Preload #01 ·
JPEG XL in Chrome, WordPress 7.1.3 and Plesk fixes
Bootstrap 6 goes alpha, Deno Deploy shuts down in six months, and Edge no longer runs unload handlers.
If this first issue of Preload has landed in your inbox, thank you: subscribing to a newsletter before seeing what is inside is an encouraging sign of trust. Let's get straight to what stood out last week: a new image format reaches two browsers, WordPress and Plesk ship fixes you should apply right away, and Deno announces the end of its hosting platform. The common thread: when things move this fast, you need to update more often and measure before you adopt.
Enjoy the read.
The essentials
- Chrome 155 decodes JPEG XL and Firefox 158 follows on October 13: test it against AVIF on your photos.
- WordPress 7.1.3 fixes seven vulnerabilities: apply it now, plugins included.
- Plesk shipped ten critical fixes in eight weeks: check your version today.
Web platform
JPEG XL arrives in Chrome 155, then in Firefox 158
Chrome 155, stable since October 6, decodes JPEG XL images with a new decoder written in Rust. Firefox 158 enables it by default on October 13 and adds image/jxl to the Accept header of its image requests. Safari has decoded it since version 17, for still images only. Google recommends trying both AVIF and JPEG XL and keeping whichever performs better: JPEG XL shines mostly for high-fidelity and lossless photos.
Partial support: Chrome 155, Firefox 158, Safari 17 without animation or progressive decoding
Next step
Compare JPEG XL and AVIF on your high-fidelity photos, then serve JPEG XL inside <picture> with a <source type="image/jxl"> placed before the AVIF and WebP sources, never on its own.
One more format in
<picture>, not a switch. AVIF stays the first choice until your own measurements say otherwise.
Edge 155 no longer runs unload handlers
Since Edge 155, released on October 8, unload handlers no longer run on any page unless you explicitly re-enable them with the unload Permissions-Policy. The gradual rollout that began in Edge 152 is complete. Like Chrome 155, the release also ships margin-trim (block and multicol containers), symbols() and text module imports (import … with { type: "text" }).
Next step
Search your code and third-party scripts for leftover unload listeners (analytics, form autosave) and move them to pagehide or visibilitychange. As a bonus, the page becomes eligible for the back/forward cache.
Performance
deliveryType finally tells you when a resource came from cache
Firefox 158, out on October 13, supports PerformanceResourceTiming.deliveryType, which returns "cache" when a resource was served from the cache. Chrome and Edge have exposed it since version 117 and Safari since 26.4, so all four engines will have it, but its Baseline status has not been updated yet.
Not Baseline yet: Chrome 117, Safari 26.4, Firefox 158
Next step
In your field data, split cached resources from the rest before reading their timings, otherwise your averages mix two very different populations.
BEACON: field data from 10,000 large sites, open in BigQuery
Since late September, Cloudflare has published BEACON: anonymized field measurements from 10,000 of the largest sites on its network, updated daily in BigQuery using the RUM Archive format. Unlike CrUX, it covers WebKit on iOS, provides full distributions and breaks down LCP and INP into their subparts. For slow LCPs, render delay and load delay weigh far more than the image download itself.
Next step
Query the cf-open-web-performance.rumarchive project with the queries documented by the RUM Archive, and always filter on the date: tables are partitioned and BigQuery bills you for the bytes scanned.
A gold mine for spotting trends, not for judging a single site. The sample is limited to large sites behind Cloudflare and says nothing about your own domain.
web-vitals 6.2.3 fixes LCP attribution
The October 5 release of Google's library fixes a negative resourceLoadDuration value in LCP attribution, as well as a memory leak related to INP.
Next step
If your own monitoring reads LCP attribution, upgrade to 6.2.3 and discard any negative values you have already collected.
CMS
WordPress 7.2 rebuilds wp_kses() on the HTML API
The filter that sanitizes HTML saved by users without the unfiltered_html capability is being rebuilt on the HTML API, targeting 7.2 or 7.3. The function signature stays the same, but the output changes: lowercase tags, double-quoted attributes, disallowed script elements removed along with their contents, and text such as <$500 escaped instead of stripped. The wp_kses_force_legacy_parser filter restores the old behavior. WordPress 7.2 ships on December 8, with beta 1 on October 20.
Next step
Starting with beta 1, run the tests of your themes and plugins that compare filtered HTML, and look for contributor content that would change when saved.
Shopify: owner_type becomes mandatory for extension metafields in January 2027
Metafield declarations in Checkout and Customer Account UI extensions must include an owner_type field. It is optional in API version 2026-10 and becomes mandatory in January 2027, when deployments without it will be blocked. Separately, the Global Catalog REST API stops serving traffic on November 2, 2026, in favor of its MCP server.
