We just published 6 CVEs identifying security vulnerabilities in React Router and Remix v2 We recommend updating to the latest appropriate versions: React Router v7 -- 7.12.0 React Router v6 -- 6.30.3 Remix v2 -- 2.17.2 Details, links, and package ranges are listed below

wake up babe, new framework CVEs just dropped 😭

Does, um, anyone else constantly play "guess the framework" while browsing the web? Just me? I get a hunch and view source to check the answer. I'm on target... surprisingly frequently. But for the life of me I could not tell you what's factoring in to my guesses. It's just... vibes? 🤷‍♂️

Now that we've all had some time to breathe, our security team here at Netlify (whom I now know much more intimately than before! 🙃) took the time to write up some notes on the recent React/Next.js CVEs.

Netlify's new Observability page is so good. I've been dogfooding it for a while and I'm excited everyone can finally use it! If you have any Netlify projects, go check it out! I bet you'll learn something about your site within a minute of poking around.

Rather than reinventing countless wheels, Netlify and Cloudflare are now collaborating on framework detection and auto-configuration! Cloudflare engineers have been contributing to the open-source www.npmjs.com/package/@net..., which wrangler now leverages just like Netlify. 🤝

I cannot stress this enough: you must upgrade *now*, and assume everything available in your runtime environment (e.g. env vars) has been compromised. Netlify and other platforms are tirelessly fighting off threat actors to minimize harm, but the only way to secure your properties is to upgrade.

What a week.

I'm using tsgo + oxlint + oxfmt for the first time. It's all *so fast*. Small project (~1k loc, ~10 files), but type checking in 90ms, building in 60ms, linting in 70ms, and formatting in 80ms is fantastic. 🚀 The future of web dev tooling is bright. Nice work @typescriptlang.org and @voidzero.dev!

React Router 7 (aka ~Remix) apps can now opt in to deployment to Netlify Edge Functions: www.netlify.com/changelog/re.... Page renders, loaders, and actions closer to your users. ⚖️ No need to reopen debates about origin SSR vs. edge SSR. Just pick whichever fits your app's needs. We support both.

@anthonyholmes.me 👀 By any chance are you @iamanthonyholmes on X who was asking a while back about Netlify support for deploying React Router 7 apps to Edge Functions? Well have I got news for you: github.com/netlify/remi....

Of course, AnalogJS 2.0 works on day one on Netlify! Try it out: analogjs.org/docs/feature... (P.S.: I'm annoyed that we require one line of manual configuration here... brb 👀)

🌶️(?): The `require-await` lint rule should not be enabled and should definitely not be in any `recommended` rulesets. It actively, misguidedly enforces worse patterns and less expressive, less readable, less consistent, less maintainable code, for little to no benefit.

React Router 7's new middleware feature is now supported on Netlify. You can even access fully type-safe Netlify request context: const country = context.get(netlifyRouterContext).geo?.country?.name console.log(`${request.url} from ${country ?? "🤷"}`) Read more: www.netlify.com/changelog/re...

Welp. $ npm install 9 vulnerabilities (4 low, 5 moderate) To address all issues (including breaking changes), run: npm audit fix --force $ npm audit fix --force 15 vulnerabilities (5 low, 2 moderate, 6 high, 2 critical)

You asked it for it (over... and over... and over). Here it is! - ☑️ Astro - ☑️ Next.js - ☑️ stable, documented API to integrate yourself if you're into that More framework support to come. (We're listening if you have a request 👀.)

Next.js 16 is here and Netlify is ready on day one (hour one!) with full support. Just push, drop, or `npx netlify deploy`. No config needed. Upgrade your site or start from our updated starter template (which now builds 12s faster thanks to Turbopack 👀). www.netlify.com/changelog/ne...

We've all thought about joining a company just to fix that one bug or implement that one missing feature that's been frustrating us for years (then quitting the next day). ... What's that bug or feature for you when it comes to Netlify? No promises, but I might just knock it out for you 🫣.

I successfully deployed the @remix.run v3 demo to @netlify.com: remix-3-on.netlify.app. Here's the source: github.com/serhalp/remi.... There were a few minor kinks to work out, but this was their conference demo app for an early preview framework, so that's expected. Seems to work great!

you can sponsor @e18e.dev through GitHub Sponsors or OpenCollective these funds will primarily be used for two things: - distributed to projects/individuals in the wider JS community - development of community projects/tools thanks so much to those of you who already sponsor us 💙

👀

Count me in! I guess I'm attending 4 Vite and Vite-adjacent happy hours in 4 days 🫣

That’s a wrap on Netlify Deploy 2025 🚀 ✨ Agent Runners announced ✨ Demos, live builds + industry panel ✨ A new way for humans + AI to ship together 📖 Blog: www.netlify.com/blog/agent-r... 🎯 Challenge: ntl-deploy-challenge.netlify.app #NTLDEPLOY

The web thrives when it’s open. 🌍 We’re supporting frameworks like @tanstack.com & @astro.build with @cloudflare.social—keeping them strong, independent & community-driven. More from @biilmann.blog → www.netlify.com/blog/support...

Looking forward to meeting a bunch of folks I've collaborated with across the ecosystem for the first time at @viteconf.org in a couple weeks! @danielroe.dev @pi0.io @43081j.com @thealexlichter.com @ryansolid.bsky.social (we were briefly teammates! 🫡) @tannerlinsley.com... anyone else?

