Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Course blog
A link-forward news digest for full-stack Next.js. Short intros, then the original article. Newest first.
These posts are instructor-curated digests, not original reporting. Each item paraphrases a public article and always links to the original source.
Cursor cut agent token costs 7% without hurting quality
- AI
- Course
On September 23, 2026, Jediah Katz, Connor O'Keefe, and Calvin Yee wrote that longer agent runs spend more on context. Cursor improved harness efficiency and reduced user token costs about 7% without reducing agent quality.
Read digest · Read original: Improved token efficiency for longer agent runs — Cursor
MemTensor npm/PyPI packages shipped a supplychain.local Go worm
- Security
- Course
On September 23, 2026, updated September 24, Oliver Smith at Aikido reported compromised packages that already had a benign history: npm @memtensor/memos-cloud-openclaw-plugin versions >=0.1.21 and PyPI MemoryOS >=2.0.34. The worm, tracked as supplychain.local, ships multiplatform Golang sckit binaries launched by language-native loaders when the package is used, not through install-time scripts.
Read digest · Read original: Novel supplychain.local Go worm appears — Aikido
Making v0 navigations instant with Next.js 16.3 and an agent loop
- Next.js
- AI
- Course
On August 6, 2026, the Next.js blog described Instant Navigations in 16.3. They help dynamic App Router apps feel snappy without moving data-fetching to the client: Suspense loading states or 'use cache' let Next extract a shell and load it into the browser before navigation, a Partial Prerendering-style approach for personalized apps.
Read digest · Read original: Making Navigations Instant in v0 — Next.js
Vercel built a software factory that authors AI SDK PRs
- AI
- Course
On August 12, 2026, Lars Grammel and Eric Dodds explained how the AI SDK team built ai-sdk-factory after the repo piled up over 1,000 open issues and nearly 800 pull requests. Dedicated agents classify issues, reproduce bugs, analyze features, implement changes, review PRs, update docs, and open backports — each agent scoped to one task with its own prompts and evals. Humans still merge every change.
Read digest · Read original: Building a software factory for AI SDK — Vercel
Sandbox egress control: half a sandbox without a network boundary
- Security
- AI
- Course
On August 11, 2026, Brandon Tuttle argued that compute isolation alone is only half a sandbox for agent workloads. A microVM can keep untrusted code off the host, but without egress control that code can still exfiltrate data, probe internal services, or abuse credentials available inside the environment. Recent research shows a forgotten DNS path or fail-open allowlist can defeat containment without crossing the VM boundary.
Read digest · Read original: A sandbox without a network boundary is only half a sandbox — Vercel
Workflow SDK: durable TypeScript without a new orchestrator
- Next.js
- AI
- Course
On August 27, 2026, Pranay Prakash described Workflow SDK as durable execution that feels like ordinary TypeScript instead of a hand-drawn DAG. Mark an orchestrator with use workflow and side-effecting work with use step; between them you keep await, try/catch, Promise.all, loops, and conditionals. The compiler splits that one file into workflow and step bundles, retries uncaught errors by default, and replaces Temporal-style signals/queries/updates with a single hook primitive — including createWebhook() for an ad-hoc URL that parks a run until someone POSTs.
Read digest · Read original: The best workflow engine is a programming language — Vercel
Next.js 16.3: Instant Navigations for app-like UX
- Next.js
- React
- Course
Next.js published a walkthrough of Instant Navigations in 16.3, built on Cache Components and Partial Prefetching. Cache Components keep a route ready with static, cached, and fallback UI; Partial Prefetching fetches that App Shell for visible Link components before a click. The post demos the pattern in Next Beats, Drop, Flow, and Huddle — music, social, calendar, and chat apps that feel like SPAs while still rendering on the server.
Read digest · Read original: Building App-like Experiences with Next.js 16.3 — Next.js
State of agent skills: 1M skills and 280M installs on skills.sh
- AI
- Course
On September 25, 2026, Amelia Charles, Andrew Qu, and Jonathan Hefner reported that Vercel's skills.sh registry reached one million agent skills and nearly 280 million installs in seven months. A skill is reusable instructions that teach an AI agent how a specific person, team, or company does a job — often plain language — so agents stop being generic and start matching local practice.
