--- title: Next.js 16.3 ships instant navigations, npm supply chain... description: Next.js 16.3 is out with no breaking changes and an immediate upgrade recommendation — the headliners are up to 90% dev server memory reduction via Turbopack... canonical: https://daily.dev/posts/next-js-16-3-ships-instant-navigations-npm-supply-chain-hit-by-chaindrop-malware-pozrms2bz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Next.js 16.3 ships instant navigations, npm supply chain hit by ChainDrop malware | daily.dev og:description: Next.js 16.3 is out with no breaking changes and an immediate upgrade recommendation — the headliners are up to 90% dev server memory reduction via Turbopack... og:url: https://daily.dev/posts/next-js-16-3-ships-instant-navigations-npm-supply-chain-hit-by-chaindrop-malware-pozrms2bz og:image: https://api.daily.dev/og/posts/POZRmS2bZ.png og:image:alt: Next.js 16.3 ships instant navigations, npm supply chain hit by ChainDrop malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Next.js 16.3 ships instant navigations, npm supply chain hit by ChainDrop malware **[Web Digest](https://daily.dev/sources/webdev_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary Next.js 16.3 is out with no breaking changes and an immediate upgrade recommendation — the headliners are up to 90% dev server memory reduction via Turbopack and opt-in Instant Navigations with client-side caching. On the security front, a supply chain attack called ChainDrop compromised over 1,300 npm package versions including keyv (600M+ monthly downloads), with valid GitHub Actions provenance signatures bypassing npm's own checks. Cloudflare shipped two experimental browser-adjacent projects: Kitesurf, a V8-isolate headless browser for AI agents, and WebMCP, a one-toggle MCP interface for any Cloudflare-hosted site. The 2026 State of CSS survey is also out, though most of its findings were covered yesterday. ## Content **TLDR:** Next.js 16.3 is out with no breaking changes and an immediate upgrade recommendation — the headliners are up to 90% dev server memory reduction via Turbopack and opt-in Instant Navigations with client-side caching. On the security front, a supply chain attack called ChainDrop compromised over 1,300 npm package versions including keyv (600M+ monthly downloads), with valid GitHub Actions provenance signatures bypassing npm's own checks. Cloudflare shipped two experimental browser-adjacent projects: Kitesurf, a V8-isolate headless browser for AI agents, and WebMCP, a one-toggle MCP interface for any Cloudflare-hosted site. The 2026 State of CSS survey is also out, though most of its findings were covered yesterday. --- ## Next.js 16.3 ships Instant Navigations, 90% dev memory reduction, no breaking changes Next.js 16.3 is a straightforward upgrade — the team says all apps should move immediately. The automatic wins are real: up to 90% less dev server memory via Turbopack memory eviction, 22% more SSR throughput through native Node.js streams, and up to 5.5x faster repeat builds with Turbopack FileSystem Cache. The opt-in headline is Instant Navigations, enabled via two config flags, which brings client-side caching through the 'use cache' directive and partial prefetching to the App Router. New APIs include root-params for layout params without prop drilling and catchError for recoverable server-side errors. There's also an experimental Rust-based React Compiler and TypeScript 7 support for 10x faster type checking. [Read more](https://daily.dev/feed-by-ids?id=y9Z1uEekK&id=8mP58BROh&id=kUlWPyisf) ## ChainDrop malware hits 1,300+ npm packages including keyv, bypasses provenance checks A supply chain attack called ChainDrop — based on the previously seen Shai-Hulud — compromised over 1,300 npm package versions across 868 packages. The entry point was the keyv maintainer account (600M+ monthly downloads), which then spread to flat-cache, file-entry-cache, and cacheable-request. The uncomfortable part: attackers published new versions with valid GitHub Actions provenance signatures, which means npm's provenance checks didn't catch it. The malware drops an obfuscated setup.mjs that downloads the Bun runtime to execute its payload. Affected companies include Deliveroo, Picsart, and ServiceTitan. The compromised packages collectively average 2 billion downloads per month. [Read more](https://daily.dev/feed-by-ids?id=0kFFJfdOh&id=ERSITeLTN) ## Cloudflare launches Kitesurf headless browser and WebMCP for AI agent browsing Cloudflare shipped two experimental projects aimed at AI agent workflows. Kitesurf is a headless browser built on V8 isolates, WebAssembly, and Rust — not Chromium — showing 3-7x lower CPU and memory usage than Chromium at the cost of roughly 1.7x slower wall time. It already passes 215,000+ Web Platform Tests and supports Puppeteer, Playwright, and MCP via CDP. WebMCP is a separate feature that adds a Model Context Protocol interface to any Cloudflare-hosted site via a single dashboard toggle, no code changes required. It uses a new browser standard shipping experimentally in Chrome 146 that exposes tools via document.modelContext, letting AI agents interact with sites directly rather than scraping. [Read