{"collection":{"slug":"frontend-frameworks","name":"Frontend Frameworks"},"digest":{"id":"cwd_2DIoO0EU4oISgG_I6a7vE","weekStart":"2026-10-12","title":"Next.js races to patch critical RCEs as Expo SDK 58 arrives","intro":"Next.js shipped emergency patches for two critical unauthenticated remote code execution flaws, while Expo released SDK 58 with day-one iOS 27 support, App Intents, and React Native 0.88.","body":"### Security first: Next.js RCE patches\n\nThe week's most urgent news came from Next.js, which patched two critical unauthenticated remote code execution vulnerabilities — one in `use cache` functions returning typed arrays, and one in the Image Optimization API when SVG files are used — alongside a high-severity denial of service in the App Router using Server Actions. The [16.x line got the full set of fixes](/release/rel_dLlbBnoJD1rKLyTZepjhb-next-js-v16-4-1-patches-two-critical-unauthenticated-rce-vulnerabilities), while the [15.5 line received the Image Optimization RCE and the Server Actions DoS backport](/release/rel_CJ2rniZrAqIgxNq_4y9jt-next-js-v15-5-28-patches-critical-rce-in-image-optimization-api), so apps pinned to the older major can close the more broadly reachable hole without a major upgrade. Anyone accepting user-supplied SVGs through `next/image` should treat this as a drop-everything upgrade; the advisories carry the full detail.\n\nNext.js also kept its quieter channels moving. The LTS branch picked up [Turbopack dev module graph chaining for the Pages Router plus a batch of snapshot-consistency fixes](/release/rel_XS5ol3EyLMxiabB6GcvMT-next-js-v16-4-2-backports-turbopack-dev-module-graph-chaining-to-pages-router), tidying lazy dynamic-import chunk collisions and module-resolution realpath errors along the way. And on canary, [Turbo-persistence began prefetching multi-page SST blocks with MADV_WILLNEED](/release/rel_s32UR2Y13vu59qggx6Nrg-next-js-v16-5-0-canary-17-prefetches-multi-page-sst-blocks-with-madv-willneed) — plumbing work that hints at faster incremental builds ahead.\n\n### Expo SDK 58 lands with iOS 27 and Apple Intelligence\n\nExpo's headline release is [SDK 58, built for iOS 27 and React Native 0.88](/release/rel_FtL16pJGCqaoucshihsJ6-expo-sdk-58-ships-ios-27-support-with-react-native-0-88-and-app-intents). Because iOS 27 requires the UIKit scene-based life cycle and makes iPhone apps resizable, this is a compatibility milestone as much as a feature drop. The alpha `expo-app-intents` package exposes app actions to Siri, Shortcuts, Spotlight, and Apple Intelligence; `expo-hinge` reports foldable hinge state; and `expo-device-hub` streams simulators into the browser. Alongside it, [expo.dev settings got a redesign around dedicated pages and a consistent sidebar](/release/rel_FCW3gv8tvTjLLCSamSmDR-expo-refreshes-expo-dev-settings-navigation-with-dedicated-sidebar-pages), with billing, access tokens, credentials, and hosting reorganized into their proper scopes.