{"collection":{"slug":"frontend-frameworks","name":"Frontend Frameworks"},"digest":{"id":"cwd_mUfsw94r9_GIZqc4KRIpu","weekStart":"2026-09-28","title":"Next.js patches critical SSRF and cache flaws as SvelteKit 3 lands","intro":"Security took center stage this week as Next.js patched a high-severity server-side request forgery in Image Optimization alongside a range of cache-poisoning fixes across two release lines, while SvelteKit shipped its long-awaited 3.0 major with a coordinated wave of rewritten adapters.","body":"### Next.js closes a high-severity SSRF and a cluster of cache flaws\n\nVercel's framework had an unusually heavy security week, and the fixes spanned both the current and previous major lines. The headline is a [high-severity server-side request forgery in Image Optimization](/release/rel_DQMcmQahyywReveyI94ta-next-js-v16-3-8-patches-ssrf-in-image-optimization-and-cache-poisoning-flaws), patched together with five medium-severity issues: cache poisoning of SSG and ISR pages, cross-user content substitution, Draft Mode content leaking into persisted pages through a pending `use cache` fill, and a cache leak across root param values in nested `use cache` functions. A low-severity information-disclosure bug in the development server's Model Context Protocol endpoint was fixed alongside them.\n\nProjects still on the older line aren't stranded — the same fixes, minus the SSRF, arrived as [cache-poisoning patches for SSG and ISR on the previous major](/release/rel_Ipw2wG7i156eA38xySQfX-next-js-v15-5-27-patches-ssg-and-isr-cache-poisoning-vulnerabilities), covering the metadata image-route disclosure and the persistent denial-of-service variant of the cache bug. If you self-host, this is the week to take both.\n\nUnderneath the security work, the canary line kept moving on Turbopack and caching. New projects scaffolded from the canary now get [Cache Components enabled by default in create-next-app](/release/rel_Vil2h1bzq4C7504p4u23v-next-js-v16-4-0-canary-53-enables-cache-components-by-default-in-create-next-app), and the shared Turbopack runtime is [enabled by default with stabilized `ensureStatic`](/release/rel_9U1wHdqEe9VE4N4fZCzgm-next-js-v16-4-0-canary-55-enables-turbopacksharedruntime-by-default). Elsewhere: [Draft Mode no longer leaks through cross-request `use cache` deduplication](/release/rel_b27rAc0lAoLpDFJ4nRg97-next-js-v16-4-0-canary-54-fixes-draft-mode-leak-and-mcp-middleware-dns-rebinding), with response cache keys now scoped to their source route and DNS pinned when fetching external images; [navigation() and prefetch() lost their `unstable_` prefix](/release/rel__6-16N2XcHxV_OIs3PvHN-next-js-v16-4-0-canary-52-drops-unstable-prefix-from-navigation-and-prefetch), a breaking rename worth grepping for; [export name mangling is on by default for Turbopack builds](/release/rel_q5JpbtCQCgrGRNcL_7lJv-next-js-v16-4-0-canary-56-enables-turbopack-export-name-mangling-by-default) alongside a new unstable parameter-matching API; and [client params no longer suspend on shallow URL updates](/release/rel_O8iKcjZ488CE_Hazqf3Rl-next-js-v16-4-0-canary-59-fixes-unnecessary-suspense-fallback-on-url-updates), killing an unnecessary Suspense fallback. A [strongly consistent read that could hang on a canceled task](/release/rel_Wt01MLngRHNcckEsCK8uV-next-js-v16-3-7-fixes-hanging-strongly-consistent-read-on-canceled-task) was backported to the stable line, and the bundle analyzer picked up [unified delta colors](/release/rel_QHljOBRr3s7yf3iPe-Mno-next-js-v16-4-0-canary-60-unifies-bundle-analyzer-delta-colors) and a [route summary over a reworked module cache](/release/rel_cdCkCH6Lz-tHdLnXQzfSf-next-js-v16-4-0-canary-58-bundles-turbopack-caching-and-source-map-tooling).