​🌐 Read Online ​

Hi everyone, Seb and Jan here 👋!

It’s a heavy security week, with patches from React and Next.js. Not React-related, but there's also a very bad “php2shell” vulnerability that has just been disclosed. Upgrade now!

On mobile, React Native 0.88 is out, switching to the web event model with no breaking changes. Expo SDK 58 ships with tons of features, ready for iOS 27 and iPhone Duo.

Outside React, TypeScript makes the headlines. v7.1 is in beta, with a new API to build devtools upon. A Rust port of the type checker is now backed by Cloudflare/VoidZero, and already faster than the official Go version.

Let's dive in!

💸 Sponsor

​On-device AI for React & React Native​

NobodyWho is a library for running LLMs locally & offline on any OS. GPU-accelerated via Vulkan or Metal.

• Any LLM: Gemma, Qwen, Mistral and more in .gguf format
• Type-safe tool calling: automatically generates structured grammars from your function signatures
• Multimodal input: provide image and audio information to your LLM
• Text-to-speech: synthesize local WAV audio with Kokoro, Pocket TTS and Supertonic backends
• Speech-to-text: transcribe audio into text with Whisper
• Voice Activity Detection: know when to stop listening and start transcribing with Silero

Available for React Native, Expo, but also for Flutter, Swift, Kotlin, Python, Godot and in React very soon thanks WebAssembly.

Star therepo if NobodyWho is useful to you, it is how people find us ❤️

⚛️ React

• 💸 build mode - What nobody tells you about writing agent skills​
• 🔐 React vulnerability - Unauthenticated Remote Code Execution in React Server Components - Patched in React 19.3.1 and the 19.0.9, 19.1.10 and 19.2.9 backports, together with a Server Functions DoS. In Next.js, the RCE affects "use cache" functions returning multiple typed arrays. Upgrade to 16.4.1 or 15.5.28, which also fixes a critical RCE in sharp via SVG images.
• 📅 React Foundation Meetup - Nov 11, London - We recently mentioned a React Foundation contributor summit, invite-only. But there’s also the first official React Foundation public meetup happening the same week at Meta King’s Cross.
• 👀 Next.js PR - - Adds a way to prefetch past the recently-introduced await navigation() boundaries for links users are likely to click.
• 👀 React docs - React DevTools for agents - The experimental react-devtools-cdt-mcp package is now documented, with a live sandbox. Registers 12 additional React-specific tools with the Chrome DevTools MCP.
• 📜 Improving navigation experience in v0 with Next.js 16.4 - The next-partial-prefetching-optimizer skill helps your agent refactor until an instant() test proves the UI is ready before the click.
• 📜 Building a filterable menu that works for everyone - Adding an input to a menu is easy, making it accessible isn’t. Base UI explains its ARIA choices (dialog, not combobox), keyboard and submenu UX.
• 📜 Pure UI in the Agentic Era - Practical advice for reviewing agent-written UI: make components pure, pass state as explicit inputs, render every combination as a grid.
• 📦 React Router 8.5 - Deprecated view transition APIs, unstable API-only mode - Now recommends React 19.3’s , wrapped around an . The new API-only mode serves prerendered HTML from a CDN, while loaders and actions run on a server that can live on another origin.
• 📦 React Three Fiber 10.0 alpha 6 - WebGPU renderer by default, better React 19 support - The upcoming major now works with and . StrictMode and Fast Refresh no longer rebuild the Canvas.
• 📦 Hydrogen 2026-10 - Shopify Hydrogen is now a library, not a framework. Bring Shopify commerce to your existing Next.js or React Router app, with skills for coding agents. Built-in WebMCP support.
• 📦 shadcn/ui - AI Elements, Trace and Code Block - 21 copy-paste patterns for agent UIs. They replace Vercel’s AI SDK Elements, which will be deprecated.
• 📦 Vinext 1.2 → 1.3 - 69% fewer JS requests per page, 5x faster cold starts, cache key collision fixes​
• 📦 Mutative 2.0 - Faster updates, safer patches - Same API, 3.6x faster than Immer on their benchmarks, for a bigger bundle (7.9 vs 3.6 kB).
• 📦 Immer 11.2 - isModified() helper​
• 📦 React Window 2.4 - Server rendering improvements​
• 📦 Astryx RichText - Lexical-based rich text field with lossless Markdown​
• 📦 React Bits 2.0 - 215 animated React components, rebuilt design tools​
• 📦 c15t v3 - One consent engine for 8 frameworks, banner in the server HTML​
• 📦 React Trees Playground - Paste React code, see its parent and owner trees​