Next step
Add owner_type to every declaration in shopify.extension.toml, with one declaration per resource type, and migrate any Global Catalog REST API calls before November 2.
Languages and frameworks
Bootstrap 6 goes alpha
The framework many had written off as dead released the first alpha of version 6 on October 8. JavaScript is now ESM only (no more window.bootstrap) and written in TypeScript, Sass moves to @use, and customization relies on CSS variables organized in cascade layers. Responsive classes change shape (.d-md-none becomes .md:d-none) and Offcanvas becomes Drawer, built on <dialog>. Minimum browsers: Chrome and Edge 130, Firefox 132, Safari 18. Version 5 is still supported, with a 5.4 release planned.
Next step
On legacy projects, move to 5.3 first, which drops jQuery without a redesign; read the v6 migration guide, but wait for the stable release before going to production.
Deno joins Cloudflare, Deno Deploy shuts down in six months
The Deno team is joining Cloudflare. The runtime will get one more year of bug fix and security releases, after which development stops; the code stays open source. Deno Deploy will shut down in six months, around April 2027, with migration help to Cloudflare Workers for paying customers. The JSR registry continues.
Next step
List your projects hosted on Deno Deploy and plan their migration now; for new projects, stop picking Deno.
Next.js: security release on October 14
Vercel is shipping an out-of-band update on Wednesday, October 14, fixing three vulnerabilities in upstream dependencies: two critical and one high. Affected versions will be listed with the advisories. Separately, Next.js 16.4, released on October 6, makes Cache Components the recommended model, and it will become the default in Next.js 17.
Next step
Book an update slot on October 14 for your Next.js apps, then try Cache Components on a branch ahead of version 17.
AI and dev tools
REA, a reverse engineering MCP server that also reads websites
REA, an MIT-licensed open source tool, gives AI agents the means to analyze binaries, apps and websites. On a website, it attaches read-only to a Chromium browser you already have open and collects the DOM, network activity, JavaScript bundles, routes and source maps. The project is three months old and moving fast (version 6.4.0 on October 11).
Next step
To try it, launch Chromium with a dedicated profile, since the debugging port exposes the whole session, cookies included; stick to your own sites or those of a client who agrees, and keep in mind that the analyzed data goes to your model provider.
Security
WordPress 7.1.3 fixes seven vulnerabilities
The October 6 release fixes seven vulnerabilities, including a stored XSS on the Comments screen, a SQL injection in the WXR export and unauthenticated access to comments on private posts. Several require a contributor account or higher. Fixes are announced for older branches back to 4.7.
Next step
Update to 7.1.3 and clear your page cache, including cached Imgur embeds; on an older branch, make sure your version actually received the fix, and review who holds a contributor role or higher.
Bricksforge under attack, and a campaign that hides its own admin account
The Bricksforge plugin, up to 3.1.8.9, allows unauthenticated file uploads leading to code execution; it has been actively exploited since October 7, and 3.1.8.10 fixes it. Another campaign exploits stored XSS flaws in Ninja Forms (before 3.15.4) and WPC Product Bundles (before 8.6.7): a single execution in an admin session leaves behind an account hidden by a mu-plugin, a secret login URL and a fake file manager plugin. The campaign write-up lists the indicators to look for.
Next step
Update these plugins, then compare the administrators in the database with those shown in the dashboard, inspect wp-content/mu-plugins and regenerate your salts.
Plesk: ten critical fixes in eight weeks
Between August 5 and September 29, the Plesk core received updates flagged “critical security issue” on ten separate dates. From February to July, there had been only three. The fixes include root code execution through the REST API (CVE-2026-68492, fixed in 18.0.80.8 and 18.0.81.1) and through an imported database name in Site Import (CVE-2026-87898, fixed in 1.12.2). On January 1, 2027, license prices go up: €15.99 per month excluding VAT for Web Admin, €28.99 for Web Pro and €62.99 for Web Host.
Next step
Run plesk version to confirm the server is at least on 18.0.80.9 or 18.0.81.2, update Site Import and Plesk Migrator or uninstall them if unused, and turn on automatic build updates. If you manage a fleet, stop waiting for the monthly maintenance window when a fix is flagged critical.
AI speeds up both the discovery and the exploitation of vulnerabilities, and update cycles have to shrink accordingly. We read the price increase as the cost of that pace; Plesk itself does not make that connection.
Finds
Page Commando
Hakim El Hattab turns any web page into a platform game: every line of text becomes solid ground, physics runs on matter.js and sound on Web Audio. It all renders inside a Shadow DOM reset with all: initial, without breaking the page underneath.
Next step
Play a round, then open page-commando.js: it is a great reading exercise on TreeWalker, Range.getClientRects() and Shadow DOM, all Baseline widely available.