Lo nuevo hoy

Today's highlights

Points forts du jour

Click en cualquiera para ir al detalle

Click any item to jump to the full section

Cliquez un élément pour aller à la section complète

🔥

Top Stories

Seguridad

Next.js 16.3 canary 10: rechazo SSRF en next/image y bump de React

La canary 16.3.0-canary.10 bumpea React de da9325b5-20260417 a f4e0d4ed-20260429, agrega el deployment id en las keys de cacheHandlers y mejora los mensajes de error cuando next/image rechaza IPs privadas para evitar SSRF. Suma swc 65 y un fix de races en turbo-tasks-backend. Ojo con esto: si tu image loader apunta a hosts internos, ahora vas a ver el porqué del bloqueo.

04 May 2026
github.com/vercel/next.js →
Release

TanStack Start estrena early hints y Link header en plena ola RC

Dos releases del 2 de mayo metieron features clave: early hints (PR #7324) y soporte de Link header (PR #7327). Es decir, el server arranca a empujar preload/preconnect ANTES del HTML — locura cósmica para LCP en SSR. Si venís usando TanStack Start como reemplazo de Next, esto te equipara una de las features que faltaban.

02 May 2026
github.com/TanStack/router →
Beta

Storybook 10.4 alpha 16: entrypoint real para React Native y CLI con scoring agéntico

Storybook agrega generación real de entrypoint para React Native (#34663) — adiós workarounds. La CLI ahora mide observability del self-healing scoring (#34699), pensado para corridas agénticas, y la automigration mueve los add-ons RN on-device a deviceAddons (#34659). Suma optimización en play functions corriendo vitest menos veces. Pre-release, pero apunta fuerte al uso por agentes.

05 May 2026
github.com/storybookjs/storybook →
⚛️

React

Release

TanStack Query: tema en devtools de angular-query y NoInfer restaurado en persister

Release del 3 de mayo: 23 paquetes actualizados a 5.100.9 / 6.1.28 (React, Vue, Svelte, Solid Query y compañía). Lo importante: opción de tema en devtools de angular-query, fix de typing en el setter onClose y vuelve NoInfer<TQueryKey> en el persister para que TS no te invente keys. Suma vitest smoke tests para svelte-query-devtools.

03 May 2026
github.com/TanStack/query →
🧩

JavaScript Frameworks

Patch

Astro 6.2.2: 16 fixes — scoped styles con Tailwind 4, AVIF animado y rutas con base custom

Patch grande para 6.2: arreglan scoped styles con & anidado en :where(...) + Tailwind v4, los crashes de build con AVIF animado, el 404 de index cuando combinás base custom con trailingSlash: 'never', y la propagación de head metadata en adapters con prerender. Suma fix del data-astro-prefetch="tap" en elementos anidados, el session.delete() como primera op del request y deduplicación de scripts. Si estabas en 6.2.0 esperando la solidez, este es el release.

04 May 2026
github.com/withastro/astro →
🔧

Build Tools & Runtimes

Patch

TanStack Router: handler GET cae como fallback para HEAD según RFC 9110 §9.3.2

Antes, si solo definías GET, los HEAD rebotaban con 404/405. Con la release del 3 de mayo (PR #7325) ahora HEAD reusa el handler de GET y devuelve solo headers, como manda la RFC 9110 §9.3.2. Es así de fácil: monitoring tools, link checkers y crawlers dejan de mentir.

03 May 2026
github.com/TanStack/router →
🛠️

Developer Tools

Release

ESLint 10.3.0: la regla no-unused-private-class-members ahora ofrece sugerencias

10.3.0 sale el 1 de mayo: la regla no-unused-private-class-members arranca a sugerir el fix (eliminar el #campo que nadie lee), no solo a marcarlo. Suma fixes en require cache para entornos donde no está disponible y arregla sugerencias rotas dentro del cuerpo de clases. Buenísimo si tenés CI con --fix-dry-run: ahora el reporte trae el cambio propuesto.

01 May 2026
github.com/eslint/eslint →
🔥

Top Stories

Security

Next.js 16.3 canary 10: SSRF rejection in next/image and React bump

Canary 16.3.0-canary.10 bumps React from da9325b5-20260417 to f4e0d4ed-20260429, includes the deployment id in cacheHandlers keys, and improves error messaging when next/image rejects private IPs to prevent SSRF. Also lands swc 65 and a snapshot race fix in turbo-tasks-backend. Heads up: if your image loader points at internal hosts, you'll now see why it's blocked.

04 May 2026
github.com/vercel/next.js →
Release

TanStack Start ships early hints and Link header in mid-RC wave

Two releases on May 2 landed key features: early hints (PR #7324) and Link header support (PR #7327). The server can now push preload/preconnect hints BEFORE the HTML — huge for LCP under SSR. If you're using TanStack Start as a Next replacement, this closes one of the gaps.

02 May 2026
github.com/TanStack/router →
Beta

Storybook 10.4 alpha 16: true React Native entrypoint and agentic CLI scoring

Storybook adds true entrypoint generation for React Native (#34663) — goodbye workarounds. The CLI now measures observability of self-healing scoring (#34699), tuned for agentic runs, and automigration moves on-device RN addons to deviceAddons (#34659). Plus play-function optimizations that run vitest fewer times. Pre-release, but the agent angle is loud.

