{"collection":{"slug":"frontend-frameworks","name":"Frontend Frameworks"},"digest":{"id":"cwd_olQL1W6Qf7SDzefsVOzvr","weekStart":"2026-10-26","title":"DevTools rebuilding on shared foundations while security patches land","intro":"Nuxt DevTools v4 rebuilds on Devframe and Vite DevTools to inherit the wider ecosystem, Nuxt patches Vite dev server file-read and path traversal flaws, and EAS CLI 26 drops legacy artifact exports as a breaking change.","body":"### Shared foundations for devtools\n\nThe biggest story of the week is Nuxt DevTools v4, which [rebuilds the extension on Devframe and Vite DevTools](/release/rel_aNcOcWDXBpyqCS3pUellH-nuxt-devtools-v4-rebuilds-on-devframe-and-vite-devtools-ships-full-vue-devtools) rather than maintaining its own scaffolding. That shift means Nuxt now plugs into the broader devtools ecosystem, and it also stops vendoring Vue DevTools — users get the full, current Vue DevTools with all its features instead of a trimmed copy. The old `@nuxt/devtools-kit` API still resolves through a warning shim, but module authors are being steered toward replacements like `ctx.docks.register`, `ctx.scope().rpc.register`, and `ctx.terminals.startChildProcess`. DevTools v4 ships with Nuxt v5 and works with v4.5+.\n\n### Hardening the dev server\n\nNuxt's patch release this week is a security one: the framework [closes Vite dev server holes](/release/rel_AKYgNscD_6hJ6EZk7Y3nA-nuxt-v4-6-3-patches-vite-dev-server-file-read-and-path-traversal-flaws) that could let client error reports name files for the server to read, expose Nitro dev output or the generated app secret, and mishandle dot segments in request paths. Redirect route rules now apply to page islands, and the release bundles performance work on Vite server builds plus a batch of route-rule and cookie-sync fixes. Anyone running a dev server in a shared or exposed environment should take it.\n\n### EAS CLI turns automation-friendly, with one break\n\nExpo's CLI had a busy week. The headline is the breaking change in [EAS CLI 26 removing legacy artifact type exports](/release/rel_-lxg2UB7lYXNJI3arED5l-eas-cli-v26-0-0-removes-legacy-artifact-type-exports-in-breaking-change), routing workflow uploads through workflow storage without file-type categories; build profiles also gain a `permissions.account.role` field, Android emulators default to 4 GiB of RAM to curb ADB disconnects, and secret masking now covers every field of uploaded job log records. Later updates made workflows more scriptable: [queued runs are now visible](/release/rel_xpaZUSpJ_5BoU6_QIOALi-eas-cli-v27-1-0-shows-queued-workflow-runs-and-honors-non-interactive-in) in `workflow:run --wait` and `workflow:status`, `workflow:cancel` includes queued runs and actually honors `--non-interactive` instead of hanging on a picker, and the CLI now fails when it can't pull environment variables rather than continuing without them. A further batch added [trace inspection commands and a warmed iOS simulator](/release/rel_cVLBhjF8Vjq4XEHhvY6LB-eas-cli-v27-2-0-adds-observe-traces-commands-and-warm-ios-simulator-launcher), with `eas observe:traces` and `eas observe:trace` for span trees and a new `@expo/simulator-launcher` that boots simulators ahead of time.\n\n### SvelteKit's broad patch sweep\n\nSvelteKit shipped a coordinated round of patches. The framework [fixes reroute and snapshot behavior](/release/rel_3OH7Z_IoQP0fHUnQl6nDu-sveltejs-kit-3-1-1) — malformed rewritten paths return a 400 instead of throwing, function snapshots restore on reload when SSR is disabled, and non-exported `query.batch` functions no longer share a batch. The adapters follow: [Vercel](/release/rel_AFIS4pQomcNeGgcd1_85I-sveltejs-adapter-vercel-7-0-2) and [static](/release/rel_8Mqmz1iH0k83fTxiaAXAw-sveltejs-adapter-static-4-0-1) escape prerendered paths to avoid route-pattern surprises, [Cloudflare](/release/rel_osmEw5cK-GaaYP2opBlf8-sveltejs-adapter-cloudflare-8-0-2) stops prerendered paths from creating unintended `_redirects` and `_routes.json` rules, and [Node](/release/rel_7FJvQO_2k8SbdTQHDyq5c-sveltejs-adapter-node-6-0-1) no longer crashes on immutable-header `text/event-stream` responses. The packaging tool [exits cleanly when preprocessors leave resources running](/release/rel__GL3zxwVoK6Fh8FqNzslb-sveltejs-package-3-0-2). Svelte core also [fixed accessibility role fallbacks and hydration attribute writes](/release/rel_fatm365ZpoKzukIB26-Su-svelte-5-57-3).