Skip to content
chornous.dev

Type two or more letters. Esc closes.

Index of sheets
Theme

Sheet 03 · Writing

Notes on the
front end.

I read release notes for React, Next.js, TypeScript, GraphQL and the AI APIs I build on, and write down what changes for a team shipping on them. Each post gets a plate drawn from its slug.

Posts
57
Topics
17
Since
2023
Feed
/rss.xml
Filter posts by tag

57 posts shown

Pinned

Gemini 4 Argon on the API: 1M output tokens, thinking levels only, and a price that doubles on December 1

Google opened Gemini 4 Argon (gemini-4-argon) to the Gemini API worldwide on October 13, 2026 at $2 input and $10 output per million tokens until November 30. It drops thinking_budget, sampling parameters and explicit caching, adds long decode up to 1,048,576 output tokens, and spends more than twice GPT-6 Astra's output tokens per benchmark task.

AIRelease NotesTooling

8 min read

2026

  1. 4 min readApache httpd 2.4.71 fixes a critical mod_http2 race that leads to RCE: CVE-2026-119618The Apache HTTP Server Project released 2.4.71 on November 11, 2026. It fixes CVE-2026-119618, a critical race condition in mod_http2's assign_headers() that can lead to remote code execution in httpd 2.4.55 through 2.4.70, plus a mod_md crash and a mod_vhost_alias overflow.SecurityRelease Notes
  2. 4 min readModern Web Guidance 1.0: Chrome's agent skills go stable, add a modernize workflow, and pick up Firefox and EdgeChrome released Modern Web Guidance 1.0 on November 10, 2026. The skill set for coding agents adds a static-analysis modernization workflow, expert-reviewed guides with a public eval dashboard, and Firefox and Edge as contributors.AIToolingPerformance
  3. 4 min readPostgreSQL 18.7 and friends fix 52 CVEs, end PostgreSQL 14, and ask you to reindexThe PostgreSQL Global Development Group released 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, 2026, with 52 security fixes and over 140 bug fixes. PostgreSQL 14 is now end-of-life, and several fixes need a reindex or a new full backup after you upgrade.SecurityRelease Notes
  4. 4 min readRust 1.100: the never type is stable, Infallible becomes !, and Cargo can hold back fresh cratesThe Rust Release Team shipped Rust 1.100.0 on November 12, 2026. The never type is stable after 10 years, older editions now fall back to ! instead of (), the core Allocator API works with Vec and Box, and Cargo gains a min-publish-age setting for dependency cooldowns.Release NotesSecurityTooling
  5. 5 min readGo 1.27 makes encoding/json/v2 stable: duplicate keys and invalid UTF-8 now fail, nil slices encode as []The Go team announced on November 4, 2026 that encoding/json/v2 and encoding/json/jsontext are stable in Go 1.27. The new packages reject duplicate names and invalid UTF-8, match struct fields case-sensitively, and unmarshal up to 10x faster than v1, which now runs on top of v2.Release NotesPerformanceTooling
  6. 4 min readNext.js 16.4.5 and 15.5.29: seven fixes, four of them in Cache Components cachingVercel shipped the November 2026 Next.js security release on November 3 in v16.4.5 and v15.5.29. It fixes one high and six medium issues, including cross-tenant cache disclosure when unstable_cache wraps a use cache function and HttpOnly cookies leaking through x-middleware-set-cookie on Edge routes.Next.jsSecurityRelease Notes
  7. 4 min readOpenSSH 10.6p2: sshd on musl without PAM accepted any 257 to 1024 byte password for accounts marked *Portable OpenSSH 10.6p2 shipped on November 5, 2026 with a workaround for a password authentication bypass on Linux systems that use musl libc with PAM disabled. Alpine published fixed packages for 3.16 through edge the same day.SecurityRelease NotesTooling
  8. 4 min readPostman desktop 12.33.4 installed plugins and a SessionStart hook into Claude Code and Codex without asking, then revertedA Postman user reported on October 25, 2026 that the desktop app auto-installed its agent plugins into Claude Code and Codex, added a startup hook, and wrote a hook trust record into ~/.codex/config.toml. On November 5 a Postman team member said the company was reverting the change.AISecurityTooling
  9. 4 min readLiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for two hours: what to delete and what to rotateAttackers published a malicious litellm 1.107.0 on October 21, 2026, through LiteLLM's own release workflow pointed at a lookalike fork. The wheels drop cook.pth, cook.py and sitecustomize.py into site-packages, which run on every Python start. The last clean version is 1.106.2.SecurityAITooling
