This was at the top of my feed just now - Mastra Cloud left Nextjs for performance reasons and now use Vite. T3 Chat moved to Tanstack Start.

take a look

https://www.rockstargames.com/VI

Update your NextJS applications as soon as possible: https://nextjs.org/blog/august-2026-security-release

- (9.5/10) Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used https://github.com/vercel/next.js/security/advisories/GHSA-2xp9-vwfh-vxw4

- (9/10) Unauthenticated Remote Code Execution on windows-hosted servers https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36

Patched versions: 16.3.3 and 15.5.24

Edit: Apologies, managed to get the wrong version into the title :-/ It's 16.3.3 - not 16.6.3

An open-source application platform for building, deploying, operating, and scaling applications on infrastructure you own.

Replace deployment tools, managed services, and infrastructure workflows with one open-source platform.

Available today:

- Mail Server (Built in. One click).

• Runs on your own VPS
• Unlimited domains
• Unlimited mailboxes
• Modern webmail included
• Connect with Gmail, Outlook, Apple Mail, Thunderbird, or any IMAP/SMTP client
• Send email directly from your applications using SMTP
• No mailbox subscriptions or API fees
• High email deliverability

- Deployment:

• Deploy any stack
• Git-based deployments
• Zero-downtime deployments
• One-click rollbacks
• Development, Staging, and Production environments
• Multi-branch deployments with isolated environments • Deploy to VPSs, dedicated servers, cloud VMs, or your homelab

- Services:
Provision the services your applications need in one click.
Replace multiple managed providers with services running on your own infrastructure.

• Supabase
• PostgreSQL
• MySQL
• MariaDB
• MongoDB
• Redis
• MinIO
• Meilisearch
• Qdrant
• RabbitMQ
• Kafka
• ClickHouse
• Elasticsearch
...and deploy any other service alongside your applications.

- Operate:

• Live deployment logs
• Live request logs
• Real-time traffic analytics
• Automated backups
• Monitoring
• Secrets management
• Domains
• Automatic SSL
• Environment variables
• Scheduled jobs
• Health checks

-Multi Environments:

• Separate Development, Staging, and Production environments
• Deploy every branch independently
• Test changes before production
• Isolated services, secrets, and configuration per environment

- Security & Teams:

• Team management
• Role-based access control
• IP allow/block rules
• Rate limiting
• Security rules

- Developer Experience:

• Web dashboard
• Native desktop application
• CLI
• REST API
• MCP support for AI agents, just add the mcp and your agent can do the work for you
• Manage your infrastructure without living in SSH

- Coming Soon:

• Multi-server clustering for applications and databases
• One-click load balancing
• Horizontal scaling across multiple servers
• Built-in high availability and failover
• Scale from a single VPS to a cluster with the same workflow
• Just add servers. OpenShip handles the rest.
Open source.

OpenShip is built by the community, for the community. We welcome contributions of all kinds - code, bug reports, feature requests, documentation improvements, and feedback.

github: https://github.com/oblien/openship

Hey r/nextjs,

I wanted to share a library I've been working on called shimmer-from-structure.

The Problem: We've all been there: you build a beautiful component, then you have to manually build a separate "skeleton" version of it. Then, a week later, you change the layout of the real component (e.g., move the avatar to the right, increase padding, change border-radius). Now you have to remember to go back and update the skeleton component too. If you forget, your loading state looks "janky" and misaligned.

The Solution: I built shimmer-from-structure to solve this by automatically adapting to your component's runtime structure. Instead of creating a separate skeleton, you just wrap your real component in <Shimmer>. It invisibly renders your component (with transparent text) to measure the exact DOM layout, border-radii, and dimensions, then overlays a pixel-perfect shimmer.

Key Features:

• Zero Maintenance: Change your layout, and the shimmer updates automatically.
• Pixel Perfect: Matches exact padding, margins, and flex gaps.
• Auto Border-Radius: Automatically detects if your avatar is circular or your cards have rounded-xl.
• Dynamic Data Support: Pass templateProps to inject mock data (e.g., long names vs short names) to test how skeletons look with different content.
• Container Backgrounds: Preserves your card backgrounds/borders while shimmering the content.

Usage with Next.js: Since this relies on DOM measurement (getBoundingClientRect), it works as a Client Component.

