{"collection":{"slug":"frontend-frameworks","name":"Frontend Frameworks"},"digest":{"id":"cwd_Px2FADpiQe8VEBJAnUo1y","weekStart":"2026-11-02","title":"Frameworks spend the week closing security holes","intro":"Nuxt shipped an emergency security release patching eleven advisories across Nuxt and Nitro, while Next.js patched cache disclosure and poisoning flaws in its use cache layer. SvelteKit, meanwhile, closed a path traversal bug and hardened its adapters.","body":"### Nuxt patches eleven advisories in one release\n\nNuxt's week was dominated by a single, urgent release: an [eight-advisory security patch in Nuxt itself that also pulls in three Nitro fixes](/release/rel_iA-8YVrWrz_GB8yfREutk-nuxt-v4-6-4-security-release-fixes-eight-nuxt-and-three-nitro-advisories) via nitropack 2.13.6. The maintainers recommend upgrading as soon as possible, and most apps won't notice the accompanying behavior changes — but a few are worth knowing about. Server render failures in production now show only generic error details in the page and payload unless the error was created through `createError`, and the webpack and rspack dev servers reject unexpected `Host` headers unless they appear in `devServer.allowedHosts`. Cached route rules got narrower too: they only cache `GET` and `HEAD` requests and skip any response that sets cookies or sends `Cache-Control: private` or `no-store`. If you rely on route rules for anything with per-user data, audit those rules before deploying.\n\n### Next.js locks down its cache layer\n\nNext.js spent the week on cache security, with one advisory set affecting both the current and LTS lines. The [cache disclosure and poisoning fixes in the current release](/release/rel_d3_6AoltBMiZM8835WVoZ-next-js-v16-4-5-patches-cache-disclosure-and-poisoning-advisories) cover six moderate advisories: cross-tenant data leaking through `use cache` when called via `unstable_cache`, a follow-up cache leak across root param values in nested cached functions, cache poisoning of shared fallback shells in Cache Components, and response injection in self-hosted apps that forward fetched responses. The same release closes an SVG rejection bypass in image optimization and stops Edge runtime routes from exposing HttpOnly cookies through an internal response header. Teams on the older line get the [equivalent injection, SVG, and cookie fixes backported to LTS](/release/rel_pN3Jg2kFB65-KRZib1hOt-next-js-15-5-29-patches-moderate-cross-client-response-injection-and-svg-bypass), so there's no reason to stay exposed on either track.\n\nAway from security, Next.js smoothed out a few Turbopack rough edges: [missed startup CSS updates now trigger a reload and the PPR resume picks up the CSP nonce](/release/rel_Gt9xfhhI8Rtn9HaCrxEZF-next-js-v16-4-4-backports-turbopack-css-reload-and-ppr-csp-nonce-fixes) on the shared-runtime bootstrap, alongside a switch from `jsonwebtoken` to `fast-jwt`. Canary users, meanwhile, can now put a [turbopackIgnore comment on `new URL()`](/release/rel_QSq_P3NMMrHc1TB4SU4or-next-js-v16-5-0-canary-45-adds-turbopackignore-support-for-new-url), useful when a URL needs to survive bundling untouched.