Migrate html-webpack-plugin and html-loader to webpack's native HTML support and minification

A build tool that combines Webpack and Bulldog to provide a streamlined development experience for Goodboy Digital projects. It simplifies the configuration and bundling process for modern JavaScript applications.

A javascript template engine, simple, easy & extras, support webpack, rspack, vite, rollup, esbuild, parcel, browserify, fis and gulp.

Compile Zod schemas into zero-overhead validation functions at build time. Works with Vite, webpack, esbuild, Rollup, etc - gajus/zod-compiler

What's Changed Describe the types listed by debug:autowiring by @nicolas-grekas in #270 Disable the void_return CS rule for tests by @nicolas-grekas in #273 [CI] Pin Fabbot to 64be516 by @Kocal in...

Spike Core is an opinionated static site build tool that leverages webpack to streamline the development and compilation of static projects. It provides a pre-configured, batteries-included approach to building modern static websites with minimal setup required.

Important7.2.1 is a bug-fix release, and one fix changes your production output: Encore was passing the legacy Sass option outputStyle, which sass-loader 16/17 ignore, so Sass was minifying your CS...

Keep your React components, hooks, and imports with a smaller, synchronous runtime. Redact supports TanStack Start, Vite, Vinext, and Next.js.

A critical security flaw in React Server Components can let attackers run code remotely without logging in. React published the advisory, tracked as GHSA-xqc2-xf4c-x3h3, on October 14, 2026. The issue carries a CVSS v4 score of 9.5, and the React team recommends immediate updates for affected applications. The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These packages support React Server Components across different build tools. However, the advisory makes an important distinction: exploitation requires an extremely rare response pattern involving multiple typed arrays and a value controlled by an attacker. Simply using React does not make every application vulnerable. React Server Components Vulnerability According to React, specially crafted payloads targeting frameworks that support React Server Components can trigger remote code execution. Typed arrays hold numeric data in defined formats. The advisory identifies responses carrying several of these arrays alongside attacker-controlled data as the relevant condition, but does not publish a complete technical breakdown or exploit instructions. The severity rating reflects the potential impact despite that narrow requirement. An attacker needs no account privileges, and exploitation requires no user interaction. The advisory rates the possible effects on data privacy, data integrity, and service availability as high. However, its public description does not establish how widely the required application pattern appears in production. The disclosure follows earlier React security issues covered in Cyber Security News’s reporting on React2Shell exploitation . Readers should not confuse those attacks with this advisory. React2Shell was tracked as CVE-2025-55182, while the October advisory lists no known CVE identifier. Evidence of attacks against the older flaw does not establish exploitation of this newer issue. Affected Versions and Available Fixes The official React security advisory lists affected releases as 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8, and 19.3.0 across all three packages. Fixed releases are 19.0.9, 19.1.10, 19.2.9, and 19.3.1. The advisory’s package tables confirm 19.0.9, despite a typo showing “19.0.09” in its patch description. Package Affected versions Patched versions react-server-dom-parcel 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 19.0.9, 19.1.10, 19.2.9, 19.3.1 react-server-dom-turbopack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 19.0.9, 19.1.10, 19.2.9, 19.3.1 react-server-dom-webpack 19.0.0–19.0.8, 19.1.0–19.1.9, 19.2.0–19.2.8, 19.3.0 19.0.9, 19.1.10, 19.2.9, 19.3.1 Cyber Security News also covered related Next.js vulnerabilities , including a Cache Components issue involving multiple typed arrays. For this React flaw, teams should check the installed server-dom package versions against the official affected ranges rather than rely on older patch guidance. React explicitly recommends upgrading affected packages immediately. Applications without server-side React code are not affected, nor are applications without a framework, bundler, or plugin supporting React Server Components. The public notice also provides no claim of active exploitation. Those distinctions matter when assessing exposure and reporting the vulnerability accurately. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Critical React Server Components Flaw Lets Hackers Execute Code Remotely Without Authentication appeared first on Cyber Security News .

✨ Create server-rendered universal JavaScript applications with no configuration

A TodoMVC written with JavaScript es5 features.