Web Programming.

Issue #1 ·

Leer en español

The Full-Stack Upgrade Map: What to Patch, Plan and Watch (September 2026)

By Karlen Trimino

Welcome to the first issue of Web Programming. Every week I read the release notes, security advisories and changelogs for the stack most of us ship with (PHP, Laravel, React, TypeScript and Node.js) and turn them into decisions: what to patch now, what to plan for, and what can wait. Every claim links to its primary source at the end.

This month was heavy. Next.js shipped three security releases since July 20, npm stopped running install scripts by default, TypeScript went native, and PHP 8.6 hits its first release candidate tomorrow.

TL;DR: your checklist for this week

  • Next.js 16.2.0 to 16.3.5? Upgrade to 16.3.6 today (critical RCE in next/og ImageResponse, September 22).
  • PHP older than the July 30 security releases? Update. CVE-2026-17543 is an SQL injection in pg_insert, pg_update, pg_select and pg_delete.
  • Composer: run composer self-update to get 2.10.3 (two more CVEs fixed, including a Perforce command injection).
  • Laravel 12 stopped receiving bug fixes on August 13. Plan the move to 13.
  • Node.js 20 has been end-of-life since April 30. Node 26 becomes LTS on October 28.
  • npm 12 no longer runs dependency install scripts by default. Check your CI before it surprises you.

1. Patch now: security

Next.js. The September 22 release fixes a critical remote code execution issue in the Node.js ImageResponse implementation of next/og, caused by improper escaping in SVG output from Satori (GHSA-vcvr-r3jv-pc5j). Affected: 16.2.0 up to 16.3.5. Fixed in 16.3.6. Next.js 15.x is not affected by the RCE (15.5.26 adds hardening), and the Edge ImageResponse is not affected. It follows security releases on July 20 and August 25, so if you skipped those, you have three to catch up on.

PHP. CVE-2026-17543 (High): the pg_* convenience functions wrap values in E'...' strings, but under PostgreSQL's default standard_conforming_strings = on, backslashes weren't escaped, so crafted input could break out of the string and inject SQL. Fixed in 8.2.33, 8.3.33, 8.4.24 and 8.5.9 (July 30). If you use PostgreSQL through those functions rather than PDO, treat this as urgent. The current releases are 8.5.10 and 8.4.25.

Composer. Versions 2.10.2 (July 1) and 2.10.3 (August 27) fixed a run of CVEs: path traversal through package bin paths (including via symlinks), file writes outside vendor/, tokens leaking into verbose logs, and command injection through malicious Perforce URLs.

Laravel. Three framework advisories landed this summer: a High-severity CRLF injection in the default email validation rule (June 1), a temporary signed URL path confusion (June 8) and a low-severity XSS in the debug page (September 10). Update to the latest Laravel 13.x or 12.x patch release.

Node.js. The July 29 security releases (26.5.1, 24.18.1, 22.23.2) fixed 11 CVEs, three of them rated High. Any release since then on a supported line includes the fixes.

2. npm just changed the rules for your CI

npm v12 became the default ("latest") on July 8. Three behaviors that used to run automatically are now opt-in:

  • Dependency lifecycle scripts (preinstall, install, postinstall and implicit node-gyp builds) don't run unless you approve them.
  • Git dependencies are blocked unless you allow them (--allow-git).
  • Remote URL dependencies, such as https tarballs, are blocked unless you allow them (--allow-remote).

To opt specific packages back in, run npm approve-scripts --allow-scripts-pending and commit the resulting allowlist.

Publishing is changing too. Tokens that bypass 2FA already lost sensitive account operations in early August, and around January 2027 they lose the ability to publish at all. The replacements are trusted publishing (OIDC) or staged publishing, where a human approves each release with 2FA.

Why now? 2026 has been a brutal year for the npm supply chain:

  • May 11: 84 malicious versions across 42 @tanstack/* packages went out in six minutes. The attacker chained a pull_request_target workflow, GitHub Actions cache poisoning, and a publish-capable OIDC token pulled from the CI runner's memory. An outside researcher spotted it about 26 minutes later.
  • August 4: the "ChainDrop" worm compromised more than 400 packages, including keyv, flat-cache and cache-manager. It stole npm, GitHub, AWS, Kubernetes and Vault credentials and planted persistence in .claude/settings.json and .vscode/tasks.json.

That last detail matters. Attackers now treat your editor and AI coding tool config as a place to run code. My take: review .claude/, .vscode/tasks.json and MCP config changes in pull requests as carefully as CI workflow files, and audit every pull_request_target workflow you own this week.

3. TypeScript 7 is here. It's fast, and it's not a drop-in.

TypeScript 7.0, the native port written in Go, shipped July 8. Microsoft reports 8 to 12x faster full builds; the VS Code codebase went from 125.7 seconds to 10.6.

Before you bump it:

  • 7.0 has no stable programmatic API yet, which affects tooling for Vue, Svelte, Angular, MDX and Astro. The API is planned for 7.1.
  • Tools that still need the old API can run TypeScript 6 side by side through the @typescript/typescript6 package.
  • New defaults: strict: true, module: esnext, and types: [] (you now list the @types packages you need).
  • Removed: target es5, downlevelIteration, baseUrl, moduleResolution classic, and AMD/UMD/SystemJS output.

My recommendation: React and Node projects with a clean tsconfig can try it now (Next.js 16.3 can already use TypeScript 7 for type checking in next build). Vue, Inertia-with-Vue and Angular teams should stay on 6.0 until 7.1. Either way, the real migration work is the new defaults, especially losing baseUrl and the empty types list.

