Cloudflare Void for Vite, and a TanStack Start XSS
Also: Bun gets a linter, Rust 1.99.1 fixes FFI bools, and ads that deliver spyware.
The main thing
Cloudflare just open-sourced a way to stare into the Void. The Void stares back with a deploy command.
Void is three products shipped as one npm package and Vite plugin (npm install void):
- Void SDK: a composable JavaScript SDK for full-stack Vite apps. It has file-based API routing, pre-rendering, caching, islands, and types that go from your database to your UI.
- Void CLI: provisions Cloudflare resources and deploys your app.
- Void Platform: a shared deployment platform that your team hosts in its own Cloudflare account, on top of Workers for Platforms.
The SDK infers what your code uses. If you import void/db, you get a local database in development, and void deploy provisions D1 in production. If you import void/ai, it sets up Cloudflare's AI Gateway. Queues and AI bindings work the same way. Void has adapters for React and Vue, and it works with React Router, SvelteKit, Nuxt, TanStack Start, Astro and Vinext. Those frameworks do routing and rendering. Void does resource APIs (with Hono), migrations, deployment and auth (with Better Auth). Every feature is optional.
The Platform is the interesting change of direction. The team first planned one private platform for all users. After VoidZero (the team behind Vite, Vitest, Oxc and Rolldown) joined Cloudflare, they open-sourced it instead. The pitch is for companies that want employees to ship vibe-coded internal apps without giving every employee cloud access. Admins control access, set resource limits and inspect deployments. Users run void connect and deploy.
To self-host it, you need a Cloudflare account with Workers for Platforms and R2, a PostgreSQL database, a login provider and a domain. You can fork it to connect your company's systems or to make it work on other deployment platforms.
If you build on Vite, you now have a first-party path from a Vite app to a running Workers app. You also get an approved place for the dashboards your ops team keeps building with agents.
Quick bits
TanStack Start has a critical reflected XSS (CVE-2026-102989, CVSS 9.3). An unauthenticated attacker can craft a link to a server function. When someone opens it, the attacker's JavaScript runs on your origin with that visitor's authority. Affected: @tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start and @tanstack/vue-start from 1.143.12 up to, not including, the patched versions. Upgrade to @tanstack/start-server-core@1.169.39, @tanstack/react-start@1.168.60, @tanstack/solid-start@1.168.57 or @tanstack/vue-start@1.168.56. If you cannot upgrade yet, the advisory suggests WAF and CSP mitigations, but they are not a full fix.
Codex "model at capacity" errors should be much rarer. OpenAI's @thsottiaux says a series of changes and more compute cut them "very significantly." When the error does happen, Codex should continue by itself and not stay blocked. No numbers yet, so your terminal is the benchmark.
Bun's next version adds bun lint, an ESLint-compatible linter with over 1,000 built-in rules. It reads eslint and oxlint configs and supports eslint plugins. Bun says it is 26x faster, and bun lint --staged replaces lint-staged.
Vercel Drives is generally available for Vercel Sandbox on all plans. It is persistent storage that an agent can mount in a new sandbox to continue its work. You can share drives read-only or fork them. Drives default to 1 TiB (1 GiB on Hobby), with up to 16 TiB available.
GitHub AI Scan for pull requests is generally available. It finds vulnerabilities in PR changes in languages that CodeQL does not cover, such as PHP, Shell, Terraform HCL and Dockerfiles. Findings are advisory and cannot block merges. Private repos need Code Security or Advanced Security. Agentic autofix is also generally available.
Rust 1.99.1 fixes a miscompilation on x86_64: Rust functions that return bool through FFI could give callers values other than 0 or 1. It also restores wcslen on UEFI and embedded targets. Run rustup update stable and your booleans are boolean again.
Citizen Lab found targeted ads that deliver zero-click spyware. Ads bought by Israeli company Discover-Tech infected devices at Al Jazeera with Candiru's spyware. Citizen Lab calls it the first public confirmation of the technique. Google, IAB Europe and others have since cut Discover-Tech off.
GitHub Copilot will deprecate selected models on November 16, 2026 in chat, inline edits, ask and agent modes, and completions. If you pin a model, read the post for the list. Claude Opus 4.8 stays available to individual subscribers on annual plans.
Patch TanStack first. Then go stare into the Void.