\n\n### SvelteKit hardens prerendering and server routing\n\nSvelteKit's batch of patches reads like a prerendering audit. The core kit release [returns a 400 instead of throwing when `reroute` rewrites a malformed pathname, escapes cache-control headers in prerendered HTML, and blocks path traversal when previewing prerendered pages on Windows](/release/rel_GeYyN5crAzzN1mq3uhS4Y-sveltejs-kit-2-70-4), plus stops server-side route resolution from pulling code out of another origin. The downstream adapters inherited pieces of the same fixes: [Cloudflare's adapter stops prerendered paths from creating stray `_redirects` and `_routes.json` rules](/release/rel_wrM2F5rxDvugedJr5KNFt-sveltejs-adapter-cloudflare-7-2-10), [adapter-static escapes prerendered paths used in Vercel route patterns](/release/rel_3GM95UE8bfskVd6CotSxk-sveltejs-adapter-static-3-0-11), and [adapter-vercel does the same while accepting every Node.js version from 26 on rather than only even ones](/release/rel_MdFTG18xlS0WyCJRTiNGj-sveltejs-adapter-vercel-6-3-5). Node users also got a targeted fix: [adapter-node no longer crashes the server when an event-stream response has immutable headers](/release/rel_yvQWeIrsqpcxnJp3NcUo8-sveltejs-adapter-node-5-5-8).\n\n### Expo sharpens simulator workflows and capability sync\n\nEAS CLI's week centered on making the warm iOS Simulator a real workflow primitive. New build steps let [Appium sessions and agent-device runners share a warm Simulator or fall back to a cold start](/release/rel_GxK-pbSUwU6EVt54-6cB5-eas-cli-v27-4-0-adds-warm-ios-simulator-session-steps), and the launcher [waits for a warm launcher that's already starting instead of racing it with a cold boot](/release/rel_Sq67QBmA89BDMeSOfOAbn-eas-cli-v27-4-1-waits-for-warm-simulator-launcher-instead-of-cold-start). On top of that, simulator control connections can now [stay open with `--keep-alive`, be inspected or closed on demand, and be driven from imported action configurations](/release/rel_vwG7p71xHOVYfw8sDxag6-eas-cli-27-5-0-adds-persistent-simulator-control-connections). Secret handling got a useful hardening pass too: [the worker now masks secrets in every record it writes to stdout](/release/rel_u2T7RZW2sJSHuWdSgyXAi-eas-cli-27-3-0-masks-worker-secrets-and-fixes-ios-capability-sync), and iOS capability sync no longer loses already linked App Groups, Merchant IDs, or iCloud containers when new identifiers are linked.","releaseIds":["rel_iA-8YVrWrz_GB8yfREutk","rel_d3_6AoltBMiZM8835WVoZ","rel_pN3Jg2kFB65-KRZib1hOt","rel_Gt9xfhhI8Rtn9HaCrxEZF","rel_QSq_P3NMMrHc1TB4SU4or","rel_GeYyN5crAzzN1mq3uhS4Y","rel_wrM2F5rxDvugedJr5KNFt","rel_3GM95UE8bfskVd6CotSxk","rel_MdFTG18xlS0WyCJRTiNGj","rel_yvQWeIrsqpcxnJp3NcUo8","rel_GxK-pbSUwU6EVt54-6cB5","rel_Sq67QBmA89BDMeSOfOAbn","rel_vwG7p71xHOVYfw8sDxag6","rel_u2T7RZW2sJSHuWdSgyXAi"],"releaseCount":14,"generatedAt":"2026-11-09T06:18:20.849Z","releases":[{"id":"rel_iA-8YVrWrz_GB8yfREutk","title":"Nuxt v4.6.4 security release fixes eight Nuxt and three Nitro advisories","path":"/release/rel_iA-8YVrWrz_GB8yfREutk-security-release-11-advisories-fixed-dev-host-checks-added","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4","org":{"slug":"nuxt","name":"Nuxt","avatarUrl":"https://media.releases.sh/orgs/nuxt.png","githubHandle":"nuxt"},"product":null,"importance":4,"composition":{"bugs":30,"features":1,"enhancements":5},"publishedAt":"2026-11-02T20:39:24.000Z"},{"id":"rel_d3_6AoltBMiZM8835WVoZ","title":"Next.js v16.4.5 patches cache disclosure and poisoning advisories","path":"/release/rel_d3_6AoltBMiZM8835WVoZ-use-cache-leaks-and-poisoning-get-patched","url":"https://github.com/vercel/next.js/releases/tag/v16.4.5","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3,"composition":{"bugs":6,"features":0,"enhancements":0},"publishedAt":"2026-11-03T18:38:39.000Z"},{"id":"rel_pN3Jg2kFB65-KRZib1hOt","title":"Next.js 15.5.29 patches moderate cross-client response injection and SVG bypass","path":"/release/rel_pN3Jg2kFB65-KRZib1hOt-cross-client-response-injection-and-svg-bypass-patched","url":"https://github.com/vercel/next.js/releases/tag/v15.5.29","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3,"composition":{"bugs":3,"features":0,"enhancements":0},"publishedAt":"2026-11-03T18:38:27.000Z"},{"id":"rel_Gt9xfhhI8Rtn9HaCrxEZF","title":"Next.js