Get the next post in your inbox
Frontend, AI and how teams ship. No spam, ever.
Quick hits
- Playwright 1.64:
page.webmcpandframe.webmcplet tests list and call the tools your app exposes through the experimental WebMCP browser API. If you are building agent-facing Frontend features, you can check those tools' results alongside your UI tests. Also: custom video frame rates. Release notes - Remix 3, beyond the RC: the release candidate landed on August 31; the official GitHub release marks 3.0.0 as stable on October 1. The Frontend angle: a new UI runtime, native browser modules and full-stack HMR. Upgrading from the RC? Review the
remix/ui->remix/componentrename;@remix-run/uiis now a separate, unstable package. - React Aria 1.22: a new swipeable Sheet component. Per This Week In React, it uses CSS scroll snapping and view timelines instead of JS touch handlers. Sheet post
- Base UI 1.9: filterable Menu, faster Select, Combobox and Menu, and better Drawer gestures. Release notes
Security
Patch Next.js now (again)
Next.js shipped its out-of-band security update on October 14. Fixes are in 16.4.1 and 15.5.28.
What it covers: two critical unauthenticated remote code execution issues and one high-severity denial of service. One RCE is in use cache functions that return typed arrays. The other is in the Image Optimization API when SVG is used, on glibc-based Linux. The DoS is in the App Router via Server Actions.
What to do: upgrade, redeploy, and read the advisories for the affected ranges. For the image issue, the fix needs sharp 0.35.5 or later; upgrading Next.js pulls in the fixed version, but check what your lockfile actually resolves. Next.js security update · Heads-up post from October 8
If you are on Next.js 15, a reminder from last week: security support ends October 21. See the dates
Frontend excellence
TanStack Start 1.0 is stable
Announced October 13. Last week we told you to patch it; this week it is a 1.0. TanStack calls it production-ready for React and Solid, after running in production through the beta and release candidate.
Two things worth knowing. React Server Components are supported but optional. And per This Week In React, the packages ship agent skills so coding agents can learn the APIs. Treat 1.0 as a commitment to the API, not a reason to migrate this quarter. Release post
Iframes that fit their content
Chrome 154 adds frame-sizing: content-height behind a flag. The embedded page opts in with a responsive-embedded-sizing meta tag, and calls window.requestResize() when its content changes later. Feature-detect and keep your old resize code as the fallback while support spreads. Chrome developers
Runtimes
Deno has a sunset date
Ryan Dahl announced on October 9 that the Deno team is joining Cloudflare. As reported, Deno Deploy keeps running for six months, then shuts down. The Deno runtime gets another year of monthly releases with bug fixes and security updates, then development ends. It stays open source, and JSR continues on Cloudflare infrastructure.
If you run on Deno Deploy, the clock is six months. If you only use the runtime locally or in CI, you have a year to decide. Either way, nothing breaks tomorrow. Deno announcement
Get the next issue in your inbox: subscribe to the newsletter. More articles: enpitech.dev/blog.
Nir