TanStack Query OpenAPI codegen hit by npm supply-chain worm
- Security
- React
- Course
On August 28, 2026, Ilyas Makari at Aikido reported that ten versions of @7nohe/openapi-react-query-codegen (a popular generator of type-safe TanStack Query hooks from OpenAPI, 150k+ weekly downloads) were published to npm in about 20 minutes with malware branded Trinitite. Both the npm package and GitHub repo were compromised via a GitHub Actions workflow vulnerability, so releases still carried valid provenance attestations from the official workflow.
Read digest · Read original: Popular code generator for TanStack Query hit by supply chain worm — Aikido
Klaviyo: 356 internal apps in two weeks on Vercel
- Next.js
- AI
- Course
On September 24, 2026, Susan Aziz and Kevin Sundstrom described how Klaviyo built a platform on Vercel for shipping internal apps, then opened it through a citizen developer program. In the first two weeks, 512 of Klaviyo's more than 2,000 employees deployed 356 apps; 196 were full-stack apps with their own databases. Teams now shipping include legal, marketing, and HR.
Read digest · Read original: How Klaviyo shipped 356 internal apps in two weeks on Vercel — Vercel
Vercel Bug Bounty Program is now public on HackerOne
- Security
- Course
On September 24, 2026, Caleb An and Talha Tariq announced that Vercel is combining its private and open-source bounty programs into a single public Vercel bug bounty program on HackerOne. Earlier public efforts named in the post include the $1 million React2Shell hacker challenge, the $1 million Vercel Sandbox hacker challenge, and the OSS bug bounty program.
Read digest · Read original: The Vercel Bug Bounty Program is now publicly available — Vercel
Vercel Connect GA: short-lived tokens instead of credential sprawl
- AI
- Security
- Course
On August 25, 2026, Hedi Zandi, Ben Sabic, and Dima Voytenko announced that Vercel Connect is generally available. Connect replaces long-lived provider tokens with short-lived ones your code requests at runtime, scoped to the task. During the public beta the ecosystem grew past 100 connectors.
Read digest · Read original: The end of credential sprawl for agents — Vercel
Next.js closed 1,462 issues with a read-only closability agent
- AI
- Next.js
- Course
The Next.js issue backlog peaked at 3,109 open reports in January 2025 and still had 2,244 on August 10, 2026. On September 4, 2026, the team described closability, built on eve, Vercel's open-source agent framework, with Vercel Sandbox. The agent is research-only: it cannot comment, close, push, or deploy, and it ignores prompt-injection instructions in issue text. It ran on GPT-5.6 Luna, with investigations averaging about 30 minutes and up to 200 concurrent eve sessions.
Read digest · Read original: How we closed 1,500 GitHub issues in one month — Next.js
Next.js plans Sept 30 security release (16.3.7 / 15.5.27)
- Next.js
- Security
- Course
Next.js is preparing a scheduled security release for September 30, 2026. The September 30 release will address nine vulnerabilities: one critical, two high, five medium, and one low. The team plans to publish 16.3.7 and 15.5.27 with full advisories covering impact, affected versions, and upgrade instructions.
Read digest · Read original: Upcoming Next.js September Security Release — Next.js
Turbopack chunking: fewer requests without over-shipping JS
- Next.js
- Course
On September 3, 2026, Next.js explained how Turbopack decides which code goes in which JavaScript file. One big chunk earns cache hits but over-ships; one chunk per page duplicates shared code; one chunk per module creates too many requests. Turbopack merges smaller chunks within a chunk group, the chunks loaded together for a route.
