--- collection: frontend-frameworks collection_name: Frontend Frameworks week_start: 2026-07-27 title: Nuxt security patches, SvelteKit 3 nears stable, and Next.js sharpens turbopack release_count: 18 generated: 2026-08-03 canonical: https://releases.sh/collections/frontend-frameworks/digest/2026-07-27 --- # Nuxt security patches, SvelteKit 3 nears stable, and Next.js sharpens turbopack Nuxt shipped emergency security releases for both v3 and v4 fixing server-side RCE and other critical vulnerabilities, while SvelteKit 3 previews continue rolling toward a stable release and Next.js published a steady stream of turbopack and runtime improvements. ### Emergency security patches across Nuxt The biggest story this week is [Nuxt v3.21.10 and v4.5.1](/release/rel_FN7Bo8seDCquWCK20W3gx-v3-21-10), both security releases that fix a cluster of critically-rated vulnerabilities. Server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure are all patched. The Nuxt team recommends upgrading immediately with `npx nuxt upgrade --dedupe`. If you're on the devtools side, refreshing your lockfile also pulls in `@nuxt/devtools@3.3.1`, which fixes a separate critical development-only RCE. The [v4.5.1 release](/release/rel_cBx_3Tl60oIaJh9Cs3CfK-v4-5-1) also includes a fix for cross-user payload disclosure on cached pages — a subtle but dangerous issue in shared hosting environments. ### SvelteKit 3 previews and breaking changes The Svelte ecosystem continues its march toward SvelteKit 3 with [@sveltejs/kit@3.0.0-next.13](/release/rel_-RiqZj87p5iBzVyeLfzQ5-sveltejs-kit-3-0-0-next-13). This week's preview introduces three breaking changes worth noting if you're testing the next major. The `noScroll` and `keepFocus` options of `goto` are replaced by a single `reset` option, and the `data-sveltekit-noscroll` and `data-sveltekit-keepfocus` attributes are consolidated into `data-sveltekit-reset`. The `error(status, {...})` signature is deprecated in favor of `error(status, message, {...})`, making error messages more explicit. Shallow routing is now baked into `goto` itself, with the old `pushState` approach deprecated. Meanwhile, the adapter suite is getting aligned: [@sveltejs/adapter-vercel@7.0.0-next.4](/release/rel_MNWk4YhBikgP9ck5eYtVl-sveltejs-adapter-vercel-7-0-0-next-4) drops support for edge and Node 20 runtimes, and [@sveltejs/adapter-static@4.0.0-next.2](/release/rel_pyYAYTR2wz4VG9g9CsR84-sveltejs-adapter-static-4-0-0-next-2) fixes prerendered redirect handling to match the Vercel adapter's behavior. A minor [@sveltejs/kit@2.70.2](/release/rel_SEymWnBs0lIZjdKY6vpQ6-sveltejs-kit-2-70-2) patch on the stable line fixes quadratic backtracking in `Accept` header content negotiation. ### A steady week of Next.js turbopack and runtime refinements The Next.js canary channel saw a half-dozen releases this week, none individually breaking but collectively tightening the developer experience. [v16.3.0-canary.100](/release/rel_F0oqqLl6wpg1mWXm1Iz1K-next-js-v16-3-0-canary-100-supports-import-meta-env-in-turbopack-and-improves) adds `import.meta.env` support in Turbopack and improves root detection to handle worktrees, more workspaces, and stray lockfiles. [v16.3.0-canary.101](/release/rel_lPGCH2aE7OAOFIbMLK1O5-next-js-v16-3-0-canary-101-aggregates-turbopack-server-hmr-into-one-subscription) aggregates Turbopack server HMR updates into a single subscription instead of broadcasting complete graph clears on every change — a welcome perf improvement for large projects. [v16.3.0-canary.102](/release/rel_t28BI8h1Sr-Osz4TuWX6y-next-js-v16-3-0-canary-102-removes-loader-calls-for-dropped-dynamic-imports) removes loader calls for dropped dynamic imports, reducing unnecessary work in Turbopack. [v16.3.0-canary.103](/release/rel_o6lm1hvAxlTY9xWNWywM4-next-js-v16-3-0-canary-103-fixes-ppr-bot-rendering-and-fragment-scroll-blur) fixes PPR rendering for configured HTML bots and stops fragment-scroll navigation from triggering blur