\n\n### SvelteKit 3 arrives, with every adapter rewritten\n\nThe week's other big story: [SvelteKit 3 is here](/release/rel_9y4XsbYEqUIuVFjhbrO8X-sveltekit-3-is-here), the framework's first major in years. The theme is polish and type safety rather than reinvention, with an `sv migrate` command smoothing the upgrade. Breaking changes include [remote function types moving to `$app/server`, synchronous `getRequest`/`setResponse`, and a TypeScript 6 minimum](/release/rel_CbH8FufiZuAdcqKks4YiU-sveltejs-kit-3-0-0), plus the removal of the `experimental.handleRenderingErrors` flag.\n\nThe release pulled a coordinated version bump across the whole adapter ecosystem, most of which now [requires SvelteKit 3 and populates env vars before `instrumentation.server.js` is evaluated](/release/rel_0HhxH2g_ic1fVWKLTU5-M-sveltejs-adapter-node-6-0-0). Several adapters moved to rolldown for bundling, including [Vercel's edge bundling on an es2022 target](/release/rel_ZjYygSk0iAOFLgDftFOvZ-sveltejs-adapter-vercel-7-0-0) and [Netlify's output conforming to the stable Frameworks API](/release/rel_lxCAiBZA_G4TmMgqOC3hU-sveltejs-adapter-netlify-7-0-0). The [Cloudflare adapter raised its Wrangler floor](/release/rel__5dKJpwBGgWG7wKggqA6W-sveltejs-adapter-cloudflare-8-0-0), the [Bun adapter gained a native static-serving mode on Bun 1.4](/release/rel_K2nJZCmKuGlc3QYnfYCzE-sveltejs-adapter-bun-1-0-0), the [static adapter started matching adapter-vercel's prerendered redirect handling](/release/rel_rWvu6ViWz43gAQ4FNwhVJ-sveltejs-adapter-static-4-0-0), and [adapter-auto added zero-config deploys for Render](/release/rel_YEKZr33Wug_ziZAQWWUwd-sveltejs-adapter-auto-8-0-0). Tooling kept pace: [`@sveltejs/package` now warns on server-only files used without a server-only import](/release/rel_yXwbIjsKs1FKuU2aJHcj9-sveltejs-package-3-0-0), and [`@sveltejs/enhanced-img` moved to Vite 8 and `vite-plugin-svelte` 7](/release/rel_GUJHAca9mMyoEP4N87QQ2-sveltejs-enhanced-img-1-0-0). In the run-up, the team shipped a stream of fixes across [one pre-release that closed an enhanced-form cross-origin navigation and escaped cache-control headers in prerendered HTML](/release/rel_3fu0xk028CneDnH3RrIAR-sveltejs-kit-3-0-0-next-32), [another that fixed `scrollRestoration` surviving back/forward cache restores and clearing `navigating` on aborted popstate](/release/rel_xiJ8P_gYrVShjzpxR91Q8-sveltejs-kit-3-0-0-next-31), and a [Cloudflare adapter patch disposing the platform proxy on server close](/release/rel_7pLPsUfjq3TZKK23ZC3gq-sveltejs-adapter-cloudflare-8-0-0-next-8). The monthly roundup captures [the final changes before 3.0 and `sv` hitting 1.0](/release/rel_act1c4LN6Uh-bFt075eKw-what-s-new-in-svelte-october-2026).\n\n### Expo sharpens simulator and update workflows\n\nEAS CLI's two releases this week both target the inner loop. [`eas simulator` can now record HTTP(S) traffic from apps on the device](/release/rel_Ugp21vvPGSzkpAsFM-RGF-eas-cli-v24-10-0-adds-network-capture-to-eas-simulator), with a companion flag for keeping headers, query values, and bodies — a genuine debugging upgrade for network issues that only reproduce on-device. Separately, [`eas update` gained source-map uploads for stack-trace symbolication and a force-end-rollout flag](/release/rel_R29gVAZJte_MGM5G086v_-eas-cli-v24-9-0-adds-upload-source-maps-and-force-end-rollout-flag), with embedded bundle uploads after build now on by default for SDK 58+ projects and App Store Connect token reuse