Neodrop
Create
FeedDiscoverMy ChannelsAuto-publishJoin Our Discord
FeedDiscoverCreateMy Channels
Starred repos weekly — Sep 21–27, 2026: Next.js 16.3.6 patches a critical flaw, VS Code 1.139 lands
2026-09-28

Starred repos weekly — Sep 21–27, 2026: Next.js 16.3.6 patches a critical flaw, VS Code 1.139 lands

A five-repo scan for September 21–27: Next.js ships an out-of-band critical security fix in 16.3.6, VS Code 1.139 speeds up agent session lists and renames its Linux launchers, and React, Rust, and Tailwind CSS publish no release.

What's New in the Repos I Starred
What's New in the Repos I Starred@NeoDrop Official
The completed week was September 21–27, 2026. Next.js shipped an out-of-band security release, v16.3.6 on September 22, that closes a critical remote-code-execution hole in the Node.js implementation of next/og. VS Code published 1.139.0 on September 23 and followed it with 1.139.1 on September 25. React, Rust, and Tailwind CSS published nothing, so those entries cover what moved inside each repository and what is worth watching.
Comment counts below are the total comments on each open issue or pull request in this snapshot, so a thread that opened in 2015 carries a large number whether or not anyone touched it this week.

Next.js

vercel/next.js published v16.3.6 on September 22 as an out-of-band security release, with v15.5.26 landing the same day 12. The advisory behind it, GHSA-vcvr-r3jv-pc5j, is rated critical: improper escaping in the SVG that Satori generates can lead to remote code execution through the Node.js ImageResponse path 34. Satori carries its own advisory for the same escaping flaw 5. Next.js lists the affected range as >=16.2.0 <16.3.6, patched by 16.3.6, and states that the Edge implementation of ImageResponse sits outside the flaw; v15.5.26 bundles related hardening, while the 15.x line was never exposed to the reported remote-code-execution issue 34.
Canary publishing ran all week, from v16.4.0-canary.38 on September 22 to v16.4.0-canary.51 on September 27, fourteen pre-release tags in six days 67. The feature work inside them centres on unstable_ensureStatic, a new segment config that accepts "shell" or "prefetch" and validates its own nesting 8. Strict route matching became the default on September 21 9, and next/og's SVG serialization was hardened on September 22, the same day the security release went out 10. One change went in and came back out: experimental custom webpack support arrived in canary.41 on September 23 and was reverted in canary.46 on September 25 1112. Server Actions that hung after navigating to a partial-prerendering page were fixed in canary.48 13.
The comment leaders are #49279, "App router issue with Framer Motion shared layout animations" with 143 comments and #64921, "Inconsistent CSS resolution order with App Router" with 108 comments; both last saw activity earlier in September 1415. The busiest thread that did move was #53473, "@next/next/no-html-link-for-pages rule does not work with pageExtensions" with 78 comments, active on September 24 16. PR #97625, "Turbopack: add Module Federation remote consumption" picked up again on September 24 with 14 comments 17.
  • Why included now: v16.3.6 is an emergency patch for a critical vulnerability, and the affected range covers every 16.2.x and 16.3.x application built before September 22.
  • Upgrade call — Yes: Install next@16.3.6 now if any route you deploy uses the Node.js ImageResponse from next/og and you run a 16.x release at or above 16.2.0. On 15.x, v15.5.26 carries the hardening but there is no reported exposure to patch.
Loading content card…

VS Code

microsoft/vscode published 1.139.0 on September 23 and 1.139.1 on September 25 181920. Agent sessions can now run inside a project's Dev Container on remote hosts — SSH, Tunnel, and WSL — gated by chat.agentHost.devContainer.enabled, which needs a Dev Container configuration in the remote folder and Docker on the remote host 20. The session list got much faster: the agent host keeps lightweight session and chat metadata in a central catalog instead of opening every conversation database when the list is built, which Microsoft measured on a machine holding around 645 sessions at 1.3 seconds down to 0.1 seconds for the first listing after launch, and 0.6 seconds down to 0.15 seconds for a refresh 20. Sessions created earlier migrate in the background. The list also gained a compact view, in-place renaming with the Rename action or F2, and a choice between tabbed and single-chat presentation for sessions holding several chats. In the editor, word wrap indicators appear in the right margin, and typing an opening bracket no longer inserts a duplicate closing one 20.
The upgrade risk sits in the Linux packages, where the desktop entry files were renamed to reverse-DNS names: code.desktop is now com.microsoft.VSCode.desktop and code-url-handler.desktop is now com.microsoft.VSCode.UrlHandler.desktop. Pinned launchers, favourites, and scripts pointing at the old names stop working, and on KDE Plasma a stale favourite reports "You are not authorized to execute this file", which is a missing desktop file rather than a permissions fault. Reinstalling the package leaves those saved references alone 20.
The comment leaders are #519, "Allow to change the font size and font of the workbench" with 602 comments and #3130, "Allow customization of mouse shortcuts" with 453 comments 2122. The threads that moved this week were the two Meta reports where agent request and model-availability failures collect: #253136, "Meta: Sorry, your request failed. Please try again." with 409 comments, active September 26, and #253137, "Meta: Language Model Unavailable" with 292 comments, active September 25 2324. A new report opened on September 23: #337570, "Linux (Xfce/xfwm4): grey border on left, right and bottom of the window since 1.139", which tracks a window-decoration regression that arrived with the Electron 43 upgrade inside this release 25.
  • Why included now: 1.139.0 is a fresh minor whose Linux packaging change breaks pinned launchers silently, and 1.139.1 followed two days later with a batch of fixes.
  • Upgrade call — Conditional: Take it for agent sessions inside remote Dev Containers or for the faster session list. On Linux, plan to remove and re-add pinned launchers and KDE favourites afterwards; on Xfce or xfwm4, check the reported window-border regression before pushing this across a team.
Loading content card…

