Weekly OSS Releases: Next.js, Remix, Astro, LiteLLM, and More

Frameworks

• vercel/next.js v16.3.4 and v15.5.25: Both stable lines re-enable AVIF image optimization after it was disabled in the prior patch, plus fixes for Turbopack manifest crossOrigin and a testmode infinite-recursion regression. v16.3.4 / v15.5.25

• withastro/astro @astrojs/mdx@8.0.0: MDX file processing is now delegated to Markdown processors (satteri or unified), requiring @astrojs/markdown-satteri@0.4.0+ or @astrojs/markdown-remark@7.3.0+ if you have an explicit processor configured. Silently dropped plugin options now emit warnings. Release

• withastro/astro @astrojs/markdown-remark@7.3.0: Both unified() and satteri() processors now compile .mdx files directly, and unified() gains a new recmaPlugins option for estree/JSX plugins. Release

• withastro/astro @astrojs/sitemap@3.7.4: Fixes homepage URL output when trailingSlash is "never" or build.format is "file", preventing a trailing empty-path entry. Release

• remix-run/remix ui@0.8.0: ⚠ Breaking: All framework-owned DOM attributes migrate to the data-rmx-* namespace (e.g. rmx-target becomes data-rmx-target). ⚠ Breaking: Script elements with non-string children now render empty and report an error rather than serializing escaped HTML. ⚠ Breaking: addEventListeners() is removed in favor of native target.addEventListener with an AbortSignal. Adds a browser-only SPA response protocol. Release

• remix-run/remix spa@0.1.0: Initial release of @remix-run/spa with render() middleware and a run(router) browser runtime for fully client-rendered Remix applications. Release

• remix-run/remix auth@0.3.0: ⚠ Breaking: Removes the built-in Atmosphere auth provider and the DPoP model; use OAuthTokens in place of OAuthStandardTokens and the new createOAuthProvider() factory for custom providers. Release

• remix-run/remix cli@0.6.0: Adds remix db rollback for reverting migrations via down.sql, with --step, --to, and --dry-run flags, plus a new remix assets command for listing and inspecting browser-reachable static assets. Release

• sveltejs/svelte svelte@5.57.0: Exports RenderOutput, Csp, and related types from svelte/server; adds has() to createContext; adds getOrInsert/getOrInsertComputed to SvelteMap; and supports defaultValue on <select>. Release

AI

• BerriAI/litellm v1.99.0: Adds an async Rust OCR bridge, restores MCP OAuth UI, fixes WebSocket passthrough for OpenAI-prefixed routes, and adds AWS Bedrock batch cancellation via StopModelInvocationJob. Release

• langchain-ai/langchain langchain==1.4.0a2: Alpha ships langchain.mcp, a first-party MCPAdapter that converts any MCP server into LangChain tools using FastMCP as the transport layer, with a single entry point across URL, stdio, in-process, and multi-server configs. Release

• openai/openai-python v3.6.0: Adds compute_units to Responses and Chat Completions usage objects, and hardens X.509 workload identity auth. Release

• anthropics/anthropic-sdk-typescript bedrock-sdk@0.33.3 and aws-sdk@0.6.6: Fixes env credential precedence over AWS_PROFILE and corrects SigV4 signing for repeated query keys. bedrock / aws

Runtime

• cloudflare/workerd v1.20260901.1: Implements FileSystemWritableFileStream in TypeScript, adds encoding and compression stream test suites, and fixes leaked SQLite handles during init failures. Release

• cloudflare/workerd v1.20260829.1: Fixes multiple use-after-free bugs in streams, EventSource, and WebSocket hibernation; adds dynamic Hyperdrive types; and patches internal buffer lifetime issues in internal.c++. Release

Data

• ClickHouse/ClickHouse released v26.8.1.2041-lts, v26.6.4.55-stable, and two v26.3.x-lts patch builds this week. Release notes were not published for these tags, so they are noted here for version tracking only.

Devtools

• neovim/neovim v0.13.0-dev nightly: Ongoing prerelease development build; no stable release this cycle.

This week's releases point to two converging themes: AI runtime integration is moving closer to the framework layer (LangChain's MCP adapter, LiteLLM's Rust bridge), while established frameworks are taking the opportunity to clean house with coordinated breaking changes in DOM contracts, auth models, and processor delegation. Founders shipping on these stacks should audit their upgrade paths before the stable tags land.