Weekly OSS Recap: Remix UI Breaks, Nuxt Security Fixes, LiteLLM Keys

This week brought a breaking UI release in Remix, a security-heavy Nuxt patch, and a signing key rotation at LiteLLM that deserves attention from anyone running its images.

Frameworks

• remix-run/remix (ui), ui@0.13.0: removes prop types for the previously removed styled Accordion, Select and Combobox components, and adds prefersReducedMotion() for animation. ⚠ Breaking: the toggle mixin is now exported as toggle instead of control, so toggle.control() becomes toggle(), and ToggleControlOptions is renamed ToggleOptions. Release
• remix-run/remix (remix), remix@3.1.0: server rendering with remix/component is about twice as fast as 3.0 and uses less memory, and frame.reload() plus prefetch options arrive. Release
• remix-run/remix (multipart-parser), multipart-parser@1.1.0: adds an unstable /future entrypoint with a streaming parser that yields parts as headers arrive, keeping memory flat for large files. Release
• nuxt/nuxt, v4.6.3: patches five security advisories, including dev server access to Nitro output and dot segments in request paths, plus several performance gains. Release
• vitejs/vite (create-vite), create-vite@9.3.2: templates now use TypeScript 7 where possible. Release

Runtime

• cloudflare/workerd, v1.20261027.1: adds an offpeak_location_hint compat flag for Durable Objects, renames the onEvict symbol to onHibernate, and continues expanding Rust JSG with promises and wildcard properties. Release
• cloudflare/workerd, v1.20261024.1: adds passive event listeners, makes Response.json() throw a TypeError for non-encodable values, and moves node:sqlite and node:diagnostics_channel from C++ to TypeScript. Release

Data

• ClickHouse/ClickHouse, v26.10.2.103-stable: a new stable build, though the release notes were empty at publication time. Release

AI

• BerriAI/litellm, v1.106.3: every Docker image and Helm chart is now signed with a new cosign key. ⚠ Breaking: verifying with the previous key fails, so update cosign verify scripts, CI checks and admission policies such as Kyverno or Sigstore policy-controller. The release also removes the eMudhra root CA from trusted bundles. The same change landed in v1.105.4, v1.104.6 and v1.103.8. Release
• openai/openai-python, v3.38.0: adds delegation controls and prompt cache lifetimes, with several Responses API fixes. Release
• openai/openai-python, v3.39.0: adds the gpt-6.1-terra model identifier. Release
• anthropics/anthropic-sdk-typescript, sdk-v1.3.0: adds Claude Tag endpoints for Claude Enterprise organizations. The sdk-v1.2.0 release added message threads and usage and cost reports by dimension. Release

Devtools

• neovim/neovim, nightly (v0.13.0-dev-1953): a prerelease development build, so no stable changes to report this week. Release

Themes this week

Security and supply chain hygiene dominated, from Nuxt's advisories to LiteLLM's key rotation and certificate pruning. Meanwhile the AI SDKs keep widening their surface area with threads, cost reporting and new model identifiers, and Remix is making performance a headline feature.