events. [v16.3.0-canary.104](/release/rel_OJo0NNtJWFrXzP4ClNA47-next-js-v16-3-0-canary-104-respects-htmllimitedbots-in-cache-components-without) ensures `htmlLimitedBots` is respected in cache components without buffering the full response — a meaningful fix for SEO-crawler handling. The [v16.3.0-preview.10](/release/rel_9NLgwN_XRds_diuQ1a8-J-next-js-v16-3-0-preview-10-optimizes-prefetching-source-maps-and-route-caching) release is the most substantial of the week, unifying allow-runtime with Partial Prefetching, attempting static prefetch before falling back to runtime, and rewriting edge server source map handling in Rust. It also replaces the vendored `http-proxy` with `httpxy` and adds Instant Insights request timing. Finally, [v16.3.0-canary.105](/release/rel_92SmzEHBShCclQthAcQQP-next-js-v16-3-0-canary-105-enables-turbopack-file-system-cache-by-default) enables turbopack file system cache for builds by default and adds a new `experimental.turbopackChunking` configuration option. The [v16.3.0-canary.106](/release/rel_ZuOgm9J8MhXnZdEZjsdVC-next-js-v16-3-0-canary-106-deprecates-experimental-usecache-and-fixes-hybrid) rounds out the week by deprecating `experimental.useCache` and fixing hybrid Pages/App Router not-found rendering with adapters. ### Expo simulator tooling [EAS CLI v21.4.0](/release/rel_zAaZgXCBcHtAsTWgOQhOh-eas-cli-v21-4-0-adds-experimental-simulator-events-command) adds an experimental `eas simulator:events` command for viewing remote simulator events, plus `--name` support for `eas simulator:start`. Bug fixes include applying `--session-id` in observe:events summary mode. ## Releases covered ### Expo - [EAS CLI v21.4.0 adds experimental simulator:events command](https://releases.sh/release/rel_zAaZgXCBcHtAsTWgOQhOh-experimental-simulator-events-command-simulator-sessions-get-names) ### Nuxt - [v3.21.10](https://releases.sh/release/rel_FN7Bo8seDCquWCK20W3gx-v3-21-10) - [v4.5.1](https://releases.sh/release/rel_cBx_3Tl60oIaJh9Cs3CfK-v4-5-1) ### Svelte - [@sveltejs/kit@3.0.0-next.13](https://releases.sh/release/rel_-RiqZj87p5iBzVyeLfzQ5-sveltejs-kit-3-0-0-next-13) - [@sveltejs/adapter-vercel@7.0.0-next.4](https://releases.sh/release/rel_MNWk4YhBikgP9ck5eYtVl-sveltejs-adapter-vercel-7-0-0-next-4) - [@sveltejs/adapter-static@4.0.0-next.2](https://releases.sh/release/rel_pyYAYTR2wz4VG9g9CsR84-sveltejs-adapter-static-4-0-0-next-2) - [@sveltejs/kit@2.70.2](https://releases.sh/release/rel_SEymWnBs0lIZjdKY6vpQ6-sveltejs-kit-2-70-2) ### Vercel - [Next.js v16.3.0-canary.100 supports import.meta.env in Turbopack and improves root detection](https://releases.sh/release/rel_F0oqqLl6wpg1mWXm1Iz1K-turbopack-supports-import-meta-env-root-detection-improved) - [Next.js v16.3.0-canary.101 aggregates Turbopack server HMR into one subscription](https://releases.sh/release/rel_lPGCH2aE7OAOFIbMLK1O5-turbopack-server-hmr-aggregated-into-single-subscription) - [Next.js v16.3.0-canary.102 removes loader calls for dropped dynamic imports](https://releases.sh/release/rel_t28BI8h1Sr-Osz4TuWX6y-turbopack-drops-loader-calls-for-removed-dynamic-imports) - [Next.js v16.3.0-canary.103 fixes PPR bot rendering and fragment-scroll blur](https://releases.sh/release/rel_o6lm1hvAxlTY9xWNWywM4-ppr-html-bot-rendering-fixed-fragment-scroll-no-longer-blurs) - [Next.js v16.3.0-canary.104 respects htmlLimitedBots in cache components without buffering](https://releases.sh/release/rel_OJo0NNtJWFrXzP4ClNA47-htmllimitedbots-respected-in-cache-components-fragment-scroll-fix) - [Next.js v16.3.0-preview.10 optimizes prefetching, source maps, and route caching](https://releases.sh/release/rel_9NLgwN_XRds_diuQ1a8-J-prefetching-source-maps-and-caching-optimized) - [Next.js v16.3.0-canary.105 enables turbopack file system cache by default](https://releases.sh/release/rel_92SmzEHBShCclQthAcQQP-turbopack-file-system-cache-enabled-by-default) - [Next.js v16.3.0-canary.106 deprecates experimental.useCache and fixes hybrid router not-found](https://releases.sh/release/rel_ZuOgm9J8MhXnZdEZjsdVC-experimental-usecache-deprecated-hybrid-router-not-found-fix)