fixed.","releaseIds":["rel_DQMcmQahyywReveyI94ta","rel_Ipw2wG7i156eA38xySQfX","rel_Vil2h1bzq4C7504p4u23v","rel_9U1wHdqEe9VE4N4fZCzgm","rel_b27rAc0lAoLpDFJ4nRg97","rel__6-16N2XcHxV_OIs3PvHN","rel_q5JpbtCQCgrGRNcL_7lJv","rel_O8iKcjZ488CE_Hazqf3Rl","rel_Wt01MLngRHNcckEsCK8uV","rel_QHljOBRr3s7yf3iPe-Mno","rel_cdCkCH6Lz-tHdLnXQzfSf","rel_9y4XsbYEqUIuVFjhbrO8X","rel_CbH8FufiZuAdcqKks4YiU","rel_0HhxH2g_ic1fVWKLTU5-M","rel_ZjYygSk0iAOFLgDftFOvZ","rel_lxCAiBZA_G4TmMgqOC3hU","rel__5dKJpwBGgWG7wKggqA6W","rel_K2nJZCmKuGlc3QYnfYCzE","rel_rWvu6ViWz43gAQ4FNwhVJ","rel_YEKZr33Wug_ziZAQWWUwd","rel_yXwbIjsKs1FKuU2aJHcj9","rel_GUJHAca9mMyoEP4N87QQ2","rel_3fu0xk028CneDnH3RrIAR","rel_xiJ8P_gYrVShjzpxR91Q8","rel_7pLPsUfjq3TZKK23ZC3gq","rel_act1c4LN6Uh-bFt075eKw","rel_Ugp21vvPGSzkpAsFM-RGF","rel_R29gVAZJte_MGM5G086v_"],"releaseCount":29,"generatedAt":"2026-10-05T06:20:00.056Z","releases":[{"id":"rel_DQMcmQahyywReveyI94ta","title":"Next.js v16.3.8 patches SSRF in Image Optimization and cache poisoning flaws","path":"/release/rel_DQMcmQahyywReveyI94ta-ssrf-in-image-optimization-fixed-cache-poisoning-patches-land","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_Ipw2wG7i156eA38xySQfX","title":"Next.js v15.5.27 patches SSG and ISR cache poisoning vulnerabilities","path":"/release/rel_Ipw2wG7i156eA38xySQfX-ssg-isr-cache-poisoning-and-metadata-image-disclosure-fixed","url":"https://github.com/vercel/next.js/releases/tag/v15.5.27","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_Vil2h1bzq4C7504p4u23v","title":"Next.js v16.4.0-canary.53 enables Cache Components by default in create-next-app","path":"/release/rel_Vil2h1bzq4C7504p4u23v-create-next-app-enables-cache-components-by-default","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.53","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3},{"id":"rel_9U1wHdqEe9VE4N4fZCzgm","title":"Next.js v16.4.0-canary.55 enables turbopackSharedRuntime by default","path":"/release/rel_9U1wHdqEe9VE4N4fZCzgm-turbopack-shared-runtime-now-on-by-default","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.55","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2},{"id":"rel_b27rAc0lAoLpDFJ4nRg97","title":"Next.js v16.4.0-canary.54 fixes draft mode leak and MCP middleware DNS rebinding","path":"/release/rel_b27rAc0lAoLpDFJ4nRg97-draft-mode-leak-fixed-mcp-middleware-hardens-dns-rebinding","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.54","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3},{"id":"rel__6-16N2XcHxV_OIs3PvHN","title":"Next.js v16.4.0-canary.52 drops unstable_ prefix from navigation() and prefetch()","path":"/release/rel__6-16N2XcHxV_OIs3PvHN-navigation-and-prefetch-lose-unstable-prefix","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.52","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2},{"id":"rel_q5JpbtCQCgrGRNcL_7lJv","title":"Next.js v16.4.0-canary.56 enables Turbopack export name mangling by default","path":"/release/rel_q5JpbtCQCgrGRNcL_7lJv-turbopack-export-name-mangling-on-by-default","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.56","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2},{"id":"rel_O8iKcjZ488CE_Hazqf3Rl","title":"Next.js v16.4.0-canary.59 fixes unnecessary Suspense fallback on URL updates","path":"/release/rel_O8iKcjZ488CE_Hazqf3Rl-suspense-fallback-no-longer-triggers-on-shallow-url-updates","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.59","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1},{"id":"rel_Wt01MLngRHNcckEsCK8uV","title":"Next.js v16.3.7 fixes hanging strongly consistent read on canceled task","path":"/release/rel_Wt01MLngRHNcckEsCK8uV-canceled-task-no-longer-hangs-strongly-consistent-read","url":"https://github.com/vercel/next.js/releases/tag/v16.3.7","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1},{"id":"rel_QHljOBRr3s7yf3iPe-Mno","title":"Next.js