Dad DX @Vercel Prev: Dagster, Twitter, Excalidraw, Smyte, Instagram, Facebook, React.js
The internet
Joined April 2008
- Tweets11.1K
- Following982
- Followers36.3K
- Likes7.4K
Itβs a great week to watch the battlestar galactica pilot youtu.be/OPKGbg16ulU
Pete Hunt π retweeted
Vercel has proactively rolled out Firewall-level mitigations for today's Node.js RCE vulnerability, in advance of the official patch release.
All traffic for all deployments is automatically protected. We're actively monitoring and rolling out managed runtime upgrades.
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-β¦
Maybe @Vjeux can port the typescript compiler to Minecraft redstone circuits next
Pete Hunt π retweeted
Ahead of Next.js 16.4, I worked on applying the upcoming features across v0 and validating our new Partial Prefetching optimizer Skill in a real app.
The post includes before-and-after videos of the navigation experience and walks through the caching, prefetching, and production checks behind the refactor.
Excited to finally share it!
We used a coding agent with Next.js 16.4's new prefetching controls and Skill to improve v0's navigation experience at no added cost.
The loop:
β’ Capture navigation with πππππππ()
β’ Define the target UI in the test
β’ Refactor until it passes
nextjs.org/blog/improving-naβ¦
let's go @MarcosHernanz!
We offered $1M to escape Vercel Sandbox.
β’ 1,285 reports
β’ $242,000 in bounties paid out
β’ One Linux kernel zero day discovered
β’ No reports of customer data compromise
vercel.com/blog/findings-froβ¦
π
The Next.js site has a new look!
We've redesigned the homepage, /docs, /blog, and more, with a consistent design that keeps the focus on the content.
nextjs.org
A few highlights β
Pete Hunt π retweeted
Next.js 16.4
β’ Cache Components by default in new apps
β’ Static output guarantees and more control over prefetching
β’ Agent-guided upgrades and feedback
β’ 20β25% smaller Turbopack disk cache
β’ Faster development and smaller bundles
nextjs.org/blog/next-16-4
Pete Hunt π retweeted
New: agent-browser Contact Sheets
Agents can now debug UI bugs they couldn't see before
Record an interaction β get timestamped frames w/ changes highlighted
This signature appears then disappears
Instead of having identical before/after screenshots, agents see what happened
Pete Hunt π retweeted
We collaborated with @HacktronAI to reproduce the libheif vulnerability in Next.js and responsibly disclose it to the maintainer.
Learn about the dependency chain and fix β
vercel.com/blog/reproducing-β¦
Pete Hunt π retweeted
When I might have sounded alarmist over the last few weeks, it was because I was aware @S1r1u5_'s excellent work here that is the perfect demonstration of our new reality:
- There is a vulnerability in a random image codec library
- This library is used by O(every app)
- There are many such libraries
- It was possible to find the vulnerability with now-well-behind-frontier models
- There are many such vulns and they will all be found over the next months
Vercel will do everything it can to do our part. This is why there have been more Next.js security releases over the last weeks and I expect the need to continue at this pace π«‘
Pete Hunt π retweeted
agent-browser, now more human
--cursor
Visible pointers and click feedback
--human
Smooth, curved mouse movement / drags
For demos, bug repros, reviewing agent runs
new react!
React 19.3 is now available!
This release makes View Transitions and Fragment Refs stable, and adds browser(), Trusted Types support, and Context in Server Components.
react.dev/blog/2026/09/09/reβ¦