\n\n### EAS CLI: simulator control for agents\n\nEAS CLI spent the week building out remote-simulator workflows aimed squarely at coding agents. The release train added [an `eas simulator:control` command that runs serve-sim actions like file upload and download on a remote iOS simulator](/release/rel_KDNRe-jYpRJtRxGRBYJLh-eas-cli-v25-2-0-adds-eas-simulator-control-for-remote-ios-simulator-sessions), a headline change that also defaulted new simulator sessions to [authenticated preview links, with public sharing opt-in via `--public-link`](/release/rel_ISLgERlDwWZD562CeiGTH-eas-cli-v25-0-0-defaults-simulator-sessions-to-authenticated-preview-links), and started `expo-device-hub` for Android sessions. Agent tooling deepened with [the `eas/run_agent` build step that runs Claude Code or Codex against the Expo MCP server](/release/rel_ddW5lrr_2R6VxzuElU_C2-eas-cli-v24-13-0-deprecates-node-js-20-and-adds-eas-run-agent-step) — which also deprecated Node.js 20 for a future Node 22 requirement — and [device run session jobs now call www only through the worker API](/release/rel_bIBRq6jhsCc1zKvCxnmnA-eas-cli-v25-1-1-routes-device-run-session-jobs-through-worker-api-only) after dropping their GraphQL fallbacks. Maestro users got [a `--platform` flag for per-platform run and flow insights](/release/rel_Qg_8Jv_R113ugdWsO0NUd-eas-cli-v24-14-0-adds-platform-to-maestro-workflow-insights).\n\n### SvelteKit hardens CSP, Nuxt cleans up routing\n\nSvelteKit's batch leaned toward server-side correctness: [the kit added CSP `report-sha256`/`384`/`512` reporting keywords and an endpoint span for tracing](/release/rel_A5uNcwZQYUb88cXIwh-GU-sveltejs-kit-3-1-0), with a fix for projects nested in a `server` directory wrongly treating every module as server-only. Its package tooling now [emits component types for the installed Svelte version](/release/rel_zhUPUn6cWTGid-n0VfBia-sveltejs-package-3-0-1), and the adapters got platform fixes — [Bun minor versions preserved in the Vercel runtime](/release/rel_HTJdpa7te7uLUo9lvUheL-sveltejs-adapter-vercel-7-0-1) and [Concurrent dev servers, Deno global quirks, and local `tracing` emulation fixed on Cloudflare](/release/rel_M421qoPkQSSIysWMbv9S7-sveltejs-adapter-cloudflare-8-0-1). Nuxt's patch closed [a `useHeadSafe` gap on server island head and made server route rules match case-insensitively](/release/rel_lbSA7wf6qpTCxKOvJT2-G-nuxt-v4-6-2-fixes-server-island-head-sanitization-and-route-rule-matching).","releaseIds":["rel_dLlbBnoJD1rKLyTZepjhb","rel_CJ2rniZrAqIgxNq_4y9jt","rel_XS5ol3EyLMxiabB6GcvMT","rel_s32UR2Y13vu59qggx6Nrg","rel_FtL16pJGCqaoucshihsJ6","rel_FCW3gv8tvTjLLCSamSmDR","rel_KDNRe-jYpRJtRxGRBYJLh","rel_ISLgERlDwWZD562CeiGTH","rel_ddW5lrr_2R6VxzuElU_C2","rel_bIBRq6jhsCc1zKvCxnmnA","rel_Qg_8Jv_R113ugdWsO0NUd","rel_A5uNcwZQYUb88cXIwh-GU","rel_zhUPUn6cWTGid-n0VfBia","rel_HTJdpa7te7uLUo9lvUheL","rel_M421qoPkQSSIysWMbv9S7","rel_lbSA7wf6qpTCxKOvJT2-G"],"releaseCount":16,"generatedAt":"2026-10-19T06:20:30.641Z","releases":[{"id":"rel_dLlbBnoJD1rKLyTZepjhb","title":"Next.js v16.4.1 patches two critical unauthenticated RCE vulnerabilities","path":"/release/rel_dLlbBnoJD1rKLyTZepjhb-critical-unauthenticated-rces-patched-in-use-cache-and-image-optimization","url":"https://github.com/vercel/next.js/releases/tag/v16.4.1","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":5,"composition":{"bugs":3,"features":0,"enhancements":0},"publishedAt":"2026-10-14T17:47:59.000Z"},{"id":"rel_CJ2rniZrAqIgxNq_4y9jt","title":"Next.js v15.5.28 patches critical RCE in Image Optimization