Aller au contenu principal

📨 #227: Next.js, tRPC, React Query, React Router, StyledComponents, MUI, Base UI, Next Intl | React Native birthday, Lynx, EAS, Atlas, Reanimated, Audio, BottomTabs | CSS, Rsdoctor, Linters, Node

· 9 minutes de lecture
Sébastien Lorber
Sébastien Lorber
Editeur - Mainteneur de Docusaurus
🇫🇷 Non traduit :/
Malheureusement, cette page n'a pas encore été traduite en français. Reviens un peu plus tard!

Hi everyone!

This week, you probably didn't miss the Next.js middleware drama, but that wasn't the only thing going on!

We also got many great releases such as tRPC, React Query, Rsdoctor and more!

Also, React Native is 10 years old today! 🥳

As always, thanks for supporting us on your favorite platform:

Ne manque pas le prochain email !

    💸 Sponsor​

    Convex: The Database Designed for AI Coding

    Convex: The Database Designed for AI Coding

    In the age of code generation, you need a backend that you can confidently generate with AI platforms. Convex is by far and away best in class in this respect.

    This is because Convex is just TypeScript, allowing you to write queries as code that are automatically transactional, cached, and realtime.

    And that’s just the beginning. With Convex, you can:

    • Easily schedule functions and write cron jobs
    • Set up file storage
    • Write efficient server functions
    • And so much more…

    Try a Quickstart today

    ⚛️ React​

    Postmortem on Next.js Middleware bypass

    Postmortem on Next.js Middleware bypass

    A few days ago, Vercel announced a critical 9.1 vulnerability in Next.js middleware system. With a simple but malicious x-middleware-subrequest header, you can bypass the middleware, possibly exposing sensitive information. Patches are available for Next.js 12/13/14/15. Note that this vulnerability only affects self-hosted apps using output: ‘standalone’ and next start are affected. Customers of major serverless cloud providers are either not affected (Vercel, Netlify), or protection can be turned on (Cloudflare).

    It's worth noting that even though Next.js middleware shouldn’t have this vulnerability, it is not the recommended place to manage user sessions and protect routes, and shouldn’t be the only line of defense in your Next.js app. The middleware is more designed to perform lightweight optimistic checks, eventually rewriting/redirecting without hitting any DB.

    This security event has caused a lot of drama in the ecosystem, which I'd rather not comment on much. Vercel could have handled the situation better, and they plan to do better in the future. I’ll let you make your own opinion based on various resources, and there’s too many, so this is just a subset:

    Ne manque pas le prochain email !

      💸 Sponsor​

      Meet @clerk/agent-toolkit

      Meet @clerk/agent-toolkit

      Clerk's new experimental package for using Clerk in your AI agent workflows. Manage users, orgs, and more with Vercel AI SDK + LangChain support. Try it now: npm install @clerk/agent-toolkit

      📱 React-Native​

      React Native turns 10

      React Native turns 10! 🎉🤯

      Believe it or not, React Native was open-sourced exactly 10 years ago, and React Native is celebrating its first decade today!

      A huge shoutout to everyone who made it happen! Let’s take the opportunity to listen again to this podcast episode with Christopher Chedeau (Vjeux, co-creator of React Native) where he explains the backstory of React Native, and how this great project could easily have died without ambitious people willing to bet on it.

      Also a shoutout to the amazing React Native community—tight-knit, always pushing forward, tackling challenges, and building the future of native declarative UI together 🚀

      To the next promising decade! 🥂

      🔀 Other​

      🤭 Fun​

      This week we have 2 videos, you need to click 😂

      alt

      alt

      See ya! 👋


      Ne manque pas le prochain email !