- Node.js emergency patches: HIGH-severity security releases shipped July 29 across the 26.x, 24.x and 22.x lines — upgrade to
26.5.1/24.18.1/22.23.2now. - TypeScript 7.0 is GA: the native Go compiler delivers roughly 8–12x faster builds and 6–26% lower memory.
- Next.js security release: four HIGH and five MEDIUM CVEs including a Server Actions DoS — patch to
16.2.11/15.5.21. - MySQL 26.7.0: first calendar-versioned release adds Change Stream Applier replication, post-quantum TLS and Thread Pool in Community Edition.
Web Development — Top of the Day
1. Node.js ships HIGH-severity security releases across every active line
Node.js released 26.5.1, 24.18.1 and 22.23.2 on July 29 (postponed a day from July 28 for infra reasons), each fixing at least one HIGH-severity CVE — including an http2 RST-stream issue and a permission-model flaw. Every supported line is affected. (July 29, 2026)
nvm install 26.5.1 && node -v # v26.5.12. TypeScript 7.0 ships — the native Go compiler is GA
Microsoft’s rewrite of tsc in Go is stable, with roughly 8x–12x faster full builds (VS Code: 125.7s → 10.6s) and 6–26% lower memory. Same install, same tsc binary. (v7.0 GA — July 8, 2026)
npm install -D typescript
npx tsc3. Next.js ships a July security release (4 HIGH + 5 MEDIUM CVEs)
Vercel patched four HIGH and five MEDIUM CVEs across the App Router, led by a DoS via Server Actions (CVE-2026-64641), a Turbopack single-locale middleware bypass and two SSRF issues. Fixes are in 16.2.11 (Active LTS) and 15.5.21 (Maintenance LTS). (July 20, 2026)
npm install next@16.2.11 # Active LTS
npm install next@15.5.21 # Maintenance LTS4. MySQL 26.7.0 lands with Change Stream Applier and post-quantum TLS
The first calendar-versioned MySQL (released July 28) adds an opt-in multi-threaded Change Stream Applier (1–1,024 workers), post-quantum key exchange for TLS 1.3, and the Thread Pool plugin now in Community Edition. (v26.7.0 — July 28, 2026)
SELECT VERSION(); -- e.g. 26.7.05. Safari 26.6 adds streaming WebAssembly compile options
Safari 26.6 adds a compileOptions parameter to compileStreaming() / instantiateStreaming() — enabling JS String Builtins without dropping the streaming path — plus CSS ic unit, position-area and zoom fixes. (Safari 26.6 — July 27, 2026)
WebAssembly.compileStreaming(fetch('m.wasm'), { builtins: ['js-string'] });6. Chrome 150 replaces three JS/CSS hacks with native features
Chrome 150 ships the auto-scaling text-fit property, declarative arrow-key navigation via the focusgroup attribute, and native gradient borders through background-clip: border-area. (Chrome 150 stable — June 30, 2026)
.title { text-fit: consistent; }7. Vite 8.0 makes Rolldown the default Rust bundler
Vite 8 replaces the esbuild+Rollup split with a single Rust-based Rolldown bundler across dev and prod, keeping plugin compatibility while cutting build times. (Vite 8.0 — March 12, 2026)
npm install vite@88. Container style queries and :open reach Baseline
Per the May 2026 Baseline digest, container style queries, the :open pseudo-class, image-rendering and SharedWorker are now interoperable across the core browser set — safe to use without polyfills. (Baseline digest — May 2026)
.parent { --variant: compact; }
@container style(--variant: compact) { .child { padding: 4px; } }Core Tech — Latest Updates
</> HTML
1. Invoker Commands reach Baseline
The command and commandfor button attributes became Baseline “newly available” on Dec 12, 2025 (Chrome/Edge 135, Firefox 144, Safari 26.2), letting a <button> control a popover, dialog or details element declaratively. (Baseline — Dec 2025)
<button commandfor="dlg" command="show-modal">Open</button>
<dialog id="dlg">
<button commandfor="dlg" command="close">Close</button>
</dialog>addEventListener/onclick wiring — and it works before JS loads.2. The <search> element is now Widely Available