05 May 2026
github.com/storybookjs/storybook →
⚛️

React

Release

TanStack Query: angular-query devtools theme option and NoInfer restored on persister

May 3 release: 23 packages bumped to 5.100.9 / 6.1.28 (React, Vue, Svelte, Solid Query and friends). The meat: devtools theme option for angular-query, type alignment in the onClose setter, and NoInfer<TQueryKey> restored on the persister so TS stops inferring stray keys. Plus vitest smoke tests for svelte-query-devtools.

03 May 2026
github.com/TanStack/query →
🧩

JavaScript Frameworks

Patch

Astro 6.2.2: 16 fixes — scoped styles with Tailwind 4, animated AVIF and custom base routes

Big patch for 6.2: fixes for scoped styles with nested & inside :where(...) + Tailwind v4, build crashes on animated AVIF, the index 404 when combining custom base with trailingSlash: 'never', and head metadata propagation in adapters using prerender. Plus a fix for data-astro-prefetch="tap" on nested anchor children, session.delete() as the first request op, and script dedup. If you were sitting on 6.2.0 waiting for solidity, this is it.

04 May 2026
github.com/withastro/astro →
🔧

Build Tools & Runtimes

Patch

TanStack Router: GET handler falls back for HEAD per RFC 9110 §9.3.2

Previously, if you only defined GET, HEAD requests bounced with 404/405. The May 3 release (PR #7325) now falls back to the GET handler for HEAD, returning headers only, exactly as RFC 9110 §9.3.2 requires. It's that simple: monitoring tools, link checkers, and crawlers stop lying.

03 May 2026
github.com/TanStack/router →
🛠️

Developer Tools

Release

ESLint 10.3.0: no-unused-private-class-members now offers suggestions

10.3.0 ships May 1: the no-unused-private-class-members rule starts suggesting the fix (drop the #field nobody reads), not just flagging it. Also require cache fixes for environments where it isn't available, plus fixes to suggestions inside class bodies. Great if your CI runs --fix-dry-run: the report now carries the proposed change.

01 May 2026
github.com/eslint/eslint →
🔥

Top Stories

Sécurité

Next.js 16.3 canary 10: rejet SSRF dans next/image et bump de React

La canary 16.3.0-canary.10 passe React de da9325b5-20260417 à f4e0d4ed-20260429, inclut le deployment id dans les clés de cacheHandlers et améliore les messages d'erreur quand next/image rejette les IP privées contre le SSRF. Aussi swc 65 et un fix de race dans turbo-tasks-backend.

04 May 2026
github.com/vercel/next.js →
Release

TanStack Start livre early hints et header Link en pleine vague RC

Deux releases du 2 mai ajoutent des features clés: early hints (PR #7324) et le support du header Link (PR #7327). Le serveur peut désormais pousser preload/preconnect AVANT le HTML — énorme pour le LCP en SSR.

02 May 2026
github.com/TanStack/router →
Bêta

Storybook 10.4 alpha 16: vrai entrypoint React Native et scoring CLI agentique

Storybook ajoute la vraie génération d'entrypoint pour React Native (#34663). La CLI mesure désormais l'observability du self-healing scoring (#34699), pensée pour les exécutions agentiques, et l'automigration déplace les addons RN on-device vers deviceAddons (#34659).

05 May 2026
github.com/storybookjs/storybook →
⚛️

React

Release

TanStack Query: option de thème dans les devtools angular-query et NoInfer restauré sur persister

Release du 3 mai: 23 packages bumpés à 5.100.9 / 6.1.28. Au menu: option de thème devtools pour angular-query, alignement de typage dans le setter onClose et retour de NoInfer<TQueryKey> sur le persister.

03 May 2026
github.com/TanStack/query →
🧩

JavaScript Frameworks

Patch

Astro 6.2.2: 16 correctifs — scoped styles avec Tailwind 4, AVIF animé et routes avec base custom

Gros patch pour 6.2: correctifs pour les scoped styles avec & imbriqué dans :where(...) + Tailwind v4, les crashes de build sur AVIF animé, le 404 sur index quand on combine base custom avec trailingSlash: 'never', et la propagation des head metadata dans les adapters utilisant prerender.

04 May 2026
github.com/withastro/astro →
🔧

Build Tools & Runtimes

Patch

TanStack Router: le handler GET sert de fallback pour HEAD selon RFC 9110 §9.3.2

Avant, si vous ne définissiez que GET, les requêtes HEAD renvoyaient 404/405. Avec la release du 3 mai (PR #7325), HEAD réutilise le handler GET et ne renvoie que les headers, conformément à la RFC 9110 §9.3.2.

03 May 2026
github.com/TanStack/router →
🛠️

Developer Tools

Release

ESLint 10.3.0: no-unused-private-class-members propose désormais des suggestions

10.3.0 sort le 1 mai: la règle no-unused-private-class-members propose désormais le fix (supprimer le #field que personne ne lit). Plus des fixes du require cache pour les environnements où il n'est pas dispo, et des fixes des suggestions dans le corps des classes.

01 May 2026
github.com/eslint/eslint →