Who an update will hit. Netflix's tool, TypeScript 7.1, Node 24.22 and 22 holes in curl

Ten days of October brought a pile of updates: Node.js 24.22, Bun 1.4.4, Deno 2.9.8, the TypeScript 7.1 beta, curl closed 22 vulnerabilities, and Cloudflare started a port of TypeScript to Rust. In the same period Netflix described a tool that shows, before a library is released, who calls it. For a business owner running their own system the question is simple: which of this to install today, which in a month, and which to leave alone. The answer depends on who the update will hit.

What came out

On October 23, Netflix described Quasar, a tool for measuring the blast radius of library changes. The author of a shared Java library sees the diff of their API but doesn't see which of the many repositories still call the method being removed, and on which version. Quasar indexes symbol definitions and references across all repositories, and when a pull request is checked it counts who references the removed or changed symbols. I liked the honesty in the description: “no references found” only means there are none in the indexed part, and reflection and dynamic loading can hide a consumer. The tool shows the risk and doesn't block the release.

On October 20, TypeScript released the 7.1 beta. It adds import attributes in ambient module declarations: you can write declare module "*" with { type: "css" } and get an error if the attribute is missing from an import. The same day Cloudflare presented tsrs, a port of TypeScript to Rust, together with VoidZero and Max Schwenk of Owner.com. By their measurements tsrs is up to 8 times faster and uses about 70% less memory than TypeScript 7.0 with the same number of workers, and the 7.1 beta itself is up to 2.5 times faster than 7.0. The status is experimental, and they don't call it a fork.

On October 14, Node.js released 24.22.0 LTS. Among the notable items: crypto.parsePKCS12(), a common MAC API, util.throttle and util.debounce, StatementSync.close() in sqlite, and passing net.BoundSocket to threads and child processes. Among the fixes I would single out Hmac.digest(), which could return uninitialized memory.

On October 22, Bun released 1.4.4 with 39 contributors; the GitHub release page has only the install commands and a link to the blog, so I haven't gone through what changed. On October 21, Deno released 2.9.8: deno compile now checks read permission for dynamically imported local files, Deno removed the compromised eMudhra certificate authorities from the trusted list and bumped rand 0.9.x to a fixed version.

On October 14, Ubuntu published a breakdown of the fixes for CVE-2026-92392 and other curl vulnerabilities. Daniel Stenberg had warned on October 7 about a release with 22 vulnerabilities, and on October 14 they were disclosed as planned. One is rated high: CVE-2026-92392, CVSS 8.1 by the Ubuntu security team, with possible remote code execution when connecting to a malicious server. It affects only Ubuntu 26.04 LTS; the rest are closed for all supported releases in USN-8927-1 and USN-8932-1. Both the curl utility and the libcurl library are affected, meaning everything built with it. To check packages they suggest the command apt list '?installed ?source-package(^curl$)'.

Blast radius on a single server

At a service company, the website, the API, the telephony and the document parsers live on one server. A Node update touches the API and the website; an update of the system curl touches everything that downloads files from a link through libcurl, from scripts to system utilities. Netflix's question “who calls this symbol” sounds simpler here: which containers are built from this image, and which scripts depend on this library.

How it works for me

The kononov.dev website runs on Next.js, Node.js 24, SQLite and Docker, so the 24.22 branch affects me directly. “Coffee Together” is written in React and TypeScript and runs in the Cloudflare Workers runtime on the same server with 2 GB of memory. During an update the old instance stops before the new one starts, and if a build runs out of memory, I build the image off the server. That is how I limit the radius: the image is built and checked separately, and only a finished one lands on the server.

At the PDR company in the US, security questions come to me, and when a major vulnerability shows up in the world I check whether it concerns us. The servers there are on Debian in Google Cloud, not Ubuntu, but curl is on every system. I brought the company's internal API to its third version, and several applications depend on it: AppSheet, the super app, the website, the TV board. Before changing the API I look at who calls it, by the same method as Netflix, only without the index: a list of applications and a search through the code. I don't put the TypeScript 7.1 beta or tsrs into a release, and what's inside them I judge from the descriptions.

What I would do

Make a list of what is on the server and what it is built from: the Node and Python versions and the system packages in the base images.

Update curl and the other system packages today. For Debian and Ubuntu that is apt; for Docker images, a rebuild of the base layer.

Put Node 24.22 into the image, run the checks and release with a rollback ready.

Before changing your own API, find all the consumers and record them next to the version. Remove the old method after the list is empty.

On background processes, which also restart during an update, there is an article on workers. On the internal API there is a page about a custom API, on the TypeScript service the “Coffee Together” case. My order for installing patches is in the review on the Node.js, Python and Next.js patch week, versions of other people's APIs in the review on shutdown dates, the local release pipeline here. I covered releasing a Docker application with a version rollback earlier. Service area: infrastructure you can release and recover. If you have a backlog of updates and no idea where to start, tell me what is on the server. Discuss your task.