v16.4.0-canary.60 unifies bundle analyzer delta colors","path":"/release/rel_QHljOBRr3s7yf3iPe-Mno-bundle-analyzer-delta-colors-unified","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.60","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1},{"id":"rel_cdCkCH6Lz-tHdLnXQzfSf","title":"Next.js v16.4.0-canary.58 bundles Turbopack caching and source map tooling updates","path":"/release/rel_cdCkCH6Lz-tHdLnXQzfSf-turbopack-module-cache-in-a-map-bundle-analyzer-route-summary","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.58","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1},{"id":"rel_9y4XsbYEqUIuVFjhbrO8X","title":"SvelteKit 3 is here","path":"/release/rel_9y4XsbYEqUIuVFjhbrO8X-sveltekit-3-is-here","url":"https://svelte.dev/blog/sveltekit-3-is-here","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":null,"importance":null},{"id":"rel_CbH8FufiZuAdcqKks4YiU","title":"@sveltejs/kit@3.0.0","path":"/release/rel_CbH8FufiZuAdcqKks4YiU-sveltejs-kit-3-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_0HhxH2g_ic1fVWKLTU5-M","title":"@sveltejs/adapter-node@6.0.0","path":"/release/rel_0HhxH2g_ic1fVWKLTU5-M-sveltejs-adapter-node-6-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-node%406.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_ZjYygSk0iAOFLgDftFOvZ","title":"@sveltejs/adapter-vercel@7.0.0","path":"/release/rel_ZjYygSk0iAOFLgDftFOvZ-sveltejs-adapter-vercel-7-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%407.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_lxCAiBZA_G4TmMgqOC3hU","title":"@sveltejs/adapter-netlify@7.0.0","path":"/release/rel_lxCAiBZA_G4TmMgqOC3hU-sveltejs-adapter-netlify-7-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-netlify%407.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel__5dKJpwBGgWG7wKggqA6W","title":"@sveltejs/adapter-cloudflare@8.0.0","path":"/release/rel__5dKJpwBGgWG7wKggqA6W-sveltejs-adapter-cloudflare-8-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_K2nJZCmKuGlc3QYnfYCzE","title":"@sveltejs/adapter-bun@1.0.0","path":"/release/rel_K2nJZCmKuGlc3QYnfYCzE-sveltejs-adapter-bun-1-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-bun%401.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_rWvu6ViWz43gAQ4FNwhVJ","title":"@sveltejs/adapter-static@4.0.0","path":"/release/rel_rWvu6ViWz43gAQ4FNwhVJ-sveltejs-adapter-static-4-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-static%404.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_YEKZr33Wug_ziZAQWWUwd","title":"@sveltejs/adapter-auto@8.0.0","path":"/release/rel_YEKZr33Wug_ziZAQWWUwd-sveltejs-adapter-auto-8-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-auto%408.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_yXwbIjsKs1FKuU2aJHcj9","title":"@sveltejs/package@3.0.0","path":"/release/rel_yXwbIjsKs1FKuU2aJHcj9-sveltejs-package-3-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_GUJHAca9mMyoEP4N87QQ2","title":"@sveltejs/enhanced-img@1.0.0","path":"/release/rel_GUJHAca9mMyoEP4N87QQ2-sveltejs-enhanced-img-1-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/enhanced-img%401.