ANOTHER vulnerability. Also OpenAI and Disney??

Watch or listen to this newsletter.

Gmail is free, but you pay with your data. Proton Mail is different.

We don’t scan your messages. We don’t sell your behavior. We don’t follow you across the internet.

Proton Mail gives you full-featured, private email without surveillance or creepy profiling. It’s email that respects your time, your attention, and your boundaries.

Email doesn’t have to cost your privacy.

Ditch the Gmail data grab

What’s up, everyone? Welcome to Next in Dev. In this edition: new Payload updates, another Cloudflare outage, and big AI news.

You currently have {{rp_num_referrals}} referrals.

Well, this week, I have to start with Next.js. If you're on Next.js 15.4.8, you need to upgrade to 15.4.9 immediately. That's specifically for Payload minimum acceptable versions. Here are all the affected versions and their patches.

In less vulnerable news. The Next.js team updated the React version in their `create-next-app` templates. This ensures that no one uses an older version of React by accident. It seems we may be getting close to Next.js 16.1, which is promising for compatibility with Payload CMS.

Payload CMS released version 3.67. This version contains two key features.

The first feature is the ability to add `groupBy` to your query presets. The `groupBy` setting persisted between presets but was never saved to the preset. Now, users can save their preferred grouping with their presets.

The second feature is the ability to add guest carts with the e-commerce plugin. This is a breaking change because the team reworked the access config. Enabled by default, this feature secures guest carts with a secret stored in local storage.

Besides the access configuration rework, a new `isLoading` status is now available for you to use to disable buttons or UI based on an action's status.

The team fixed a couple of important bugs as well. First, Payload added 2 new custom components. The upload field didn't have the `beforeInput` or `afterInput` properties, so the team added those. In a similar vein, the `unlock`, `findVersions`, and `findVersionByID` operations were missing the `afterOperation` and `beforeOperation` hook. The team added those hooks in version 3.67.

They also released versions 3.68, 3.68.1, and 3.68.2. These versions introduce turbopack support on the canary branches of Next.js. This work is contributing to Next.js 16 compatibility, which we should expect soon. Much of version 3.68.2 is bug fixes for Next, such as fixing an error for Windows users and other unhandled or unhelpful errors. Payload also removed unnecessary React hooks from the default template. They used `useMemo` in a server component, which didn't do anything. Version 3.68.3 bumped the minimum version of Next.js allowed by Payload CMS.

I released two videos on recent updates with Payload CMS. Here’s one of them here:

Figma added some new AI image editing tools in Design and Draw. You can now expand an image as well as isolate and erase objects using AI. They also improved how their crop tool works.

You're also now able to use ChatGPT to generate Figma Slides and Buzz assets. This is available to everyone in the US using ChatGPT on any plan. Support for the EU should be coming soon. I'm not really in love with ChatGPT anymore, so I'm hoping that Figma will continue to branch out into other AI providers.

Cloudflare experienced yet another outage on December 5th. It seems that we have a new outage from someone each week. Cloudflare had services back up and running in about 25 minutes, so the response was quick.

The outage was the result of work Cloudflare was doing to protect customers from the recent React vulnerability. They made some technical changes, which caused some websites to return 500 HTTP error codes.

We live in a world now where we should expect more outages from major cloud providers. As infrastructure continues to get more complex, mistakes are more likely to happen. It's an unfortunate reality; we're becoming more reliant on cloud providers, but they aren't immune to issues.

OpenAI and Disney came to an agreement. This blows my mind. Disney has agreed to allow OpenAI's Sora to generate Disney's intellectual property. Sora will soon generate over 200 characters from Marvel, Pixar, and Star Wars. Disney has also announced a large investment into OpenAI and has agreed to use it as a tool within Disney+ and internal tools.

The Cursor team released Cursor 2.2. This version adds debug mode, which helps you reproduce and fix the bugs AI adds to your code. This should help coders of all experience levels work on and understand their code better.

They added to Cursor's plan mode the ability to generate and stream images into your plans. Now you can see how your AI assistant is looking at your code and how it intends to work.

Multi-agent judging is also now available in Cursor. When running many agents together, Cursor will check all the runs and make a recommendation for the best solution.

Anthropic is donating its Model Context Protocol to the Linux Foundation. This news comes just 2 months after Meta donated React to the Linux Foundation. So, this is big news and the Linux Foundation is going to be busy. Right now, there aren't very many standards in AI, so this donation is good news. Standardization is important for adoption, so I'm excited to see MCP take center-stage in the race to standardizing how we communicate with AI.

In a bid to secure the enterprise segment, Anthropic is partnering with Accenture. Accenture promises to train 30,000 of their staff to use Claude Code. In return, Accenture will invest in something they're calling the Claude Center of Excellence inside Accenture. OpenAI isn't the only AI company making moves in the enterprise segment.

The Railway team improved their Smart Canvas. The Canvas is now the central location for monitoring for your infrastructure. It provides clear visibility into your service health by showing the exact failure or status on the canvas. You no longer need to dig through your logs to find errors. You'll even see the status of your last run cron job on the canvas. You'll spend much less time digging through logs and much more time fixing the issues.

Magic Config's newest iteration is now available in beta. The plan is to give you even more control over what you deploy from a GitHub repo. Now you can be selective in what you deploy and when from a monorepo. There is no option to select and deploy all yet, but that is coming soon.

JetBrains released their new 2025.3 versions of their software. Specifically, they released WebStorm 2025.3. This version contains better support for TypeScript type evaluation and stronger monorepo support. They also upgraded their AI Assistant with Claude Agent and their AI agent, Junie, in a single chat. It's no surprise that JetBrains is lagging in the AI-assisted coding department, but they are making strides in that direction.

The JetBrains team is discontinuing development for Fleet. The team's original goal for this IDE was to create it to be a multi-language IDE with smart coding assistance. It then shifted to be an AI-first editor. Neither of these worked because there was a lot of overlap in the target audience, with no clear sign of which IDE to choose. This led the team to abandon the project, starting on December 22. If you use Fleet, plan on switching soon after that date, as it will no longer be under active development.

What did I miss? There’s so much happening in modern web dev that I’m sure I have missed something. Please share your thoughts in the comments or reply to this email. I want to address your suggestions and may include them in future newsletters.

Thanks for reading. See you next time.

Your readers want great content. You want growth and revenue. beehiiv gives you both. With stunning posts, a website that actually converts, and every monetization tool already baked in, beehiiv is the all-in-one platform for builders. Get started for free, no credit card required.