Page 2 of 6. 110 briefs in the archive, newest first.
React 19.3 stabilizes `<ViewTransition>`, which drives enter, exit, move, and resize animations via the browser's View Transition API without a flag, and adds `browser()` from `react-dom` for components that should not render on the server.
1 source
sharp below 0.35.4 inherits two libheif flaws rated critical upstream that can reach remote code execution on glibc-based Linux. The fix is a version bump or a one-line AVIF block.
2 sources
A preprint scan of 3,171 repositories finds 16% of AI coding-agent setups carry a security defect, with 9.8% installing unpinned MCP servers that run with your privileges.
1 source
CVE-2026-85625 covers sift through 17.1.3 with no patched release: a prototype-pollution path plus default `$where` compilation turns a benign `sift({})` call into arbitrary code execution.
3 sources
Vitest 5.0.0 flips `clearMocks` to true, fails the un-awaited async assertions that used to pass silently, and raises the floor to Vite 6.4.0 and Node.js 22.12.0. The 53% vm-pool gain is the second beat, not the headline.
2 sources
Chrome 154 enforces CORS and Local Network Access for Background Fetch targets on localhost and the LAN, the one item here that needs work before the September 22 stable. The CSS additions are branch work, and text decoration insets retire gradient underline hacks.
2 sources
pnpm 12.0.0 shipped stable on August 26 and 12.1/12.2 landed this week, bringing deterministic lockfiles, 2-3x faster peer resolution on cycle-heavy workspaces, workspace task orchestration, and shared build artifacts.
1 source
A week after the 327-fix build, Chrome stable moves to 152.0.7977.75/.76 with 26 fixes, including two Critical use-after-frees in WebGL and Shared Tab Groups that can lead to code execution outside the sandbox.
1 source
attr() drops its string-only limit, new progress() and alpha() functions grow the CSS math and color toolkit, and Promise.allKeyed plus allSettledKeyed land.
1 source
Astro's stewardship passes to Matthew Phillips as the project ships a browser playground that compiles your components on a real Astro Compiler instance, no project setup required.
1 source
The Aug 31 patch brings back the AVIF output that the critical Aug 25 security release disabled, but only when your installed sharp resolves to 0.35.4 or newer.
3 sources
text-box and sibling-count()/sibling-index() are now Baseline, so you can drop the JavaScript workarounds for precise typography and dynamic layouts.
1 source
A high-severity Renovate advisory (CVSS 8.6) can leak your GitHub credentials to an attacker-controlled host through pagination links, and with no workaround you need to upgrade to 44.11.3 or Mend images 15.4.0 before your next run.
1 source
The unload event stops firing by default for 60% of page loads in Edge 152, 100% by Edge 155, so move telemetry and state-saving to pagehide or visibilitychange before your data silently vanishes.
1 source
Safari's latest preview shows where CSS is heading with random() and corner-shape, and drops a line-clamp value worth grepping for.
1 source
Node.js can now revoke permissions at runtime and audit what it would block, so you can harden a production process without a restart.
1 source
Node.js 26.8.0 adds native ZIP archives to core, a GCM-SIV mode for Ciphers, and a stable TracingChannel, so tooling authors can drop a native dependency and you can build observability on an API that will not move.
1 source
Vercel's security checks now run in CI as a JSON-emitting CLI, so frontend teams automate 2FA, OIDC, and env-var cleanup instead of clicking through a dashboard.
1 source
Chrome 152 stable ships a standard CPU performance tier API, a network allowlist header, and CSSPseudoElement targets for backdrop clicks and mid-flight view transitions.
2 sources
Chrome 152's security drop patches 327 flaws, 10 of them Critical with sandbox escapes, and sets the new evergreen baseline every browser build has to reach.
1 source
Weekday mornings. 60-second reads. Unsubscribe anytime.