  10. 4 min readNode.js 22.23.4, 24.22.1 and 26.12.1: a Brotli out-of-bounds write, three TLS hostname bypasses and repeated random UUIDsThe Node.js project shipped security releases for 22.x, 24.x and 26.x on October 21, 2026. They fix ten CVEs, four rated high, including an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497) and TLS hostname checks that non-canonical IPv4 spellings could fool.Node.jsSecurityRelease Notes
  11. 5 min readPHP2Shell: two critical PHP RCEs in OOM handling and stale worker state, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35The PHP team published GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) on October 21, 2026. Both score 9.2 on CVSS v4 and allow unauthenticated remote code execution as the web worker account. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.SecurityRelease Notes
  12. 5 min readReact Native 0.88: events dispatch through EventTarget, Text gets variable fonts, and iOS apps move to SceneDelegateReact Native 0.88 shipped on October 19, 2026 with React 19.3.0 and Metro 0.87. Events now run through the W3C EventTarget path, fontVariationSettings works on Text and TextInput, and RCTReactNativeFactory gains SceneDelegate entry points ahead of Apple's iOS 27 SDK requirement. No user-facing breaking changes.ReactRelease Notes
  13. 5 min readAnthropic replaced git for its monorepo with Scion: 30,000 merges a day and checkouts in secondsOn October 13, 2026 Anthropic described Scion, the source control system a seven-person team built in five months after merges grew from 2,500 to more than 30,000 a day. It moves commits, merges and history to the server and fetches the trees and blobs a client asks for.ArchitectureToolingAI
  14. 4 min readGitHub Actions gets lockfiles: gh actions-lock pins every action, including transitive ones, to a commitGitHub put workflow dependency lockfiles into public preview on October 14, 2026. The gh actions-lock CLI extension writes .github/workflows/actions.lock, runners re-check each pin at job start, and a Require lockfile policy lets admins enforce it.SecurityTooling
  15. 4 min readNext.js 16.4.1 and 15.5.28: two critical RCEs in use cache and SVG image optimization, plus a Server Actions DoSVercel published three Next.js advisories on October 14, 2026. A use cache function that returns typed arrays and the Image Optimization API on glibc Linux both allow unauthenticated remote code execution, rated CVSS 9.5. A Server Actions bug can pin the CPU. Upgrade to 16.4.1 or 15.5.28.SecurityNext.jsRelease Notes
  16. 4 min readPython 3.15: lazy imports, frozendict, and UTF-8 as the default encodingPython 3.15.0 shipped on October 9, 2026. It adds the lazy import keyword (PEP 810), frozendict and sentinel built-ins, unpacking in comprehensions, and the Tachyon sampling profiler, and it makes UTF-8 the default when you open a file without an encoding.Release NotesPerformanceTooling
  17. 5 min readClaude Haiku 5.5: a tenth of Haiku 4.5's price under 100K tokens, and a tokenizer that counts 30% moreAnthropic released Claude Haiku 5.5 on October 7, 2026 at $0.10 input and $0.50 output per million tokens for prompts up to 100K. It adds effort levels, rejects thinking budgets, sampling parameters and prefill, and counts about 30% more tokens than Haiku 4.5 for the same text.AIRelease NotesTooling
  18. 4 min readGleam 1.19 stops writing Erlang source: abstract forms, real line numbers and faster BEAM buildsLouis Pilfold announced Gleam v1.19.0 on October 5, 2026. The compiler now emits Erlang abstract forms instead of .erl source, which fixes line numbers in BEAM stack traces and cut a 10,000-function compile benchmark from 0.434 to 0.342.Release NotesToolingPerformance
  19. 4 min readmold 3.0: the linker moved from C++ to Rust, and the build moved from CMake to CargoRui Ueyama released mold 3.0.0 on October 5, 2026, the first version written in Rust. It keeps 2.42.1's options, targets and linking speed, replaces CMake with Cargo, needs Rust 1.95 to build, and panics on corrupted input instead of reading out of bounds.Release NotesToolingPerformance