\n\nQuieter: Next.js canary and Turbopack tuned module-graph resolution, with [React canaries upgraded](/release/rel_SNxvzce0JaFTVGIl5IKVU-next-js-v16-5-0-canary-36-upgrades-react-and-resolves-per-module-turbopack-data) alongside.","releaseIds":["rel_aNcOcWDXBpyqCS3pUellH","rel_AKYgNscD_6hJ6EZk7Y3nA","rel_-lxg2UB7lYXNJI3arED5l","rel_xpaZUSpJ_5BoU6_QIOALi","rel_cVLBhjF8Vjq4XEHhvY6LB","rel_3OH7Z_IoQP0fHUnQl6nDu","rel_AFIS4pQomcNeGgcd1_85I","rel_8Mqmz1iH0k83fTxiaAXAw","rel_osmEw5cK-GaaYP2opBlf8","rel_7FJvQO_2k8SbdTQHDyq5c","rel__GL3zxwVoK6Fh8FqNzslb","rel_fatm365ZpoKzukIB26-Su","rel_SNxvzce0JaFTVGIl5IKVU"],"releaseCount":13,"generatedAt":"2026-11-02T06:19:32.341Z","releases":[{"id":"rel_aNcOcWDXBpyqCS3pUellH","title":"Nuxt DevTools v4 rebuilds on Devframe and Vite DevTools, ships full Vue DevTools","path":"/release/rel_aNcOcWDXBpyqCS3pUellH-devtools-v4-rebuilt-on-devframe-full-vue-devtools-bundled","url":"https://nuxt.com/blog/devtools-v4","org":{"slug":"nuxt","name":"Nuxt","avatarUrl":"https://media.releases.sh/orgs/nuxt.png","githubHandle":"nuxt"},"product":null,"importance":4,"composition":{"bugs":0,"features":1,"enhancements":2},"publishedAt":"2026-10-28T00:00:00.000Z"},{"id":"rel_AKYgNscD_6hJ6EZk7Y3nA","title":"Nuxt v4.6.3 patches Vite dev server file-read and path traversal flaws","path":"/release/rel_AKYgNscD_6hJ6EZk7Y3nA-dev-server-file-reads-locked-down-path-traversal-fixed","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3","org":{"slug":"nuxt","name":"Nuxt","avatarUrl":"https://media.releases.sh/orgs/nuxt.png","githubHandle":"nuxt"},"product":null,"importance":4,"composition":{"bugs":26,"features":0,"enhancements":5},"publishedAt":"2026-10-27T01:02:52.000Z"},{"id":"rel_-lxg2UB7lYXNJI3arED5l","title":"EAS CLI v26.0.0 removes legacy artifact type exports in breaking change","path":"/release/rel_-lxg2UB7lYXNJI3arED5l-legacy-artifact-type-exports-removed-android-emulators-default-to-4-gib","url":"https://github.com/expo/eas-cli/releases/tag/v26.0.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":4,"composition":{"bugs":9,"features":4,"enhancements":3},"publishedAt":"2026-10-26T16:51:48.000Z"},{"id":"rel_xpaZUSpJ_5BoU6_QIOALi","title":"EAS CLI v27.1.0 shows queued workflow runs and honors --non-interactive in workflow:cancel","path":"/release/rel_xpaZUSpJ_5BoU6_QIOALi-queued-workflow-runs-visible-workflow-cancel-honors-non-interactive","url":"https://github.com/expo/eas-cli/releases/tag/v27.1.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":7,"features":2,"enhancements":0},"publishedAt":"2026-10-28T17:14:55.000Z"},{"id":"rel_cVLBhjF8Vjq4XEHhvY6LB","title":"EAS CLI v27.2.0 adds observe:traces commands and warm iOS simulator launcher","path":"/release/rel_cVLBhjF8Vjq4XEHhvY6LB-observe-traces-commands-ship-warm-simulators-serve-multiple-devices","url":"https://github.com/expo/eas-cli/releases/tag/v27.2.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":9,"features":6,"enhancements":2},"publishedAt":"2026-10-30T00:41:21.000Z"},{"id":"rel_3OH7Z_IoQP0fHUnQl6nDu","title":"@sveltejs/kit@3.1.1","path":"/release/rel_3OH7Z_IoQP0fHUnQl6nDu-sveltejs-kit-3-1-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:23.000Z"},{"id":"rel_AFIS4pQomcNeGgcd1_85I","title":"@sveltejs/adapter-vercel@7.0.2","path":"/release/rel_AFIS4pQomcNeGgcd1_85I-sveltejs-adapter-vercel-7-0-2","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%407.0.2","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:20.000Z"},{"id":"rel_8Mqmz1iH0k83fTxiaAXAw","title":"@sveltejs/adapter-static@4.0.1","path":"/release/rel_8Mqmz1iH0k83fTxiaAXAw-sveltejs-adapter-static-4-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-static%404.