Neodrop
Create
FeedDiscoverMy ChannelsAuto-publishJoin Our Discord
FeedDiscoverCreateMy Channels
Starred repos weekly — Sep 28–Oct 4, 2026: Rust 1.99 and VS Code 1.140 land, Next.js patches a high-severity SSRF
2026-10-05

Starred repos weekly — Sep 28–Oct 4, 2026: Rust 1.99 and VS Code 1.140 land, Next.js patches a high-severity SSRF

A five-repo scan for September 28 – October 4: Rust 1.99.0 and VS Code 1.140.0 are both new stable releases, Next.js patches seven advisories including a high-severity Image Optimization flaw, and React and Tailwind CSS publish nothing.

What's New in the Repos I Starred
What's New in the Repos I Starred@NeoDrop Official
The completed week was September 28 – October 4, 2026. Three of the five tracked repositories shipped a new stable release. Rust published 1.99.0 on October 1 1 and VS Code published 1.140.0 on September 30 2, while Next.js issued the security patch v16.3.8 on September 30 3. React and Tailwind CSS published nothing, so those entries cover what moved inside each repository and what is worth watching.
Comment counts below are the total comments on each open issue or pull request in this snapshot, so a thread that opened years ago carries a large number whether or not anyone touched it this week.

Next.js

vercel/next.js published v16.3.8 on September 30, a security release that closes seven advisories at once 3. The headline is a High-rated server-side request forgery in Image Optimization, GHSA-cjq9-62q9-8jv4, which the advisory lists against next >=16.0.0 and v16.3.8 patches 4. Five sit at Medium: an information disclosure in the App Router's metadata image routes through a dynamicParams bypass 5, two cache-poisoning flaws in the SSG and ISR paths of self-hosted applications, one of which lets one user's content substitute for another's and can be held as a persistent denial of service 67, a pending use cache fill that can leak Draft Mode content into regular responses 8, and a cache leak across root parameter values in nested use cache functions 9. One Low finding covers information disclosure in the development server's Model Context Protocol endpoint 10.
The 15.x line got its own patch the same day: v15.5.27 carries three of the Medium advisories, and the advisory scopes the request forgery to 16.x, so a 15.x installation takes the patch for the cache fixes alone 11. A day earlier, v16.3.7 shipped a single backported fix that stops a strongly consistent read from hanging on a cancelled task in the Turbopack backend 12.
Canary publishing never paused, running from v16.4.0-canary.52 on September 28 to v16.4.0-canary.60 on October 4 1314. The window's canary work added a React Compiler memoization-preservation option 15 and reorganised the bundle analyzer's comparison views.
The standing comment leaders are #49279, "App router issue with Framer Motion shared layout animations" with 143 comments and #64921, "Inconsistent CSS resolution order with App Router" with 108 comments; both last saw activity earlier in September 1617. The thread that moved this week is PR #97625, "Turbopack: add Module Federation remote consumption", still active on October 4, alongside PR #99191, "Do not block manual next dev while nudging upgrade", touched again on September 29 1819.
  • Why included now: v16.3.8 is a security release, and the affected range covers every 16.0.x and later application built before September 30.
  • Upgrade call — Yes: Take next@16.3.8 if you run any 16.x release; the v16.3.7 backend fix rides along. On 15.x, install v15.5.27 for the three cache fixes.
Loading content card…

VS Code

microsoft/vscode published 1.140.0 on September 30 220. The release expands agent workflows: the Copilot harness arrives as a choice in the chat input, running on the Copilot SDK so behaviour matches the standalone GitHub Copilot app and the Copilot CLI, and Microsoft notes it may already be selected for you. HydraFusion, which can escalate a task to a stronger model or have one model critique and revise another's output, is a research preview. Multi-folder sessions let each chat in a session use its own folder or worktree, off by default behind chat.agentHost.copilotAgent.multiRootEnabled and its Claude and Codex equivalents. Agents can delegate to remote agent hosts through four new built-in tools, and git.worktreeSymlinkFolders reuses ignored folders such as node_modules across worktrees, so a new worktree skips the dependency install.
Away from agents, the release ships a set of operational fixes: Dev Containers used by sessions stop after five idle minutes and restart on demand, fresh containers reuse cached server and CLI downloads, and the Done section sorts by completion time. New worktree sessions default their branch picker to the current branch's upstream, such as origin/main, and fetch that remote branch before creating the worktree. Two editor-level additions are editor.selectedTextMatchMode, which controls whether selection matching follows the Find widget, and terminal.integrated.fontRendering, which can be set to grayscale for sharper text on macOS high-DPI displays. The notes list no deprecated features or settings for this release, so nothing that worked in 1.139 was removed.
The comment leaders are #519, "Allow to change the font size and font of the workbench" with 602 comments and #3130, "Allow customization of mouse shortcuts" with 453 comments 2122.
#253136, "Meta: Sorry, your request failed. Please try again." picked up again on October 2 and reached 411 comments 23.
  • Why included now: 1.140.0 is a new minor, and the Copilot harness may already be selected for you, changing which agent backend runs your sessions.
  • Upgrade call — Conditional: Take it for multi-folder sessions, remote delegation, or the Dev Container cleanups. No settings were removed, so the risk is low; if you depend on the Claude or Codex harness, confirm your choice is still selected in the picker after updating.
Loading content card…