Read digest · Read original: How Turbopack chunks your JavaScript — Next.js
Jev: fastest first-day adoption on Vercel AI Gateway
- AI
- Course
On September 18, 2026, Amelia Charles, Harpreet Arora, and Eric Dodds reported that within 24 hours of launching on AI Gateway, Jev from TypeSafe AI reached more than twice as many paid teams as any previous model launch. By hour 24, nearly 13% of paid teams were using it — 2x the GPT-5.6 family and more than 6x Fable 5.1's share. The post also notes Jev is free on AI Gateway until September 25.
Read digest · Read original: Jev is the fastest-adopted model in AI Gateway history — Vercel
Featured: 100K media pitches a month with three engineers on Vercel
- Next.js
- AI
- Course
On September 11, 2026, Susan Aziz (with Eric Dodds) described how Featured, a co-pilot for public relations, runs on Vercel with three engineers supporting three brands and more than 100,000 users. The team migrated 374 Sanity sites from AWS Elastic Beanstalk to Vercel, routes chat across 17 models through AI SDK and AI Gateway, and replaced custom long-running job infrastructure with Workflow SDK. Agents deliver more than 100,000 media pitches per month.
Read digest · Read original: How Featured's users make 100K media pitches per month on Vercel — Vercel
Next.js 16.3.6 / 15.5.26: patch Node.js ImageResponse RCE now
- Next.js
- Security
- Course
On September 22, 2026, the Next.js team published an out-of-band security update. Next.js 16.3.6 (Active LTS) and 15.5.26 (Maintenance LTS) upgrade upstream dependencies, including Satori, to address an issue that could lead to remote code execution. Version 15.5.26 includes related hardening, but Next.js 15.x is not affected by the remote code execution issue.
Read digest · Read original: Next.js Security Update for a Critical Upstream Issue — Next.js
AI Gateway Index: open-weight models hit 56% of token volume
- AI
- Course
On September 17, 2026, Amelia Charles and Eric Dodds published the September AI Gateway Production Index, covering data through August 2026. Open-weight models ran 56% of AI Gateway tokens in August, up from 7% in December — the first month they held a majority. Average price per token fell 23.2% in August, the third straight monthly drop; among teams with more than 10M tokens in both months, the median team paid 7.6% less.
Read digest · Read original: Open-weight models take 56% of token volume, Astra doubles Fable 5.1 spend — Vercel
Delphi: 100+ production deploys a day with Python backend on Vercel
- Next.js
- AI
- Course
On September 15, 2026, Susan Aziz and Kevin Sundstrom described how Delphi, which builds digital minds, ships on Vercel. Founding engineer Spencer Schoeben emphasized needing excellent developer and agentic experience. The frontend ran on Vercel from day one; about six months ago the team rebuilt its Python backend on Vercel after onboarding pain with AWS, ECS, Docker, and a local database.
Read digest · Read original: How Delphi ships 100 times a day with its Python backend on Vercel — Vercel
Next.js plans Sept 22 out-of-band security release (16.3.6 / 15.5.26)
- Next.js
- Security
- Course
Next.js announced an upcoming out-of-band security update for a critical issue identified in an upstream dependency. The team plans to publish Next.js 16.3.6 and 15.5.26 on September 22, 2026. The full advisory GHSA-vcvr-r3jv-pc5j will publish with the update and will cover impact, affected versions, and upgrade instructions.
Read digest · Read original: Upcoming Next.js Security Update for a Critical Upstream Issue — Next.js
libheif AVIF RCE: from Next.js image opt to upstream fix
- Next.js
- Security
- Course
On September 18, 2026, Karim Rahal wrote up how Vercel reproduced, disclosed, and helped fix a libheif remote-code-execution bug that first showed up as an apparent Next.js image-optimization RCE. Hacktron reported the issue; the root cause was the upstream AVIF decoder. The request path was next/image to /_next/image to sharp to libvips to libheif.
Read digest · Read original: Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers — Vercel
Tailscale Aperture: model routing on Vercel AI Gateway and Sandbox
- AI
- Course
On September 11, 2026, Eric Dodds and Susan Aziz described how Tailscale built Aperture, a customer-facing model router that applies tailnet identity to AI model access. Add someone to the private network and they can use approved models; remove them and access disappears. Co-founder David Carney framed Tailscale as a networking company that chose not to rebuild provider routing; Remy Guercio leads the Aperture product.