API","path":"/release/rel_CJ2rniZrAqIgxNq_4y9jt-critical-rce-in-image-optimization-api-patched","url":"https://github.com/vercel/next.js/releases/tag/v15.5.28","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":5,"composition":{"bugs":2,"features":0,"enhancements":0},"publishedAt":"2026-10-14T17:47:49.000Z"},{"id":"rel_XS5ol3EyLMxiabB6GcvMT","title":"Next.js v16.4.2 backports Turbopack dev module graph chaining to Pages Router","path":"/release/rel_XS5ol3EyLMxiabB6GcvMT-backports-pages-router-dev-graph-chaining-gc-path-fixes","url":"https://github.com/vercel/next.js/releases/tag/v16.4.2","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2,"composition":{"bugs":5,"features":0,"enhancements":0},"publishedAt":"2026-10-15T20:44:37.000Z"},{"id":"rel_s32UR2Y13vu59qggx6Nrg","title":"Next.js v16.5.0-canary.17 prefetches multi-page SST blocks with MADV_WILLNEED","path":"/release/rel_s32UR2Y13vu59qggx6Nrg-turbo-persistence-prefetches-multi-page-sst-blocks","url":"https://github.com/vercel/next.js/releases/tag/v16.5.0-canary.17","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1,"composition":{"bugs":0,"features":0,"enhancements":1},"publishedAt":"2026-10-17T23:46:40.000Z"},{"id":"rel_FtL16pJGCqaoucshihsJ6","title":"Expo SDK 58 ships iOS 27 support with React Native 0.88 and App Intents","path":"/release/rel_FtL16pJGCqaoucshihsJ6-ios-27-and-react-native-0-88-app-intents-for-siri","url":"https://expo.dev/changelog/sdk-58","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":5,"composition":{"bugs":0,"features":6,"enhancements":3},"publishedAt":"2026-10-15T20:00:00.000Z"},{"id":"rel_FCW3gv8tvTjLLCSamSmDR","title":"Expo refreshes expo.dev settings navigation with dedicated sidebar pages","path":"/release/rel_FCW3gv8tvTjLLCSamSmDR-settings-get-dedicated-consistent-pages-across-expo-dev","url":"https://expo.dev/changelog/settings-navigation-refresh","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":2,"composition":{"bugs":0,"features":1,"enhancements":0},"publishedAt":"2026-10-14T18:45:00.000Z"},{"id":"rel_KDNRe-jYpRJtRxGRBYJLh","title":"EAS CLI v25.2.0 adds eas simulator:control for remote iOS simulator sessions","path":"/release/rel_KDNRe-jYpRJtRxGRBYJLh-remote-ios-simulator-control-with-file-transfer","url":"https://github.com/expo/eas-cli/releases/tag/v25.2.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":0,"features":4,"enhancements":0},"publishedAt":"2026-10-17T23:25:53.000Z"},{"id":"rel_ISLgERlDwWZD562CeiGTH","title":"EAS CLI v25.0.0 defaults simulator sessions to authenticated preview links","path":"/release/rel_ISLgERlDwWZD562CeiGTH-simulator-sessions-default-to-authenticated-preview-links","url":"https://github.com/expo/eas-cli/releases/tag/v25.0.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":4,"features":7,"enhancements":1},"publishedAt":"2026-10-15T22:45:24.000Z"},{"id":"rel_ddW5lrr_2R6VxzuElU_C2","title":"EAS CLI v24.13.0 deprecates Node.js 20 and adds eas/run_agent step","path":"/release/rel_ddW5lrr_2R6VxzuElU_C2-node-js-20-deprecated-eas-run-agent-step-added","url":"https://github.com/expo/eas-cli/releases/tag/v24.13.