This Week In React

• ⚛️ Stay up-to-date with React
• 📡 High signal, no drama
• 🔥 Join 42k React devs - 1 email/week
• 📨 By @sebastienlorber

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

👀 React Compiler in Rust - Exciting update from @rickyfm

TLDR:
- Rust compiler ➡️ 99.9% the same output as the original
- Confident ➡️ merge the PR within the next weeks
- Can be tested locally

The Oxc team is already working on an integration (draft PR)

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 283

⚛️
- TanStack Query / Router / Virtual
- RSC + composition
- Perf: GitHub & Linear
- Liquid DOM
- Apollo
- i18n
📱
- Expo SDK 56
- Reanimated
- Worklets
- NativeScript
- Strict DOM
- Standard Nav

🍿 Read: https://t.co/1TB0sNT7Uz

✍️ @jaworek3211 & I

[This Week In React @ThisWeekInReact]

Major milestone for the npm ecosystem

All widely used package managers will soon block postinstall scripts by default!

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

❤️ npm + Supply chain security => improving now! 🤩

📦 npm v11.16
- Phase 1 - PR merged
- package.allowScripts = []
- Warns on unapproved postinstall script

📦 npm v12.0
- Phase 2 - Upcoming PR 👀
- Blocks unapproved postinstall scripts by default 🚀

[This Week In React @ThisWeekInReact]

Another newsletter about security 😅

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 282
⚛️
- Security
- Fate
- TanStack
- Redux
- Base UI
- Relay
- Storybook
- Jotai
📱
- Hermes-node
- Expo
- Rozenite
- Harness
- VR
- Nitro
- Skia
- Redraw

🍿 Read: https://t.co/c3tRQu1hY3

✍️ @jaworek3211 & I

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

💡 Use "using" for Vitest/Jest mocks/spys

It's really nice to simplify

You don't need manual mockReset / global afterEach

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

Erratum: you'd rather EXPLICITLY disable caching in sensitive workflows using setup-node

[This Week In React @ThisWeekInReact]

Security is making headlines this week 😅

But we also have a lot of exciting releases!

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 281
⚛️
- Next.js CVE
- TanStack Router compromise
- Security
- Redact
- React Router
- Waku
- HTML Parser
📱
- Redraw
- Expo 56 beta
- Tabs
- Screens
- Pressable
- Activity
- Strict DOM
- Rock
- SWC
- AI

🍿 Read: https://t.co/Cb7ryURprE

✍️ @jaworek3211 & I

[This Week In React @ThisWeekInReact]

These orgs have been compromised because of pull_request_target:

- TanStack
- PostHog
- Nx
- LiteLLM

Any many more...

As safe as you think it is, it's not and hackers are searching for repos using that workflow, easy target!

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

TL;DR for open-source maintainers

🚫 NEVER use "pull_request_target" workflows

🚫 NEVER use shared caches in your publish pipeline

Combining these 2 in particular is extremely dangerous

I've repeated this countless times over the years, but another reminder is always useful

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

TL;DR for open-source maintainers

🚫 NEVER use "pull_request_target" workflows

🚫 NEVER use shared caches in your publish pipeline

Combining these 2 in particular is extremely dangerous

I've repeated this countless times over the years, but another reminder is always useful

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 280

⚛️
- TanStack
- Remotion
- React Router
- Remix
- Trees
- Pracht
- shadcn
📱
- Expo Go
- Ease
- Screen Transitions
- LegendList
- JSI
- Gradle
- Radon
- AI
- DevTools

🍿 Read/subscribe: https://t.co/GNM7vBbiY4

✍️ @jaworek3211 & I

[This Week In React @ThisWeekInReact]

Email sent!

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 280

⚛️
- TanStack
- Remotion
- React Router
- Remix
- Trees
- Pracht
- shadcn
📱
- Expo Go
- Ease
- Screen Transitions
- LegendList
- JSI
- Gradle
- Radon
- AI
- DevTools

🍿 Read/subscribe: https://t.co/GNM7vBbiY4

✍️ @jaworek3211 & I

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

Node.js 26 🎉

🔥 Temporal ➡️ modern date/time API
⚡️ Undici 8 ➡️ better/faster HTTP client
🔓 V8 14.6 ➡️ Unlocks Map.getOrInsert() & Iterator.concat

[Remotion @Remotion]

HTML-in-canvas is now a first-class primitive in Remotion!

It enables new types of effects that were impossible before.

[This Week In React @ThisWeekInReact]

Calm week for the React ecosystem, but still a few interesting releases

Thanks to @swmansion for handling this issue!

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 279:
⚛️
- React Compiler
- TSRX
- StyleX
- TanStack
- XState
- shadcn
- Hook Form
- Inertia
📱
- Swift Package Manager
- JSI
- SimCam
- Enriched Markdown
- MLX
- Jail Monkey

🍿 Read/subscribe: https://t.co/hYQISjypMX

✍️ @kacperkapusciak @Konrad_Armatys

[This Week In React @ThisWeekInReact]

Check your inbox! 😋

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 278
⚛️
- React Email
- TSRX
- ESLint plugin
- Rspack RSC
- TanStack Store
- TanStack Blog
- Hook Form
📱
- Vision Camera
- Expo
- Nano Icons
- ExecuTorch
- Argent
- Audio API
- RNSec
- CSS

🍿 Read/subscribe: https://t.co/rbPMzse0e4

✍️ @piaskowyk @f_solecki

[This Week In React @ThisWeekInReact]

Lots of interesting releases this week!

For both React and RN

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 277 - Exciting week 🤩

⚛️
- TanStack RSC
- React2Dos
- Next.js
- MUI
- BaseUI
- StyledComp
- React Aria
- Storm
- Unhead
📱
- Pulsar
- Nitro Fetch
- Agent React Devtools
- Pretext
- Metro
- Voltra

🍿 Read/subscribe: https://t.co/ii6QnQnEQv
✍️ @jaworek3211

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

New React CVE just dropped 😆

DOS vulnerability in Server Functions

Patched versions already out:
- 19.0.5
- 19.1.6
- 19.2.5

[This Week In React @ThisWeekInReact]

We are always happy to receive a positive newsletter feedback!

Please send us more and tell us what you think!

Also tell us what we could do better, we are here to serve you.

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

I rarely get any replies to my newsletter emails

Once in a while, I get one that really makes me happy 😊

If you like something, please be loud about it!
Authors will appreciate it more than you think

[This Week In React @ThisWeekInReact]

Email sent ✅

New React Native release

And many little React / RN library updates

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 276

⚛️
- Boneyard
- Ink
- MUI
- React Router
- Next.js
- shadcn
- Docusaurus
- Comark
- Forms
- Shaders
📱
- RN 0.85
- ViewTransition
- Skia
- Windows
- CRNL
- Maestro
- Nitro Player
- RNGH

🍿 Read/subscribe: https://t.co/hpQOC2obX2

✍️ @jaworek3211 & I

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

This Week In React 276

⚛️
- Boneyard
- Ink
- MUI
- React Router
- Next.js
- shadcn
- Docusaurus
- Comark
- Forms
- Shaders
📱
- RN 0.85
- ViewTransition
- Skia
- Windows
- CRNL
- Maestro
- Nitro Player
- RNGH

🍿 Read/subscribe: https://t.co/hpQOC2obX2

✍️ @jaworek3211 & I