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_3fu0xk028CneDnH3RrIAR","title":"@sveltejs/kit@3.0.0-next.32","path":"/release/rel_3fu0xk028CneDnH3RrIAR-sveltejs-kit-3-0-0-next-32","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0-next.32","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_xiJ8P_gYrVShjzpxR91Q8","title":"@sveltejs/kit@3.0.0-next.31","path":"/release/rel_xiJ8P_gYrVShjzpxR91Q8-sveltejs-kit-3-0-0-next-31","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0-next.31","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_7pLPsUfjq3TZKK23ZC3gq","title":"@sveltejs/adapter-cloudflare@8.0.0-next.8","path":"/release/rel_7pLPsUfjq3TZKK23ZC3gq-sveltejs-adapter-cloudflare-8-0-0-next-8","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.0-next.8","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_act1c4LN6Uh-bFt075eKw","title":"What’s new in Svelte: October 2026","path":"/release/rel_act1c4LN6Uh-bFt075eKw-what-s-new-in-svelte-october-2026","url":"https://svelte.dev/blog/whats-new-in-svelte-october-2026","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":null,"importance":null},{"id":"rel_Ugp21vvPGSzkpAsFM-RGF","title":"EAS CLI v24.10.0 adds network capture to eas simulator","path":"/release/rel_Ugp21vvPGSzkpAsFM-RGF-eas-simulator-records-http-s-traffic-via-network-capture","url":"https://github.com/expo/eas-cli/releases/tag/v24.10.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3},{"id":"rel_R29gVAZJte_MGM5G086v_","title":"EAS CLI v24.9.0 adds --upload-source-maps and force-end rollout flag","path":"/release/rel_R29gVAZJte_MGM5G086v_-source-map-uploads-embedded-bundle-upload-now-default-on-sdk-58","url":"https://github.com/expo/eas-cli/releases/tag/v24.9.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3}],"sections":[{"heading":"Next.js closes a high-severity SSRF and a cluster of cache flaws","anchor":"next-js-closes-a-high-severity-ssrf-and-a-cluster-of-cache-flaws","lede":"Vercel's framework had an unusually heavy security week, and the fixes spanned both the current and previous major lines.","releaseIds":["rel_DQMcmQahyywReveyI94ta","rel_Ipw2wG7i156eA38xySQfX","rel_Vil2h1bzq4C7504p4u23v","rel_9U1wHdqEe9VE4N4fZCzgm","rel_b27rAc0lAoLpDFJ4nRg97","rel__6-16N2XcHxV_OIs3PvHN","rel_q5JpbtCQCgrGRNcL_7lJv","rel_O8iKcjZ488CE_Hazqf3Rl","rel_Wt01MLngRHNcckEsCK8uV","rel_QHljOBRr3s7yf3iPe-Mno","rel_cdCkCH6Lz-tHdLnXQzfSf"],"releases":[{"id":"rel_DQMcmQahyywReveyI94ta","title":"Next.js v16.3.8 patches SSRF in Image Optimization and cache poisoning flaws","path":"/release/rel_DQMcmQahyywReveyI94ta-ssrf-in-image-optimization-fixed-cache-poisoning-patches-land","url":"https://github.com/vercel/next.js/releases/tag/v16.3.8","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_Ipw2wG7i156eA38xySQfX","title":"Next.js v15.5.27 patches SSG and ISR cache poisoning vulnerabilities","path":"/release/rel_Ipw2wG7i156eA38xySQfX-ssg-isr-cache-poisoning-and-metadata-image-disclosure-fixed","url":"https://github.com/vercel/next.js/releases/tag/v15.5.27","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":4},{"id":"rel_Vil2h1bzq4C7504p4u23v","title":"Next.js v16.4.0-canary.53 enables Cache Components by default in create-next-app","path":"/release/rel_Vil2h1bzq4C7504p4u23v-create-next-app-enables-cache-components-by-default","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.53","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3},{"id":"rel_9U1wHdqEe9VE4N4fZCzgm","title":"Next.js v16.4.0-canary.55 enables turbopackSharedRuntime by default","path":"/release/rel_9U1wHdqEe9VE4N4fZCzgm-turbopack-shared-runtime-now-on-by-default","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.55","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2},{"id":"rel_b27rAc0lAoLpDFJ4nRg97","title":"Next.js v16.4.0-canary.54 fixes draft mode leak and MCP middleware DNS rebinding","path":"/release/rel_b27rAc0lAoLpDFJ4nRg97-draft-mode-leak-fixed-mcp-middleware-hardens-dns-rebinding","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.54","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3},{"id":"rel__6-16N2XcHxV_OIs3PvHN","title":"Next.js v16.4.0-canary.52 drops unstable_ prefix from navigation() and