Dev weekly digest: The week npm caught fire
TanStack's npm supply-chain compromise and Next.js's 13-CVE security release dominated the week, but Rolldown 1.0, Node.js 26.1 with experimental FFI, Bun 1.3.14's built-in image processing, and Expo SDK 56 Beta show the tooling layer kept moving underneath.