  20. 4 min readPolars 2.0: lazy queries run on the streaming engine, and row order is no longer a givenThe Polars team tagged Python Polars 2.0.0 on October 6, 2026. LazyFrame.collect() now defaults to the streaming engine with out-of-core spilling at 80% of RAM, read_csv dispatches to scan_csv, and mixed signed and UInt64 math returns Int128.Release NotesPerformanceTooling
  21. 5 min readClaude Sonnet 5.5: same price as Sonnet 5, and five request settings that now return a 400Anthropic released Claude Sonnet 5.5 on September 28, 2026 at $2 input and $10 output per million tokens, with 70.6% on Terminal-Bench 4.0. The model rejects forced tool choice and disabled thinking, so Sonnet 5 code needs changes before you swap the ID.AIRelease NotesTooling
  22. 4 min readA bad Firebase server payload crashed iOS apps at launch for six hours: issue 16728From 00:41 UTC on September 29, 2026, Google Analytics for Firebase on iOS crashed apps that fetched a malformed sdk-exp experiment payload. Google fixed the payload by 23:52 PDT on September 28 and released GoogleUtilities 8.1.4 to harden the SDK.ToolingArchitecture
  23. 4 min readPi 1.0: the minimal coding agent goes stable, two days after it added MCPEarendil tagged Pi 1.0.0 on October 1, 2026. The terminal coding agent runs fullscreen by default, cuts codemode prompt tokens by about 40%, hardens MCP OAuth, and ships an experimental durable harness, pi-durable.AIToolingRelease Notes
  24. 4 min readSvelteKit 3: config moves into vite.config, $lib becomes #lib, and Svelte 4 support endsThe Svelte team shipped SvelteKit 3.0 on October 1, 2026. It drops svelte.config.js, replaces $lib with a Node subpath import, requires Node 22.17, TypeScript 6, Svelte 5.57.1 and Vite 8, and removes $app/stores and $service-worker.Release NotesToolingTypeScript
  25. 4 min readF-Droid 2.0: a Kotlin and Compose rewrite, automatic updates, and no more Android 6F-Droid announced 2.0 on September 24, 2026, its largest client update in ten years. The app moved to Kotlin and Jetpack Compose, installs through Android's session installer with pre-approval, updates apps by default, and dropped Android 6 and the Privileged Extension.Release NotesToolingArchitecture
  26. 4 min readGitHub Actions runners dropped Node 20: JavaScript actions run on Node 24 nowOn September 23, 2026 GitHub removed Node 20 from Actions runners and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out. JavaScript actions run on Node 24, and self-hosted runners on macOS 13.4 or older and ARM32 lost support.Node.jsToolingRelease Notes
  27. 4 min readGitHub drops SHA-1 RSA signatures over SSH and adds a post-quantum key exchangeGitHub's September 22, 2026 changelog removes the ssh-rsa signature type and diffie-hellman-group-exchange-sha256, requires 3072-bit RSA keys from October 14, and turns on mlkem768x25519-sha256. Brownouts land on November 4 and December 9.SecurityTooling
  28. 4 min readA web page could run code through OpenCode's local server: GHSA-632h-h47v-g4x4Datadog Security Labs disclosed a remote code execution bug in OpenCode 1.14.30 to 1.18.21 on September 24, 2026. A text/plain form post to the local /global/upgrade endpoint made npm install an attacker's tarball. OpenCode 1.18.22 fixes it.SecurityAITooling
  29. 3 min readClaude Opus 5.5 from a front-end desk: price, speed and the agent partsAnthropic's September model claims Fable-level work at 40% lower cost than Opus 5. Notes on long codebase migrations, prompt caching and agents that read untrusted pages.AITooling
  30. 4 min readGraphQL caught up: a spec edition, GraphQL.js 17 and an AI pitchThe first full GraphQL spec edition since 2021 added @oneOf inputs and schema coordinates. GraphQL.js 17, the reference implementation, followed in June 2026. The changes for a client team, with a schema you can copy.GraphQLArchitectureRelease Notes
  31. 3 min readThe next/og advisory, and another Next.js patch on September 30A critical advisory on September 22, 2026 covers Next.js 16.2.0 to 16.3.5 through the Node.js ImageResponse in next/og, and a scheduled release on September 30 will fix nine more issues. Triage steps for sites that render OG images.SecurityNext.js
  32. 3 min readNode.js 26 goes LTS in October, with Temporal switched onNode.js 26 enables the Temporal API by default, adds Map.getOrInsert and Iterator.concat, and removes a batch of long-deprecated APIs. Test these before it becomes the LTS line next month.Node.jsRelease NotesTooling