💸 Sponsor

​Make Forms a Scalable Part of Your React App​

Product teams need to launch new forms and update existing ones. Developers shouldn't have to edit fields, labels, and validation rules for every change. SurveyJSprovides a JSON-driven form library and an embeddable drag-and-drop form builder for your React application.

Customize SurveyJS components to match your UI with custom themes or ready-to-use theme adapters for Bootstrap, shadcn/ui, and Material UI.

• Works with any backend and database
• Fits your existing design system
• Keeps developers in control of architecture and data

Developers control the UI and data. Business users update forms visually without waiting for every change to be coded. 🚀

📱 React Native

​React Native 0.88​

The new release is out with one of the largest runtime changes in years! Events are now dispatched through the W3C EventTarget API by default. This is the same model as on the web, making it possible to share event handling code between web and native. This opens the path to web-compatible imperative APIs in the future. And yet, it’s a third release with no user-facing breaking changes, after 0.83 and 0.86.

Other key highlights include:

• SceneDelegate on iOS - support for the UIScene lifecycle required by the iOS 27 SDK, added additively.
• Variable fonts - fontVariationSettings on Text and TextInput, on Android and iOS, in object or CSS string form.
• ArrayBuffer for Java TurboModules - binary data no longer needs base64 or number-array encoding, and synchronous calls can borrow JavaScript memory instead of copying it.
• Swift Package Manager improvements - still experimental, but iOS versions now come from the app's deployment target, and Xcode builds no longer break for libraries shipping their own Package.swift. 0.89 targets SwiftPM as the default.

​Expo SDK 58​

A React Native release is not enough! Expo SDK 58 is out with React Native 0.88, built for iOS 27 and ready for iPhone Duo on day one, and it comes with a long list of improvements of its own. Too many to list them all, so here are the highlights:

• Expo Modules 2.0 (beta) - plain Swift and Kotlin classes with annotations, with sync calls 2.5-5.6x faster than the DSL on iOS and faster than TurboModules in all twelve Android microbenchmarks.
• Faster builds and faster modules - prebuilt expo-modules-core Android libraries cut a clean four-ABI debug build from about 80 seconds to about 39, and iOS calls passing long strings are up to 3.8x faster.
• ​App Intents(alpha) - expo-app-intents exposes your app to Siri, Shortcuts, Spotlight, and Apple Intelligence.
• Expo UI and Android home screen widgets - lists recycle rows now, iOS gains NavigationStack and Toolbar, and expo-widgets runs on Android with its own Hermes runtime.
• A CLI built for agents - the experimental @expo/agent-cli wraps Expo CLI, EAS CLI, and expo-doctor.
• Expo Router - data loaders, SSR and middleware are now stable, alongside native tabs and a reworked navigation core.

And a few more: an experimental Rust transformer for roughly 2x faster cold bundling, SwiftPM groundwork for Expo apps, and Expo Observe gaining control over automatic error recording.

