SvelteKit 3 tightens its foundation while Next.js and EAS broaden reach

SvelteKit 3's breaking-change avalanche

The Svelte ecosystem dominated the week with a coordinated set of breaking changes across the entire SvelteKit 3 pre-release line. The core SvelteKit 3.0.0-next.15 update sets the new baseline: it requires Node 22 or newer, bumps the minimum TypeScript version to 6, makes getRequest and setResponse synchronous, and removes the experimental handleRenderingErrors flag. It also introduces a behavioral change where all load functions and queries refresh when clicking a link to the current URL — a nod toward fresher client state. Perhaps most notably for those migrating soon, it upgrades the cookie package to v2, which means cookie names must now contain only ASCII characters, a potentially subtle source of breakage.

This foundation shift ripples through the entire adapter ecosystem. @sveltejs/package 3.0.0-next.5 follows suit with a Node 22 requirement and adds a helpful warning when using .server. files without importing a server-only module. The adapters themselves are aligning on Vite 8 and stable Rolldown 1.0.0, the first Vite release to bundle the new build engine. @sveltejs/adapter-node 6.0.0-next.8 officially migrates from rollup to rolldown, while both @sveltejs/adapter-vercel 7.0.0-next.5 and @sveltejs/adapter-netlify 7.0.0-next.6 now use rolldown for edge function bundling. The Netlify adapter is the most disruptive of the bunch: it now writes output conforming to the stable Netlify Frameworks API and requires Netlify CLI v17.31.0 or later, so existing deploy pipelines will need attention.

Two fixes stand out across these releases because they correct potentially confusing behavior: adapter-node 6.0.0-next.7 now serves static files with the Content-Type recorded in the manifest and stops sending Vary: Accept-Encoding for assets that were never precompressed. And @sveltejs/adapter-cloudflare 8.0.0-next.5 removes the deprecated platform.context in favor of platform.ctx — a small but potentially widespread API break for Cloudflare users.

Next.js: security backports and Turbopack stability

Next.js had a quieter but important week. The headline is the v16.3.0 stable release, which includes a vendored lodash update to 4.17.23 to fix CVE-2025-13465, alongside fixes for invalid HTML responses in RSC requests and normalized encoded dynamic placeholders in app routes.

Canary releases continued the focus on reliability. Next.js v16.3.1-canary.8 enables the shared runtime and CommonJS tree shaking by default in Turbopack, and canary.107 turns on Turbopack's build filesystem cache by default — the latter should meaningfully speed up subsequent local builds. Bug fixes in this batch include a dev-server cache invalidation fix for use cache, a fix for a race when navigating Back before hydration, and a fix for catch-all index pages being served for every other slug.

Security-minded developers on the maintenance line should note Next.js v15.5.23, which ports ReplyServer traversal guards to the FlightClient transport layer. It's a small patch but a meaningful one for anyone still on the 15.x line.

EAS CLI grows submission management

The Expo team shipped a pair of meaningful updates. EAS CLI v21.5.0 adds five new submission management commands — eas submit:list, eas submit:view, eas submit:retry, eas submit:cancel, and eas submit:status — with list and view exposing the runtime version and fingerprint of the submitted build. The status command goes further, cross-referencing EAS submissions with live App Store and TestFlight states, which should make troubleshooting submission pipelines far less opaque. Custom builds can now also resolve local composite functions referenced via uses:.

The follow-up EAS CLI v21.7.0 tightens code signing: --private-key-path without a matching updates.codeSigningCertificate in the app config now fails loudly instead of silently publishing an unsigned update — a valuable guardrail for anyone managing distribution.

Nuxt's quiet end-of-life note

Nuxt v3.21.11 carries an important reminder in its patch release: Nuxt v3 is now officially end-of-life, and users are encouraged to upgrade to Nuxt v4. The release itself fixes island payload serialization for components with underscores in keys and dedupes island renders when prerendering. Meanwhile, Nuxt v4.5.2 focuses on performance, skipping the rewrite of unchanged generated files and using lazy imports to speed up parsing.