<p><strong>TLDR:</strong> A critical RCE vulnerability in Next.js App Router was exploited at scale within 24 hours of a working PoC dropping. GitHub published a detailed post-mortem on how they cut memory usage by 50% and sped up INP by 78% in the pull request diff view. ESLint v10.2.0 ships with native Temporal support. Anthropic accidentally leaked Claude Code’s full source via a bad npm package.</p>
<hr>
<h2>CVE-2025-55182: Next.js RCE exploited in the wild</h2>
<p>This one needs immediate attention if you’re running Next.js 13.3+ with the App Router. A single unauthenticated POST request with a <code>Next-Action</code> header is enough to get a shell — no Server Actions required. Threat group UAT-10608 automated scanning and hit 766 hosts within 24 hours of the PoC going public, stealing database credentials from 91.5% of compromised hosts and SSH keys from 78.2%. The patch-to-weaponized-exploit window was 30 hours. Update to the patched version for your branch now, rotate any secrets if you ran unpatched after December 4, 2025, and check your logs for suspicious <code>Next-Action</code> POST requests.</p>
<h2>GitHub’s diff view rewrite: 74% fewer components, 10x less heap at scale</h2>
<p>GitHub’s engineering team published a thorough breakdown of how they fixed the Files Changed tab. The old architecture had 8-13 React components and 20+ event handlers per diff line, which meant JavaScript heaps over 1 GB and 400,000+ DOM nodes on large PRs. The rewrite cut that to 2 components per line, switched to O(1) Map-based lookups, and replaced scattered <code>useEffect</code> hooks with top-level handlers using data attributes. On a 10,000-line diff: 74% fewer rendered components, roughly 50% less memory, and 78% faster INP. For the really large PRs, they added TanStack Virtual for windowing, dropping INP from 275-700ms down to 40-80ms. Worth reading if you’re building anything that renders large lists.</p>
<h2>ESLint v10.2.0 ships Temporal support and language-aware rules</h2>
<p><code>Temporal</code> is now a recognized built-in global in ESLint following its TC39 stage 4 promotion. The <code>no-undef</code> rule won’t flag it anymore, and <code>no-obj-calls</code> will catch direct calls to the <code>Temporal</code> object. The other notable addition is <code>meta.languages</code> on rules, letting rule authors declare which languages a rule supports — mismatches throw at runtime. Incremental but useful, especially if you’ve been waiting to use <code>Temporal</code> without suppressing lint warnings.</p>
<h2>Anthropic leaked Claude Code’s source via npm packaging error</h2>
<p>An npm packaging mistake exposed a source map pointing to a zip archive containing roughly 500,000 lines of Claude Code’s TypeScript source. The leak revealed a three-layer memory architecture, an unreleased autonomous mode, and references to an upcoming model called Capiara. Not a security vulnerability in your code, but worth knowing if you’re building on top of Claude Code tooling.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Module Federation 2.0 stable:</strong> The ByteDance-led rewrite ships a fully decoupled runtime that works across webpack, Rspack, Rollup, Vite, and Metro, plus dynamic TypeScript type hints that auto-generate from remote modules — the feature most people actually wanted.</li>
<li><strong>VS Code 1.110 browser agent tools:</strong> GitHub Copilot agents can now open your running app in VS Code’s integrated browser, click around, take screenshots, and run Playwright code — closes the UI verification loop without leaving the editor.</li>
<li><strong>Biome vs ESLint pre-commit benchmark:</strong> One team cut pre-commit hook time from 27 seconds to 1.8 seconds by moving 90% of linting and formatting to Biome, keeping a minimal ESLint config only for JSDoc and custom rules.</li>
<li><strong>React Native Windows v0.82:</strong> Drops the legacy Paper renderer entirely — Fabric only from here. Apps still on Paper must migrate before upgrading.</li>
<li><strong>SolidStart 2.0:</strong> New release of the SolidJS meta-framework is out, though detailed changelogs are still sparse.</li>
<li><strong>TypeScript 6.0 GA / Vite 8.0 / Next.js 16.2:</strong> A roundup post flags TS 6.0 as a bridge to the Go-based TS 7.0, Vite 8.0 switching to Rolldown for builds, and Next.js 16.2 adding AI agent-specific tooling.</li>
<li><strong><code>overscroll-behavior: contain</code>:</strong> Useful one-liner to stop scroll chaining on mobile, but apply it only to elements with a fixed or max height or you’ll trap users.</li>
<li><strong>Cloudflare Mdash:</strong> Open-source TypeScript CMS built on Astro and Cloudflare Workers with a sandboxed plugin model, positioned as a WordPress alternative.</li>
<li><strong>Generic undo/redo in React:</strong> Walkthrough of the <code>{ past, present, future }</code> Redux pattern wrapped in a higher-order <code>undoable</code> reducer — clean approach if you need this without pulling in <code>redux-undo</code>.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A curated developer news roundup covering several high-priority items: CVE-2025-55182, a critical unauthenticated RCE in Next.js App Router (13.3+) already exploited against 766 hosts within 24 hours of PoC release; GitHub's engineering post-mortem on rewriting their PR diff view, achieving 74% fewer React components, 50% less memory, and 78% faster INP using TanStack Virtual for large diffs; ESLint v10.2.0 adding native Temporal support and language-aware rule metadata; and Anthropic accidentally leaking Claude Code's TypeScript source via a bad npm package. Also covered: Module Federation 2.0 stable, VS Code 1.110 Copilot browser agent tools, a Biome vs ESLint pre-commit benchmark, React Native Windows v0.82 dropping Paper renderer, SolidStart 2.0, TypeScript 6.0 GA, Vite 8.0, Next.js 16.2, and several smaller web development tips.

CVE-2025-55182 hits 766 Next.js hosts, GitHub rewrites diff rendering for speed