prefetch()","path":"/release/rel__6-16N2XcHxV_OIs3PvHN-navigation-and-prefetch-lose-unstable-prefix","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.52","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2},{"id":"rel_q5JpbtCQCgrGRNcL_7lJv","title":"Next.js v16.4.0-canary.56 enables Turbopack export name mangling by default","path":"/release/rel_q5JpbtCQCgrGRNcL_7lJv-turbopack-export-name-mangling-on-by-default","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.56","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2},{"id":"rel_O8iKcjZ488CE_Hazqf3Rl","title":"Next.js v16.4.0-canary.59 fixes unnecessary Suspense fallback on URL updates","path":"/release/rel_O8iKcjZ488CE_Hazqf3Rl-suspense-fallback-no-longer-triggers-on-shallow-url-updates","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.59","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1},{"id":"rel_Wt01MLngRHNcckEsCK8uV","title":"Next.js v16.3.7 fixes hanging strongly consistent read on canceled task","path":"/release/rel_Wt01MLngRHNcckEsCK8uV-canceled-task-no-longer-hangs-strongly-consistent-read","url":"https://github.com/vercel/next.js/releases/tag/v16.3.7","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1},{"id":"rel_QHljOBRr3s7yf3iPe-Mno","title":"Next.js v16.4.0-canary.60 unifies bundle analyzer delta colors","path":"/release/rel_QHljOBRr3s7yf3iPe-Mno-bundle-analyzer-delta-colors-unified","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.60","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1},{"id":"rel_cdCkCH6Lz-tHdLnXQzfSf","title":"Next.js v16.4.0-canary.58 bundles Turbopack caching and source map tooling updates","path":"/release/rel_cdCkCH6Lz-tHdLnXQzfSf-turbopack-module-cache-in-a-map-bundle-analyzer-route-summary","url":"https://github.com/vercel/next.js/releases/tag/v16.4.0-canary.58","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1}]},{"heading":"SvelteKit 3 arrives, with every adapter rewritten","anchor":"sveltekit-3-arrives-with-every-adapter-rewritten","lede":"The week's other big story: SvelteKit 3 is here, the framework's first major in years.","releaseIds":["rel_9y4XsbYEqUIuVFjhbrO8X","rel_CbH8FufiZuAdcqKks4YiU","rel_0HhxH2g_ic1fVWKLTU5-M","rel_ZjYygSk0iAOFLgDftFOvZ","rel_lxCAiBZA_G4TmMgqOC3hU","rel__5dKJpwBGgWG7wKggqA6W","rel_K2nJZCmKuGlc3QYnfYCzE","rel_rWvu6ViWz43gAQ4FNwhVJ","rel_YEKZr33Wug_ziZAQWWUwd","rel_yXwbIjsKs1FKuU2aJHcj9","rel_GUJHAca9mMyoEP4N87QQ2","rel_3fu0xk028CneDnH3RrIAR","rel_xiJ8P_gYrVShjzpxR91Q8","rel_7pLPsUfjq3TZKK23ZC3gq","rel_act1c4LN6Uh-bFt075eKw"],"releases":[{"id":"rel_9y4XsbYEqUIuVFjhbrO8X","title":"SvelteKit 3 is here","path":"/release/rel_9y4XsbYEqUIuVFjhbrO8X-sveltekit-3-is-here","url":"https://svelte.dev/blog/sveltekit-3-is-here","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":null,"importance":null},{"id":"rel_CbH8FufiZuAdcqKks4YiU","title":"@sveltejs/kit@3.0.0","path":"/release/rel_CbH8FufiZuAdcqKks4YiU-sveltejs-kit-3-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_0HhxH2g_ic1fVWKLTU5-M","title":"@sveltejs/adapter-node@6.0.0","path":"/release/rel_0HhxH2g_ic1fVWKLTU5-M-sveltejs-adapter-node-6-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-node%406.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_ZjYygSk0iAOFLgDftFOvZ","title":"@sveltejs/adapter-vercel@7.0.0","path":"/release/rel_ZjYygSk0iAOFLgDftFOvZ-sveltejs-adapter-vercel-7-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%407.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_lxCAiBZA_G4TmMgqOC3hU","title":"@sveltejs/adapter-netlify@7.0.0","path":"/release/rel_lxCAiBZA_G4TmMgqOC3hU-sveltejs-adapter-netlify-7-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-netlify%407.