Dev Digest — January 2026

Chrome 143 (published Jan 12, 2026) changes the FedCM identity flow: ID assertion tokens can be structured JSON, client_metadata validation is enforced, and several API fields move/rename — migration required before Chrome 145.

GitHub has made a new low-cost, containerized 1‑vCPU Linux runner (ubuntu-slim) generally available in GitHub Actions — what full‑stack teams should know and do first.

Vercel's Next.js engineering team published a deep dive into Turbopack's fine‑grained incremental computation model and the new on‑disk cache for next dev — implications and practical steps for full‑stack teams.

Firefox 147 (Jan 2026) adds support for ECMAScript-module service workers (type: 'module'). This is a practical, high‑impact change: service workers can now use import/export and top‑level await natively. Here’s a concise migration and rollout checklist for full‑stack teams.

Cloudflare has acquired the Astro team. Full‑stack teams should test Astro 6 beta, validate Cloudflare Vite runtime parity, and update CI/deploy pipelines to benefit from tighter edge integration without losing portability.

Node.js published December 2025/Jan 2026 security releases fixing several high‑severity runtime and dependency issues (Buffer allocation, filesystem symlink escape, HTTP/2 crashes, undici/c-ares). Practical mitigation and rollout checklist for full‑stack teams.

GitHub/npm permanently revoked classic npm tokens (Dec 9, 2025). Full‑stack teams must rotate CI secrets, adopt granular tokens or OIDC trusted publishing, and audit images & registries—here’s a concise, prioritized playbook.

A critical unauthenticated remote‑code execution vulnerability in React Server Components (CVE‑2025‑55182) is actively exploited. Immediate inventory, patching, and secret rotation are required for affected apps and hosting environments.

A Jan 14, 2026 security advisory for undici (the Node.js HTTP client) describes an unbounded decompression-chain vulnerability that can lead to high CPU and memory usage. Full‑stack teams must find and upgrade affected undici versions and add lightweight runtime protections.

Node.js 25.5 (Jan 26, 2026) introduces --build-sea to produce single executable Node apps in one step — practical implications for CI, deployment, native add‑ons, and security.

Vercel ships Next.js 15 with Turbopack stability, async request/caching changes, and Server Action security updates — what full‑stack teams must plan for now.

Bun 1.3.6 (Jan 13, 2026) adds Bun.JSONC, Bun.Archive, esbuild‑compatible metafile output and several runtime optimizations — a short, practical checklist for full‑stack teams to adopt safely.

Vite 8's move to Rolldown (a Rust bundler) changes build performance, Node targets, and plugin behavior — a practical migration checklist for full‑stack teams.

A Jan 13, 2026 Node.js security release fixes an async_hooks/AsyncLocalStorage bug that can cause unrecoverable process crashes affecting React Server Components, Next.js and APM tooling. Upgrade guidance and short‑term mitigations for teams.

WASIp3 (WASI Preview 3) release‑candidate support has landed in key runtimes (Spin, wasmCloud). Full‑stack teams should evaluate composable, concurrent WebAssembly components for edge and serverless workloads — here’s a concise, practical adoption checklist.

React Router and @remix-run/server-runtime patched a medium-severity CSRF issue affecting server-side action handlers and unstable React Server Actions — what full‑stack teams must check and patch now.

Chrome 124 (stable) adds WebSocketStream and ReadableStream async-iteration — practical, high‑impact changes that simplify streaming code and introduce backpressure-aware WebSocket clients for full‑stack teams.

Electron 40.0.0 is out — upgrades Chromium, V8 and Node; introduces dynamic ESM in non‑context‑isolated preloads and deprecates direct renderer clipboard access. What full‑stack teams must know.

Anthropic’s acquisition of the high‑performance Bun runtime shifts the incentives for JavaScript runtimes and tooling. Practical, prioritized guidance for full‑stack teams to avoid disruption and gain advantages.

pnpm v10 adds automatic runtime management via package.json devEngines.runtime: teams can pin and auto-download Node/Deno/Bun per-project to make scripts and CI reproducible and safer.

ECMAScript 2026 has been published. Practical changes — array-by-copy methods, Set ops, RegExp.escape, Promise.try, Float16Array and more — and a short migration checklist for full‑stack teams.

WebGPU shipped across major browsers in late 2025. Full‑stack teams should plan incremental adoption for graphics, ML inference, and heavy compute with clear fallbacks and runtime considerations.