JavaScript Frameworks Release Notes
Release notes for JavaScript and web frameworks, bundlers and static site generators
Products (10)
Latest JavaScript Frameworks Updates
- Oct 16, 2026
- Date parsed from source:Oct 16, 2026
- First seen by Releasebot:Oct 17, 2026
v6.0.0-alpha.5
Fastify ships an alpha update with performance gains, HTTP behavior fixes, and improved TypeScript support, alongside clearer security and API documentation.
What's Changed
- docs: clarify headers validation is additive, not a sanitized view by @mcollina in #7029
- perf: read the merged headers once in the trust proxy getters by @hktitof in #7039
- types: restrict route lookup methods by @Yanhaoxi in #6963
- fix(types): custom logger instance not assignable to FastifyInstance by @Tony133 in #6901
- fix(types): restore this context in route shorthand hooks by @lazerg in #6975
- perf: decode string bodies once instead of per chunk by @gurgunday in #7049
- docs(ecosystem): add @validex/fastify to community plugins by @chiptoma in #6660
- perf: avoid resetting the level of request child loggers by @gurgunday in #7056
- fix: omit absent compileSerializationSchema metadata instead of passing null by @Kjubikstronk in #7001
- fix: remove error when HTTP QUERY request has empty body by @LiviaMedeiros in #6929
- docs: list fastify-mariadb as a community plugin by @melroy89 in #7062
- fix: resolve reply.mediaType from raw response headers by @agustin18 in #7054
- perf: use a FIFO cache for parsed content-types by @gurgunday in #7071
- docs: remove plugins that do not support Fastify v5 by @ilteoood in #7075
- fix: copy a set-cookie array passed to reply.header instead of storing it by @fadiroot in #7068
- test: fix "recieve" typo in comment by @ump45nose in #7066
- docs: document fastify.query() shorthand for RFC 10008 by @Puppo in #7004
- docs(security): clarify scope of unvalidated template selection by @mcollina in #7065
- docs(ecosystem): Add fastify-mosquitto-dynsec to community plugins by @LuizTakeda in #7064
- docs: clarify reply.redirect encoding does not prevent open redirects by @mcollina in #6964
- docs: fix external link to node docs by @BenMotz in #7088
- test(validation): cover remaining propertyNames header branches by @mcollina in #7105
New Contributors
- @hktitof made their first contribution in #7039
- @Yanhaoxi made their first contribution in #6963
- @chiptoma made their first contribution in #6660
- @Kjubikstronk made their first contribution in #7001
- @agustin18 made their first contribution in #7054
- @fadiroot made their first contribution in #7068
- @ump45nose made their first contribution in #7066
- @LuizTakeda made their first contribution in #7064
- @BenMotz made their first contribution in #7088
Full Changelog: v6.0.0-alpha.4...v6.0.0-alpha.5
Original source - Oct 16, 2026
- Date parsed from source:Oct 16, 2026
- First seen by Releasebot:Oct 17, 2026
v16.4.2
Next.js ships an LTS update with Turbopack fixes for module resolution, dependency cleanup, and dynamic-import chunk collisions, plus turbo-task snapshot consistency and code-frame improvements. It also includes documentation fixes.
What's Changed
- [lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in #100002
- [lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in #100008
- [lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in #100212
- [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in #100209
- [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in #100217
- [lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in #100246
- [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in #100211
- [lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in #100262
Full Changelog: v16.4.1...v16.4.2
Original source All of your release notes in one feed
Join Releasebot and get updates from Fastify and hundreds of other software products.
- Oct 15, 2026
- Date parsed from source:Oct 15, 2026
- First seen by Releasebot:Oct 15, 2026
v16.4.1
Next.js releases security fixes for critical remote code execution flaws and a high-severity denial-of-service issue.
This release contains security fixes for the following advisories:
Critical
- Unauthenticated Remote Code Execution in use cache functions returning typed arrays
- Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
High
- Denial of Service in App Router using Server Actions
- Oct 15, 2026
- Date parsed from source:Oct 15, 2026
- First seen by Releasebot:Oct 15, 2026
v15.5.28
Next.js fixes critical remote code execution in Image Optimization and high-severity denial of service risks in App Router Server Actions.
This release contains security fixes for the following advisories:
Critical
- Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
High
- Denial of Service in App Router using Server Actions
- Oct 14, 2026
- Date parsed from source:Oct 14, 2026
- First seen by Releasebot:Oct 16, 2026
Next.js Security Update for Upstream Vulnerabilities
Next.js releases an out-of-band security update dated October 14, 2026.