The semantic <search> landmark crossed into Baseline “Widely available” in April 2026, giving an implicit search ARIA role to search and filter forms. (Baseline Widely available — Apr 2026)
<search>
<form><input type="search" name="q"><button>Go</button></form>
</search>role="search" by hand.3. ARIA attribute reflection goes Widely Available
ARIA properties now reflect as DOM element properties (el.ariaExpanded, el.ariaLabel), reaching Baseline “Widely available” in April 2026. (Baseline Widely available — Apr 2026)
button.ariaExpanded = "true"; // instead of setAttribute("aria-expanded", "true")</> CSS
1. Container style queries reach Baseline
@container style(--var: value) became Baseline “newly available” in May 2026, letting elements respond to a parent container’s custom-property values. (Baseline — May 2026)
@container style(--theme: dark) {
.card { background: #111; color: #eee; }
}2. The :open pseudo-class is now Baseline
:open matches <dialog>, <details> and <select> while in their open state, Baseline “newly available” May 2026. (Baseline — May 2026)
dialog:open { animation: fade-in 0.2s; }3. contrast-color() arrives
Baseline “newly available” in April 2026, contrast-color() auto-resolves to the highest-contrast text color (black or white) for a given background. (Baseline — Apr 2026)
.badge { background: var(--bg); color: contrast-color(var(--bg)); }</> JavaScript
1. Map/WeakMap “Upsert” hits TC39 Stage 4
Map.prototype.getOrInsert and getOrInsertComputed (plus WeakMap variants) advanced to Stage 4 at the January 2026 TC39 meeting, targeting ES2026. (Stage 4 — Jan 2026)
const groups = new Map();
groups.getOrInsertComputed(key, () => []).push(item);has/get/set dance.2. Iterator.concat() reaches Stage 4
The Iterator Sequencing proposal advanced to Stage 4 in November 2025, letting you chain multiple iterators or iterables into one lazy sequence. (Stage 4 — Nov 2025)
const all = Iterator.concat([0, 1], [2, 3], nums);
Array.from(all);3. Math.sumPrecise() is now shipping
Baseline “newly available” in April 2026, Math.sumPrecise() does precision-safe summation of a list of numbers, avoiding floating-point drift. (Baseline — Apr 2026)
Math.sumPrecise([0.1, 0.2, 0.3]); // 0.6, not 0.6000000000000001</> TypeScript
1. TypeScript 7.0 — the native Go compiler (GA)
The compiler rewritten in Go delivers roughly 8x–12x faster full builds, 6–26% lower memory and a new LSP-based language server. (v7.0 GA — July 8, 2026)
npm install -D typescript
npx tsc2. Multithreaded checking and builds in 7.0
New --checkers and --builders flags parallelize type-checking and project-reference builds across CPU cores, with a watch mode ported to a Parcel-based file watcher. (v7.0 — July 8, 2026)
tsc --checkers 4 --builders 43. TypeScript 6.0 — final JS-based release, new strict defaults
6.0 flips tsc --init defaults (strict: true, module: esnext, types: []) and deprecates legacy options like es5, --outFile and AMD/UMD/SystemJS. (v6.0 — March 23, 2026)
{ "compilerOptions": { "ignoreDeprecations": "6.0" } }</> React
1. <Activity /> ships in React 19.2
<Activity> pre-renders or hides UI regions at lower priority without unmount-cost penalties on visible content. (v19.2 — Oct 1, 2025)
<Activity mode={isVisible ? 'visible' : 'hidden'}>
<Page />
</Activity>2. useEffectEvent becomes a stable Hook
React 19.2 stabilized useEffectEvent, extracting non-reactive “event” logic out of Effects so those values don’t force the Effect to re-run. (v19.2 — Oct 1, 2025)
const onConnected = useEffectEvent(() => {
showNotification('Connected!', theme);
});
useEffect(() => {
const c = createConnection(serverUrl, roomId);
c.on('connected', () => onConnected());
c.connect();
return () => c.disconnect();
}, [roomId]); // theme not needed here3. React Compiler v1.0 is production-ready
The build-time compiler auto-memoizes components and hooks (React 17+ compatible), with Meta reporting up to 12% faster loads and 2.5x faster interactions. (v1.0 — Oct 7, 2025)