React

react/react, the canonical public repository behind the facebook/react whitelist entry, published no release in the window. v19.3.0 from September 9 remains the newest stable 26. Three commits landed on main on September 22. The compiler now permits setState after await inside an effect function 27. The Rust compiler port fixed its detection of shorthand and computed object properties 28. Flight began preserving a leading U+FEFF byte-order mark in text rows 29. The middle change is the snapshot Next.js adopted the same day, bumping its vendored React from 59aff3e1-20260918 to 8b0da1c6-20260922 30. None of the three has reached a published release.
The comment leaders are #13991, "Hooks + multiple instances of React" with 515 comments and #11347, "RFC: Plan for custom element attributes/properties in React 19" with 286 comments, and both last saw activity well before the window 3132. The only thread above 100 comments to move was #29034, "[React 19] allow opting out of automatic form reset when Form Actions are used", active September 27 with 105 comments 33.
  • Why included now: The compiler change alters what counts as a legal effect function, which can flip code that compiles and runs today.
  • Upgrade call — Hold: v19.3.0 remains the newest stable and nothing replaced it. If you have not moved to it yet, that upgrade still stands; if you have, there is nothing to install this week.
Loading content card…

Rust

rust-lang/rust published no release in the window, and 1.98.1 from September 3 remains the newest stable 34. The week's substantive merge is PR #156882, "alloc: stabilise Allocator", which landed on September 23 after 202 comments 35. Three more changes reached main. Forced keywords, written k#, let any identifier be forced into a keyword position 36. SyncView was stabilised on September 26 37. RawWakerVTable gained a guarantee of 8-byte alignment 38. The compiler also switched the crate hash it stores in the SVH from SipHash-128 to XXH3-128, worth roughly ten times less work per byte on the AVX2 path 39.
The formal comment leader is PR #112049, "[do not merge] CI experiments" with 2,432 comments, a build-testing thread last touched September 23 40. The open work that matters for production code is PR #132553, "Make Rc<T>::deref and Arc<T>::deref zero-cost" with 173 comments, active September 27, and PR #158845, "Resolver: Parallelize the import resolution loop" with 107 comments, active September 25 4142.
  • Why included now: Stabilising Allocator is the kind of merge that unblocks crates waiting on allocator-generic containers, and it arrived six days before the next scheduled stable.
  • Upgrade call — Hold: Stay on 1.98.1. Take that release first if your toolchain is still below it. The Allocator work lands in a future stable, so there is nothing to adopt yet.
Loading content card…

Tailwind CSS

tailwindlabs/tailwindcss published no release in the window, and v4.3.3 from July 16 remains the newest stable 43. Four commits landed on September 25. The one with reach is PR #20513, "Improve style invalidation performance of group-* and peer-* variants", which changes how the compiler decides which styles to rebuild when those variants are in play 44. Two smaller fixes came with it: a backslash inside a CSS comment is read as an ordinary character again 45, and breakpoint variants holding decimal values sort in numeric order 46. A run of pull requests opened between September 25 and 27 and has not landed yet, covering the global git ignore file in the source scanner, a Vite input-dependency rebuild race, content-visibility, interpolate-size, and text-stable utilities, and recognition of viewport and font-relative length units 4748495051.
The most-commented open issues are #17958, "Error: Cannot find module '../lightningcss.linux-x64-musl.node'" with 38 comments, which hits musl-based Linux images, and #15005, "@property isn't supported in shadow roots" with 33 comments; both last saw activity months ago 5253. What moved in the window was #20501, "@tailwindcss/vite: cached Root.compiler pins the build's plugin context, keeping the finished bundle alive (multi-GB RSS in Astro SSG)", active September 25 54.
  • Why included now: The invalidation change touches the rebuild path of any project using group-* or peer-* variants, and the queued pull requests show the next release carrying new utilities alongside fixes.
  • Upgrade call — Hold: v4.3.3 stays the newest stable since July 16, so this week brings nothing to install.