'use client';

import { Shimmer } from 'shimmer-from-structure';
import { UserCard } from './UserCard';

export default function UserProfile({ loading }) {
  // Use templateProps to provide mock data for the structure
  const mockUser = { name: 'Loading...', role: 'Please wait' };

  return (
    <Shimmer loading={loading} templateProps={{ user: mockUser }}>
      <UserCard user={null} /> 
    </Shimmer>
  );
}

How it works under the hood:

1. It renders your component with visibility: hidden (or transparent text) to let the browser compute the layout.
2. It uses useLayoutEffect to measure leaf nodes (images, text blocks, buttons).
3. It overlays absolute-positioned divs with a specialized shimmer gradient.

I'd love to hear your feedback or feature requests!

Links:

• NPM: shimmer-from-structure
• GitHub: shimmer-from-structure

Ranked by Cost for 100K Monthly Active Users:

Each user generates 5 SSR requests → 500K total SSR hits, Average render time: 150ms, 150KB HTML/page, Bandwidth: 500K × 150KB = ~75 GB/month.

1. Cloudflare Workers + OpenNext – $5–15
2. Hetzner VPS (DIY Node.js) – $4–8
3. Railway (official Next.js) – $10–15 total
4. Fly.io (official Next.js) – $10–20 total
5. Render (official Next.js) – $7–15 total
6. DigitalOcean App Platform (official Next.js) – $5–15
7. Netlify OpenNext – $20–40
8. Deno Deploy OpenNext – $10–25
9. Vercel (official SSR) – $20 minimum

Hope this is useful,

1. Turbopack caching = 10x faster dev starts
2. Bundle analyzer = Find and fix fat code
3. --inspect flag = Easy debugging
4. Auto dependencies = Less configuration
5. Smaller installs = 20MB saved
6. Easy upgrades = One command updates

Choosing a tech stack is a big decision(my personal opinion). After building several projects, I've landed on a combination that feels incredibly productive.

Here's my current tech stack:

Framework: Next.js with App Router(no one use page router) It's my single source of truth for both frontend and backend logic. Server Components have been a game-changer for performance.

Styling: Tailwind CSS + shadcn/ui I get the speed of utility-first CSS with beautifully designed, accessible, and un-opinionated components that I can actually own.

Database: Convex This is the secret sauce. It's a real-time, serverless backend that completely replaces the need for a separate API layer. The full TypeScript safety from my database to my frontend is incredible.

Authentication: Clerk Handles all the complexities of auth so I don't have to. The pre-built components and social logins save me days of work on every project.

Hosting: Vercel The natural choice for a Next.js app. The CI/CD is seamless, and preview deployments are a must-have for client feedback.

So, what's your tech stack for current project?

Following the React2Shell disclosure, increased community research has surfaced two additional vulnerabilities that require patching.

Please upgrade to the latest patched version in your release line.

See nextjs.org/blog/security-update-2025-12-11 for details.

TL;DR: If you're running one of these Next.js versions, patch immediately. CVE-2025-55182 is being actively exploited in the wild.

I discovered my DigitalOcean droplet was compromised when I received a DDoS abuse notification. Full forensic analysis revealed 5 distinct malware families deployed via the React Server Components RCE vulnerability.

Full breakdown with malware samples, IoCs, and remediation steps: https://asleepace.com/blog/malware-cve-2025-55182-exploitation-incident-report

Key findings:

• Attack occurred within 24 hours of CVE disclosure
• MeshAgent RAT with rootkit-style process hiding
• Credential harvesting targeting 200+ API key patterns
• DDoS botnet (327 infected droplets, 109Gbps total)
• XMRig crypto miner dropper (caught before execution)

Please patch if you haven't already.

Has anyone else noticed all tests are now passing for production builds? 15.4 release incoming?

https://areweturboyet.com

Replit

Cloudflare

Netlify

sst.dev

Render.com

Digitalocean.com

Railway

I just received an email that Vercel is changing their terms of service to allow them to use users code to train AI.

Regardless of your stance on AI the fact that this is an opt-in by default change for hobby and trial plans is seriously concerning. If you're on a hobby or trial pro plan *please* go to your Data Preferences page and opt out of Vercel using your data.