React

react/react, the canonical public repository behind the facebook/react whitelist entry, published no release in the window, and v19.3.0 from September 9 remains the newest stable 24. Two commits landed on main. PR #37739, "Fix: Infinite loop caused by uDV + error recovery" merged October 2 and closes a loop between the deferred-value hook and error recovery 25. PR #37699, "[compiler] Remove unused collections in HIR passes" merged September 29 and trims work from the compiler's hot path 26. Neither has reached a published release.
React had the quietest week of the five. The comment leaders #13991, "Hooks + multiple instances of React" with 515 comments and #11347, "RFC: Plan for custom element attributes/properties in React 19" with 286 comments both last moved well before the window, and no thread above 100 comments gained a comment inside it 2728.
  • Why included now: Two merges are all that changed, and the useDeferredValue fix touches an error-recovery path some applications hit.
  • Upgrade call — Hold: v19.3.0 remains the newest stable. If you have not taken it, that upgrade still stands; if you have, there is nothing to install this week.
Loading content card…

Rust

rust-lang/rust published 1.99.0 on October 1, the first stable since 1.98.1 on September 3 129. The language work stabilises C-variadic function definitions and the #[unsafe(naked)] form of them, lets an outlined module mod foo; sit inside the body of a custom attribute or derive macro, and adds an allow-by-default raw_borrows_via_references lint. The unconditional_panic lint now also fires on calls that panic when a chunks or windows size is zero.
The compatibility notes are where an upgrade gets noticed. The legacy integral modules are now fully deprecated, so std::i32::MAX is written i32::MAX 30. no_mangle_generic_items became a hard error 31. The semicolon_in_expressions_from_non_local_macros lint now fires for macros from other crates as well as the current one 32. In Cargo, incremental compilation is disabled by default whenever the CI environment variable is set 33. The compiler moves to LLVM 23 34, and riscv64-unknown-linux-musl is promoted to Tier 2 with host tools 35.
New stabilised APIs include IntoIterator for Box<[T; N]> and its references, VecDeque::retain_back, Vec::into_parts and from_parts, and Box::into_non_null and from_non_null 1. Work merged during the window points at the next release: PR #161491, "Rip out old solver coherence" landed October 4, PR #162974 added a future-compatibility warning for #[panic_handler] on an unsafe fn, PR #163711 stabilised CStr::display, and PR #163742 added the movdir64b and movdiri x86 target features 36373839.
The comment leader is PR #112049, "[do not merge] CI experiments" with 2,452 comments, still active October 4 40.
The open work that reaches production code is PR #132553, "Make Rc<T>::deref and Arc<T>::deref zero-cost" with 180 comments and PR #133502, "[DO NOT MERGE] -Znext-solver=globally experiments" with 472 comments, both active October 4 4142.
  • Why included now: 1.99.0 is a new stable with two changes that will warn or fail on code that compiles today: the fully deprecated integral modules and the cross-crate semicolon lint.
  • Upgrade call — Yes: Move to 1.99.0 when you would take any stable. If your CI denies warnings, expect the new semicolon lint on macros from third-party crates and deprecation warnings on the legacy integral modules.
Loading content card…

Tailwind CSS

tailwindlabs/tailwindcss published no release in the window — v4.3.3 from July 16 is still the newest stable — and no commits landed on main at all, the last change coming on September 25 43. PR #20528, "Ensure sr-only hides the caption of a table" was touched on September 28 and remains open 44, and PR #20436, "Do not migrate a variant literal behind a conditional" is still waiting with 14 comments 45.
The most-commented open issues are #17958, "Error: Cannot find module '../lightningcss.linux-x64-musl.node'" with 38 comments, which hits musl-based Linux images, and #15005, "@property isn't supported in shadow roots" with 33 comments; both last saw activity months ago 4647.
  • Why included now: The repository was silent, and the pending sr-only change touches a common accessibility utility.
  • Upgrade call — Hold: v4.3.3 stays the newest stable. There is nothing to install this week.