Quick reference

RepositoryLatest relevant releaseWindow status and hot watchUpgrade call
vercel/next.jsv16.3.6, Sep 22; v16.4.0-canary.51, Sep 27 17Critical next/og RCE patched for >=16.2.0 <16.3.6; canaries .38–.51 with unstable_ensureStatic and default strict route matching; #49279 has 143 comments and #64921 has 108, while #53473 moved with 78 316Yes
microsoft/vscode1.139.0, Sep 23; 1.139.1, Sep 25 1819Dev Container agent sessions on SSH/Tunnel/WSL, session list up to 12x faster, compact list and in-place rename; Linux desktop entries renamed, breaking pinned launchers; #253136 moved with 409 comments 2023Conditional
react/reactv19.3.0, Sep 9 26No release; three main commits on Sep 22 covering setState after await, compiler property detection, and Flight text rows; #13991 has 515 comments and #11347 has 286, with #29034 moving at 105 3133Hold
rust-lang/rust1.98.1, Sep 3 34No release; Allocator stabilised, forced keywords k#, SyncView stabilised, RawWakerVTable alignment guaranteed; #112049 has 2,432 comments and #132553 has 173 3541Hold
tailwindlabs/tailwindcssv4.3.3, Jul 16 43No release; group-* and peer-* invalidation performance and two parser fixes on Sep 25, plus a wave of unreleased utility pull requests; #17958 has 38 comments and #15005 has 33, with #20501 moving 4454Hold

References

  1. 1
    Next.js v16.3.6 release

    github.com

  2. 2
    Next.js v15.5.26 release

    github.com

  3. 3
    Next.js security advisory GHSA-vcvr-r3jv-pc5j

    github.com

  4. 4
    Next.js security update for a critical upstream issue

    nextjs.org

  5. 5
    Satori security advisory GHSA-wx4j-mvgx-mqwp

    github.com

  6. 6
    Next.js v16.4.0-canary.38 release

    github.com

  7. 7
    Next.js v16.4.0-canary.51 release

    github.com

  8. 8
    Next.js pull request #98191

    github.com

  9. 9
    Next.js pull request #97397

    github.com

  10. 10
    Next.js pull request #99061

    github.com

  11. 11
    Next.js pull request #98862

    github.com

  12. 12
    Next.js pull request #99227

    github.com

  13. 13
    Next.js pull request #99252

    github.com

  14. 14
    Next.js issue #49279

    github.com

  15. 15
    Next.js issue #64921

    github.com

  16. 16
    Next.js issue #53473

    github.com

  17. 17
    Next.js pull request #97625

    github.com

  18. 18
    Visual Studio Code 1.139.0 release

    github.com

  19. 19
    Visual Studio Code 1.139.1 release

    github.com

  20. 20
    Visual Studio Code 1.139 update notes

    code.visualstudio.com

  21. 21
    VS Code issue #519

    github.com

  22. 22
    VS Code issue #3130

    github.com

  23. 23
    VS Code issue #253136

    github.com

  24. 24
    VS Code issue #253137

    github.com

  25. 25
    VS Code issue #337570

    github.com

  26. 26
    React v19.3.0 release

    github.com

  27. 27
    React pull request #36734

    github.com

  28. 28
    React pull request #37674

    github.com

  29. 29
    React pull request #37625

    github.com

  30. 30
    Next.js v16.4.0-canary.40 release

    github.com

  31. 31
    React issue #13991

    github.com

  32. 32
    React issue #11347

    github.com

  33. 33
    React issue #29034

    github.com

  34. 34
    Rust 1.98.1 release

    github.com

  35. 35
    Rust pull request #156882

    github.com

  36. 36
    Rust commit abcef063

    github.com

  37. 37
    Rust commit eccccf3

    github.com

  38. 38
    Rust commit 38d0d17

    github.com

  39. 39
    Rust commit 79ee8dc

    github.com

  40. 40
    Rust pull request #112049

    github.com

  41. 41
    Rust pull request #132553

    github.com

  42. 42
    Rust pull request #158845

    github.com

  43. 43
    Tailwind CSS v4.3.3 release

    github.com

  44. 44
    Tailwind CSS pull request #20513

    github.com

  45. 45
    Tailwind CSS pull request #20508

    github.com

  46. 46
    Tailwind CSS pull request #20512

    github.com

  47. 47
    Tailwind CSS pull request #20524

    github.com

  48. 48
    Tailwind CSS pull request #20525

    github.com

  49. 49
    Tailwind CSS pull request #20520

    github.com

  50. 50
    Tailwind CSS pull request #20518

    github.com

  51. 51
    Tailwind CSS pull request #20516

    github.com

  52. 52
    Tailwind CSS issue #17958

    github.com

  53. 53
    Tailwind CSS issue #15005

    github.com

  54. 54
    Tailwind CSS issue #20501

    github.com

What's New in the Repos I Starred
What's New in the Repos I Starred@NeoDrop Official

This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.

Related content

  • Next.js
  • VS Code
  • React
  • Rust
  • Tailwind CSS
  • Quick reference
github.com · GitHub repository
vercel/next.js
https://github.com/vercel/next.js
github.com · GitHub repository
microsoft/vscode
https://github.com/microsoft/vscode
github.com · GitHub repository
react/react
https://github.com/react/react
github.com · GitHub repository
rust-lang/rust
https://github.com/rust-lang/rust