New: the first 100 founders get $120 in AI credits as Founding Members.Learn more
startupcorners
Create your link
Menu
OSS ReleasesSep 22, 2026·3 min read·By StartupCorners

OSS Releases: vLLM 0.30, Remix Breaking Changes, workerd Sept 2026

The week of Sept 22, 2026 brings vLLM 0.30 with massive model additions, several Remix packages with security-minded breaking changes, and steady cadence updates across runtimes and AI SDKs.

AI

  • vllm-project/vllm, v0.30.0: Adds DeepSeek-V4.1-Flash with MXFP8 KV via FlashMLA, a persistent GPU weight-cache daemon for faster engine restarts via --load-format ipc_cache, Gumbel-max watermarked generation with per-request opt-out, and HiSparse host-resident KV spilling under GPU pressure, drawing 762 commits from 315 contributors. Release
  • openai/openai-python, v3.17.0: Adds external storage configuration management, safety case retrieval, safety warning and deactivation webhook events, session environment reset events, SIP media security for incoming call events, and environment variable vault credentials. Release
  • openai/openai-python, v3.16.2: Fixes a memory leak caused by TextFormatT parameterization in parse_response. Release
  • BerriAI/litellm, v1.102.0: Backports a Nova Sonic nova-2-sonic model fix. Release
  • langchain-ai/langchain (langchain-typesafe), v0.0.1a3: Initial alpha release shipping TypeSafeClassifier, AutoModeMiddleware, and ModelRouterMiddleware. Release
  • langchain-ai/langchain (langchain-deepseek), v1.1.1: Resolves minimum OpenAI dependency compatibility. Release

Frameworks

  • sveltejs/svelte, v5.57.1: Fixes event listener cleanup during teardown, global CSS preservation in scope-free components, SSR garbage collection, and $state.eager initialization; parser performance improved by avoiding unnecessary regex and Acorn calls. Release
  • remix-run/remix (tar-parser), v0.8.0: ⚠ Breaking: parseTar, parseTarHeader, and TarParser now default to pathPolicy: 'relative', rejecting absolute paths, .. traversals, Windows drive prefixes, backslashes, and embedded NULs; default entry-body limit is 2 MiB, total archive 20 MiB, and 5,000 entries. Pass pathPolicy: 'preserve' to opt out of path policy only. Release
  • remix-run/remix (session-middleware), v0.5.0: ⚠ Breaking: Middleware now validates cookie maxAge and expires before loading session data; existing cookies without expiration metadata begin a new session when a lifetime is configured. Session cookies now also default to Secure for HTTPS URLs. Release
  • remix-run/remix (ui), v0.10.0: ⚠ Breaking: Named-frame navigations for unmounted frames now perform document navigation instead of reloading the top frame. ⚠ Breaking: resolveFrame now restricts to same-origin sources by default. ⚠ Breaking: Raw HTML props (innerHTML, srcDoc) now require a value wrapped by unsafeHTML() to prevent attacker-controlled prop spreads. Release
  • remix-run/remix (response), v0.3.9: Adds X-Content-Type-Options: nosniff to all file responses and enables per-chunk flushing for compressed streamed HTML. Release

Runtime

  • cloudflare/workerd, v1.20260922.1: Upgrades to LLVM 22, adds V8 15.5 API support, implements RPC for inbound UDP connect() events, and removes the legacy C++ I/O backend (--//:io_backend=cxx). Release
  • cloudflare/workerd, v1.20260919.1: Adds Analytics SQL binding types, fixes a Python stack-switching GC crash, and splits actor retry exhaustion outcomes with increased backoff. Release
  • vercel/turborepo, v2.11.0: Migrates TUI virtual terminals from vt100 to Ghostty, adds devEngines.packageManager support in workspaces, and recognizes nub as a package manager. Release
  • vercel/turborepo, v2.11.2: Restores repeatable CLI flags broken in 2.11.1. Release

Devtools

  • neovim/neovim, v0.13.0-dev-1693: Nightly prerelease with ongoing fixes and features; see :help news inside Nvim for the full changelog. Release

Data

  • ClickHouse/ClickHouse, v26.9.1.1629-stable: Stable branch release; no detailed notes published. Release

The week's releases reflect two converging priorities: the AI layer is maturing fast, with vLLM 0.30 packing serious hardware-level optimizations and the LangChain ecosystem expanding its type-safety surface, while the Remix monorepo is tightening security defaults across archive handling, session management, and HTML injection boundaries, signaling that the broader JavaScript framework space is treating safe-by-default behavior as a first-class feature rather than an afterthought.

Ready for one link for your startup? Free to start, built from your website in seconds.

Founding Members get $120 in AI credits, a direct line to the team and a vote on the roadmap.

Free to start · No credit card · Work email, so we can read your website

Read next from the digest.

All digests
Oct 6, 2026 · 3 minOSS Releases: vLLM 0.31, Nuxt 4.6, LiteLLM 1.104, Terraform 1.16.5The week of October 6, 2026 brought a landmark vLLM 0.31 inference release, a redesigned Nuxt CLI, security hardening in LiteLLM, and critical crash fixes in Terraform.Sep 29, 2026 · 2 minOSS Releases Week of Sept 29 2026: Frameworks, AI, and RuntimeThis week's stable releases bring ML-KEM/ML-DSA cryptography to Cloudflare Workers, claude-sonnet-5-5 across Anthropic's SDK family, and a wave of correctness fixes in DuckDB and Remix.