📨 #266: DoS, shadcn, Skills, Rspack, React Aria, TanStack, Remotion, ChartGPU | Expo 55 beta, Hermes, Expo Router, Widgets, CSS, AI, Bootsplash, Detox | TC39, Rolldown, Yarn, Nodde, Mermaid, Unplugin

Hi everyone!

This week, the community continued to publish React-related Agent skills. React RSCs and Next.js are hit by another set of DoS vulnerabilities, and it’s recommended to upgrade immediately.

The React Native side is more exciting, with Expo SDK 55 in beta and upcoming support for new CSS features. We now have 2 distinct libraries implementing home screen widgets, and need to understand the trade-offs of each approach.

As always, thanks for supporting us on your favorite platform:

• 🦋 Bluesky
• ✖️ X / Twitter
• 👔 LinkedIn
• 👽 Reddit

Ne manque pas le prochain email !

My favorite resource for keeping up with the React community!

Evan BaconEngineering Manager - Expo

💸 Sponsor

Automate your React Localization with Crowdin Stack

Stop treating i18n as a deployment bottleneck🛑 Crowdin automates your React localization workflow. Sync content to Crowdin, translate with AI and human proofreaders, and auto-sync the translations back to your git.

• Repo Integration: Connect directly to GitHub/GitLab repo. Localization becomes a simple, continuous part of your CI/CD pipeline.
• Context Harvester: Our open-source CLI uses Agentic AI to scan your JSX. It automatically provides translators with the exact UI context for every string.
• Over-The-Air (OTA) Updates: Fix a typo in real-time. With OTA SDK, you can push updates to your React Native app instantly. No rebuilds or App Store reviews required.⚡

Focus on your components. Crowdin handles the translation. 🚀

⚛️ React

• 💸 Make React apps fast where it actually matters. Learn how to diagnose real bottlenecks and fix slow, janky React apps using modern React 19 patterns.
• 🔐 React CVE-2026-23864 - More Denial-of-Service vulnerabilities have been found in the React RSC-related packages, and have already patched in all React 19 minor versions. All RSC frameworks can be affected. It’s recommended to update immediately.
• 🔐 Next.js DoS CVEs - In addition to the CVE above, Next.js also published fixes for 2 medium-severity DoS vulnerabilities affecting the Image Optimizer and PPR in self-hosted deployments.
• 👀 React PR - Init Claude config - It seems like the React core team is planning to leverage AI more.
• 👀 React-DOM Types PR - Properly type form-related events - Narrowing the type of event.target to its underlying element, for example, HTMLInputElement.
• 👀 React Aria PR - Add render prop to allow customizing DOM element - React Aria chose the render prop pattern (following Ariakia and Base UI) and not the asChild pattern popularized by Radix UI.
• 👀 TanStack PR - New @tanstack/meta package - New package coming for composable SEO / meta tags management.
• 🗓 React Summit - 🇳🇱 Amsterdam - 12 & 16 Jun. The world's biggest React conference is back! Knowledge you'll use, people you'll remember, and an after-party you won't forget. Reserve your spot to with promo code TWIR (-10%)
• 📜 The Incredible Overcomplexity of the Shadcn Radio Button - A fair criticism, questioning the need for abstraction layers and repurposing HTML elements, instead of just styling <input type="radio">.
• 📜 Single Flight Mutations in TanStack Start - Explains how to mutate the data and refresh the UI in a single network round trip. The first article shows the big picture with a simple implementation, while the second makes it more robust and scalable using middleware.
• 📜 StyleX - New Year, New Website - The modern CSS-in-JS library gives an overview of 2025, covering project adoption outside Meta, new APIs, and easier integration. They rebuilt the docs with Waku to dogfood the project and its compatibility with RSCs.
• 📜 Designing Glean for accessibility – design system and compliance - Positive feedback after migrating their design system to Base UI.
• 📜 Open-sourcing our microfrontend React bridge - A simple alternative to the Module Federation bridge to help you manage microfrontends using distinct React versions.
• 💸 Product for Engineers - How startups lose their edge
• 📦 Rspack 2.0.0-alpha.1 - Built-in support for React Server Components - RSC support also comes with a higher-level RSC plugin for Rsbuild.
• 📦 ChartGPU - Beautiful, open source, TypeScript WebGPU-based charting library, with React bindings - This new library should be fast for large datasets. However, we are still waiting for Firefox to support WebGPU.
• 📦 ESLint Plugin React Unhookify - Now that we have the React Compiler, this plugin contains rules to remove useless memoizations and suggests a compiler adoption strategy.
• 📦 Conform 1.16 - New configureForms future API
• 📦 shadcn/ui Changelog - January 2026 - Inline Start and End Styles for Base UI components
• 📦 React Router 7.13 - Add crossOrigin prop to Links component
• 📦 Storybook 10.2 - New Viewports and Zoom UI, MDX support for Storybook MCP
• 📦 Next-SEO 7.1 - New HowToJsonLd component for tutorials SEO
• 🤖 Next.js Skills - Newly published Vercel Agent skills for common Next.js workflows - Skills for the App Router, Cache Components, performance, and more.
• 🤖 The Missing Next.js AGENTS.md File - Relatedly, Vercel has found that AGENTS.md outperforms Skills in evals for general framework knowledge.
• 🤖 React Email Agent Skills
• 🤖 AI Code Elements - Vercel components to build the next generation of IDEs
• 🎥 Jonny Burger - Creating videos just from prompting - Claude Code and Remotion - Vibe coding videos with Remotion is trending lately. A trend also supported by motion designer trolls posting their hand-made videos as if it only required a single prompt. Here’s a demo from its author. See also this feedback on X from someone who rendered a real product launch video.
• 🎥 Delba - Next.js Patterns: Public pages with personalization - Greatly explains the usefulness of Cache Components to keep navigation fast. By the way, Delba uses Remotion.
• 🎥 Shruti Kapoor - React Performance Optimizations: How to Fix a Slow App

Ne manque pas le prochain email !