• 💸 DeployPulse - Hosted OTA updates for React Native. A drop-in replacement for CodePush and EAS Update.​
• 💬 RFC - API removal strategy in React Native - Removed APIs like InteractionManager throw on access. This proposes alternatives so that library authors can more easily use feature detection to keep supporting older React Native versions.
• 📣 React Native Edge to Edge is now deprecated - RN 0.86+ ships the fixes natively: set edgeToEdgeEnabled=true in gradle.properties instead.
• 📜 Icons and iOS 27 updates in React Navigation 8 - Native tabs now accept custom SF Symbols and VectorDrawables. With Nano Icons, you can use SVG icons in native tabs without hurting performance. Also includes filled Material Symbols and the iOS 27 prominent tab.
• 📜 OpenIAP adds support for Amazon - react-native-iap and expo-iap can now sell on Fire OS and Vega OS with the same APIs.
• 📜 Relaunching TeamReach: how OTA updates saved a 5,000,000-user cutover​
• 📜 Multi-Window React Native Apps With the Meta VR Layout SDK​
• 📜 Control App Test Conditions With Appduct for AI QA Agents​
• 💸 Maestro MCP - Let your coding agent write, run and debug your UI tests​
• 📦 expo-device-hub - Your simulators and emulators in a browser tab - Also fixes the Expo CLI i shortcut, broken by Xcode 27 after the removal of Simulator.app.
• 📦 FastImage 10.0 - New Architecture rewrite, objectFit replaces resizeMode, objectPosition added - The original library is actively maintained again.
• 📦 Screens 4.30 - iPhone Duo support, opaque headers fixed on iOS 26+, prominentScreenKey for Tabs​
• 📦 Gesture Handler 3.4 - iOS SPM support, immediatePressOut prop​
• 📦 Bottom Sheet 0.17 - Scroll handoff with nested scrollables, percentage detents​
• 📦 Uniwind 1.13 - CSS cascade order on native​
• 📦 Nitro Fetch 1.9 - iOS WebSockets on Network.framework (~30% faster), built-in SSL pinning, Android perf fixes​
• 📦 RN GPUI - Render React Native components natively with GPUI, Zed's Rust UI framework (macOS only)​
• 📦 Better PDF 1.1 - Several files as one document, base64 sources, cheaper long documents​
• 📦 Babel Plugin RN Direct Imports - Rewrite react-native barrel imports into direct module imports, so your bundle only includes the APIs you use​
• 📦 Skia WebGPU Video 0.1 Beta - Video playback, composition and export for React Native Skia 3 and WebGPU​
• 📦 Xcode 27.1 - Swift 6.4, iOS 27.1 SDKs, iPhone Duo support​

🔀 Other

• 📣 Experimental soft navigation metrics now available in CrUX - Exciting news for SPA / client-side routing frameworks! Core Web Vitals takes into account soft navigations, measuring the full navigation session instead of only the initial page load, and the Chrome User Experience Report dataset now exposes these metrics as experimental. Use the CrUX Vis tool and check the “Include soft navigations” toggle to see the score impact on any site. The React site’s score is improving because subsequent navigations are faster than the initial page load.
• 🔐 PHP - Critical remote code execution vulnerabilities - These 2 “php2shell” RCEs look really bad: no login needed, affecting PHP since 5.4. Yes, that includes your WordPress and Laravel sites. Upgrade now!
• 📜 The Future of CSS - Josh Comeau’s top 10 picks for Interop 2027, nicely presented with browser support and interactive demos.
• 📜 JPEG XL vs AVIF for web use-cases - JPEG XL recently landed in all browsers. AVIF remains better for lossy compression, but JPEG XL wins for lossless compression and recompressing existing JPEGs.
• 📦 TypeScript 7.1 beta - New TypeScript API, Import Attributes in Ambient Modules, stable es2026 lib/target, performance improvements - The real highlight is the new TypeScript API, unlocking ecosystem tools such as TypeScript-ESLint to integrate with TypeScript 7. Content Mappers are a game changer for improving the type safety of external files such as MDX, Astro, CSS Modules, Vue, and more.
• 📦 tsrs - Rust port of the TypeScript 7 type checker and LSP - There have been a lot of TypeScript ports to Rust recently. The most promising one is already much faster than tsgo. It’s now supported by Cloudflare/VoidZero, incubating under the Oxc toolchain umbrella. Not a fork: they are actively collaborating with the TypeScript team and plan to keep it aligned with the reference implementation. The backstory is also interesting, and shows the port will also speed up Oxlint type-aware linting.
• 📦 Node.js 24.22 LTS - util.throttle() and util.debounce(), crypto improvements​
• 📦 Rsdoctor 2.0 - Now Rspack-only, Agent CLI, 57% faster analysis, 56% smaller install, multi-compiler reports​
• 📦 Webpack 5.112 - SSR asset manifest, source map scopes, multi-entry library exports, async DefinePlugin values​
• 📦 Astro 7.4 - Build timings, separate build/runtime image services, parallel prerendering (experimental)​

🤭 Fun

See ya! 👋