Read digest · Read original: How Tailscale built a customer-facing model router on AI Gateway — Vercel
design.md: teach agents on-brand pages outside the repo
- AI
- Course
On August 31, 2026, John Phamous explained how Vercel agents build on-brand pages when they cannot read the repo. The internal product-design skill works in-repo; design.md is a single public URL for reports, proposals, and one-offs that live outside the codebase. A naive port of that skill into one prompt failed because models interpreted vague design language differently without real components nearby.
Read digest · Read original: How our agents build on-brand pages with design.md — Vercel
Claude Code vs Copilot vs Cursor: pick the tool that matches how you work
- AI
- Course
On September 7, 2026, GeekyGoo published a comparison of three AI coding tools and the philosophies behind them. GitHub Copilot adds AI to the IDE you already use; Cursor is an AI-first fork of VS Code; Claude Code is a terminal-native agent from Anthropic.
Read digest · Read original: Claude Code vs. GitHub Copilot vs. Cursor: which AI coding tool actually fits your workflow (2026) — GeekyGoo
Shai-Hulud npm worm resurfaces after 111 days despite publish-time scanning
- Security
- Course
On September 7, 2026, Charlie Eriksen wrote that the Shai-Hulud npm worm had resurfaced. The May 19, 2026 wave hit @antv with 639 malicious versions in an hour. After 111 days of silence, the same payload hash (e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6) reappeared in four packages published within the same hour: feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, and bmc-translate-utils@1.1.1.
Read digest · Read original: Shai-Hulud Rises From the Dead after 111 days — Aikido Security
Vercel Fluid: one compute layer for functions, sandboxes, and builds
- Next.js
- AI
- Course
On September 1, 2026, Luke Phillips-Sheard published Compute that takes any shape on the Vercel blog. Fluid is Vercel's unified compute layer: it assembles the machine a workload needs, swaps configuration on the fly, and absorbs burst capacity. Builds ran on it first, then sandboxes, and now functions; the post says if you have shipped on Vercel you have already been on Fluid.
Read digest · Read original: Compute that takes any shape — Vercel
OpenAI Agents API: Codex harness for cloud agents in public beta
- AI
- Course
On September 10, 2026, OpenAI introduced the Agents API in public beta. It exposes the same harness and infrastructure that powers Codex so developers can create cloud agents through an API: specify the task, model, tools, and environment, then let OpenAI host and maintain the harness.
Read digest · Read original: Introducing the Agents API — OpenAI
Vercel Flat Rate CDN: predictable Pro billing for traffic spikes
- Next.js
- Course
On September 8, 2026, Jas Garcha and Eric Dodds announced Flat Rate CDN for Vercel Pro teams: a fixed monthly CDN bill with spike protection instead of pure usage-based CDN charges. New Pro teams get Flat Rate CDN by default; existing Pro teams can opt in. Usage is tracked at the team level across all projects.
Read digest · Read original: Introducing Flat Rate CDN — Vercel
Vercel Run SDK: sandboxed JavaScript for agent-generated code
- AI
- Security
- Course
On August 25, 2026, Aayush Kapoor published Introducing Run SDK on the Vercel blog. The package runs untrusted JavaScript or type-stripped TypeScript in a fresh QuickJS context inside a worker thread, with no direct route to Node.js or the network. Applications expose narrow hostFunctions that become callable globals inside the sandbox; credentials and service clients stay in the host.
Read digest · Read original: Introducing Run SDK: secure eval for your agents — Vercel
Cursor Projects: coordinator agents for features, migrations, and gardening
- AI
- Course
On September 10, 2026, Alexi Robbins and Fredrika Lindh introduced Cursor Projects on the product blog, rolling out in beta. Projects take on larger bodies of work such as a feature, a migration, or a full app: they keep context over months, delegate to thousands of subagents, and can run recurring work without being prompted. You chat with a Projects coordinator that directs other agents rather than writing code itself. Runs are cloud by default on their own computer so closing a laptop does not stop the work, agents share context files, and subscriptions cover Slack, a schedule, and pull requests or CI.