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":4,"features":10,"enhancements":0},"publishedAt":"2026-10-12T17:47:08.000Z"},{"id":"rel_bIBRq6jhsCc1zKvCxnmnA","title":"EAS CLI v25.1.1 routes device run session jobs through worker API only","path":"/release/rel_bIBRq6jhsCc1zKvCxnmnA-device-run-sessions-call-www-only-via-worker-api","url":"https://github.com/expo/eas-cli/releases/tag/v25.1.1","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":1,"composition":{"bugs":1,"features":0,"enhancements":0},"publishedAt":"2026-10-16T21:37:47.000Z"},{"id":"rel_Qg_8Jv_R113ugdWsO0NUd","title":"EAS CLI v24.14.0 adds --platform to Maestro workflow insights","path":"/release/rel_Qg_8Jv_R113ugdWsO0NUd-maestro-insights-now-list-runs-and-flows-per-platform","url":"https://github.com/expo/eas-cli/releases/tag/v24.14.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":2,"composition":{"bugs":1,"features":1,"enhancements":0},"publishedAt":"2026-10-14T21:10:56.000Z"},{"id":"rel_A5uNcwZQYUb88cXIwh-GU","title":"@sveltejs/kit@3.1.0","path":"/release/rel_A5uNcwZQYUb88cXIwh-GU-sveltejs-kit-3-1-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-14T22:32:57.000Z"},{"id":"rel_zhUPUn6cWTGid-n0VfBia","title":"@sveltejs/package@3.0.1","path":"/release/rel_zhUPUn6cWTGid-n0VfBia-sveltejs-package-3-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-14T22:33:00.000Z"},{"id":"rel_HTJdpa7te7uLUo9lvUheL","title":"@sveltejs/adapter-vercel@7.0.1","path":"/release/rel_HTJdpa7te7uLUo9lvUheL-sveltejs-adapter-vercel-7-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%407.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-14T22:32:54.000Z"},{"id":"rel_M421qoPkQSSIysWMbv9S7","title":"@sveltejs/adapter-cloudflare@8.0.1","path":"/release/rel_M421qoPkQSSIysWMbv9S7-sveltejs-adapter-cloudflare-8-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-14T22:32:51.000Z"},{"id":"rel_lbSA7wf6qpTCxKOvJT2-G","title":"Nuxt v4.6.2 fixes server island head sanitization and route rule matching","path":"/release/rel_lbSA7wf6qpTCxKOvJT2-G-server-island-head-sanitized-route-rules-match-case-insensitively","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.2","org":{"slug":"nuxt","name":"Nuxt","avatarUrl":"https://media.releases.sh/orgs/nuxt.png","githubHandle":"nuxt"},"product":null,"importance":2,"composition":{"bugs":26,"features":0,"enhancements":1},"publishedAt":"2026-10-16T17:21:23.000Z"}],"sections":[{"heading":"Security first: Next.js RCE patches","anchor":"security-first-next-js-rce-patches","lede":"The week's most urgent news came from Next.js, which patched two critical unauthenticated remote code execution vulnerabilities — one in use cache functions returning typed arrays, and one in the Image Optimization API when SVG files are used — alongside a high-severity denial of service in the App Router using Server Actions.","releaseIds":["rel_dLlbBnoJD1rKLyTZepjhb","rel_CJ2rniZrAqIgxNq_4y9jt","rel_XS5ol3EyLMxiabB6GcvMT","rel_s32UR2Y13vu59qggx6Nrg"],"releases":[{"id":"rel_dLlbBnoJD1rKLyTZepjhb","title":"Next.js v16.4.1 patches two critical unauthenticated RCE vulnerabilities","path":"/release/rel_dLlbBnoJD1rKLyTZepjhb-critical-unauthenticated-rces-patched-in-use-cache-and-image-optimization","url":"https://github.com/vercel/next.js/releases/tag/v16.4.1","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":5,"composition":{"bugs":3,"features":0,"enhancements":0},"publishedAt":"2026-10-14T17:47:59.000Z"},{"id":"rel_CJ2rniZrAqIgxNq_4y9jt","title":"Next.js v15.5.28 patches critical RCE in Image Optimization