// babel.config.js
module.exports = { plugins: [["babel-plugin-react-compiler"]] };useMemo/useCallback and let the compiler handle memoization.</> shadcn/ui
1. New Toast component (Base UI)
The July 2026 changelog adds a Toast primitive built on Base UI, with support for actions, status types, promises, stacking and swipe-to-dismiss. (July 2026 changelog)
pnpm dlx shadcn@latest add toast2. React Aria added as a first-class base
React Aria joins Base UI and Radix as a supported component foundation via a new --base aria flag, compatible with all eight style presets. (July 2026 changelog)
pnpm dlx shadcn@latest init --base aria3. Base UI is now the default component base
New projects from shadcn init default to Base UI; Radix stays fully supported behind a -b radix flag, with a migration skill for incremental moves. (July 2026 changelog)
pnpm dlx shadcn init # defaults to Base UI
pnpm dlx shadcn init -b radix # opt back into Radix</> Tailwind CSS
1. First-party scrollbar utilities (v4.3)
v4.3 adds native scrollbar utilities for width and thumb/track color, so no third-party plugin is needed for common cases. (v4.3 — May 8, 2026)
<div class="scrollbar-thin scrollbar-thumb-gray-400 scrollbar-track-gray-100 overflow-auto">...</div>2. zoom and tab-size utilities (v4.3)
v4.3 introduces zoom-* utilities for CSS zoom and tab-* utilities for tab-size in preformatted text. (v4.3 — May 8, 2026)
<pre class="tab-4">function indent() {
return "tabbed";
}</pre>3. Improved @variant support (v4.3)
v4.3 improves the @variant API, enabling stacked/compound variants and functional @utility definitions. (v4.3 — May 8, 2026)
@variant hover-focus (&:hover, &:focus);</> Bootstrap
1. Bootstrap 5.3.8 — current stable patch
Reverted a problematic dropdown focus-return change, fixed the color-contrast() function for WCAG compliance and set a pointer cursor on the search cancel button. (v5.3.8 — Aug 25, 2025)
npm install bootstrap@5.3.82. Bootstrap 5.3.7 — post-Astro fixes
Corrected “View on GitHub” URLs and downloadable example HTML after the docs migration, and fixed popover/tooltip hover-click behavior. (v5.3.7 — June 17, 2025)
npm install bootstrap@5.3.73. Bootstrap 5.3.6 — docs migrated to Astro
Moved the documentation from Hugo to Astro, prevented .visually-hidden children from becoming focusable and scoped .card-group selectors to immediate children. (v5.3.6 — May 5, 2025)
<span class="visually-hidden">Loading...</span></> Node.js
1. Emergency security release patches HIGH-severity CVEs across all lines
Node.js 26.5.1, 24.18.1 and 22.23.2 shipped July 29, fixing multiple CVEs including an http2 RST-stream issue and a permission-model flaw. (July 29, 2026)
nvm install 26.5.1 && node -v # v26.5.12. blob.textStream() lands in Node 26.5.0
Node 26.5.0 added the semver-minor blob.textStream() API for streaming a Blob’s contents as UTF-8 text. (v26.5.0 — July 8, 2026)
const blob = new Blob(['hello world']);
for await (const chunk of blob.textStream()) console.log(chunk);.text().3. Experimental text imports in ES modules
Node 26.5.0 introduced the --experimental-import-text flag, allowing text files to be imported directly in ESM. (v26.5.0 — July 8, 2026)
// node --experimental-import-text app.mjs
import readme from './README.txt' with { type: 'text' };fs.readFile calls for loading templates, SQL or shaders as strings.</> Express
1. June 2026 security releases fix Multer and Morgan CVEs
Express published fixes for a HIGH-severity Multer DoS via deeply nested multipart field names (patched in multer 2.2.0), a Multer orphaned-file DoS, and a Morgan CR/LF log-forging issue (patched in morgan 1.11.0). (June 30, 2026)
npm update multer morgan2. March 2026 path-to-regexp ReDoS patches
Express disclosed three path-to-regexp ReDoS CVEs, fixed in path-to-regexp 0.1.13 and 8.4.0. (March 30, 2026)
