Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Course blog
A link-forward news digest for full-stack Next.js. Short intros, then the original article. Newest first.
These posts are instructor-curated digests, not original reporting. Each item paraphrases a public article and always links to the original source. Optional further reading — not required for grades.
libheif AVIF RCE: from Next.js image opt to upstream fix
- Next.js
- Security
- Course
On September 18, 2026, Karim Rahal wrote up how Vercel reproduced, disclosed, and helped fix a libheif remote-code-execution bug that first showed up as an apparent Next.js image-optimization RCE. Hacktron reported the issue; the root cause was the upstream AVIF decoder. The request path was next/image to /_next/image to sharp to libvips to libheif.
Read digest · Read original: Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers — Vercel
Tailscale Aperture: model routing on Vercel AI Gateway and Sandbox
- AI
- Course
On September 11, 2026, Eric Dodds and Susan Aziz described how Tailscale built Aperture, a customer-facing model router that applies tailnet identity to AI model access. Add someone to the private network and they can use approved models; remove them and access disappears. Co-founder David Carney framed Tailscale as a networking company that chose not to rebuild provider routing; Remy Guercio leads the Aperture product.
Read digest · Read original: How Tailscale built a customer-facing model router on AI Gateway — Vercel
design.md: teach agents on-brand pages outside the repo
- AI
- Course
On August 31, 2026, John Phamous explained how Vercel agents build on-brand pages when they cannot read the repo. The internal product-design skill works in-repo; design.md is a single public URL for reports, proposals, and one-offs that live outside the codebase. A naive port of that skill into one prompt failed because models interpreted vague design language differently without real components nearby.
Read digest · Read original: How our agents build on-brand pages with design.md — Vercel
Claude Code vs Copilot vs Cursor: pick the tool that matches how you work
- AI
- Course
On September 7, 2026, GeekyGoo published a comparison of three AI coding tools and the philosophies behind them. GitHub Copilot adds AI to the IDE you already use; Cursor is an AI-first fork of VS Code; Claude Code is a terminal-native agent from Anthropic.
Read digest · Read original: Claude Code vs. GitHub Copilot vs. Cursor: which AI coding tool actually fits your workflow (2026) — GeekyGoo
Shai-Hulud npm worm resurfaces after 111 days despite publish-time scanning
- Security
- Course
On September 7, 2026, Charlie Eriksen wrote that the Shai-Hulud npm worm had resurfaced. The May 19, 2026 wave hit @antv with 639 malicious versions in an hour. After 111 days of silence, the same payload hash (e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6) reappeared in four packages published within the same hour: feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, and bmc-translate-utils@1.1.1.
Read digest · Read original: Shai-Hulud Rises From the Dead after 111 days — Aikido Security
Vercel Fluid: one compute layer for functions, sandboxes, and builds
- Next.js
- AI
- Course
On September 1, 2026, Luke Phillips-Sheard published Compute that takes any shape on the Vercel blog. Fluid is Vercel's unified compute layer: it assembles the machine a workload needs, swaps configuration on the fly, and absorbs burst capacity. Builds ran on it first, then sandboxes, and now functions; the post says if you have shipped on Vercel you have already been on Fluid.
Read digest · Read original: Compute that takes any shape — Vercel
OpenAI Agents API: Codex harness for cloud agents in public beta
- AI
- Course
On September 10, 2026, OpenAI introduced the Agents API in public beta. It exposes the same harness and infrastructure that powers Codex so developers can create cloud agents through an API: specify the task, model, tools, and environment, then let OpenAI host and maintain the harness.
Read digest · Read original: Introducing the Agents API — OpenAI
Vercel Flat Rate CDN: predictable Pro billing for traffic spikes
- Next.js
- Course
On September 8, 2026, Jas Garcha and Eric Dodds announced Flat Rate CDN for Vercel Pro teams: a fixed monthly CDN bill with spike protection instead of pure usage-based CDN charges. New Pro teams get Flat Rate CDN by default; existing Pro teams can opt in. Usage is tracked at the team level across all projects.
Read digest · Read original: Introducing Flat Rate CDN — Vercel
Vercel Run SDK: sandboxed JavaScript for agent-generated code
- AI
- Security
- Course
On August 25, 2026, Aayush Kapoor published Introducing Run SDK on the Vercel blog. The package runs untrusted JavaScript or type-stripped TypeScript in a fresh QuickJS context inside a worker thread, with no direct route to Node.js or the network. Applications expose narrow hostFunctions that become callable globals inside the sandbox; credentials and service clients stay in the host.