v16.4.4 backports Turbopack CSS reload and PPR CSP nonce fixes","path":"/release/rel_Gt9xfhhI8Rtn9HaCrxEZF-turbopack-css-updates-no-longer-missed-ppr-resume-gets-csp-nonce","url":"https://github.com/vercel/next.js/releases/tag/v16.4.4","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2,"composition":{"bugs":4,"features":0,"enhancements":1},"publishedAt":"2026-11-02T16:41:08.000Z"},{"id":"rel_QSq_P3NMMrHc1TB4SU4or","title":"Next.js v16.5.0-canary.45 adds turbopackIgnore support for new URL()","path":"/release/rel_QSq_P3NMMrHc1TB4SU4or-turbopack-honors-turbopackignore-on-new-url","url":"https://github.com/vercel/next.js/releases/tag/v16.5.0-canary.45","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1,"composition":{"bugs":0,"features":1,"enhancements":3},"publishedAt":"2026-11-08T23:47:13.000Z"},{"id":"rel_GeYyN5crAzzN1mq3uhS4Y","title":"@sveltejs/kit@2.70.4","path":"/release/rel_GeYyN5crAzzN1mq3uhS4Y-sveltejs-kit-2-70-4","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%402.70.4","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:28:53.000Z"},{"id":"rel_wrM2F5rxDvugedJr5KNFt","title":"@sveltejs/adapter-cloudflare@7.2.10","path":"/release/rel_wrM2F5rxDvugedJr5KNFt-sveltejs-adapter-cloudflare-7-2-10","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%407.2.10","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:28:50.000Z"},{"id":"rel_3GM95UE8bfskVd6CotSxk","title":"@sveltejs/adapter-static@3.0.11","path":"/release/rel_3GM95UE8bfskVd6CotSxk-sveltejs-adapter-static-3-0-11","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-static%403.0.11","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:28:56.000Z"},{"id":"rel_MdFTG18xlS0WyCJRTiNGj","title":"@sveltejs/adapter-vercel@6.3.5","path":"/release/rel_MdFTG18xlS0WyCJRTiNGj-sveltejs-adapter-vercel-6-3-5","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%406.3.5","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:28:59.000Z"},{"id":"rel_yvQWeIrsqpcxnJp3NcUo8","title":"@sveltejs/adapter-node@5.5.8","path":"/release/rel_yvQWeIrsqpcxnJp3NcUo8-sveltejs-adapter-node-5-5-8","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-node%405.5.8","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:29:02.000Z"},{"id":"rel_GxK-pbSUwU6EVt54-6cB5","title":"EAS CLI v27.4.0 adds warm iOS Simulator session steps","path":"/release/rel_GxK-pbSUwU6EVt54-6cB5-warm-simulator-session-steps-for-ios-builds","url":"https://github.com/expo/eas-cli/releases/tag/v27.4.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":2,"composition":{"bugs":4,"features":3,"enhancements":1},"publishedAt":"2026-11-03T17:40:36.000Z"},{"id":"rel_Sq67QBmA89BDMeSOfOAbn","title":"EAS CLI v27.4.1 waits for warm Simulator launcher instead of cold start","path":"/release/rel_Sq67QBmA89BDMeSOfOAbn-simulator-launcher-now-waits-for-warm-session-before-cold-start","url":"https://github.com/expo/eas-cli/releases/tag/v27.4.1","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":1,"composition":{"bugs":1,"features":0,"enhancements":0},"publishedAt":"2026-11-04T00:25:43.000Z"},{"id":"rel_vwG7p71xHOVYfw8sDxag6","title":"EAS CLI 27.5.0 adds persistent simulator control connections","path":"/release/rel_vwG7p71xHOVYfw8sDxag6-simulator-control-connections-persist-via-keep-alive","url":"https://github.com/expo/eas-cli/releases/tag/v27.5.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":6,"features":4,"enhancements":0},"publishedAt":"2026-11-05T23:06:33.000Z"},{"id":"rel_u2T7RZW2sJSHuWdSgyXAi","title":"EAS CLI 27.3.0 masks worker secrets and fixes iOS capability sync","path":"/release/rel_u2T7RZW2sJSHuWdSgyXAi-worker-secrets-masked-in-all-stdout-records-ios-capability-sync-fixed","url":"https://github.com/expo/eas-cli/releases/tag/v27.3.