4. React 19.3 and Next.js 16.3

React 19.3 (September 9) makes two APIs stable: <ViewTransition>, which animates elements entering, leaving, updating or moving using the browser's View Transition API, and refs on <Fragment>, which give you DOM methods over a group of sibling elements without a wrapper div. New in React DOM: use(browser()) opts a component out of server rendering (handy for localStorage or timezone code), plus Trusted Types support. Server Components can now render a Context from a 'use client' module directly.

Next.js 16.3 (August 3) is a free performance upgrade: up to 90% less memory in long dev sessions, build caching on by default, and up to 22% more server-rendered requests under load after switching to native Node.js streams. The opt-in "Instant Navigations" work (cacheComponents plus partialPrefetching) previews where the next major is heading. An experimental Rust port of the React Compiler inside Turbopack cut time-to-ready on v0 by 34% cold and 46% warm.

5. Node.js: put these dates on your calendar

  • Node 20: end-of-life since April 30, 2026. If it's still in production, it's your biggest risk item.
  • Node 22: maintenance LTS until April 30, 2027.
  • Node 24: moves from active LTS to maintenance on October 20, 2026.
  • Node 26: Current today; becomes LTS on October 28, 2026.
  • From Node 27: one major release per year, and every release becomes LTS. 27.0.0 is planned for April 2027.

Also worth knowing: TypeScript type stripping is stable in Node.js (since 25.2.0 and 24.12.0), and Node 26 turns on Temporal by default.

6. PHP 8.6: RC1 lands tomorrow

The schedule: RC1 on September 24, more RCs on October 8, October 22 and November 5, and general availability on November 19, 2026.

The feature most people will feel is partial function application, which passed 33 to 0. Leave ? or ... in place of arguments and you get a closure back:

$f = foo(1, ?, 3);   // closure that waits for $b
$g = foo(1, ...);    // closure that waits for the rest
$out = array_map(str_replace('hello', 'hi', ?), $lines);

It pairs naturally with the pipe operator that arrived in PHP 8.5. PHP 8.6 also adds a native clamp() function.

The support calendar that should drive your upgrade plan:

  • PHP 8.2: security fixes end December 31, 2026.
  • PHP 8.3: security fixes only, until December 31, 2027.
  • PHP 8.4: active support ends December 31, 2026; security fixes until the end of 2028.
  • PHP 8.5: active support until the end of 2027; security fixes until the end of 2029.

My take: target 8.4 or 8.5 today, and add the 8.6 RC to your CI matrix this week so November isn't a surprise.

7. Laravel: 13 is the line to be on

  • Laravel 13 (March 17, 2026) supports PHP 8.3 to 8.5, with bug fixes until Q3 2027 and security fixes until March 17, 2028.
  • Laravel 12: bug fixes ended August 13, 2026; security fixes until February 24, 2027.
  • Laravel 11: past end of life.

From Laracon US (July 29), the announcements worth your time: an image manipulation API, Laravel LSP for any editor, Blade formatting in Pint, artisan doctor health checks, debounced jobs, refreshable locks, CPX (think npx for PHP), and human approval of tool calls in the AI SDK. On Laravel Cloud: managed queues that scale to zero, MySQL scale-to-zero, a secrets manager, and HIPAA compliance for Private Cloud.

On September 11, Laravel MCP 1.0 shipped searchable tool catalogs. Instead of advertising every tool on every request, the server exposes search_tools and execute_tools. With 100 tools, the tool definitions drop from 58,585 bytes to 1,431 (97.6% smaller), which means more of the model's context goes to your actual task.

8. AI coding tools: the numbers, not the hype

  • Adoption: JetBrains surveyed more than 15,000 professional developers from May to July 2026. 90% use AI coding agents at work at least weekly and 68% daily. Work adoption by tool: Claude Code 39%, GitHub Copilot 21%, Codex 16%, Cursor 12%.
  • Pricing: GitHub Copilot moved to usage-based billing on June 1. "AI Credits" replace premium requests, each plan includes credits equal to its price, and code completions stay free.
  • Protocol: the MCP 2026-07-28 spec makes the protocol stateless. With no initialize handshake and no session IDs, MCP servers can sit behind an ordinary load balancer. Authorization moves from Dynamic Client Registration toward Client ID Metadata Documents.

One warning: the 2026 Stack Overflow Developer Survey results are not out yet. If you see posts quoting "2026" numbers like 84% AI usage and 3% high trust, those are the 2025 results.

9. The job market in two numbers

  • Indeed's US software development job postings index was 76.62 on September 11, 2026 (February 2020 = 100), about 23% below pre-pandemic levels.
  • The BLS now projects 10% growth for software developers from 2025 to 2035 (about 174,700 new jobs), down from the 15.8% it projected for 2024 to 2034. Median pay was $135,980 in May 2025.

The market is recovering, not booming. Engineers who keep their stack patched and current are the ones teams trust with production.

10. Quick hits

  • ES2026 was approved June 30: Map getOrInsert (upsert), Iterator.concat, JSON.parse source text access, Uint8Array base64/hex conversion, Math.sumPrecise, Error.isError, Array.fromAsync and RegExp.escape. Temporal and explicit resource management (using) are slated for ES2027.
  • Vite 8 (March) made Rolldown its single bundler; Vite 8.1 (June 23) added an experimental bundled dev mode.
  • Vitest 5 (September 3) requires Node 22.12+ and now fails tests that forget to await resolves or rejects.
  • Bun 1.4 (August 20) is the first release rewritten from Zig to Rust.

One thing to do this week

Search your repositories for pull_request_target and for next/og on the Node.js runtime. Those two searches map to two of the most expensive problems of the summer.

That's issue #1. If it saved you an hour, follow Web Programming so the next issue lands in your feed. And tell me in the comments: what's the oldest runtime still running in your production?

Sources

Discuss on LinkedIn