Frontend · JavaScript · NPM

Next.js 16.3 Lands Instant Navigation, npm Worm Hits Keyv, and CSS Anchor Positioning Tops Dev Wishlists

By 晓得迷路了 · Aug 10, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

The keyv/cacheable worm is an active supply-chain compromise still spreading through transitive dependencies — any project pulling those namespaces needs an immediate audit. Next.js 16.3's instant navigation and the CSS survey's anchor-positioning enthusiasm both point to a frontend that is getting faster and more expressive, but still gated by runtime compatibility.

Summary

Next.js 16.3 brings instant page navigation, faster builds, SSR performance upgrades, and optional TypeScript 7 type checking. The release also includes AI-related optimizations. Separately, Node.js 26.7.0 arrived two days after 26.6, adding a `--test-coverage-include-all` flag that pulls uncovered files into coverage reports and fixing crashes in FFI and SQLite modules.

A credential-stealing worm infected the popular npm packages keyv and cacheable, and the breach has since cascaded to hundreds of other packages. The 2026 State of CSS survey named anchor positioning the most-loved new feature, though poor browser support blocks production use; `:has()`, `aspect-ratio`, and CSS nesting lead actual adoption. AI tool usage among CSS developers remains low.

Two articles tackle data integrity: a Playwright-based soak test catches SPA memory leaks by looping user flows and monitoring DOM nodes and event listeners until CI fails, and a deep look at JSON serialization shows how `JSON.parse` + `JSON.stringify` silently corrupts large integers, undefined, and Date objects.

Takeaways

— Next.js 16.3 adds instant page navigation, faster builds, SSR performance improvements, optional TypeScript 7 type checking, and AI-related optimizations.

— Node.js 26.7.0 shipped two days after 26.6 with a new `--test-coverage-include-all` flag, FFI and SQLite crash fixes, and opt-in Perfetto tracing that requires a source build.

— A credential-stealing worm compromised the keyv and cacheable npm packages; hundreds of downstream packages have since been infected.

— The 2026 State of CSS survey found anchor positioning is developers' favorite new feature, but low browser support prevents adoption. `:has()`, `aspect-ratio`, and CSS nesting are the most-used new features.

— AI tool usage among CSS developers remains low, and CSS Grid is still reported as difficult to learn.

— Playwright soak tests detect SPA memory leaks by looping user workflows in one browser context and tracking DOM node and event listener counts, failing CI when a leak appears.

— A `JSON.parse` + `JSON.stringify` round-trip is lossy: large integers, undefined, and Date objects get mangled or dropped.

— Git discipline at large orgs centers on three practices: a uniform commit message format, a branching model, and mandatory code review.

— TanStack Charts is a new framework-agnostic charting library under active development.

— MicroDiff 1.6 returns diffs between two objects or arrays with high performance.

— Virtua is a lightweight virtual list and table component that works across React, Vue, Solid, Svelte, and Angular.

Conclusions

Anchor positioning topping the CSS wishlist while failing the compatibility threshold is a recurring frontend pattern: the features developers want most are often the ones browsers ship last.

The keyv/cacheable worm spreading to hundreds of packages shows how deeply a single compromised maintainer account can cut when popular namespaces act as transitive hubs.

JSON round-trip corruption is a well-known footgun, but the explicit framing of `JSON.parse` + `JSON.stringify` as a lossy transform — not a faithful serialization — is a mental model most codebases still lack.

Soak testing SPAs by counting DOM nodes and event listeners inside a CI loop is a cheap, high-signal regression guard that very few teams actually wire up.

Concepts & terms

Soak testing

A long-running test that loops a user workflow inside a single browser context to surface slow leaks — memory, DOM nodes, event listeners — that only appear over time, not in a single page load.

Anchor positioning

A CSS feature that lets an element position itself relative to another anchor element, enabling tooltips, popovers, and context menus without JavaScript layout calculations.

Perfetto tracing

An open-source tracing and performance analysis tool built into Chromium and Android; Node.js 26.7.0 adds opt-in support for emitting Perfetto-compatible traces, but requires compiling Node from source.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