API","path":"/release/rel_CJ2rniZrAqIgxNq_4y9jt-critical-rce-in-image-optimization-api-patched","url":"https://github.com/vercel/next.js/releases/tag/v15.5.28","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":5,"composition":{"bugs":2,"features":0,"enhancements":0},"publishedAt":"2026-10-14T17:47:49.000Z"},{"id":"rel_XS5ol3EyLMxiabB6GcvMT","title":"Next.js v16.4.2 backports Turbopack dev module graph chaining to Pages Router","path":"/release/rel_XS5ol3EyLMxiabB6GcvMT-backports-pages-router-dev-graph-chaining-gc-path-fixes","url":"https://github.com/vercel/next.js/releases/tag/v16.4.2","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2,"composition":{"bugs":5,"features":0,"enhancements":0},"publishedAt":"2026-10-15T20:44:37.000Z"},{"id":"rel_s32UR2Y13vu59qggx6Nrg","title":"Next.js v16.5.0-canary.17 prefetches multi-page SST blocks with MADV_WILLNEED","path":"/release/rel_s32UR2Y13vu59qggx6Nrg-turbo-persistence-prefetches-multi-page-sst-blocks","url":"https://github.com/vercel/next.js/releases/tag/v16.5.0-canary.17","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1,"composition":{"bugs":0,"features":0,"enhancements":1},"publishedAt":"2026-10-17T23:46:40.000Z"}]},{"heading":"Expo SDK 58 lands with iOS 27 and Apple Intelligence","anchor":"expo-sdk-58-lands-with-ios-27-and-apple-intelligence","lede":"Expo's headline release is SDK 58, built for iOS 27 and React Native 0.88.","releaseIds":["rel_FtL16pJGCqaoucshihsJ6","rel_FCW3gv8tvTjLLCSamSmDR"],"releases":[{"id":"rel_FtL16pJGCqaoucshihsJ6","title":"Expo SDK 58 ships iOS 27 support with React Native 0.88 and App Intents","path":"/release/rel_FtL16pJGCqaoucshihsJ6-ios-27-and-react-native-0-88-app-intents-for-siri","url":"https://expo.dev/changelog/sdk-58","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":5,"composition":{"bugs":0,"features":6,"enhancements":3},"publishedAt":"2026-10-15T20:00:00.000Z"},{"id":"rel_FCW3gv8tvTjLLCSamSmDR","title":"Expo refreshes expo.dev settings navigation with dedicated sidebar pages","path":"/release/rel_FCW3gv8tvTjLLCSamSmDR-settings-get-dedicated-consistent-pages-across-expo-dev","url":"https://expo.dev/changelog/settings-navigation-refresh","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":2,"composition":{"bugs":0,"features":1,"enhancements":0},"publishedAt":"2026-10-14T18:45:00.000Z"}]},{"heading":"EAS CLI: simulator control for agents","anchor":"eas-cli-simulator-control-for-agents","lede":"EAS CLI spent the week building out remote-simulator workflows aimed squarely at coding agents.","releaseIds":["rel_KDNRe-jYpRJtRxGRBYJLh","rel_ISLgERlDwWZD562CeiGTH","rel_ddW5lrr_2R6VxzuElU_C2","rel_bIBRq6jhsCc1zKvCxnmnA","rel_Qg_8Jv_R113ugdWsO0NUd"],"releases":[{"id":"rel_KDNRe-jYpRJtRxGRBYJLh","title":"EAS CLI v25.2.0 adds eas simulator:control for remote iOS simulator sessions","path":"/release/rel_KDNRe-jYpRJtRxGRBYJLh-remote-ios-simulator-control-with-file-transfer","url":"https://github.com/expo/eas-cli/releases/tag/v25.2.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":0,"features":4,"enhancements":0},"publishedAt":"2026-10-17T23:25:53.000Z"},{"id":"rel_ISLgERlDwWZD562CeiGTH","title":"EAS CLI v25.0.0 defaults simulator sessions to authenticated preview links","path":"/release/rel_ISLgERlDwWZD562CeiGTH-simulator-sessions-default-to-authenticated-preview-links","url":"https://github.com/expo/eas-cli/releases/tag/v25.0.