jQuery 4.0 Ships After a Decade & htmx 4.0 Rewrites Core & AWS GovCloud Expands AI Model Choice

Frameworks & Libraries

• jQuery 4.0 released after nearly a decade—the first major version since January 2016. W3Techs reports 66.5% of all websites use jQuery, but one in six is still on unpatched jQuery 1.x (closed in 2016 with unfixed CVE-2020-11023). Read more
• htmx 4.0 ships with breaking changes: XMLHttpRequest replaced by fetch() across all requests, local cache removed in favor of server re-fetching on back navigation (now opt-in via hx-history-cache extension), and attribute inheritance flipped to opt-in with :inherited suffix instead of CSS-like default inheritance. Read more
• Quasar v3.8.0 bumps build targets: browsers to Chrome/Edge 121+, Firefox 123+, Safari/iOS 17.2+, and Node to 22. QSelect gains a stable q-select__selected-value CSS class for targeting, and QInput now supports Vue's v-model lazy modifier for deferred emission. Read more

DevOps & Cloud

• AWS GovCloud (US) now offers multiple frontier AI model families through Amazon Bedrock: Amazon Nova, Claude by Anthropic, Meta Llama, NVIDIA Nemotron, OpenAI, and xAI Grok—all accessible via a single unified API endpoint in a compliant, isolated environment for government missions. Read more
• Xytech AI cuts media production resource scheduling from 45 minutes to 5–10 minutes (~80% reduction) by adding natural-language interface to the Xytech operations platform. Built with AWS, it launched at NAB Show 2026 and demonstrates the first step toward making full platform depth accessible via natural language. Read more

Security

• CVE-2026-81319 in ash_cloak (Elixir, versions 0.1.0–0.4.0): Deserialization of untrusted data allows attackers to crash the BEAM node via unbounded atom creation or decompression bombs during decryption. AshCloak.Calculations.Decrypt decodes without the :safe option, and unauthenticated AES.CTR ciphertext can be XOR-attacked if plaintext is known. Read more
• CVE-2026-81322 in ash_cloak: Sensitive information exposure—decrypted values can leak into logs, error trackers, and crash reports accessible to unauthorized actors. Read more
• CVE-2026-15369 in Custom User Registration Fields for WooCommerce (WordPress, up to 2.2.3): Privilege escalation vulnerability allows unauthorized privilege elevation. Read more