We’ve updated Netlify pricing – but if you’re an existing customer, nothing changes. ❤️ We're rolling out credit-based plans for new users. – One metric across 5 categories – Analytics now included – New Personal plan starts at $9/mo

Three vulnerabilities affecting Next.js were just disclosed. @netlify.com sites were unaffected by two and are highly unlikely to be exposed to the third. Thank you to the @nextjs.org team for working with providers to keep Next.js sites secure. Full details: www.netlify.com/changelog/se...

This has honestly been really fun to work on — and to dogfood while developing my own projects. I can't believe how easy it was to build that Nuxt module... It makes me wonder about clever use cases we haven't thought of 🤔. Pretty sure we can make it work with Next.js... Any fun ideas out there?

Some *slightly* overdue cleanup: $ nodenv uninstall -f 0.10.48 6.9.1 8.9.0 8.11.4 10.15.3 10.24.1 12.2.0 12.16.3 12.18.3 12.22.0 14.15.3 14.15.4 14.15.5 14.16.0 14.16.1 14.17.0 14.17.2 14.18.2 14.19.0 16.13.1 16.13.2 16.14.0 16.14.2 ... oh, uh. Does anyone still use nodenv? Is that overdue too?

just some of the highlights of the great work the @e18e.dev community has been doing in the last few months. awesome work by everyone involved, and big thanks to all the maintainers who collaborated ❤️

Full Netlify platform emulation right in your native dev command ✅ Vite: add `@netlify/vite-plugin` (bsky.app/profile/netl...) ✅ Nuxt: add `@netlify/nuxt` (bsky.app/profile/dani...) ✅ Astro: now just works with `@astrojs/netlify` (👇🏼) Which framework should we level up next? (No replies = jQuery)

RR + unstable RSC support has shipped. Please give it a go and let me know about any pain points. remix.run/blog/react-r...

The launch of the new @netlify/nuxt module empowers users & agents with the features of the Netlify dev environment right in Nuxt's CLI -- no separate CLI required ✨ Check out our new guide by @philippeserhal.com & get started today! developers.netlify.com/guides/run-s...

This was fun to collaborate on with @danielroe.dev and the @nuxt.com team! Looking forward to continued collaboration "across the aisle" ;) Now go enjoy that beach, Daniel!

Shout out to the @nextjs.org team for leaning into changes partners were asking for. Just recently: - publicly shared plans for v16 w/ a timeline - disclosed vulns to providers - fixed bugs we reported - found a Netlify-specific bug + PR'd a fix to our adapter(!) - working on Deployment Adapters API

Nuxt 4.0 is here at last … and it's all about DX ✨ 🗂️ app/ directory for better organisation 🔄 smarter data fetching ⚡️ a faster CLI with socket communication 🔧 improved TypeScript integration ... and a smooth upgrade experience. 💚 👉 nuxt.com/blog/v4

An overlooked benefit of AI codegen is that now when I have a really stupid fun idea I can knock it out immediately instead of adding it to my endless pile of unfinished projects. second-wrapped.netlify.app From idea to app on @bolt.new to production on @netlify.com in—literally—about 30 seconds.

🫠 This is the most deranged code I've seen an LLM write so far. It decided to test its change by reading the source code file from the file system and asserting what code it contains or doesn't contain. No human would ever come up with this. I am speechless, but also this is hilarious.

Nice articulation of something I've been thinking about. I've been comparing to the late 90s when "power users" knew how to craft the perfect query with the right combination of operators to make search engines do their bidding but everyone else used natural language and couldn't find a thing.

Check out what we've been working on! github.com/netlify/prim... Why waste time install lot tool when one tool do trick?

Local development is getting a serious upgrade 🤫

Hypothetically, say you wanted a really, really big `node_modules/` (let's say 5-10 GB) to test something, what would you do? I'd want it to be realistic, not just filler or video files, and duplicating files is off the table because what I'm testing involves compression.

Powerful, simple, standard, with no vendor lock-in. What else could you need?

Security update: Vulnerabilities affecting React Router and Remix were recently disclosed. Netlify sites had limited exposure, and a mitigation has already been rolled out. We recommend upgrading to React Router 7.5.2. Full details:

Hey security researchers, if you could start dropping your framework CVEs ~Mon–Wed instead of near the weekend, that would really spark joy. — Sincerely, framework teams at all deployment providers

Is there anything out there that calculates an npm package's total size incl. full dependency tree, like @antfu.me's github.com/antfu/node-m... and @hirok.io's github.com/privatenumbe..., but with a programmatic API? I want a diff on PRs like github.com/marketplace/..., but with the actual size.

🚀 We shipped perf fixes to the Netlify CLI. On my M3 it's now 2-3x faster. Plus, for node 22.8.0+, we'll leverage the new V8 code cache (nodejs.org/api/module.h...) for even faster subsequent runs (extra 75-400ms savings). Upgrade! `npm i -g netlify-cli@latest` www.netlify.com/changelog/ne...

Hmm. "React Server Components are nice in theory but 5 years in it just isn’t working out" — Remix co-creator "Despite heroic efforts [...] the RSC milestone remained “just a couple of months away” for over a year" — @redwoodjs.com team "RSCs will be available soon" — @tannerlinsley.com 8 mos ago

Big news, Redwood community! 🌲 We're splitting our focus to better serve you: RedwoodGraphQL: the mature framework you trust RedwoodSDK: our new toolkit for the personal software revolution Your existing apps? Fully supported. Your future? Even brighter. More information: redwoodjs.com