Hi everyone, Seb and Jan here 👋!
It’s a heavy security week, with patches from React and Next.js. Not React-related, but there's also a very bad “php2shell” vulnerability that has just been disclosed. Upgrade now!
On mobile, React Native 0.88 is out, switching to the web event model with no breaking changes. Expo SDK 58 ships with tons of features, ready for iOS 27 and iPhone Duo.
Outside React, TypeScript makes the headlines. v7.1 is in beta, with a new API to build devtools upon. A Rust port of the type checker is now backed by Cloudflare/VoidZero, and already faster than the official Go version.
Let's dive in!
💡 Subscribe to the official newsletter to receive an email every week!
💸 Sponsor
On-device AI for React & React Native
NobodyWho is a library for running LLMs locally & offline on any OS. GPU-accelerated via Vulkan or Metal.
- Any LLM: Gemma, Qwen, Mistral and more in .gguf format
- Type-safe tool calling: automatically generates structured grammars from your function signatures
- Multimodal input: provide image and audio information to your LLM
- Text-to-speech: synthesize local WAV audio with Kokoro, Pocket TTS and Supertonic backends
- Speech-to-text: transcribe audio into text with Whisper
- Voice Activity Detection: know when to stop listening and start transcribing with Silero
Available for React Native, Expo, but also for Flutter, Swift, Kotlin, Python, Godot and in React very soon thanks WebAssembly.
Star the repo if NobodyWho is useful to you, it is how people find us ❤️
⚛️ React
- 💸 build mode - What nobody tells you about writing agent skills
- 🔐 React vulnerability - Unauthenticated Remote Code Execution in React Server Components - Patched in React 19.3.1 and the 19.0.9, 19.1.10 and 19.2.9 backports, together with a Server Functions DoS. In Next.js, the RCE affects
"use cache"functions returning multiple typed arrays. Upgrade to 16.4.1 or 15.5.28, which also fixes a critical RCE in sharp via SVG images. - 📅 React Foundation Meetup - Nov 11, London - We recently mentioned a React Foundation contributor summit, invite-only. But there’s also the first official React Foundation public meetup happening the same week at Meta King’s Cross.
- 👀 Next.js PR -
<Link prefetch="navigation">- Adds a way to prefetch past the recently-introducedawait navigation()boundaries for links users are likely to click. - 👀 React docs - React DevTools for agents - The experimental
react-devtools-cdt-mcppackage is now documented, with a live sandbox. Registers 12 additional React-specific tools with the Chrome DevTools MCP. - 📜 Improving navigation experience in v0 with Next.js 16.4 - The
next-partial-prefetching-optimizerskill helps your agent refactor until aninstant()test proves the UI is ready before the click. - 📜 Building a filterable menu that works for everyone - Adding an input to a menu is easy, making it accessible isn’t. Base UI explains its ARIA choices (dialog, not combobox), keyboard and submenu UX.
- 📜 Pure UI in the Agentic Era - Practical advice for reviewing agent-written UI: make components pure, pass state as explicit inputs, render every combination as a grid.
- 📦 React Router 8.5 - Deprecated view transition APIs, unstable API-only mode - Now recommends React 19.3’s
<ViewTransition>, wrapped around an<Outlet>. The new API-only mode serves prerendered HTML from a CDN, while loaders and actions run on a server that can live on another origin. - 📦 React Three Fiber 10.0 alpha 6 - WebGPU renderer by default, better React 19 support - The upcoming major now works with
<Activity>and<ViewTransition>. StrictMode and Fast Refresh no longer rebuild the Canvas. - 📦 Hydrogen 2026-10 - Shopify Hydrogen is now a library, not a framework. Bring Shopify commerce to your existing Next.js or React Router app, with skills for coding agents. Built-in WebMCP support.
- 📦 shadcn/ui - AI Elements, Trace and Code Block - 21 copy-paste patterns for agent UIs. They replace Vercel’s AI SDK Elements, which will be deprecated.
- 📦 Vinext 1.2 → 1.3 - 69% fewer JS requests per page, 5x faster cold starts, cache key collision fixes
- 📦 Mutative 2.0 - Faster updates, safer patches - Same API, 3.6x faster than Immer on their benchmarks, for a bigger bundle (7.9 vs 3.6 kB).