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":4,"features":7,"enhancements":1},"publishedAt":"2026-10-15T22:45:24.000Z"},{"id":"rel_ddW5lrr_2R6VxzuElU_C2","title":"EAS CLI v24.13.0 deprecates Node.js 20 and adds eas/run_agent step","path":"/release/rel_ddW5lrr_2R6VxzuElU_C2-node-js-20-deprecated-eas-run-agent-step-added","url":"https://github.com/expo/eas-cli/releases/tag/v24.13.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":4,"features":10,"enhancements":0},"publishedAt":"2026-10-12T17:47:08.000Z"},{"id":"rel_bIBRq6jhsCc1zKvCxnmnA","title":"EAS CLI v25.1.1 routes device run session jobs through worker API only","path":"/release/rel_bIBRq6jhsCc1zKvCxnmnA-device-run-sessions-call-www-only-via-worker-api","url":"https://github.com/expo/eas-cli/releases/tag/v25.1.1","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":1,"composition":{"bugs":1,"features":0,"enhancements":0},"publishedAt":"2026-10-16T21:37:47.000Z"},{"id":"rel_Qg_8Jv_R113ugdWsO0NUd","title":"EAS CLI v24.14.0 adds --platform to Maestro workflow insights","path":"/release/rel_Qg_8Jv_R113ugdWsO0NUd-maestro-insights-now-list-runs-and-flows-per-platform","url":"https://github.com/expo/eas-cli/releases/tag/v24.14.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":2,"composition":{"bugs":1,"features":1,"enhancements":0},"publishedAt":"2026-10-14T21:10:56.000Z"}]},{"heading":"SvelteKit hardens CSP, Nuxt cleans up routing","anchor":"sveltekit-hardens-csp-nuxt-cleans-up-routing","lede":"SvelteKit's batch leaned toward server-side correctness: the kit added CSP report-sha256/384/512 reporting keywords and an endpoint span for tracing, with a fix for projects nested in a server directory wrongly treating every module as server-only.","releaseIds":["rel_A5uNcwZQYUb88cXIwh-GU","rel_zhUPUn6cWTGid-n0VfBia","rel_HTJdpa7te7uLUo9lvUheL","rel_M421qoPkQSSIysWMbv9S7","rel_lbSA7wf6qpTCxKOvJT2-G"],"releases":[{"id":"rel_A5uNcwZQYUb88cXIwh-GU","title":"@sveltejs/kit@3.1.0","path":"/release/rel_A5uNcwZQYUb88cXIwh-GU-sveltejs-kit-3-1-0","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-14T22:32:57.000Z"},{"id":"rel_zhUPUn6cWTGid-n0VfBia","title":"@sveltejs/package@3.0.1","path":"/release/rel_zhUPUn6cWTGid-n0VfBia-sveltejs-package-3-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-14T22:33:00.000Z"},{"id":"rel_HTJdpa7te7uLUo9lvUheL","title":"@sveltejs/adapter-vercel@7.0.1","path":"/release/rel_HTJdpa7te7uLUo9lvUheL-sveltejs-adapter-vercel-7-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%407.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-14T22:32:54.000Z"},{"id":"rel_M421qoPkQSSIysWMbv9S7","title":"@sveltejs/adapter-cloudflare@8.0.1","path":"/release/rel_M421qoPkQSSIysWMbv9S7-sveltejs-adapter-cloudflare-8-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-14T22:32:51.000Z"},{"id":"rel_lbSA7wf6qpTCxKOvJT2-G","title":"Nuxt v4.6.2 fixes server island head sanitization and route rule matching","path":"/release/rel_lbSA7wf6qpTCxKOvJT2-G-server-island-head-sanitized-route-rules-match-case-insensitively","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.2","org":{"slug":"nuxt","name":"Nuxt","avatarUrl":"https://media.releases.sh/orgs/nuxt.png","githubHandle":"nuxt"},"product":null,"importance":2,"composition":{"bugs":26,"features":0,"enhancements":1},"publishedAt":"2026-10-16T17:21:23.000Z"}]}]}}