Patch Next.js, meet Argon, say goodbye to Deno.
Good morning. Next.js shipped an emergency security fix, Google's new flagship model is open to everyone, and Deno has one year left. Coffee first, then npm update.
- Next.js fixes two critical RCE bugs
- Gemini 4 Argon goes wide
- Deno joins Cloudflare, and the runtime winds down
- An npm Trusted Publishing hole hit 1,500+ packages
Next.js fixes two critical remote-code-execution bugs
Vercel shipped an out-of-band security release yesterday. Next.js 16.4.1 and 15.5.28 fix two critical RCE bugs (CVSS 9.5) and one high-severity denial-of-service bug.
- RCE #1: App Router apps with Cache Components on, where a
use cachefunction returns typed arrays. - RCE #2: SVG processing through sharp. It hits
next/imagewithdangerouslyAllowSVG,next/ogon Node, and any app that runs user SVGs through sharp. A public proof-of-concept exists. - DoS: any App Router app with at least one Server Action.
use cache bug has no CVE number, so some dependency scanners won't flag it. Don't wait for the bot to open a PR.Do this: npm i next@16.4.1 (or 15.5.28 on 15.x), and check that sharp is 0.35.5 or later.
Sources: Next.js, The Cyber Sec Guru
Gemini 4 Argon is now open to every developer
Google made Gemini 4 Argon, its new flagship model, broadly available this week in the Gemini API, AI Studio and the Gemini app. It had been in a limited preview since September 30.
- Price: $2 per million input tokens and $10 per million output tokens, at an introductory rate.
- Output: up to 1 million tokens in a single response, up from 64,000.
- Benchmark: Google reports 77.9% on DeepSWE v1.1, a long-horizon software engineering test.
Sources: Tech Startups, ForkLog
Deno joins Cloudflare, and the runtime has a year left
Ryan Dahl announced on October 9 that the whole Deno team is joining Cloudflare.
- Deno runtime: monthly bug-fix and security releases for one more year. Then development ends. It stays open source.
- Deno Deploy: shuts down in about six months. Paying customers get help moving to Cloudflare Workers.
- JSR: stays up, now on Cloudflare's infrastructure.
Sources: Deno, Cloudflare
An npm Trusted Publishing hole exposed 1,500+ packages
Bloom Security found that npm Trusted Publishing checked a GitHub repo's name, not its permanent ID. When a maintainer renamed, moved or deleted a repo, an attacker could create a new repo with the old name and publish new versions of the package. No stolen password needed.
The exposed packages have more than 10 million downloads in total. GitHub says unvalidated Trusted Publishing configurations now expire after 48 hours. Nobody has seen an attack in the wild.
Do this (maintainers): run npm trust list and confirm each binding points to a repo you still control. Remove the binding before you rename or delete a repo.
Source: Help Net Security
- GitHub Copilot can now use a computer. The Copilot CLI and Copilot app can click through graphical apps, not only edit files. Public preview. Read more
- Node.js 26.12.0 is out on the Current line. Release notes
- Mozilla launched Firefox Enterprise, a separate Firefox product for organizations. Mozilla
- Timescale released pg_vectorsearch, a faster vector index for Postgres. GitHub
- Windows Server 2022 left mainstream support on October 13. Extended support runs to October 2031. BleepingComputer
- Oct 20Node.js 24 moves to Maintenance LTS.
- Oct 28Node.js 26 becomes Active LTS. Time to plan the upgrade.
- ~Apr 2027Deno Deploy shuts down.
- ~Oct 2027Last Deno runtime releases.
Source: NodeSource
How Cloudflare tracked down a rare MySQL caching bug in Hyperdrive. A good debugging story with a lesson for anyone who caches database queries.
That's the merge.
See you tomorrow morning. If a teammate still runs Next.js 16.4.0, forward this to them.