Quick reference

RepositoryLatest relevant releaseWindow status and hot watchUpgrade call
vercel/next.jsv16.3.8, Sep 30; v16.3.7, Sep 29; v15.5.27, Sep 30 3Seven advisories fixed, headed by a High request forgery against next >=16.0.0; canaries .52–.60; #49279 has 143 comments and #64921 has 108, while #97625 moved 418Yes
microsoft/vscode1.140.0, Sep 30 2Copilot harness, HydraFusion preview, multi-folder sessions, remote delegation, no deprecated settings; #519 has 602 comments and #253136 moved to 411 2023Conditional
react/reactv19.3.0, Sep 9 24No release; two main commits on Sep 29 and Oct 2; #13991 has 515 comments and #11347 has 286, and neither moved 27Hold
rust-lang/rust1.99.0, Oct 1 1Stable release: legacy integral modules deprecated, no_mangle_generic_items a hard error, cross-crate semicolon lint, Cargo disables incremental in CI, LLVM 23; #112049 has 2,452 comments and #132553 has 180 3041Yes
tailwindlabs/tailwindcssv4.3.3, Jul 16 43No release and no commits in the window; sr-only table-caption fix pending; #17958 has 38 comments and #15005 has 33 44Hold

References

  1. 1
    Rust 1.99.0 release

    github.com

  2. 2
    Visual Studio Code 1.140.0 release

    github.com

  3. 3
    Next.js v16.3.8 release

    github.com

  4. 4
    Next.js security advisory GHSA-cjq9-62q9-8jv4

    github.com

  5. 5
    Next.js security advisory GHSA-f87g-xv8r-7p7x

    github.com

  6. 6
    Next.js security advisory GHSA-4jqv-mc3x-m676

    github.com

  7. 7
    Next.js security advisory GHSA-mcj8-r9mp-w47p

    github.com

  8. 8
    Next.js security advisory GHSA-3w37-wq28-93x7

    github.com

  9. 9
    Next.js security advisory GHSA-h694-7cp9-m8p3

    github.com

  10. 10
    Next.js security advisory GHSA-39w2-rjm5-chcv

    github.com

  11. 11
    Next.js v15.5.27 release

    github.com

  12. 12
    Next.js v16.3.7 release

    github.com

  13. 13
    Next.js v16.4.0-canary.52 release

    github.com

  14. 14
    Next.js v16.4.0-canary.60 release

    github.com

  15. 15
    Next.js pull request #98589

    github.com

  16. 16
    Next.js issue #49279

    github.com

  17. 17
    Next.js issue #64921

    github.com

  18. 18
    Next.js pull request #97625

    github.com

  19. 19
    Next.js pull request #99191

    github.com

  20. 20
    Visual Studio Code 1.140 update notes

    code.visualstudio.com

  21. 21
    VS Code issue #519

    github.com

  22. 22
    VS Code issue #3130

    github.com

  23. 23
    VS Code issue #253136

    github.com

  24. 24
    React v19.3.0 release

    github.com

  25. 25
    React pull request #37739

    github.com

  26. 26
    React pull request #37699

    github.com

  27. 27
    React issue #13991

    github.com

  28. 28
    React issue #11347

    github.com

  29. 29
    Rust 1.98.1 release

    github.com

  30. 30
    Rust pull request #146882

    github.com

  31. 31
    Rust pull request #154585

    github.com

  32. 32
    Rust pull request #159222

    github.com

  33. 33
    Cargo pull request #17220

    github.com

  34. 34
    Rust pull request #158734

    github.com

  35. 35
    Rust pull request #158766

    github.com

  36. 36
    Rust pull request #161491

    github.com

  37. 37
    Rust pull request #162974

    github.com

  38. 38
    Rust pull request #163711

    github.com

  39. 39
    Rust pull request #163742

    github.com

  40. 40
    Rust pull request #112049

    github.com

  41. 41
    Rust pull request #132553

    github.com

  42. 42
    Rust pull request #133502

    github.com

  43. 43
    Tailwind CSS v4.3.3 release

    github.com

  44. 44
    Tailwind CSS pull request #20528

    github.com

  45. 45
    Tailwind CSS pull request #20436

    github.com

  46. 46
    Tailwind CSS issue #17958

    github.com

  47. 47
    Tailwind CSS issue #15005

    github.com

What's New in the Repos I Starred
What's New in the Repos I Starred@NeoDrop Official

This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.

Related content

  • Next.js
  • VS Code
  • React
  • Rust
  • Tailwind CSS
  • Quick reference
github.com · GitHub repository
vercel/next.js
https://github.com/vercel/next.js
github.com · GitHub repository
microsoft/vscode
https://github.com/microsoft/vscode
github.com · GitHub repository
react/react
https://github.com/react/react
github.com · GitHub repository
rust-lang/rust
https://github.com/rust-lang/rust