  33. 4 min readOpenAI's API this quarter: GPT-6 arrived, the Assistants API leftBetween July and September 2026 OpenAI shipped GPT-5.6, then GPT-6 Astra, Sol and Luna, retired the Assistants API and changed its error codes. Notes from the changelog for teams with OpenAI calls in production.AITooling
  34. 4 min readTypeScript 7: the compiler moved to Go, and 6.0's warnings became errorsTypeScript 7.0 ships the native Go port with builds up to twelve times faster. It keeps the defaults 6.0 introduced, turns 6.0's deprecations into hard errors, and has no programmatic API yet, which matters if you use MDX, Vue, Svelte or Astro.TypeScriptToolingPerformance
  35. 3 min readVite 8 runs on one bundler now: what the build numbers sayVite 8 replaced the esbuild-plus-Rollup pair with Rolldown, a single Rust bundler, and kept most plugins working. Build times from Linear, Ramp, Beehiiv and Mercedes-Benz.io, and a two-step migration path.ToolingPerformanceArchitecture
  36. 3 min readGrok 4.6 and 4.7 on the API: two frontier models in two monthsxAI shipped Grok 4.6 in August and Grok 4.7 in September 2026, with the same 500k context window and the same price. The release notes for developers, with a cost check and a deprecation to schedule.AITooling
  37. 4 min readReact Native 0.85: a shared animation backend, layout props on the native driver and a new Jest presetReact Native 0.85 shipped on April 7, 2026 with an experimental animation backend that Animated and Reanimated share, native-driver support for width and height, Metro TLS, a separate @react-native/jest-preset package and the removal of StyleSheet.absoluteFillObject.React NativeRelease NotesTooling
  38. 5 min readNext.js adapters make the platform contract publicOn March 25, 2026, the Next.js team explained the stable Adapter API from 16.2: two build hooks, a public test suite that Vercel's own adapter must pass, verified adapters under the Next.js GitHub org, and a working group with OpenNext, Netlify, Cloudflare, AWS Amplify and Google Cloud.Next.jsArchitectureTooling
  39. 5 min readNext.js 16.2 for teams that ship on itNext.js 16.2 shipped on March 18, 2026 with faster dev startup, 25% to 60% faster HTML rendering from a React change, Server Fast Refresh, SRI in Turbopack, AGENTS.md in create-next-app and a dev server lock file. Notes from the three release posts.Next.jsRelease NotesPerformance
  40. 4 min readThe React Foundation launches: Meta hands React to eight members and the Linux FoundationOn February 24, 2026, Meta stopped owning React, React Native and JSX. The React Foundation, hosted by the Linux Foundation with eight Platinum members and Seth Webster as executive director, now holds them, and a separate council sets technical direction.ReactGovernanceArchitecture
  41. 4 min readReact Native on Meta Quest: Expo Go on the headset, one config plugin, no Google servicesMeta and Callstack published the setup for React Native on Meta Quest on February 24, 2026. Horizon OS is Android without Google Mobile Services, Expo Go runs on the headset, and the expo-horizon-core plugin adds a Quest build flavor next to your phone build.React NativeArchitectureRelease Notes
  42. 5 min readBuilding Next.js for agents starts with debugging for peopleOn February 12, 2026, Jiachi Liu described how the Next.js team built and shut down an in-browser agent called Vector, then moved the useful parts into the framework: an MCP endpoint in next dev, browser logs in the terminal and version-matched docs.Next.jsAITooling
  43. 5 min readReact Native 0.84 makes Hermes V1 the default and stops compiling iOS core from sourceReact Native 0.84 shipped on February 11, 2026 with Hermes V1 on iOS and Android, precompiled iOS core binaries, Legacy Architecture code stripped from iOS builds and a Node.js 22.11 minimum. The post also lists the opt-out switches and a short set of breaking changes.React NativePerformanceRelease Notes
  44. 5 min readInside Turbopack: speed from doing lessOn January 20, 2026, the Turbopack team explained its incremental engine: value cells that track reads like signals, dirty marking that stops when output stays equal, demand-driven recompute and an aggregation graph over millions of results. Your import graph decides how much of that it can skip.Next.jsPerformanceArchitecture