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel__5dKJpwBGgWG7wKggqA6W","title":"@sveltejs/adapter-cloudflare@8.0.0","path":"/release/rel__5dKJpwBGgWG7wKggqA6W-sveltejs-adapter-cloudflare-8-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_K2nJZCmKuGlc3QYnfYCzE","title":"@sveltejs/adapter-bun@1.0.0","path":"/release/rel_K2nJZCmKuGlc3QYnfYCzE-sveltejs-adapter-bun-1-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-bun%401.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_rWvu6ViWz43gAQ4FNwhVJ","title":"@sveltejs/adapter-static@4.0.0","path":"/release/rel_rWvu6ViWz43gAQ4FNwhVJ-sveltejs-adapter-static-4-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-static%404.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_YEKZr33Wug_ziZAQWWUwd","title":"@sveltejs/adapter-auto@8.0.0","path":"/release/rel_YEKZr33Wug_ziZAQWWUwd-sveltejs-adapter-auto-8-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-auto%408.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_yXwbIjsKs1FKuU2aJHcj9","title":"@sveltejs/package@3.0.0","path":"/release/rel_yXwbIjsKs1FKuU2aJHcj9-sveltejs-package-3-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_GUJHAca9mMyoEP4N87QQ2","title":"@sveltejs/enhanced-img@1.0.0","path":"/release/rel_GUJHAca9mMyoEP4N87QQ2-sveltejs-enhanced-img-1-0-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/enhanced-img%401.0.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_3fu0xk028CneDnH3RrIAR","title":"@sveltejs/kit@3.0.0-next.32","path":"/release/rel_3fu0xk028CneDnH3RrIAR-sveltejs-kit-3-0-0-next-32","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0-next.32","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_xiJ8P_gYrVShjzpxR91Q8","title":"@sveltejs/kit@3.0.0-next.31","path":"/release/rel_xiJ8P_gYrVShjzpxR91Q8-sveltejs-kit-3-0-0-next-31","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0-next.31","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_7pLPsUfjq3TZKK23ZC3gq","title":"@sveltejs/adapter-cloudflare@8.0.0-next.8","path":"/release/rel_7pLPsUfjq3TZKK23ZC3gq-sveltejs-adapter-cloudflare-8-0-0-next-8","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.0-next.8","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null},{"id":"rel_act1c4LN6Uh-bFt075eKw","title":"What’s new in Svelte: October 2026","path":"/release/rel_act1c4LN6Uh-bFt075eKw-what-s-new-in-svelte-october-2026","url":"https://svelte.dev/blog/whats-new-in-svelte-october-2026","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":null,"importance":null}]},{"heading":"Expo sharpens simulator and update workflows","anchor":"expo-sharpens-simulator-and-update-workflows","lede":"EAS CLI's two releases this week both target the inner loop. eas simulator can now record HTTP(S) traffic from apps on the device, with a companion flag for keeping headers, query values, and bodies — a genuine debugging upgrade for network issues that only reproduce on-device.","releaseIds":["rel_Ugp21vvPGSzkpAsFM-RGF","rel_R29gVAZJte_MGM5G086v_"],"releases":[{"id":"rel_Ugp21vvPGSzkpAsFM-RGF","title":"EAS CLI v24.10.0 adds network capture to eas simulator","path":"/release/rel_Ugp21vvPGSzkpAsFM-RGF-eas-simulator-records-http-s-traffic-via-network-capture","url":"https://github.com/expo/eas-cli/releases/tag/v24.10.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3},{"id":"rel_R29gVAZJte_MGM5G086v_","title":"EAS CLI v24.9.0 adds --upload-source-maps and force-end rollout flag","path":"/release/rel_R29gVAZJte_MGM5G086v_-source-map-uploads-embedded-bundle-upload-now-default-on-sdk-58","url":"https://github.com/expo/eas-cli/releases/tag/v24.9.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3}]}]}}