- 📦 Immer 11.2 -
isModified()helper - 📦 React Window 2.4 - Server rendering improvements
- 📦 Astryx RichText - Lexical-based rich text field with lossless Markdown
- 📦 React Bits 2.0 - 215 animated React components, rebuilt design tools
- 📦 c15t v3 - One consent engine for 8 frameworks, banner in the server HTML
- 📦 React Trees Playground - Paste React code, see its parent and owner trees
💸 Sponsor
Make Forms a Scalable Part of Your React App
Product teams need to launch new forms and update existing ones. Developers shouldn't have to edit fields, labels, and validation rules for every change. SurveyJS provides a JSON-driven form library and an embeddable drag-and-drop form builder for your React application.
Customize SurveyJS components to match your UI with custom themes or ready-to-use theme adapters for Bootstrap, shadcn/ui, and Material UI.
• Works with any backend and database
• Fits your existing design system
• Keeps developers in control of architecture and data
Developers control the UI and data. Business users update forms visually without waiting for every change to be coded. 🚀
📱 React-Native
The new release is out with one of the largest runtime changes in years! Events are now dispatched through the W3C EventTarget API by default. This is the same model as on the web, making it possible to share event handling code between web and native. This opens the path to web-compatible imperative APIs in the future. And yet, it’s a third release with no user-facing breaking changes, after 0.83 and 0.86.
Other key highlights include:
-
SceneDelegate on iOS - support for the
UIScenelifecycle required by the iOS 27 SDK, added additively. -
Variable fonts -
fontVariationSettingsonTextandTextInput, on Android and iOS, in object or CSS string form. - ArrayBuffer for Java TurboModules - binary data no longer needs base64 or number-array encoding, and synchronous calls can borrow JavaScript memory instead of copying it.
-
Swift Package Manager improvements - still experimental, but iOS versions now come from the app's deployment target, and Xcode builds no longer break for libraries shipping their own
Package.swift. 0.89 targets SwiftPM as the default.
A React Native release is not enough! Expo SDK 58 is out with React Native 0.88, built for iOS 27 and ready for iPhone Duo on day one, and it comes with a long list of improvements of its own. Too many to list them all, so here are the highlights:
- Expo Modules 2.0 (beta) - plain Swift and Kotlin classes with annotations, with sync calls 2.5-5.6x faster than the DSL on iOS and faster than TurboModules in all twelve Android microbenchmarks.
-
Faster builds and faster modules - prebuilt
expo-modules-coreAndroid libraries cut a clean four-ABI debug build from about 80 seconds to about 39, and iOS calls passing long strings are up to 3.8x faster. -
App Intents (alpha) -
expo-app-intentsexposes your app to Siri, Shortcuts, Spotlight, and Apple Intelligence. -
Expo UI and Android home screen widgets - lists recycle rows now, iOS gains NavigationStack and Toolbar, and
expo-widgetsruns on Android with its own Hermes runtime. -
A CLI built for agents - the experimental
@expo/agent-cliwraps Expo CLI, EAS CLI, andexpo-doctor. - Expo Router - data loaders, SSR and middleware are now stable, alongside native tabs and a reworked navigation core.
And a few more: an experimental Rust transformer for roughly 2x faster cold bundling, SwiftPM groundwork for Expo apps, and Expo Observe gaining control over automatic error recording.
- 💸 DeployPulse - Hosted OTA updates for React Native. A drop-in replacement for CodePush and EAS Update.
- 💬 RFC - API removal strategy in React Native - Removed APIs like
InteractionManagerthrow on access. This proposes alternatives so that library authors can more easily use feature detection to keep supporting older React Native versions. - 📣 React Native Edge to Edge is now deprecated - RN 0.86+ ships the fixes natively: set
edgeToEdgeEnabled=trueingradle.propertiesinstead. - 📜 Icons and iOS 27 updates in React Navigation 8 - Native tabs now accept custom SF Symbols and VectorDrawables. With Nano Icons, you can use SVG icons in native tabs without hurting performance. Also includes filled Material Symbols and the iOS 27 prominent tab.
