DevTools rebuilding on shared foundations while security patches land

Shared foundations for devtools

The biggest story of the week is Nuxt DevTools v4, which rebuilds the extension on Devframe and Vite DevTools rather than maintaining its own scaffolding. That shift means Nuxt now plugs into the broader devtools ecosystem, and it also stops vendoring Vue DevTools — users get the full, current Vue DevTools with all its features instead of a trimmed copy. The old @nuxt/devtools-kit API still resolves through a warning shim, but module authors are being steered toward replacements like ctx.docks.register, ctx.scope().rpc.register, and ctx.terminals.startChildProcess. DevTools v4 ships with Nuxt v5 and works with v4.5+.

Hardening the dev server

Nuxt's patch release this week is a security one: the framework closes Vite dev server holes that could let client error reports name files for the server to read, expose Nitro dev output or the generated app secret, and mishandle dot segments in request paths. Redirect route rules now apply to page islands, and the release bundles performance work on Vite server builds plus a batch of route-rule and cookie-sync fixes. Anyone running a dev server in a shared or exposed environment should take it.

EAS CLI turns automation-friendly, with one break

Expo's CLI had a busy week. The headline is the breaking change in EAS CLI 26 removing legacy artifact type exports, routing workflow uploads through workflow storage without file-type categories; build profiles also gain a permissions.account.role field, Android emulators default to 4 GiB of RAM to curb ADB disconnects, and secret masking now covers every field of uploaded job log records. Later updates made workflows more scriptable: queued runs are now visible in workflow:run --wait and workflow:status, workflow:cancel includes queued runs and actually honors --non-interactive instead of hanging on a picker, and the CLI now fails when it can't pull environment variables rather than continuing without them. A further batch added trace inspection commands and a warmed iOS simulator, with eas observe:traces and eas observe:trace for span trees and a new @expo/simulator-launcher that boots simulators ahead of time.

SvelteKit's broad patch sweep

SvelteKit shipped a coordinated round of patches. The framework fixes reroute and snapshot behavior — malformed rewritten paths return a 400 instead of throwing, function snapshots restore on reload when SSR is disabled, and non-exported query.batch functions no longer share a batch. The adapters follow: Vercel and static escape prerendered paths to avoid route-pattern surprises, Cloudflare stops prerendered paths from creating unintended _redirects and _routes.json rules, and Node no longer crashes on immutable-header text/event-stream responses. The packaging tool exits cleanly when preprocessors leave resources running. Svelte core also fixed accessibility role fallbacks and hydration attribute writes.

Quieter: Next.js canary and Turbopack tuned module-graph resolution, with React canaries upgraded alongside.