Frontend Newsletter · Oct 8 · Patch TanStack Start, Meet Next.js 16.4

Newsletter

Get the next post in your inbox

Frontend, AI and how teams ship. No spam, ever.

Quick hits

TanStack Charts 1.0: stable, with a framework-agnostic core and a React adapter. Docs
SvelteKit 3.0: the Svelte team calls it a little more polish, a little more type safety and a little less junk. Post
Effect 4.0: the core has zero runtime dependencies. Effect reports a minimal program dropping from 35.6 to 7.1 kB minified and gzipped. Release post

Enpitech illustration based on the Effect 4.0 release post: a minimal program, 35.6 kB before and 7.1 kB after, minified and gzipped, as reported by Effect

Security

Patch TanStack Start now

What happened: a crafted link to a TanStack Start app can make a server function return attacker-controlled HTML from your own origin. If a user opens it, the attacker's script runs with that user's access.

TanStack rates it 9.3 (CVE-2026-102989). Updating locally is not enough: redeploy, and check that your lockfile resolves @tanstack/start-server-core 1.169.39 or later. TanStack advisory · GitHub advisory

Enpitech illustration based on the TanStack advisory: crafted link, attacker-controlled HTML from a server function, script runs with the user's access

Next.js 15 security support ends October 21

endoflife.date lists October 21, 2026 as the end of security support for Next.js 15. If you are still on it, plan the move to 16. See the dates

Frontend excellence

Next.js 16.4: Cache Components for new projects

Released October 6. Cache Components are now on by default in new create-next-app projects. Existing apps still opt in. Next.js 17 is planned to make the model the default.

For the guarantee that dynamic content fails the build, set ensureStatic = 'navigation'. The release also brings React 19.3 features, including stable View Transitions. Release post

Compiled Context came close to a selector store

Jenna Smith tested 5,000 radios in one production-build benchmark. With the React Compiler, Context came close to a selector store. One benchmark, not a general promise. Read the article

Enpitech illustration based on Jenna Smith's article: compiled Context close to a selector store in one 5,000-radio production-build benchmark

Frontend + AI

Follow-up: Shopify and the move to native

This follows the September story from our Sep 26 issue. Shopify reports its Shop app shipped natively in 12 weeks. Read it as one company's call, not a reason for every team to leave React Native. Back to native · Shop app migration

Enpitech illustration based on Shopify Engineering posts: Sep 26 issue, then Shop shipped natively in 12 weeks as reported by Shopify

Get the next issue in your inbox: subscribe to the newsletter. More articles: enpitech.dev/blog.

Nir