- 📜 OpenIAP adds support for Amazon -
react-native-iapandexpo-iapcan now sell on Fire OS and Vega OS with the same APIs. - 📜 Relaunching TeamReach: how OTA updates saved a 5,000,000-user cutover
- 📜 Multi-Window React Native Apps With the Meta VR Layout SDK
- 📜 Control App Test Conditions With Appduct for AI QA Agents
- 💸 Maestro MCP - Let your coding agent write, run and debug your UI tests
- 📦 expo-device-hub - Your simulators and emulators in a browser tab - Also fixes the Expo CLI
ishortcut, broken by Xcode 27 after the removal ofSimulator.app. - 📦 FastImage 10.0 - New Architecture rewrite,
objectFitreplacesresizeMode,objectPositionadded - The original library is actively maintained again. - 📦 Screens 4.30 - iPhone Duo support, opaque headers fixed on iOS 26+,
prominentScreenKeyfor Tabs - 📦 Gesture Handler 3.4 - iOS SPM support,
immediatePressOutprop - 📦 Bottom Sheet 0.17 - Scroll handoff with nested scrollables, percentage detents
- 📦 Uniwind 1.13 - CSS cascade order on native
- 📦 Nitro Fetch 1.9 - iOS WebSockets on
Network.framework(~30% faster), built-in SSL pinning, Android perf fixes - 📦 RN GPUI - Render React Native components natively with GPUI, Zed's Rust UI framework (macOS only)
- 📦 Better PDF 1.1 - Several files as one document, base64 sources, cheaper long documents
- 📦 Babel Plugin RN Direct Imports - Rewrite react-native barrel imports into direct module imports, so your bundle only includes the APIs you use
- 📦 Skia WebGPU Video 0.1 Beta - Video playback, composition and export for React Native Skia 3 and WebGPU
- 📦 Xcode 27.1 - Swift 6.4, iOS 27.1 SDKs, iPhone Duo support
🔀 Other
- 📣 Experimental soft navigation metrics now available in CrUX - Exciting news for SPA / client-side routing frameworks! Core Web Vitals takes into account soft navigations, measuring the full navigation session instead of only the initial page load, and the Chrome User Experience Report dataset now exposes these metrics as experimental. Use the CrUX Vis tool and check the “Include soft navigations” toggle to see the score impact on any site. The React site’s score is improving because subsequent navigations are faster than the initial page load.
- 🔐 PHP - Critical remote code execution vulnerabilities - These 2 “php2shell” RCEs look really bad: no login needed, affecting PHP since 5.4. Yes, that includes your WordPress and Laravel sites. Upgrade now!
- 📜 The Future of CSS - Josh Comeau’s top 10 picks for Interop 2027, nicely presented with browser support and interactive demos.
- 📜 JPEG XL vs AVIF for web use-cases - JPEG XL recently landed in all browsers. AVIF remains better for lossy compression, but JPEG XL wins for lossless compression and recompressing existing JPEGs.
- 📦 TypeScript 7.1 beta - New TypeScript API, Import Attributes in Ambient Modules, stable
es2026lib/target, performance improvements - The real highlight is the new TypeScript API, unlocking ecosystem tools such as TypeScript-ESLint to integrate with TypeScript 7. Content Mappers are a game changer for improving the type safety of external files such as MDX, Astro, CSS Modules, Vue, and more. - 📦 tsrs - Rust port of the TypeScript 7 type checker and LSP - There have been a lot of TypeScript ports to Rust recently. The most promising one is already much faster than tsgo. It’s now supported by Cloudflare/VoidZero, incubating under the Oxc toolchain umbrella. Not a fork: they are actively collaborating with the TypeScript team and plan to keep it aligned with the reference implementation. The backstory is also interesting, and shows the port will also speed up Oxlint type-aware linting.
- 📦 Node.js 24.22 LTS -
util.throttle()andutil.debounce(), crypto improvements - 📦 Rsdoctor 2.0 - Now Rspack-only, Agent CLI, 57% faster analysis, 56% smaller install, multi-compiler reports
- 📦 Webpack 5.112 - SSR asset manifest, source map scopes, multi-entry library exports, async
DefinePluginvalues - 📦 Astro 7.4 - Build timings, separate build/runtime image services, parallel prerendering (experimental)
🤭 Fun
See ya! 👋