If every newsletter was as informative, the world would be a better place!

Mike GrabowskiCTO and founder - Callstack

💸 Sponsor

Build better React Native & Expo apps with Radon

Stop context switching between your code editor and native IDEs. Radon helps you write cleaner code, catch errors instantly, and focus on what matters most — building great apps.

Why developers are choosing Radon:

• 🦾 Built-in previews: Radon runs iOS Simulator and Android emulator directly in your VS Code or Cursor project.
• 🔍 Element Inspector: You can jump directly from preview to a file where your React Native component is defined. It can't really get simpler than that.
• ⏯️ Instant Replays (PRO): Missed a bug during a manual test? Rewatch the last 30 seconds of device interaction.
• 🤖 Radon AI (PRO): your coding assistant with the latest React Native knowledge.

Discover all the features & turn your code editor into a React Native IDE you'll actually enjoy using.

📱 React-Native

Expo SDK 55 Beta

It's been longer than usual since the last SDK, so this new SDK 55 looks like a significant update. The stable version will be released in about two weeks; until then, you can already check the beta release notes with a long list of highlights:

• React 19.2, unlocking <Activity>, useEffectEvent()
• React Native 0.83.1, unlocking DOM Node APIs, new DevTools features, Intersection Observers (experimental)
• New Architecture only, Legacy Architecture removed
• Revamped project template, using native Tabs by default
• Hermes v1 opt-in flag, for performance improvements (but slower native build times)
• Hermes bytecode diffing opt-in flag, for ~75% smaller incremental OTA updates
• AI tooling, MCP server, Agent skills
• Expo Router 7 beta with more native features (preview tweet) and web SSR (alpha)
• Expo brownfield integration to existing native apps
• Expo UI improvements, support for Jetpack Compose coming
• Expo Widgets alpha for iOS home screen widgets and Live Activities
• … and more

• 💸 10 Real-World React App Examples to Inspire Your Next Project
• 🐦 Synchronous TextInput validation in React Native and Expo UI
• 🐦 CSS calc() support coming to React Native?
• 📜 Bringing CSS Clipping to React Native - A great deep-dive article that explores what it would take to support masking with CSS clip-path() natively on iOS and Android, covering the whole rendering stack. What a great way to announce upcoming support, with PRs being under review!
• 📜 Expo EAS - Compiler cache for builds and Workflows - Set an env variable to get 30% faster builds.
• 📦 Voltra 1.1 - Android widget support, iOS Enhancements
• 📦 Bootsplash 7.0 - Edge-to-edge by default, improved Expo plugin
• 📦 create-react-native-library 0.57 - Improved templates, more example app types
• 📦 Nitro MLX 0.3 - Tool calling
• 📦 Detox 20.47 - Support for RN 0.83 and iOS 26, new by.type() API for semantic matching
• 📦 Expo AI Chatbot 2.0 - Incognito mode, long-term memory, upgrades to Expo 54 and AI SDK 5
• 🤖 Vercel React Native Skills - Agent Skills extracted from lessons of building v0 for iOS, and the upcoming Vercel app
• 🎥 Software Mansion - First Look at Expo Widgets: iOS Widgets Without Native Code
• 🎥 Software Mansion - Introducing Expo Brownfield Target – Automate Brownfield Setup in Your Expo App
• 🎙️ RNR 351 - Transforming Packages to Nitro with Marc Rousavy
• 🎙️ RocketShip 90 - Expo SDK 55, AI Agent Skills, Tiny Harvest Revenue & Industrial Revolution of Software

🔀 Other

• 🦋 TC39 - Proposals progressing after the 112th meeting - Upsert, import sync, Error options, and more.
• 📜 Anchor Interpolated Morph - A FLIP-inspired animation technique using modern CSS.
• 📦 Rolldown 1.0 RC - The next-gen high-performance Rust bundler now has a stable API. It should become the default bundler of Vite 8.
• 📦 Remix Component 0.3 - Updated Component API, no stateless component, new setup prop - Interesting to see how the Remix component model evolves and differs from React.
• 📦 Better All - Better Promise.all with automatic dependency optimization - A clever way to minimize async waterfalls and maximize parallelization.
• 📦 Yarn 6 Preview - Complete rewrite in Rust, strict compatibility, Yarn Switch, Lazy Installs - Benchmarks show the Rust rewritten version is now faster than pnpm.
• 📦 Node.js 25.5 - Simplifies building Single Executable Applications (SEA) - See also this deep-dive blog post from the PR author.
• 📦 Rstest 0.8 - Browser Mode (experimental)
• 📦 Mermaid Rust Renderer - Much faster than the official Mermaid CLI, no headless browser overhead
• 📦 Unplugin 3.0 - Unified bundler plugin system - Add Bun plugin support, drop Node 18 and CJS build

🤭 Fun

See ya! 👋