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:18.000Z"},{"id":"rel_osmEw5cK-GaaYP2opBlf8","title":"@sveltejs/adapter-cloudflare@8.0.2","path":"/release/rel_osmEw5cK-GaaYP2opBlf8-sveltejs-adapter-cloudflare-8-0-2","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.2","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:11.000Z"},{"id":"rel_7FJvQO_2k8SbdTQHDyq5c","title":"@sveltejs/adapter-node@6.0.1","path":"/release/rel_7FJvQO_2k8SbdTQHDyq5c-sveltejs-adapter-node-6-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-node%406.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:15.000Z"},{"id":"rel__GL3zxwVoK6Fh8FqNzslb","title":"@sveltejs/package@3.0.2","path":"/release/rel__GL3zxwVoK6Fh8FqNzslb-sveltejs-package-3-0-2","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.2","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:27.000Z"},{"id":"rel_fatm365ZpoKzukIB26-Su","title":"svelte@5.57.3","path":"/release/rel_fatm365ZpoKzukIB26-Su-svelte-5-57-3","url":"https://github.com/sveltejs/svelte/releases/tag/svelte%405.57.3","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"svelte","name":"Svelte"},"importance":null,"composition":null,"publishedAt":"2026-10-26T18:15:06.000Z"},{"id":"rel_SNxvzce0JaFTVGIl5IKVU","title":"Next.js v16.5.0-canary.36 upgrades React and resolves per-module Turbopack data once","path":"/release/rel_SNxvzce0JaFTVGIl5IKVU-turbopack-resolves-per-module-data-once-react-upgraded","url":"https://github.com/vercel/next.js/releases/tag/v16.5.0-canary.36","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1,"composition":{"bugs":0,"features":0,"enhancements":1},"publishedAt":"2026-10-31T23:42:35.000Z"}],"sections":[{"heading":"Shared foundations for devtools","anchor":"shared-foundations-for-devtools","lede":"The biggest story of the week is Nuxt DevTools v4, which rebuilds the extension on Devframe and Vite DevTools rather than maintaining its own scaffolding.","releaseIds":["rel_aNcOcWDXBpyqCS3pUellH"],"releases":[{"id":"rel_aNcOcWDXBpyqCS3pUellH","title":"Nuxt DevTools v4 rebuilds on Devframe and Vite DevTools, ships full Vue DevTools","path":"/release/rel_aNcOcWDXBpyqCS3pUellH-devtools-v4-rebuilt-on-devframe-full-vue-devtools-bundled","url":"https://nuxt.com/blog/devtools-v4","org":{"slug":"nuxt","name":"Nuxt","avatarUrl":"https://media.releases.sh/orgs/nuxt.png","githubHandle":"nuxt"},"product":null,"importance":4,"composition":{"bugs":0,"features":1,"enhancements":2},"publishedAt":"2026-10-28T00:00:00.000Z"}]},{"heading":"Hardening the dev server","anchor":"hardening-the-dev-server","lede":"Nuxt's patch release this week is a security one: the framework closes Vite dev server holes that could let client error reports name files for the server to read, expose Nitro dev output or the generated app secret, and mishandle dot segments in request paths.","releaseIds":["rel_AKYgNscD_6hJ6EZk7Y3nA"],"releases":[{"id":"rel_AKYgNscD_6hJ6EZk7Y3nA","title":"Nuxt v4.6.3 patches Vite dev server file-read and path traversal flaws","path":"/release/rel_AKYgNscD_6hJ6EZk7Y3nA-dev-server-file-reads-locked-down-path-traversal-fixed","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3","org":{"slug":"nuxt","name":"Nuxt","avatarUrl":"https://media.releases.sh/orgs/nuxt.png","githubHandle":"nuxt"},"product":null,"importance":4,"composition":{"bugs":26,"features":0,"enhancements":5},"publishedAt":"2026-10-27T01:02:52.000Z"}]},{"heading":"EAS CLI turns automation-friendly, with one break","anchor":"eas-cli-turns-automation-friendly-with-one-break","lede":"Expo's CLI had a busy week.","releaseIds":["rel_-lxg2UB7lYXNJI3arED5l","rel_xpaZUSpJ_5BoU6_QIOALi","rel_cVLBhjF8Vjq4XEHhvY6LB"],"releases":[{"id":"rel_-lxg2UB7lYXNJI3arED5l","title":"EAS CLI v26.0.0 removes legacy artifact type exports in breaking change","path":"/release/rel_-lxg2UB7lYXNJI3arED5l-legacy-artifact-type-exports-removed-android-emulators-default-to-4-gib","url":"https://github.com/expo/eas-cli/releases/tag/v26.0.