Starter security patches — Oct 2026

Between 19–20 October 2026 the official starters shipped dependency security patches. This note groups them so you get one upgrade checklist instead of three thin posts. Only public release-note items are listed.

datePublished for this article matches the newest cut in the group (Next 1.0.2).

Who should upgrade

Anyone still on Next starter 1.0.0 or Nuxt starter before 1.0.1. Application code in these patches is unchanged — pull the tag and reinstall.

Next.js starter 1.0.1 → 1.0.2

1.0.1 (19 Oct)

• next → 15.5.28, plus postcss, sharp, source-map-js (release).
• Public GHSAs addressed in that release: GHSA-4jqv-mc3x-m676, GHSA-mcj8-r9mp-w47p, GHSA-qx2v-qp2m-jg93, GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849, GHSA-wq5f-xc86-pv6w, GHSA-68fv-2mgg-jv7q.
• Known remaining (per release): GHSA-vfj7-8cjw-p6xm (braces, dev chain) — no upstream fix yet.

1.0.2 (20 Oct)

• react / react-dom → 19.3.1 (release).
• Closes the last open security item called out for the starter after Next was already on 15.5.28.
• npm audit --omit=dev: 0 vulnerabilities (per release verification).

Upgrade

cd externa-next-starter
git fetch --tags
git checkout v1.0.2
npm ci
npm run lint && npm run build

Nuxt starter 1.0.1 (19 Oct)

• Update @nuxt/devtools to 3.4.3, dropping vulnerable simple-git (release).
• Public GHSAs listed: GHSA-v5rq-49vh-5v5c, GHSA-x6jw-m9v5-85vh, GHSA-g4wm-2vf7-vfgr, GHSA-858h-whjf-mvg5.
• Known remaining (per release): GHSA-vfj7-8cjw-p6xm (braces) and GHSA-86w9-cpqp-85rv (node-forge, via Nuxt) — no upstream fix yet.

cd externa-nuxt-starter
git fetch --tags
git checkout v1.0.1
npm ci
npm run lint && npm run build

If you can move further, prefer Nuxt starter 1.1.1 (Node ≥22.13, <NuxtPage /> fix) after this baseline.

Sources

• next-starter v1.0.1 · v1.0.2
• nuxt-starter v1.0.1
• Headless starter