--- title: Next.js schedules its first security release for July... description: Next.js is formalizing a monthly security release program, with the first scheduled drop on July 20 covering 4 high and 5 medium severity vulnerabilities... canonical: https://daily.dev/posts/next-js-schedules-its-first-security-release-for-july-20-carve-takes-aim-at-markdown-s-20-year-debt-4wj3udgwx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Next.js schedules its first security release for July 20, Carve takes aim at Markdown's 20-year debt | daily.dev og:description: Next.js is formalizing a monthly security release program, with the first scheduled drop on July 20 covering 4 high and 5 medium severity vulnerabilities... og:url: https://daily.dev/posts/next-js-schedules-its-first-security-release-for-july-20-carve-takes-aim-at-markdown-s-20-year-debt-4wj3udgwx og:image: https://api.daily.dev/og/posts/4WJ3udgWX.png og:image:alt: Next.js schedules its first security release for July 20, Carve takes aim at Markdown's 20-year debt og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Next.js schedules its first security release for July 20, Carve takes aim at Markdown's 20-year debt **[Web Digest](https://daily.dev/sources/webdev_digest)** · 4 min read · 2 upvotes · 0 comments ## Summary Next.js is formalizing a monthly security release program, with the first scheduled drop on July 20 covering 4 high and 5 medium severity vulnerabilities across versions 16.2 and 15.5. A new markup language called Carve ships three reference implementations and 388 conformance tests, targeting the ambiguities Markdown never fixed. GPT-5.6 Sol hit 1353 Elo on Design Arena, taking the top spot in frontend design benchmarks. The CSS sibling-index() function is enabling staggered animations natively in about 75% of browsers, cutting out the JavaScript hacks most teams still reach for. ## Content **TLDR:** Next.js is formalizing a monthly security release program, with the first scheduled drop on July 20 covering 4 high and 5 medium severity vulnerabilities across versions 16.2 and 15.5. A new markup language called Carve ships three reference implementations and 388 conformance tests, targeting the ambiguities Markdown never fixed. GPT-5.6 Sol hit 1353 Elo on Design Arena, taking the top spot in frontend design benchmarks. The CSS sibling-index() function is enabling staggered animations natively in about 75% of browsers, cutting out the JavaScript hacks most teams still reach for. --- ## Next.js formalizes monthly security releases, first drop July 20 with 9 CVEs Vercel is moving Next.js off ad-hoc security patches and onto a scheduled monthly program. The first release targets July 20, 2026, with fixes for 4 high and 5 medium severity vulnerabilities across Next.js 16.2 and 15.5. Actively exploited issues will still get immediate patches outside the schedule. If you're running either version, mark the date and watch the Next.js blog for advance severity notices going forward. [Read more](https://daily.dev/posts/MhdOM7XYU) ## Carve: a new markup language with 388 conformance tests and XSS protection baked into the spec Carve is a new lightweight markup language designed to fix the ambiguities that have plagued Markdown for two decades. It ships three byte-identical reference implementations in JavaScript, PHP, and Rust, verified against 388 conformance tests. Security is normative in the spec — XSS and DoS protections, URL denylists, and linear-time parsing are required, not optional. Native support for footnotes, citations, rowspan/colspan tables, math, and cross-references covers the document-grade features Markdown extensions have never standardized. A migration tool converts existing Markdown files, and editor support covers VS Code, JetBrains, Vim, and Emacs. [Read more](https://daily.dev/posts/dlKDA0yS5) ## GPT-5.6 Sol hits 1353 Elo on Design Arena, beats Claude Fable 5 in frontend design GPT-5.6 Sol has taken first place on Design Arena with an Elo score of 1353 in frontend design, surpassing Claude Fable 5. Details beyond the score are sparse from the source, but this is the first time a GPT model has topped the frontend design benchmark category. Worth watching if you're evaluating models for UI generation work. [Read more](https://daily.dev/posts/ELabur7Ky) ## CSS sibling-index() enables native staggered animations, no JavaScript needed Modern CSS now supports staggered animations using sibling-index() and sibling-count() to calculate animation-delay per element, covering roughly 75% of browsers (Chromium and Safari). Combined with @starting-style for entry animations, the