javascript

Angular's maintainers published four GitHub advisories between September 23 and October 1 covering router and platform-server flaws in server-side rendering, three rated High.

SvelteKit 3.0 was released October 1, moving configuration into vite.config.ts, replacing $lib with #lib, and requiring Vite 8, TypeScript 6 and Node 22.17.

Vercel's Next.js team released 16.3.8 and 15.5.27 fixing one high, five medium and one low severity flaw; a critical and a high fix were postponed over upstream delays.

Mozilla released Firefox 156 on September 15, 2026, with scheduler and Promise.try fixes, TLS group removals, a roughly 45% faster PDF viewer startup and new enterprise policies.

Vercel shipped Next.js 16.3.6 to fix a critical, 9.5-rated remote code execution flaw in ImageResponse rooted in a Satori SVG-escaping bug, CVE-2026-94545.

Node.js 26.9.0 adds a global Worker class implementing the WHATWG Web Worker API and enables the experimental node:ffi module by default.

The indexed-btree npm package evades npm v12's install-script blocking by hiding its malware loader inside a runtime method instead, Checkmarx reports.

htmx skipped version 3 and shipped 4.0, replacing XMLHttpRequest with fetch(), building in morphing swaps, and requiring an :inherited suffix for attribute inheritance.

vlt, a JavaScript package manager built by npm's original developers, ships 1.0 with hosted registries that block malware and phased installs that stop scripts from running automatically.

pnpm 12 replaces the package manager's TypeScript/Node.js implementation with Rust, with independent Vercel Turborepo testing showing median install-time cuts of 64.4% to 90.5%.

Bun 1.4, released August 20, is the first stable version built entirely on the runtime's contested Rust rewrite, delivering 30x faster package installs and 5x lower idle CPU usage.

Node.js shipped 11 CVE fixes across three High-severity HTTP/2 and Permission Model bugs on July 29, after two delays, while EOL versions 18 and 20 get nothing upstream.