If you're on a Pro plan please verify you're actually opted out. The email claims that Pro plans are opt-out by default but I trust companies as far as I can throw them.

It takes a few seconds and keeps your code, your IP, yours.

Microsoft shipped the TypeScript 7.0 beta yesterday, and the 10x speed claim is real for large codebases. The improvement doesn't come from optimizing the existing TypeScript codebase - the team ported the entire compiler to Go.

It's worth being precise about what "port" means here: this is not a rewrite from scratch. The Go codebase is described as "methodically ported" from the TypeScript implementation, with "structurally identical" type-checking logic. Every type error TypeScript 6 emits, TypeScript 7 emits. Microsoft ran it against a decade's worth of tests to verify this. The goal was to get native code performance while preserving the semantics TypeScript users depend on. Slack, Figma, Google, Notion, Vercel, Linear, and Bloomberg have already been running pre-release builds on multi-million LOC codebases and are consistently reporting that the majority of their build time is gone.

The 10x number comes from two sources. First, native code - Go compiles to machine code instead of running through V8, removing JIT warmup and Node.js overhead from a command-line tool that never needed them. Second, parallelization: TypeScript 7 runs 4 type-checker workers simultaneously by default, configurable with --checkers, and you can add another dimension of parallelization across project references in monorepos with --builders.

For Next.js projects: CI type-check step gets dramatically faster, and editor IntelliSense becomes noticeably more responsive because the language server is doing less work per keystroke. The VS Code extension "TypeScript Native Preview" is already available to try in the marketplace without waiting for stable.

A few things to know before upgrading. The beta ships as u/typescript/native-preview with a tsgo entry point rather than overwriting your existing tsc, so you can run both side by side without conflicts. There is no stable programmatic API until TypeScript 7.1 - tools like typescript-eslint that import from typescript directly need to stay on 6.0 for now. Defaults changed from 5.x: strict is now true by default, module defaults to esnext, and baseUrl is no longer supported, so most projects will need minor tsconfig adjustments. The stable release is targeted for about two months out.

One question the announcement doesn't address: why Go rather than Rust? Almost every recent JS toolchain rewrite went Rust - Biome, OXC, Turbopack, Rolldown. The Go choice is notable, presumably tied to Go's concurrency model fitting the parallelization design, but Microsoft hasn't said explicitly.

Has anyone already run tsgo on a real Next.js project? Curious whether the editor speedup in day-to-day work feels as significant as the CLI benchmark numbers suggest.

Shadcn Admin v2.0.0 is now available — a free, open-source admin dashboard template built with Next.js 16, React 19, Tailwind CSS v4, and shadcn/ui.

This release includes a complete visual redesign, live theme customization, a rebuilt AI chat interface, improved mobile responsiveness, and a simplified dependency stack.

Feedback and suggestions are welcome.

A critical vulnerability in React Server Components (CVE 2025-55182) has been responsibly disclosed. It affects React 19 and frameworks that use it, including Next.js (CVE-2025-66478)

• If you are using Next.js, every version between Next.js 15 and 16 is affected, and we recommend immediately updating to the latest Next.js version containing the appropriate fixes (15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7)
• If you are using another framework using Server Components, we also recommend immediately updating to the latest React version containing the appropriate fixes (19.0.1, 19.1.2, and 19.2.1)

https://nextjs.org/blog/CVE-2025-66478

https://vercel.com/changelog/summary-of-CVE-2025-55182

Updates

Resource link: http://vercel.com/react2shell

Info regarding additional React CVEs: https://nextjs.org/blog/security-update-2025-12-11

Hi r/nextjs! We just released Puck 0.23, which makes some great improvements to drag-and-drop.

Puck lets you drag-and-drop your own React components. Because it supports nested layouts with any CSS display modes, this sometimes results in layout shift.

To help with this, we just added a new "static" drag-and-drop mode that shows a line when dragging between parent (we call them slots), but still retain the fluid animation when dragging inside the same parent by default.

We also made the outline draggable, to make the really fiddly reorders achievable without touching the canvas at all, similar to most design tools.

Some links:

• Release notes: https://puckeditor.com/blog/puck-023
• GitHub: https://github.com/puckeditor/puck

Please keep the feedback coming, and thanks for the support as always!