Web Development
Frontend and web development: architecture, performance, and the details that matter in production.
The two Next.js fixes September promised have landed
Next.js shipped the postponed 'use cache' RCE and Server Actions DoS on 14 October, plus a critical in SVG processing. 16.4.1 and 15.5.28 are out. This site moved in four days.
Oct 19, 2026 · Web Development · 3 min
Next.js ships security on a schedule: what September changed
Two September releases, eight advisories, one critical that hit this site's own OG image route. What actually applies to which config, and the 16.3.5 to 16.3.8 upgrade an agent ran today.
Oct 06, 2026 · Web Development · 6 min
A Lighthouse 100 on desktop with Next.js 16: the levers that moved the score
Desktop 100 across the board, mobile stuck at 77 to 84: which levers moved this site's score (inlineCss, both-theme critical CSS, a server-only header, lazy islands) and why the remaining mobile gap is React hydration, not a config mistake.
Sep 16, 2026 · Web Development · 4 min