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":6,"features":1,"enhancements":0},"publishedAt":"2026-11-03T02:53:59.000Z"}],"sections":[{"heading":"Nuxt patches eleven advisories in one release","anchor":"nuxt-patches-eleven-advisories-in-one-release","lede":"Nuxt's week was dominated by a single, urgent release: an eight-advisory security patch in Nuxt itself that also pulls in three Nitro fixes via nitropack 2.13.6.","releaseIds":["rel_iA-8YVrWrz_GB8yfREutk"],"releases":[{"id":"rel_iA-8YVrWrz_GB8yfREutk","title":"Nuxt v4.6.4 security release fixes eight Nuxt and three Nitro advisories","path":"/release/rel_iA-8YVrWrz_GB8yfREutk-security-release-11-advisories-fixed-dev-host-checks-added","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4","org":{"slug":"nuxt","name":"Nuxt","avatarUrl":"https://media.releases.sh/orgs/nuxt.png","githubHandle":"nuxt"},"product":null,"importance":4,"composition":{"bugs":30,"features":1,"enhancements":5},"publishedAt":"2026-11-02T20:39:24.000Z"}]},{"heading":"Next.js locks down its cache layer","anchor":"next-js-locks-down-its-cache-layer","lede":"Next.js spent the week on cache security, with one advisory set affecting both the current and LTS lines.","releaseIds":["rel_d3_6AoltBMiZM8835WVoZ","rel_pN3Jg2kFB65-KRZib1hOt","rel_Gt9xfhhI8Rtn9HaCrxEZF","rel_QSq_P3NMMrHc1TB4SU4or"],"releases":[{"id":"rel_d3_6AoltBMiZM8835WVoZ","title":"Next.js v16.4.5 patches cache disclosure and poisoning advisories","path":"/release/rel_d3_6AoltBMiZM8835WVoZ-use-cache-leaks-and-poisoning-get-patched","url":"https://github.com/vercel/next.js/releases/tag/v16.4.5","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3,"composition":{"bugs":6,"features":0,"enhancements":0},"publishedAt":"2026-11-03T18:38:39.000Z"},{"id":"rel_pN3Jg2kFB65-KRZib1hOt","title":"Next.js 15.5.29 patches moderate cross-client response injection and SVG bypass","path":"/release/rel_pN3Jg2kFB65-KRZib1hOt-cross-client-response-injection-and-svg-bypass-patched","url":"https://github.com/vercel/next.js/releases/tag/v15.5.29","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":3,"composition":{"bugs":3,"features":0,"enhancements":0},"publishedAt":"2026-11-03T18:38:27.000Z"},{"id":"rel_Gt9xfhhI8Rtn9HaCrxEZF","title":"Next.js v16.4.4 backports Turbopack CSS reload and PPR CSP nonce fixes","path":"/release/rel_Gt9xfhhI8Rtn9HaCrxEZF-turbopack-css-updates-no-longer-missed-ppr-resume-gets-csp-nonce","url":"https://github.com/vercel/next.js/releases/tag/v16.4.4","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":2,"composition":{"bugs":4,"features":0,"enhancements":1},"publishedAt":"2026-11-02T16:41:08.000Z"},{"id":"rel_QSq_P3NMMrHc1TB4SU4or","title":"Next.js v16.5.0-canary.45 adds turbopackIgnore support for new URL()","path":"/release/rel_QSq_P3NMMrHc1TB4SU4or-turbopack-honors-turbopackignore-on-new-url","url":"https://github.com/vercel/next.js/releases/tag/v16.5.0-canary.45","org":{"slug":"vercel","name":"Vercel","avatarUrl":"https://media.releases.sh/orgs/vercel.png","githubHandle":"vercel"},"product":{"slug":"nextjs","name":"Next.js"},"importance":1,"composition":{"bugs":0,"features":1,"enhancements":3},"publishedAt":"2026-11-08T23:47:13.000Z"}]},{"heading":"SvelteKit hardens prerendering and server routing","anchor":"sveltekit-hardens-prerendering-and-server-routing","lede":"SvelteKit's batch of patches reads like a prerendering