October was busy. Next.js shipped a release and two critical security fixes in the same month, TypeScript 7.1 went to beta, TanStack put out five announcements in four weeks, and Convex shipped three minor versions. This is what I think is worth knowing from it, with a link to the release note or announcement behind every item. Dates are the publish dates on those pages.

There's one thing to put in your calendar first. Next.js has a scheduled security release on November 3 covering seven medium-severity vulnerabilities. The advisories aren't public yet, so plan an upgrade window for that day.

Next.js

Next.js 16.4 (Oct 6). The headline is that the Next.js team now recommends Cache Components for every Next.js app. New apps from create-next-app get it enabled by default, and the post says it will be the default in Next.js 17. There's also a lot of agent tooling: next upgrade --agent gives a coding agent version-specific upgrade steps, experimental.agentUpgrade nudges you during next dev and next build when a relevant upgrade exists (the default policy only covers security fixes), and experimental.agentFeedback (on by default in new apps, opt-in for existing ones) lets an agent draft bug reports that you review before anything gets sent. For everyone else: a 20 to 25% smaller Turbopack disk cache, lazy server HMR, shorter CSS Module class names in production, and React 19.3. The experimental Rust React Compiler got a fast path that skips files that don't need it, and the post reports 30% less memory and 15% faster compiles for it.

October 14 security update. This one is not optional. Two critical unauthenticated RCEs were fixed: one in use cache functions that return multiple typed arrays (no workaround, so upgrade even if you don't think you have that pattern), and one in the Image Optimization API with SVGs on glibc-based Linux, which comes from the upstream image library. If you can't upgrade right away, the workaround for that one is making sure Next.js resolves sharp 0.35.5 or later. There's also a high-severity DoS for App Router apps with at least one Server Action. The fixed versions are 16.4.1 and 15.5.28. The latest 16.4 patch is 16.4.3 on npm (Oct 23).

Two agent-focused posts. Improving navigation in v0 with Next.js 16.4 (Oct 16) walks through Partial Prefetching and the new next-partial-prefetching-optimizer skill on a real app. Ship less JavaScript with your AI agent (Oct 28) introduces the next-bundle-optimizer skill, which gives an agent Turbopack's module graph. Vercel says agents cut close to 2 MB of compressed JavaScript across v0 and vercel.com with it. It requires Turbopack.

React

There was no React blog post in October; React 19.3 is from September. On Oct 14, the same day as the Next.js security update, React published 19.3.1 along with backports 19.2.9, 19.1.10 and 19.0.9. The release notes say "Improve transport protocol" under React Server Components, and the Next.js post links two upstream React advisories. If you use RSC outside Next.js, upgrade React too.

React Hook Form shipped 7.90.0 and 7.91.0, mostly useFieldArray fixes, and v8.0.0-beta.5, which says it improves React Compiler compatibility and adds full test coverage with the compiler.

TypeScript

TypeScript 7.1 Beta (Oct 20). The language changes are small but useful. Ambient module declarations can now match on import attributes (declare module "*" with { type: "text" }). There's support for source phase imports (import source), and es2026 is now a stable --target and --lib (Map.prototype.getOrInsert, Uint8Array.fromBase64, Error.isError and more). The bigger story is the new programmatic API split into entry points like typescript/sync and typescript/async, plus "content mappers", a plugin point that lets tools for Vue, Svelte, Astro, MDX and similar formats feed TypeScript a virtual version of the file. Running them from tsc needs the new --runExternalCode flag. Microsoft's own numbers show 1.2x to 1.9x faster checks than 7.0 on five large codebases. One behavior change might add errors: distributive conditional types are stricter about constraints. The post says an RC is about a month out.

TanStack

TanStack Charts 1.0 (Oct 5). A new charting library, already at 1.0. The pitch is "charts you don't have to outgrow".

TanStack Start 1.0 is stable (Oct 13). This is the formal API commitment for the full-stack framework many people were already running in production during the RC. If you were holding off on Start until it hit 1.0, that wait is over.

TanStack AI 1.0 (Oct 23). Stable core APIs, rewritten docs, 23 provider adapters, and an experimental agent harness. The harness APIs are explicitly not covered by the stability promise.

Introducing TanStack Redact (Oct 26). A smaller replacement for React and React DOM in the browser that keeps your application code unchanged. It's early (0.2.x on npm), so check its compatibility docs before trying it on a real app.

TanStack DB 1.0 RC1 (Oct 29). The release candidate, plus a long post about the "oracle" tests used to harden it. Read the RC migration guide before upgrading. Query Collection handlers no longer refetch automatically after a mutation, and that one quietly changes app behavior.

Convex

Three minor versions landed in about two weeks, all in the convex-js changelog.

1.47 (Oct 15) added .staged() on defineTable, so a schema change can be validated in the background instead of blocking the deploy on a table scan. npx convex deploy now asks before building an index on a large table, ctx.meta.getSnapshotTs() is public, and the envList MCP tool returns only variable names by default.

1.48 (Oct 22) lets deployments sign their own JWTs with ctx.auth.signJwt in mutations (verifiable via the deployment's /.well-known/jwks.json) and makes ctx.storage.store() and ctx.storage.get() work in mutations, not just actions. Verbose deploy logs now redact env values, and npx convex env list shows only names when it detects an AI agent is running it.

1.49 (Oct 30) drops Node.js 20, so you need Node 22 or newer for the CLI. It also adds a v.function() validator for function handles and an npx convex plugins install command for the Claude Code and Codex plugin.

AI SDKs and agent tooling

Composio TypeScript SDK. 0.23.0 (Oct 12) lets a session tool ask for user input, such as an approval, instead of running, and surfaces that as a new ComposioToolInputRequiredError. 0.24.0 (Oct 14) adds session.executeMeta() for running COMPOSIO_* meta tools. 0.27.0 (Oct 22) adds session hooks, which can block a tool call before it runs or block its result before the agent sees it. 0.25 and 0.26 change how the SDK passes identity and credentials to its API client, so read those notes if you set custom headers.

Vercel AI SDK. Only patch releases on 7.0 in October (7.0.127 through 7.0.159). The one I'd note is 7.0.158, which added stat, listDirectory and deleteFile to the experimental sandbox session.

MCP TypeScript SDK 1.32.0 (Oct 2). HTTP client transports now only follow same-origin redirects. If your server endpoint redirects to another host or port, either configure the final URL or set redirectPolicy: 'follow'. On the v2 packages, @modelcontextprotocol/server 2.3.0 adds an expectedResource option to requireBearerAuth so a server only accepts tokens issued for it.

OpenAI Agents JS. 0.19 to 0.21 were mostly fixes. If you used the Runloop sandbox provider, 0.21.0 of agents-extensions removed it and links a migration guide.

What I'd do this week

Make sure you're on Next.js 16.4.1+ (or 15.5.28+) already, then upgrade again after the November 3 release. If you're on Convex and still on Node 20, sort that out before you bump to 1.49. Everything else can wait for a quiet afternoon. For me that's TypeScript 7.1's content mappers and TanStack Start 1.0.

What did I miss from October that you're actually using?