November 2–8, 2026: Next.js 16.4.5, AI SDK 7.0.165, TanStack AI 1.2

The upgrade I'd actually stop a Sunday for is Next.js. 16.4.5 and 15.5.29 shipped on November 3 with the scheduled security release. Around that, Vercel AI SDK started enforcing data-part schemas, Composio stopped retrying writes, and TanStack AI put out 1.1 and 1.2. Every item below links to its release note or announcement. Dates are the publish dates on those pages.

Next.js

The November 2026 security release is out as 16.4.5 (Active LTS) and 15.5.29 (Maintenance LTS). The post lists seven issues: one High, where cached content can leak across root parameters when the same public use cache function is called both directly and from inside unstable_cache, and six Medium covering more cache leaks and poisoning, an HttpOnly cookie showing up on an internal Edge response header, an SVG rejection bypass in image optimization, and a self-hosted compressed-response framing issue. I'm not going to recap the exploit conditions here. The official post has the impact write-ups, affected versions, and the install commands.

The day before, 16.4.4 backported a handful of bug fixes (Turbopack CSS reload, a CSP nonce for the shared-runtime bootstrap, next analyze using route summaries) and said outright that the security patches would land the next day. If you picked up 16.4.4 last week, you still want 16.4.5.

Vercel AI SDK

[email protected] (Nov 2) is the one that can change runtime behavior. processUIMessageStream used to look up dataPartSchemas by the full chunk type (data-weather) instead of the bare part name (weather), so useChat and Chat never validated streamed data parts. They do now, and an invalid part raises a TypeValidationError. I wrote that up with a test against 7.0.159 vs 7.0.160. The same release added steering.queue(), which sends a follow-up message once the current task is done.

The rest of the week was patches through 7.0.165 (Nov 7):

• 7.0.161 handles cross-realm Uint8Array and ArrayBuffer values in generated files, data content, and cloneModelMessages.
• 7.0.162 restores server-defined tool metadata, dynamic status, and title when validating tool-approval continuations, and adds a single telemetry operation for durable WorkflowAgent runs.
• 7.0.163 (Nov 5) is a bigger patch. Groq can transcribe an HTTP(S) audio URL through its native url parameter instead of downloading and re-uploading the file. Telemetry integrations and the ai:telemetry channel now respect recordInputs and recordOutputs, filtering nested content when recording is off. There's also native URL transcription metadata that can leave audio.byteLength and audio.mediaType undefined when the provider fetches the URL itself.
• 7.0.164 was a dependency bump (@ai-sdk/gateway).
• 7.0.165 strips transcription word timings from telemetry when recordOutputs is false, and sanitizes provider request URLs before text-generation results reach telemetry integrations and tracing subscribers, so endpoint credentials don't leak into traces.

If you turned off input/output recording and still saw prompt text or timing data in an exporter, 7.0.163 through 7.0.165 are the patches to pick up.

Composio

@composio/core 0.28.0 (Nov 3) stops automatically retrying POST and PATCH requests, including tool execution and trigger creation, after a lost response or a retryable status. Other requests still retry. On the raw client from getClient(), a write retries only when that call sets maxRetries. The same release also changes that raw client through @composio/client 2.0.1: resource classes and request() are gone, and .js subpaths no longer resolve.

When I counted the requests against a local 503 mock, high-level tools.execute was already a single POST in 0.27.0. The retry change showed up on triggers.create and on raw getClient() writes (3 attempts down to 1; passing maxRetries: 2 restored the three).

TanStack

@tanstack/ai 1.1.0 (Nov 4) adds optional cancel options without breaking existing calls. embed() and getVideoJobStatus() take abortSignal and timeout. A cancel now stops the provider request, not only the caller, including summarize(), subagent children, and video status polls. Usage is reported for billed calls that later fail, and client tools still run when a custom AG-UI server ends a run with finishReason: 'tool_calls' and closes the stream. The next day, @tanstack/openai-base 1.0.2 switched the adapters to call the provider HTTP API with fetch and only load small SDK modules at runtime (error classes, for example). With a bundler that splits chunks, the startup bundle is smaller; a single-file bundle can be a little larger, because a few rare options still load the full SDK on first use.

@tanstack/ai 1.2.0 (Nov 5) is smaller. withSandbox now emits a sandbox.starting custom event before it creates or resumes a sandbox, then sandbox.created or sandbox.resumed, so a client can show a pending state while the sandbox boots. New exports include CUSTOM_EVENT.SANDBOX_STARTING and typed event members on KnownCustomEvent.

Two more packages landed around that: @tanstack/ai-effect 0.1.0 (Nov 6) runs TanStack AI activities as Effects or Streams and lets you write server tools as Effects, and @tanstack/ai-gemini 1.2.0 adds Gemini Omni 1.2 Flash (gemini-omni-1.2-flash) as an Interactions video model. Clips are 3 to 15 seconds (default 10). generation_config.video_config.task: 'extend' appends 3 to 10 seconds per turn, up to 30 seconds total. gemini-omni-1.1-flash stays until 2026-12-03, then Google routes it to 1.2.

TanStack Query moved from 5.105.2 to 5.107.1. The React-relevant core fixes I'd note: 5.105.2 keeps every waiter of an in-flight query on the replacement fetch when invalidation cancels it, and drops status from the filters on isMutating (those APIs always count pending mutations). 5.105.3 stops a cancelled retry from pausing the query when its delay expires, and treats a query as static only when it has data, so a static query without data can refetch after reset, invalidation, or an explicit refetch. 5.107.0 keeps the timestamp stable for the same selector error, which prevents an infinite render loop. Devtools in 5.106.0 can search nested property names and values in the Data Explorer and virtualizes long query and mutation lists. The November 6 release also adds a filter-scope toggle (query key, query data, or both). Several of the 5.107 notes are Vue-only (state narrowing, enabled(query)).

TanStack DB's release candidate picked up three patches, through 1.0.0-rc.1.4 (Nov 6). rc.1.2 keeps adapter-owned live queries alive when only .limit() or .offset() changes. rc.1.4 restores nested-row query performance by keeping source payloads opaque during metadata cleanup. If you're already on the RC, these are the kinds of live-query correctness fixes you want before 1.0.

What didn't move

React is still 19.3.1. TypeScript stable is still 7.0.2; 7.1 is in beta, and the iteration plan currently lists the RC for November 10. Convex stayed on 1.49.0. No new TanStack blog posts this week.

What I'd do this week

Upgrade Next.js to 16.4.5 or 15.5.29 first. If you stream custom data parts through AI SDK useChat, read the 7.0.160 note (or the post) before you bump. The Composio 0.28 write-retry change and the AI SDK telemetry filters are worth a look if you already depend on the old behavior. Everything else can wait for a quiet hour.

What did I miss from this week that you're actually using?