Express August 2026 security releases: hbs, multer, and morgan
- Security
- Course
On August 31, 2026, Ulises Gascon published August 2026 security releases on the Express blog. The releases are hbs 4.3.0, multer 2.3.0, and morgan 1.12.0, addressing six vulnerabilities.
Read digest · Read original: August 2026 Security Releases — Express.js
Vercel CDN: indexed metadata shards cut P99 lookup latency 91%
- Next.js
- Course
On September 10, 2026, Tim Caswell, Steven Salat, and Luba Kravchenko described how Vercel cut CDN metadata lookup latency. The CDN runs on average over 80 million routing instructions per second, and metadata lookups decide which paths exist and how to serve them. The team moved from per-path metadata objects to bounded indexed shards of about 200 KB, using JSONL plus inline indexes so one fetch warms many paths while lookups parse only the needed record.
Read digest · Read original: How we cut CDN metadata lookup latency by 91% — Vercel
AI SDK 7: agents, tools, and realtime beyond text
- AI
- Course
On June 25, 2026, Vercel published AI SDK 7, the TypeScript SDK they describe as the layer for building AI applications, features, frameworks, and agents across model providers. The post frames the release as production depth for agent work: developing agents (reasoning control, typed tool and runtime context, provider file and skill uploads, MCP Apps, and a terminal UI), running them (tool approvals, durable WorkflowAgent, timeouts, and sandbox sessions), integrating established harnesses, and observing runs with telemetry and lifecycle events.
Next.js security: Middleware and Proxy are not the only authorization layer
- Next.js
- Security
- Course
On September 14, 2026, iSyncEvolution published a CTO-oriented guide to Next.js Middleware and Proxy authorization risk. It reviews CVE-2025-29927, a critical Middleware authorization bypass (CVSS 9.1) patched in releases including 12.3.5, 13.5.9, 14.2.25, and 15.2.3, plus later 2026 Middleware/Proxy bypasses disclosed in May (App Router segment-prefetch, Pages Router i18n, dynamic route parameters) and July (certain App Router apps using Turbopack and a single i18n locale in the 16.0.x–16.2.x range).
Read digest · Read original: Next.js Security Best Practices: CTO Guide to Middleware & Proxy Risks — iSyncEvolution
React 19.3: View Transitions, Fragment Refs, browser(), and Trusted Types
- React
- Course
On September 9, 2026, the React Team announced that React 19.3 is on npm. View Transitions and Fragment Refs, shared as experimental APIs last year, are stable in this release.
August 2026 Next.js security release: patch 16.3.3
- Next.js
- Security
- Course
On August 25, 2026, the Next.js team published a security release and asked everyone to patch immediately. Updates landed in v16.3.3 (Active LTS) and v15.5.24 (Maintenance LTS) after an extra critical issue in an upstream dependency moved the date forward.
Read digest · Read original: August 2026 Security Release — Next.js
Next.js 16.3: Instant Navigations and a faster everyday toolchain
- Next.js
- React
- Course
Next.js 16.3 is the framework release this course site already sits on. The official post highlights Instant Navigations — an opt-in suite that aims for SPA-like clicks without giving up the server-driven App Router — plus quieter wins you will feel in lab: lower next dev memory (up to 90% less RAM on long sessions), faster rebuilds via disk cache, TypeScript 7 type-checking during next build, and up to 22% more requests under load after App Router SSR switched to native Node streams.
Next.js 16.3 AI improvements: version-matched docs and agent Skills
- Next.js
- AI
- Course
Before 16.3 went stable, the Next.js team published a preview-era post about designing the framework for agent-driven development. The through-line is keeping coding agents on this version of Next.js instead of stale training data: next dev writes a version-matched AGENTS.md pointer at the bundled docs in node_modules/next/dist/docs/.
Read digest · Read original: Next.js 16.3: AI Improvements — Next.js