audit.","releaseIds":["rel_GeYyN5crAzzN1mq3uhS4Y","rel_wrM2F5rxDvugedJr5KNFt","rel_3GM95UE8bfskVd6CotSxk","rel_MdFTG18xlS0WyCJRTiNGj","rel_yvQWeIrsqpcxnJp3NcUo8"],"releases":[{"id":"rel_GeYyN5crAzzN1mq3uhS4Y","title":"@sveltejs/kit@2.70.4","path":"/release/rel_GeYyN5crAzzN1mq3uhS4Y-sveltejs-kit-2-70-4","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%402.70.4","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:28:53.000Z"},{"id":"rel_wrM2F5rxDvugedJr5KNFt","title":"@sveltejs/adapter-cloudflare@7.2.10","path":"/release/rel_wrM2F5rxDvugedJr5KNFt-sveltejs-adapter-cloudflare-7-2-10","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-cloudflare%407.2.10","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:28:50.000Z"},{"id":"rel_3GM95UE8bfskVd6CotSxk","title":"@sveltejs/adapter-static@3.0.11","path":"/release/rel_3GM95UE8bfskVd6CotSxk-sveltejs-adapter-static-3-0-11","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-static%403.0.11","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:28:56.000Z"},{"id":"rel_MdFTG18xlS0WyCJRTiNGj","title":"@sveltejs/adapter-vercel@6.3.5","path":"/release/rel_MdFTG18xlS0WyCJRTiNGj-sveltejs-adapter-vercel-6-3-5","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-vercel%406.3.5","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:28:59.000Z"},{"id":"rel_yvQWeIrsqpcxnJp3NcUo8","title":"@sveltejs/adapter-node@5.5.8","path":"/release/rel_yvQWeIrsqpcxnJp3NcUo8-sveltejs-adapter-node-5-5-8","url":"https://github.com/sveltejs/kit/releases/tag/%40sveltejs/adapter-node%405.5.8","org":{"slug":"svelte","name":"Svelte","avatarUrl":"https://media.releases.sh/orgs/svelte.png","githubHandle":"sveltejs"},"product":{"slug":"sveltekit","name":"SvelteKit"},"importance":null,"composition":null,"publishedAt":"2026-11-05T12:29:02.000Z"}]},{"heading":"Expo sharpens simulator workflows and capability sync","anchor":"expo-sharpens-simulator-workflows-and-capability-sync","lede":"EAS CLI's week centered on making the warm iOS Simulator a real workflow primitive.","releaseIds":["rel_GxK-pbSUwU6EVt54-6cB5","rel_Sq67QBmA89BDMeSOfOAbn","rel_vwG7p71xHOVYfw8sDxag6","rel_u2T7RZW2sJSHuWdSgyXAi"],"releases":[{"id":"rel_GxK-pbSUwU6EVt54-6cB5","title":"EAS CLI v27.4.0 adds warm iOS Simulator session steps","path":"/release/rel_GxK-pbSUwU6EVt54-6cB5-warm-simulator-session-steps-for-ios-builds","url":"https://github.com/expo/eas-cli/releases/tag/v27.4.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":2,"composition":{"bugs":4,"features":3,"enhancements":1},"publishedAt":"2026-11-03T17:40:36.000Z"},{"id":"rel_Sq67QBmA89BDMeSOfOAbn","title":"EAS CLI v27.4.1 waits for warm Simulator launcher instead of cold start","path":"/release/rel_Sq67QBmA89BDMeSOfOAbn-simulator-launcher-now-waits-for-warm-session-before-cold-start","url":"https://github.com/expo/eas-cli/releases/tag/v27.4.1","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":1,"composition":{"bugs":1,"features":0,"enhancements":0},"publishedAt":"2026-11-04T00:25:43.000Z"},{"id":"rel_vwG7p71xHOVYfw8sDxag6","title":"EAS CLI 27.5.0 adds persistent simulator control connections","path":"/release/rel_vwG7p71xHOVYfw8sDxag6-simulator-control-connections-persist-via-keep-alive","url":"https://github.com/expo/eas-cli/releases/tag/v27.5.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":6,"features":4,"enhancements":0},"publishedAt":"2026-11-05T23:06:33.000Z"},{"id":"rel_u2T7RZW2sJSHuWdSgyXAi","title":"EAS CLI 27.3.0 masks worker secrets and fixes iOS capability sync","path":"/release/rel_u2T7RZW2sJSHuWdSgyXAi-worker-secrets-masked-in-all-stdout-records-ios-capability-sync-fixed","url":"https://github.com/expo/eas-cli/releases/tag/v27.3.0","org":{"slug":"expo","name":"Expo","avatarUrl":"https://media.releases.sh/orgs/expo.png","githubHandle":"expo"},"product":null,"importance":3,"composition":{"bugs":6,"features":1,"enhancements":0},"publishedAt":"2026-11-03T02:53:59.000Z"}]}]}}