Next.js 16.4.2, Docker 29.9.1 and SvelteKit 3 Updates

Executive Summary

• Next.js 16.4.2 is the new stable patch on top of the October 14 security update; 15.x security support ends October 21, so 15.5.28 users should plan their move now.
• Docker Engine 29.9.1 and Docker Desktop 4.95.0 both landed this week, with containerd 2.4.2 security fixes and Enhanced Container Isolation startup fixes.
• Node.js has pre-announced a high-severity October 21 security release for the 26.x, 24.x and 22.x lines.
• SvelteKit 3.0 (breaking, Vite 8 and Node 22 required) is followed by 3.1.0; Prisma 8 is at release candidate 18.
• Kubernetes 1.37.1 is the current stable patch, and 1.38.0-alpha.2 is out for early testing.

Next.js 16.4.2 and the Patch Window

Next.js 16.4.2 shipped on October 15 as the latest stable release. It is mostly Turbopack backports: snapshot consistency fixes, lazy dynamic-import chunk-list collisions, and module resolution that now ignores realpath errors like Node does. The 16.5 canary line is moving daily, with partial prefetching and cached navigation fixes.

If you have not patched yet, the October 14 advisory covers two critical RCEs (CVE-2026-96889 in SVG image optimization and GHSA-673q-mjm6-r5xr in use cache) plus a Server Actions DoS. Pin to a fixed release:

npm install [email protected]   # 16.x line
npm install [email protected]  # 15.x line, security support ends 21 Oct

Next.js 16.4 also makes Cache Components the recommended default, adds ensureStatic, and ships next upgrade --agent. The upgrade reminder policy is configurable:

// next.config.ts
const nextConfig = {
  cacheComponents: true,
  partialPrefetching: true,
  experimental: { agentUpgrade: 'security' },
};
export default nextConfig;

Docker Engine 29.9 and Docker Desktop 4.95.0

Docker Engine 29.9.1 (October 14) updates containerd to v2.4.2 to fix three containerd security issues, and fixes --link-local-ip validation and docker save leaving layers on disk. 29.9.0 (October 8) brought a Go runtime update for several HTTP/2 CVEs, BuildKit v0.34.0 and a lazy-pull daemon feature.

Docker Desktop 4.95.0 (October 12) is a stability release:

• The engine no longer restarts after startup when an admin policy enables Enhanced Container Isolation.
• Auto-update downloads no longer start before sign-in on machines that enforce it, closing a policy bypass.
• The Windows installer no longer deletes the WSL data disk when the data root sits inside the install directory.
• A new docker desktop auth status subcommand shows Docker Hub login details.

docker version --format '{{.Server.Version}}'   # expect 29.9.1
docker desktop auth status

Node.js: Release Trail Before October 21

Node.js 26.12.0 and 24.22.0 (October 14) add crypto.parsePKCS12() and SIV/GCM-SIV cipher modes on 24.x, plus http websocket mask helpers on 26.x. The security announcement lists no CVE IDs or fixed versions yet; the highest severity is HIGH on all three lines, and end-of-life versions are affected too. Schedule a rebuild of Node base images for October 21.

SvelteKit 3.0 and 3.1

SvelteKit 3.0.0 (October 1) requires Node 22+, TypeScript 6+, Svelte 5.56.4+ and Vite 8. It removes $app/stores and $service-worker, defaults the cookie path to '/', forbids external redirects by default and replaces $lib with #lib. 3.1.0 adds CSP report-sha* keywords and a sveltekit.endpoint tracing span. Pair it with adapter-vercel 7.0.1 and adapter-cloudflare 8.0.1.

Prisma 8 Release Candidates

Prisma 8.0.0-rc.18 (October 14) requires sql literals for raw SQL in a contract, supports multi-field weighted full-text indexes, and adds whereUnique and firstOrThrow to the SQL ORM. Every schema file needs a // use prisma-8 header, so test migrations on a branch first.

Kubernetes

Kubernetes v1.37.1 (September 23) remains the latest stable patch, alongside 1.36.5, 1.35.9 and 1.34.12. v1.38.0-alpha.2 (October 7) is a pre-release; keep it out of production clusters.

Action Items

1. Upgrade Next.js to 16.4.2 or 15.5.28 and confirm sharp is 0.35.5 or later.
2. Rebuild images on Docker Engine 29.9.1 and roll out Docker Desktop 4.95.0.
3. Reserve a patch window for the Node.js October 21 security release.