more](https://daily.dev/feed-by-ids?id=PFNyPoUJE&id=h0QMMm3j8) ## iCloud Private Relay leaks real IP via three WebKit vectors, fix not until autumn 2026 Researchers Talal Haj Bakry and Tommy Mysk demonstrated three separate IP leak vectors in iCloud Private Relay, all rooted in WebKit — which Apple mandates for every iOS browser. DNS prefetching resolves hostnames through the device's normal DNS path, WebTransport opens QUIC connections outside the proxied path, and WebAuthn Related Origin Requests can trigger the OS credential service to fetch a validation file directly from the device with no login required. Apple has acknowledged all three and confirmed a fix, but the timeline is autumn 2026. VPNs aren't affected since they tunnel at the system level. If you're relying on Private Relay for meaningful IP privacy on iOS right now, you're not getting what you're paying for. [Read more](https://daily.dev/posts/o1sMJfYeE) --- ## Also notable - **JetBrains ships ReSharper 2026.2 as a VS Code extension for AI-first editors:** JetBrains released ReSharper 2026.2 as a VS Code-compatible extension, bringing full .NET tooling — debugger, static analysis, refactoring, unit test running — to Cursor, Devin Desktop, and Kiro via a single install command, ending the need for a separate IDE window. [Read more](https://daily.dev/posts/G6NgrXJ38) - **ShieldFont poisons AI scrapers using OpenType glyph substitution:** ShieldFont is an open-source project that swaps roughly 25% of content words with semantically plausible alternatives via OpenType GSUB tables, so scraped HTML looks coherent but is subtly wrong while human visitors see the original text rendered correctly by the font. [Read more](https://daily.dev/posts/6UGAuZ4k6) - **Astro 7.2 adds experimental incremental static builds with cache key support:** Astro 7.2 ships experimental incremental static builds where routes returning a cacheKey from getStaticPaths() are skipped on rebuild if the module graph hash and cache key both match, with the cache stored in node_modules/.astro/. [Read more](https://daily.dev/posts/RYlSV9nOk) - **vlt 1.0 ships as npm alternative with CSS-like dependency selectors:** vlt hit 1.0 with CSS-like dependency graph selectors and built-in private registry hosting — previously covered for its 73% faster install claims, now at a stable release milestone. [Read more](https://daily.dev/posts/ERSITeLTN) - **Twig 4.0 overhauls macro system with strict argument handling and upgrade path via 3.29:** Twig 4.0 makes macro arguments required by default, adds explicit variadic syntax, mandates parentheses on calls, and makes names case-sensitive — all previously silent failures — with a smooth migration path through Twig 3.29 deprecation warnings. [Read more](https://daily.dev/posts/iohntEUqX) ## Similar posts on daily.dev - [Next.js 16.3: Instant Navigations, Up to 90% Less Dev Memory and Faster Builds](https://daily.dev/posts/next-js-16-3-instant-navigations-up-to-90-less-dev-memory-and-faster-builds-abksajvqx) · InfoQ · 3 upvotes · 1 comments - [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 131 upvotes · 4 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#nextjs](https://daily.dev/tags/nextjs), [#npm](https://daily.dev/tags/npm), [#security](https://daily.dev/tags/security), [#turbopack](https://daily.dev/tags/turbopack) [View this post on daily.dev](https://daily.dev/posts/next-js-16-3-ships-instant-navigations-npm-supply-chain-hit-by-chaindrop-malware-pozrms2bz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/next-js-16-3-ships-instant-navigations-npm-supply-chain-hit-by-chaindrop-malware-pozrms2bz","headline":"Next.js 16.3 ships instant navigations, npm supply chain hit by ChainDrop malware","text":"Next.js 16.3 is out with no breaking changes and an immediate upgrade recommendation — the headliners are up to 90% dev server memory reduction via Turbopack and opt-in Instant Navigations with client-side caching. On the security front, a supply chain attack called ChainDrop compromised over 1,300 npm package versions including keyv (600M+ monthly downloads), with valid GitHub Actions provenance signatures bypassing npm's own checks. Cloudflare shipped two experimental browser-adjacent projects: Kitesurf, a V8-isolate headless browser for AI agents, and WebMCP, a one-toggle MCP interface for any Cloudflare-hosted site. The 2026 State of CSS survey is also out, though most of its findings were covered yesterday.","url":"https://daily.dev/posts/next-js-16-3-ships-instant-navigations-npm-supply-chain-hit-by-chaindrop-malware-pozrms2bz","datePublished":"2026-08-07T04:19:27.910Z","dateModified":"2026-10-14T02:30:34.393Z","author":{"@type":"Organization","name":"Web Digest","logo":"https://media.daily.dev/image/upload/s--C833eNQW--/f_auto,q_auto/v1773839396/logos/webdev_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/webdev_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/webdev_digest","name":"Web Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Web Digest","item":"https://daily.dev/sources/webdev_digest"},{"@type":"ListItem","position":3,"name":"Next.js 16.3 ships instant navigations, npm supply chain hit by ChainDrop malware"}]} ```