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":4,"composition":{"bugs":9,"features":4,"enhancements":3},"publishedAt":"2026-10-26T16:51:48.000Z"},{"id":"rel_xpaZUSpJ_5BoU6_QIOALi","title":"EAS CLI v27.1.0 shows queued workflow runs and honors --non-interactive in workflow:cancel","path":"/release/rel_xpaZUSpJ_5BoU6_QIOALi-queued-workflow-runs-visible-workflow-cancel-honors-non-interactive","url":"https://github.com/expo/eas-cli/releases/tag/v27.1.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":7,"features":2,"enhancements":0},"publishedAt":"2026-10-28T17:14:55.000Z"},{"id":"rel_cVLBhjF8Vjq4XEHhvY6LB","title":"EAS CLI v27.2.0 adds observe:traces commands and warm iOS simulator launcher","path":"/release/rel_cVLBhjF8Vjq4XEHhvY6LB-observe-traces-commands-ship-warm-simulators-serve-multiple-devices","url":"https://github.com/expo/eas-cli/releases/tag/v27.2.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":9,"features":6,"enhancements":2},"publishedAt":"2026-10-30T00:41:21.000Z"}]},{"heading":"SvelteKit's broad patch sweep","anchor":"sveltekits-broad-patch-sweep","lede":"SvelteKit shipped a coordinated round of patches.","releaseIds":["rel_3OH7Z_IoQP0fHUnQl6nDu","rel_AFIS4pQomcNeGgcd1_85I","rel_8Mqmz1iH0k83fTxiaAXAw","rel_osmEw5cK-GaaYP2opBlf8","rel_7FJvQO_2k8SbdTQHDyq5c","rel__GL3zxwVoK6Fh8FqNzslb","rel_fatm365ZpoKzukIB26-Su","rel_SNxvzce0JaFTVGIl5IKVU"],"releases":[{"id":"rel_3OH7Z_IoQP0fHUnQl6nDu","title":"@sveltejs/kit@3.1.1","path":"/release/rel_3OH7Z_IoQP0fHUnQl6nDu-sveltejs-kit-3-1-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:23.000Z"},{"id":"rel_AFIS4pQomcNeGgcd1_85I","title":"@sveltejs/adapter-vercel@7.0.2","path":"/release/rel_AFIS4pQomcNeGgcd1_85I-sveltejs-adapter-vercel-7-0-2","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%407.0.2","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:20.000Z"},{"id":"rel_8Mqmz1iH0k83fTxiaAXAw","title":"@sveltejs/adapter-static@4.0.1","path":"/release/rel_8Mqmz1iH0k83fTxiaAXAw-sveltejs-adapter-static-4-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-static%404.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:18.000Z"},{"id":"rel_osmEw5cK-GaaYP2opBlf8","title":"@sveltejs/adapter-cloudflare@8.0.2","path":"/release/rel_osmEw5cK-GaaYP2opBlf8-sveltejs-adapter-cloudflare-8-0-2","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%408.0.2","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:11.000Z"},{"id":"rel_7FJvQO_2k8SbdTQHDyq5c","title":"@sveltejs/adapter-node@6.0.1","path":"/release/rel_7FJvQO_2k8SbdTQHDyq5c-sveltejs-adapter-node-6-0-1","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-node%406.0.1","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:15.000Z"},{"id":"rel__GL3zxwVoK6Fh8FqNzslb","title":"@sveltejs/package@3.0.2","path":"/release/rel__GL3zxwVoK6Fh8FqNzslb-sveltejs-package-3-0-2","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.2","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-10-29T23:47:27.000Z"},{"id":"rel_fatm365ZpoKzukIB26-Su","title":"svelte@5.57.3","path":"/release/rel_fatm365ZpoKzukIB26-Su-svelte-5-57-3","url":"https://github.com/sveltejs/svelte/releases/tag/svelte%405.57.3","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"svelte","name":"Svelte"},"importance":null,"composition":null,"publishedAt":"2026-10-26T18:15:06.000Z"},{"id":"rel_SNxvzce0JaFTVGIl5IKVU","title":"Next.js v16.5.0-canary.36 upgrades React and resolves per-module Turbopack data once","path":"/release/rel_SNxvzce0JaFTVGIl5IKVU-turbopack-resolves-per-module-data-once-react-upgraded","url":"https://github.com/vercel/next.js/releases/tag/v16.5.0-canary.36","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1,"composition":{"bugs":0,"features":0,"enhancements":1},"publishedAt":"2026-10-31T23:42:35.000Z"}]}]}}