SL#115 - Your Open Graph Image Route Is an Interpreter. Next.js Just Showed What Happens When You Feed It Strings.
Next.js shipped two security releases in eight days, and the nastiest bugs lived in image routes. Here is the pattern behind them, and the one-hour audit it suggests for your own app.
SL#95 - Next.js Bet Your App Was Mostly Static. TanStack Start Bets It Isn't.
Both frameworks server-render. The real fight is over what should be the default, and Next.js 16 quietly reversing its own caching default is a hint the original bet was too aggressive for the apps most of us actually build.