The October 14, 2026 out-of-band security update for Next.js is now available
Original source - Oct 14, 2026
- Date parsed from source:Oct 14, 2026
- First seen by Releasebot:Oct 15, 2026
19.3.1 (October 14th, 2026)
React improves the React Server Components transport protocol.
React Server Components
Improve transport protocol (#37845 by @unstubbable and @eps1lon)
Original source - Oct 14, 2026
- Date parsed from source:Oct 14, 2026
- First seen by Releasebot:Oct 15, 2026
19.2.9 (October 14th, 2026)
React improves the Server Components transport protocol.
React Server Components
Improve transport protocol (#37844 by @unstubbable and @eps1lon)
Original source - Oct 14, 2026
- Date parsed from source:Oct 14, 2026
- First seen by Releasebot:Oct 15, 2026
19.1.10 (October 14th, 2026)
React improves its Server Components transport protocol.
React Server Components
Improve transport protocol (#37843 by @unstubbable and @eps1lon)
Original source - Oct 14, 2026
- Date parsed from source:Oct 14, 2026
- First seen by Releasebot:Oct 15, 2026
19.0.9 (October 14th, 2026)
React improves the Server Components transport protocol.
React Server Components
Improve transport protocol (#37842 by @unstubbable and @eps1lon)
Original source - Oct 14, 2026
- Date parsed from source:Oct 14, 2026
- First seen by Releasebot:Oct 14, 2026
[1.2.14] - 2026-10-14
Rolldown adds configurable output character encoding and improves code-splitting, tree-shaking, source maps, and module handling. The release also fixes numerous issues in renaming, CommonJS output, and development file watching.
🚀 Features
- add
output.charsetoption (#11194) by @sapphi-red - code-splitting: route independent ESM re-exports per consumer (#11177) by @hyfdev
🐛 Bug Fixes
- handle
output.charset: 'ascii'+output.minify: false(#11207) by @sapphi-red - tree-shaking: preserve initialization of wrapped ESM re-exports (#11167) by @hyfdev
- sourcemap: preserve boundaries when tracing has no mapping (#11170) by @sapphi-red
- strict-execution-order: account for init imports during code splitting (#11162) by @hyfdev
- strict-execution-order: avoid eager loading through mixed re-exports (#11151) by @hyfdev
- tree-shake expression statements that coerce known constants (#10825) by @IWANABETHATGUY
- shim-missing-exports: shim deep namespace reads through default imports (#11184) by @IWANABETHATGUY
- shim-missing-exports: shim missing static namespace members (#11179) by @hyfdev
- preserve-entry-signatures: keep internal bindings out of entry exports (#11094) by @hyfdev
- report ASSIGN_TO_IMPORT for writes to re-exported namespace members (#11148) by @IWANABETHATGUY
- dev: keep files loaded by the HMR stage watched when the same task rebuilds (#11154) by @Brooooooklyn
- dev: watch lazily compiled files even when a build starts first (#11152) by @Brooooooklyn
- cjs: print a CommonJS module's top-level
thisas a wrapper parameter rolldown names (#11135) by @IWANABETHATGUY - renamer: keep fixed names off the bindings that would capture them (#11134) by @IWANABETHATGUY
- renamer: keep an external
require()local in a CJS module off the top-level names (#11133) by @IWANABETHATGUY - rolldown: make a repeated
close()a no-op (#11142) by @Brooooooklyn - avoid renaming entry top-level bindings onto their nested bindings (#11122) by @IWANABETHATGUY
- renamer: keep generated top-level names off inner bindings (#11121) by @IWANABETHATGUY
🚜 Refactor
- renamer: treat a CJS-wrapped module's root scope as an inner scope (#11130) by @IWANABETHATGUY
📚 Documentation
- add renaming design and implementation docs (#11131) by @IWANABETHATGUY
⚡ Performance
- ci: overlap independent setup, checks, and artifacts (#11169) by @hyfdev
🧪 Testing
- dev: use dunce::canonicalize so dev engine tests pass on Windows (#11192) by @shulaoda
- preserve-entry-signatures: cover nested dynamic imports (#11164) by @hyfdev
⚙️ Miscellaneous Tasks
- deps: upgrade oxc to 0.154.0 (#11209) by @shulaoda
- make Security Analysis pass again (security-action v1.0.10, serde_yaml -> saphyr) (#11197) by @Brooooooklyn
- deps: update rollup submodule for tests to v4.64.5 (#11190) by @rolldown-guard[bot]
- deps: update test262 submodule for tests (#11191) by @rolldown-guard[bot]
- deps: update crate-ci/typos action to v1.51.1 (#11174) by @renovate[bot]
- vite-tests: link the workspace rolldown into the Vite clone again (#11147) by @Brooooooklyn