v4.5.1","path":"/release/rel_cBx_3Tl60oIaJh9Cs3CfK-v4-5-1","org":{"slug":"nuxt","name":"Nuxt"},"importance":null},{"id":"rel_-RiqZj87p5iBzVyeLfzQ5","title":"@sveltejs/kit@3.0.0-next.13","path":"/release/rel_-RiqZj87p5iBzVyeLfzQ5-sveltejs-kit-3-0-0-next-13","org":{"slug":"svelte","name":"Svelte"},"importance":null},{"id":"rel_MNWk4YhBikgP9ck5eYtVl","title":"@sveltejs/adapter-vercel@7.0.0-next.4","path":"/release/rel_MNWk4YhBikgP9ck5eYtVl-sveltejs-adapter-vercel-7-0-0-next-4","org":{"slug":"svelte","name":"Svelte"},"importance":null},{"id":"rel_pyYAYTR2wz4VG9g9CsR84","title":"@sveltejs/adapter-static@4.0.0-next.2","path":"/release/rel_pyYAYTR2wz4VG9g9CsR84-sveltejs-adapter-static-4-0-0-next-2","org":{"slug":"svelte","name":"Svelte"},"importance":null},{"id":"rel_SEymWnBs0lIZjdKY6vpQ6","title":"@sveltejs/kit@2.70.2","path":"/release/rel_SEymWnBs0lIZjdKY6vpQ6-sveltejs-kit-2-70-2","org":{"slug":"svelte","name":"Svelte"},"importance":null},{"id":"rel_F0oqqLl6wpg1mWXm1Iz1K","title":"Next.js v16.3.0-canary.100 supports import.meta.env in Turbopack and improves root detection","path":"/release/rel_F0oqqLl6wpg1mWXm1Iz1K-turbopack-supports-import-meta-env-root-detection-improved","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_lPGCH2aE7OAOFIbMLK1O5","title":"Next.js v16.3.0-canary.101 aggregates Turbopack server HMR into one subscription","path":"/release/rel_lPGCH2aE7OAOFIbMLK1O5-turbopack-server-hmr-aggregated-into-single-subscription","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_t28BI8h1Sr-Osz4TuWX6y","title":"Next.js v16.3.0-canary.102 removes loader calls for dropped dynamic imports","path":"/release/rel_t28BI8h1Sr-Osz4TuWX6y-turbopack-drops-loader-calls-for-removed-dynamic-imports","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_o6lm1hvAxlTY9xWNWywM4","title":"Next.js v16.3.0-canary.103 fixes PPR bot rendering and fragment-scroll blur","path":"/release/rel_o6lm1hvAxlTY9xWNWywM4-ppr-html-bot-rendering-fixed-fragment-scroll-no-longer-blurs","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_OJo0NNtJWFrXzP4ClNA47","title":"Next.js v16.3.0-canary.104 respects htmlLimitedBots in cache components without buffering","path":"/release/rel_OJo0NNtJWFrXzP4ClNA47-htmllimitedbots-respected-in-cache-components-fragment-scroll-fix","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_9NLgwN_XRds_diuQ1a8-J","title":"Next.js v16.3.0-preview.10 optimizes prefetching, source maps, and route caching","path":"/release/rel_9NLgwN_XRds_diuQ1a8-J-prefetching-source-maps-and-caching-optimized","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_92SmzEHBShCclQthAcQQP","title":"Next.js v16.3.0-canary.105 enables turbopack file system cache by default","path":"/release/rel_92SmzEHBShCclQthAcQQP-turbopack-file-system-cache-enabled-by-default","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_ZuOgm9J8MhXnZdEZjsdVC","title":"Next.js v16.3.0-canary.106 deprecates experimental.useCache and fixes hybrid router not-found","path":"/release/rel_ZuOgm9J8MhXnZdEZjsdVC-experimental-usecache-deprecated-hybrid-router-not-found-fix","org":{"slug":"vercel","name":"Vercel"},"importance":2},{"id":"rel_zAaZgXCBcHtAsTWgOQhOh","title":"EAS CLI v21.4.0 adds experimental simulator:events command","path":"/release/rel_zAaZgXCBcHtAsTWgOQhOh-experimental-simulator-events-command-simulator-sessions-get-names","org":{"slug":"expo","name":"Expo"},"importance":2}]}}