2025

  1. 4 min readNext.js 16.1: a disk cache for next dev, a bundle analyzer and next dev --inspectNext.js 16.1 shipped on December 18, 2025. Turbopack's file system cache for next dev is stable and on by default, cutting a large Vercel app's first route compile from 15 s to 1.1 s. It also adds an experimental bundle analyzer, next dev --inspect and transitive serverExternalPackages.Next.jsToolingPerformance
  2. 4 min readReact Native 0.83: React 19.2, a DevTools desktop app and no breaking changesReact Native 0.83 shipped on December 10, 2025 as the first release with no user-facing breaking changes. It brings React 19.2, network and performance panels in a new DevTools desktop app, stable Web Performance APIs and a flag that cut a test app's iOS build from 73 to 58 seconds.React NativeToolingRelease Notes
  3. 4 min readReact Server Components advisories: build a patch laneCVE-2025-55182 let an unauthenticated request run code on any server that supports React Server Components, with a CVSS of 10.0. Researchers probing the fix found three denial-of-service bugs and a source leak over the next eight weeks. This post covers the timeline and a response plan that holds up when the next patch is also incomplete.ReactNext.jsSecurity
  4. 4 min readReact Conf 2025: a stable compiler, a foundation and React Native at 4M weekly downloadsReact Conf 2025 ran October 7 and 8 in Henderson, Nevada. The React team shipped Compiler 1.0, previewed ViewTransition and Fragment refs, announced the React Foundation, and reported React Native at 4 million weekly downloads.ReactPerformanceGovernance
  5. 4 min readReact Native 0.82 runs only on the New ArchitectureReact Native 0.82 shipped on October 8, 2025 as the first release with no Legacy Architecture switch. It also brings opt-in Hermes V1, React 19.1.1, DOM-style node APIs on refs and a debugOptimized Android build that runs at about 60 FPS instead of 20.React NativeArchitectureRelease Notes
  6. 4 min readReact Compiler 1.0: roll it out like a migrationReact Compiler 1.0 went stable on October 7, 2025, after Meta measured up to 12% faster loads and interactions over 2.5x faster on the Quest Store. Lint first, compile one directory, gate it behind a flag, and pin the version.ReactPerformanceTooling
  7. 5 min readReact 19.2: Activity, useEffectEvent, performance tracks and partial pre-renderingReact 19.2 shipped on October 1, 2025 with Activity for hidden UI that keeps state, useEffectEvent for effect logic that reads fresh values, Chrome DevTools performance tracks, partial pre-rendering and a new useId prefix.ReactRelease NotesPerformance
  8. 5 min readReact Native 0.81: Android 16 forces edge-to-edge, and iOS builds compile up to 10x fasterReact Native 0.81 shipped on August 12, 2025. It targets Android 16 by default, which removes the edge-to-edge opt-out and turns on predictive back, deprecates SafeAreaView, drops built-in JavaScriptCore and adds experimental precompiled iOS builds.React NativeToolingPerformance

2023

  1. 2 min readReact state without the noiseDerive what you can, store what changes, and keep effects for the systems React doesn't own.ReactState
  2. 2 min readFrom JAMstack to the App RouterA static site can carry search, feeds and interaction without turning into a backend project. The hard part is the contracts between those systems.Next.jsStatic SitesArchitecture
  3. 2 min readReact.dev as a product resetThe 2023 docs relaunch treated documentation as a product surface. The same moves cut cognitive load in any front end.ReactDocumentation
  4. 2 min readComponents as product boundariesDesign a React component around the product decision it owns. Reuse follows from that, and review gets easier.ReactDesign Systems