Read digest · Read original: Introducing Run SDK: secure eval for your agents — Vercel
Cursor Projects: coordinator agents for features, migrations, and gardening
- AI
- Course
On September 10, 2026, Alexi Robbins and Fredrika Lindh introduced Cursor Projects on the product blog, rolling out in beta. Projects take on larger bodies of work such as a feature, a migration, or a full app: they keep context over months, delegate to thousands of subagents, and can run recurring work without being prompted. You chat with a Projects coordinator that directs other agents rather than writing code itself. Runs are cloud by default on their own computer so closing a laptop does not stop the work, agents share context files, and subscriptions cover Slack, a schedule, and pull requests or CI.
Express August 2026 security releases: hbs, multer, and morgan
- Security
- Course
On August 31, 2026, Ulises Gascon published August 2026 security releases on the Express blog. The releases are hbs 4.3.0, multer 2.3.0, and morgan 1.12.0, addressing six vulnerabilities.
Read digest · Read original: August 2026 Security Releases — Express.js
Vercel CDN: indexed metadata shards cut P99 lookup latency 91%
- Next.js
- Course
On September 10, 2026, Tim Caswell, Steven Salat, and Luba Kravchenko described how Vercel cut CDN metadata lookup latency. The CDN runs on average over 80 million routing instructions per second, and metadata lookups decide which paths exist and how to serve them. The team moved from per-path metadata objects to bounded indexed shards of about 200 KB, using JSONL plus inline indexes so one fetch warms many paths while lookups parse only the needed record.
Read digest · Read original: How we cut CDN metadata lookup latency by 91% — Vercel
AI SDK 7: agents, tools, and realtime beyond text
- AI
- Course
On June 25, 2026, Vercel published AI SDK 7, the TypeScript SDK they describe as the layer for building AI applications, features, frameworks, and agents across model providers. The post frames the release as production depth for agent work: developing agents (reasoning control, typed tool and runtime context, provider file and skill uploads, MCP Apps, and a terminal UI), running them (tool approvals, durable WorkflowAgent, timeouts, and sandbox sessions), integrating established harnesses, and observing runs with telemetry and lifecycle events.
Next.js security: Middleware and Proxy are not the only authorization layer
- Next.js
- Security
- Course
On September 14, 2026, iSyncEvolution published a CTO-oriented guide to Next.js Middleware and Proxy authorization risk. It reviews CVE-2025-29927, a critical Middleware authorization bypass (CVSS 9.1) patched in releases including 12.3.5, 13.5.9, 14.2.25, and 15.2.3, plus later 2026 Middleware/Proxy bypasses disclosed in May (App Router segment-prefetch, Pages Router i18n, dynamic route parameters) and July (certain App Router apps using Turbopack and a single i18n locale in the 16.0.x–16.2.x range).
Read digest · Read original: Next.js Security Best Practices: CTO Guide to Middleware & Proxy Risks — iSyncEvolution
React 19.3: View Transitions, Fragment Refs, browser(), and Trusted Types
- React
- Course
On September 9, 2026, the React Team announced that React 19.3 is on npm. View Transitions and Fragment Refs, shared as experimental APIs last year, are stable in this release.
August 2026 Next.js security release: patch 16.3.3
- Next.js
- Security
- Course
On August 25, 2026, the Next.js team published a security release and asked everyone to patch immediately. Updates landed in v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) after an extra critical issue in an upstream dependency moved the date forward.
Read digest · Read original: August 2026 Security Release — Next.js
Next.js 16.3: Instant Navigations and a faster everyday toolchain
- Next.js
- React
- Course
Next.js 16.3 is the framework release this course site already sits on. The official post highlights Instant Navigations — an opt-in suite that aims for SPA-like clicks without giving up the server-driven App Router — plus quieter wins you will feel in lab: lower next dev memory (up to 90% less RAM on long sessions), faster rebuilds via disk cache, TypeScript 7 type-checking during next build, and up to 22% more requests under load after App Router SSR switched to native Node streams.
Next.js 16.3 AI improvements: version-matched docs and agent Skills
- Next.js
- AI
- Course
Before 16.3 went stable, the Next.js team published a preview-era post about designing the framework for agent-driven development. The through-line is keeping coding agents on this version of Next.js instead of stale training data: next dev writes a version-matched AGENTS.md pointer at the bundled docs in node_modules/next/dist/docs/.
Read digest · Read original: Next.js 16.3: AI Improvements — Next.js