technique replaces preprocessor hacks and JavaScript timing loops. The post covers @supports fallbacks for the remaining browsers and prefers-reduced-motion handling. Exit animations still need JavaScript — that gap hasn't closed yet. [Read more](https://daily.dev/feed-by-ids?id=k09M57fTT&id=GpABDPeO1) --- ## Also notable - **JetBrains ships .NET debugger for Cursor and VS Code in ReSharper 2026.2:** ReSharper 2026.2 adds full .NET debugging to VS Code-compatible editors including Cursor, Kiro, and Devin Desktop — breakpoints, variable inspection, step-through, and process attach — built on the same engine as JetBrains Rider, filling the gap left by Microsoft's C# extensions not being licensed for those editors. [Read more](https://daily.dev/feed-by-ids?id=749pfIhER&id=lhlBeXHJv) - **react-admin used 45% fewer tokens than shadcn/ui in Claude Code agent experiment:** A controlled experiment at Marmelab building the same admin app three ways found react-admin consumed ~45% fewer tokens than shadcn/ui and ~25% fewer than from scratch, with a secondary finding that Tailwind CSS lost ~80% of revenue despite tripled usage as AI agents bypass documentation and sponsorship flows. [Read more](https://daily.dev/posts/hSjzRKGef) - **Swiss government login system blocks AZERTY keyboard users from entering verification codes:** A developer found that AGOV, Switzerland's mandatory government login system, intercepts keystrokes and explicitly blocks the Shift key in its verification code input — which on AZERTY French keyboards is required to type digits, locking out an entire keyboard layout from a legally required service. [Read more](https://daily.dev/posts/kVGYM5lfu) - **Lea Verou argues polyfills are net positive, pushes back on WHATWG's Anne van Kesteren:** Verou, as a spec editor and library author, contends that banning polyfills doesn't eliminate the need they serve — it forces developers into worse ad-hoc fallbacks — and that failures like smooshgate are symptoms of standards processes being too slow, not evidence that polyfilling is harmful. [Read more](https://daily.dev/posts/bxv3GIwQN) - **SkiaSharp 4.0 stable ships with up to 24% faster GPU rendering and variable font support:** SkiaSharp 4.0, the rendering library underpinning .NET MAUI, WinUI 3, and Uno Platform, reaches stable with up to 24% faster GPU rendering (30% for Uno Platform apps), variable font support, color font palettes, animated WebP encoding, and Uno Platform joining as a formal co-maintainer alongside Microsoft's .NET team. [Read more](https://daily.dev/posts/WxS8k3g86) --- Tags: [#security](https://daily.dev/tags/security), [#css](https://daily.dev/tags/css), [#nextjs](https://daily.dev/tags/nextjs), [#vercel](https://daily.dev/tags/vercel), [#markdown](https://daily.dev/tags/markdown) [View this post on daily.dev](https://daily.dev/posts/next-js-schedules-its-first-security-release-for-july-20-carve-takes-aim-at-markdown-s-20-year-debt-4wj3udgwx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/next-js-schedules-its-first-security-release-for-july-20-carve-takes-aim-at-markdown-s-20-year-debt-4wj3udgwx","headline":"Next.js schedules its first security release for July 20, Carve takes aim at Markdown's 20-year debt","text":"Next.js is formalizing a monthly security release program, with the first scheduled drop on July 20 covering 4 high and 5 medium severity vulnerabilities across versions 16.2 and 15.5. A new markup language called Carve ships three reference implementations and 388 conformance tests, targeting the ambiguities Markdown never fixed. GPT-5.6 Sol hit 1353 Elo on Design Arena, taking the top spot in frontend design benchmarks. The CSS sibling-index() function is enabling staggered animations natively in about 75% of browsers, cutting out the JavaScript hacks most teams still reach for.","url":"https://daily.dev/posts/next-js-schedules-its-first-security-release-for-july-20-carve-takes-aim-at-markdown-s-20-year-debt-4wj3udgwx","datePublished":"2026-07-14T04:18:05.313Z","dateModified":"2026-09-13T20:51:05.278Z","author":{"@type":"Organization","name":"Web Digest","logo":"https://media.daily.dev/image/upload/s--C833eNQW--/f_auto,q_auto/v1773839396/logos/webdev_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/webdev_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/webdev_digest","name":"Web Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Web Digest","item":"https://daily.dev/sources/webdev_digest"},{"@type":"ListItem","position":3,"name":"Next.js schedules its first security release for July 20, Carve takes aim at Markdown's 20-year debt"}]} ```