Starred repos weekly — Aug 24–30, 2026: Next.js security patch and VS Code 1.135

The completed week was August 24-30, 2026. Next.js published a critical security patch and continued its v16.4 canary train. VS Code shipped 1.135.0. React, Rust, and Tailwind CSS kept their latest release lines, so the decision for those three depends on the current integration risks rather than a fresh version number.

Open-item counts below are total comments on currently open issues or pull requests in the August 31 snapshot. They are not comments added during August 24-30.

Next.js

vercel/next.js ended the window with v16.4.0-canary.12, published August 29. That canary adds non-interactive mode to upgrade codemod prompts, lets Next.js codemods transform .mjs files, and stores keys in order in SST blocks that omit hashes. 1

The stable line also received v16.3.3 on August 25. The patch fixes two critical unauthenticated remote-code-execution paths: Windows-hosted servers and the Image Optimization API when AVIF files are used. 2

The most-commented open threads are #49279, "App router issue with Framer Motion shared layout animations" with 142 comments and #64921, "Inconsistent CSS resolution order with App Router" with 104. The two issues matter to teams using App Router transitions or depending on stable CSS ordering across environments. 3

Why included now: The week combines an urgent stable security patch with a fast-moving canary line.
Upgrade call — Conditional: Apply v16.3.3 to supported 16.3 deployments, then run the application and image-optimization test suites. Keep v16.4.0-canary.12 in a test lane until a stable release carries the canary work.

github.com · GitHub repository

vercel/next.js

https://github.com/vercel/next.js

Loading content card…

VS Code

Microsoft/vscode published 1.135.0 on August 26. The release adds external agent sessions, so recent Copilot or Claude sessions from other applications can continue in VS Code. The Agents window now defaults to a single-pane layout, and the chat response footer exposes input, cached-input, and output token usage on hover. 4 5

The release also adds the experimental /rubber-duck second-opinion command for agent work. Local agent harness sandboxing now defaults to 0%, with opt-in controls still available. Teams that use agent sessions should check those two behavior changes during rollout. 5

The current comment leaders are #519, "Allow to change the font size and font of the workbench" with 600 comments and #3130, "Allow customization of mouse shortcuts" with 453. Both are long-running workbench requests, so they describe product gaps rather than 1.135 regressions. 6

Why included now: 1.135.0 changes the agent workflow and the default sandboxing posture.
Upgrade call — Conditional: Upgrade when external sessions or the new Agents window solves a current workflow problem, after checking the sandbox setting in managed installations. Hold for the next desktop validation window when those changes are outside the team's workflow.

github.com · GitHub repository

microsoft/vscode

https://github.com/microsoft/vscode

Loading content card…

React

react/react has no release published in the completed week. The latest stable line remains v19.2.8, published July 21, with an improvement to React Server Components decoding performance. 7 8

The most-commented open threads are #13991, "Hooks + multiple instances of React" with 515 comments and #11347, "RFC: Plan for custom element attributes/properties in React 19" with 286. The first is a check for applications that load duplicate React packages. The second remains relevant to Web Components and custom-element integration. 9

Why included now: The stable version is unchanged, while duplicate React instances and custom elements remain practical integration checks.
Upgrade call — Hold: Keep the tested React version. Move to v19.2.8 when the application still lacks the Server Components decoding improvement or when a measured workload benefits from it.

Rust

rust-lang/rust has no release published in the completed week. The current stable line is 1.98.0, published August 20. Rust 1.98 allows more lifetime shortening for &mut unsize coercions, adds lints for runtime symbol definitions and c_void return types, promotes several thumb targets to Tier 2, and stabilizes APIs including str::substr_range, UTF-16 conversion methods, and mutable atomic-reference helpers. 10 11

The compatibility notes deserve a CI pass. Rust 1.98 changes some trait-object lifetime inference and ambiguous-import errors, tightens repr(transparent) and transmute() checks, changes Windows thread-local destructor behavior, and lets rustfmt discover module files selected by cfg_select!. 11

The formal comment leader is #112049, "[do not merge] CI experiments" with 2,318 comments. The next listed thread is #113382, "[perf] test MCP510" with 496. For application developers, #32838, "Allocator traits and std::heap" with 495 comments is the more useful long-running watch. 12

Why included now: Rust 1.98 remains the current stable baseline, and its compatibility notes affect compiler, target, and release CI.
Upgrade call — Conditional: Test 1.98.0 in compiler, benchmark, and release CI. The release fits projects that need the stabilized APIs or target promotions; projects touching the compatibility notes should stage the move.

github.com · GitHub repository

rust-lang/rust

https://github.com/rust-lang/rust

Loading content card…

Tailwind CSS

tailwindlabs/tailwindcss has no release published in the completed week. The latest stable line remains v4.3.3, published July 16. That release adds polling for unreliable filesystem events, handles CSS nesting when Lightning CSS is absent, loads the file watcher only when needed, and selects platform fonts so CJK text follows the page language on Windows. 13 14

The most-commented open items are #15005, "@property isn't supported in shadow roots" with 33 comments and #20436, "Do not migrate a variant literal behind a conditional" with 11. The first matters to Web Components using Shadow DOM. The second is an active pull request around variant migration in conditional syntax. 15

Why included now: The stable line is unchanged, while Shadow DOM and conditional variant behavior remain environment-specific checks.
Upgrade call — Conditional: Move to v4.3.3 when polling, CSS nesting, Windows CJK fonts, or another listed fix addresses a current problem. Hold when the tested version already covers the project's build and component environments.

Quick reference

Repository	Latest relevant release	Window status and hot watch	Upgrade call
vercel/next.js	`v16.4.0-canary.12`, Aug 29; stable security patch `v16.3.3`, Aug 25 1 2	Critical RCE fixes on the stable line; #49279 has 142 comments and #64921 has 104 3	Conditional
microsoft/vscode	`1.135.0`, Aug 26 4 5	External agent sessions, single-pane Agents window, sandboxing default change; #519 has 600 comments and #3130 has 453 6	Conditional
react/react	`v19.2.8`, Jul 21 7 8	No in-window release; duplicate React instances and custom-element integration remain the practical watch; #13991 has 515 comments and #11347 has 286 9	Hold
rust-lang/rust	`1.98.0`, Aug 20 10 11	No in-window release; compatibility-sensitive compiler and target changes; #112049 has 2,318 comments and #32838 has 495 12	Conditional
tailwindlabs/tailwindcss	`v4.3.3`, Jul 16 13 14	No in-window release; Shadow DOM and conditional variant migration remain the main checks; #15005 has 33 comments and #20436 has 11 15	Conditional