npm update path-to-regexp3. Express 5.1.0 is the npm default
Tagged latest on npm since March 31, 2025, so npm install express installs v5; it added Uint8Array support in res.send() and an ETag option for res.sendFile(). (v5.1.0 latest — since Mar 2025)
npm install express # installs 5.x by default</> MySQL
1. MySQL 26.7.0 — Change Stream Applier for replication
The first calendar-versioned release adds an opt-in per-channel multi-threaded applier (APPLIER_VERSION = 2, 1–1,024 workers) that separates transaction application from commit ordering. (v26.7.0 — July 28, 2026)
CHANGE REPLICATION SOURCE TO
APPLIER_VERSION = 2,
APPLIER_WORKER_COUNT = 8
FOR CHANNEL 'ch1';STOP REPLICA responsiveness on high-write workloads.2. MySQL 26.7.0 — post-quantum TLS 1.3
On OpenSSL 3.5.0+, MySQL 26.7.0 adds PQC key-exchange support for TLS 1.3 with new system variables like force_pqc. (v26.7.0 — July 28, 2026)
SET GLOBAL force_pqc = ON;3. MySQL 26.7.0 — Thread Pool in Community Edition
The previously Enterprise-only Thread Pool plugin is now available in Community Edition, and default thread_pool_max_unused_threads rose from 2 to 32. (v26.7.0 — July 28, 2026)
INSTALL PLUGIN thread_pool SONAME 'thread_pool.so';</> Next.js
1. July 2026 security release (16.2.11 / 15.5.21)
Four HIGH and five MEDIUM CVEs patched, including a Server Actions DoS (CVE-2026-64641), a Turbopack single-locale middleware bypass (CVE-2026-64642) and two SSRF issues. (July 20, 2026)
npm install next@16.2.11 # Active LTS
npm install next@15.5.21 # Maintenance LTS2. Next.js adopts a preannounced security-release model
A formal program now publishes patches ahead of time on LTS tracks (Active + Maintenance), so teams can plan maintenance windows. (July 13, 2026)
npm install next@lts3. Next.js 16.3 — Instant Navigations
16.3 gives <Link> a per-route strategy (Stream, Cache or Block) plus Partial Prefetching that reuses a client-cached shell. (16.3 — June 25, 2026)
import Link from "next/link";
<Link href="/dashboard" prefetch="cache">Dashboard</Link>Other Languages, Frameworks & Databases
1. Vue 3.6 — Vapor Mode still in pre-release
The 3.6 branch introduces Vapor Mode, an opt-in SFC compile mode that skips the virtual DOM and compiles to direct DOM operations, plus an alien-signals reactivity rewrite. It remains in the beta/pre-release line; 3.5.x stays stable. (3.6 beta — 2026)
<script setup vapor>
// compiles without the virtual DOM
</script>2. Angular v22 is the current stable major
Angular v22.0.0 (released June 3, 2026) is in active support; v21 has moved to LTS. It is the version to target for new apps and upgrades this cycle. (v22.0.0 — June 3, 2026)
ng update @angular/core@22 @angular/cli@223. PostgreSQL 19 Beta 2 released
Beta 2 refines headline v19 features including temporal tables (FOR PORTION OF), SQL/PGQ property-graph support and virtual generated-column optimizations; GA is expected around September/October 2026. (Beta 2 — July 16, 2026)
UPDATE t FOR PORTION OF valid_time
FROM '2026-01-01' TO '2026-07-01' SET status = 'archived';4. Supabase Launch Week 15 — Pipelines, Unified Logs, Grafana Cloud
During Launch Week 15 (July 14–18): Unified Logs entered open beta (July 16), Supabase Pipelines reached public alpha (July 21) and one-click Grafana Cloud observability launched (July 23). (July 2026)
5. Python 3.14.6 and 3.13.14 maintenance releases
Routine bugfix drops (~179 and ~240 fixes respectively) for the current and prior stable Python lines. The 3.14 series carries free-threaded (no-GIL) support and t-strings. (June 10, 2026)
name = "world"
template = t"Hello {name}" # PEP 750 t-string6. Java — JDK 26 in early access
JDK 26 is in early access with language, API and runtime improvements targeted for a fall 2026 GA; JDK 25 remains the current general-availability release (Sept 2025). (Early access — 2026)
Discussion