Introducing Public Beta for Shaders ✨ The wait is over 🎉 Try it now for @vuejs.org , @react.dev , @svelte.dev & @solidjs.com

We found that the fix to address the DoS vulnerability in React Server Components (CVE-2025-55184) was incomplete and does not prevent an attack in a specific case. This is disclosed as CVE-2025-67779. New patches are available now, please update immediately.

Researchers have found two new vulnerabilities in React Server Components while attempting to exploit the patches last week. These are new issues, separate from the critical CVE last week. The patch for React2Shell remains effective for the Remote Code Execution exploit.

There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it. A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately. react.dev/blog/2025/12...

Critical Security Vulnerability in React Server Components – React

The library for web and native user interfaces

react.dev

For anyone that missed it, the React Server Components critical vulnerability has a name and website now Please refer to this before sharing any supposed POCs react2shell.com

Hoisting state is so often the answer, but many devs avoid it because they want co-location. Underrated solution: Export a hook alongside the component. Import and use the hook in a parent, pass the returned state down. Now parent owns the state and can interact with it, but logic is co-located.

I finally found and fixed the unhandled promise rejection errors we've had in React Query for some time. If you are using prefetchQuery() without awaiting in Server Components, you'll want to upgrade to 5.90.3 to get rid of those pesky "An error occurred in the Server Components render" errors.

On my way to Amsterdam, looking forward to meeting so many friends, old and new!

👋 We're building a new type of word processor at Marker, and we're hiring for React/ProseMirror engineers and full-stack AI engineers to join the team in London. Are you an engineer who cares about writing? Or do you know someone who does? See: writewithmarker.com/jobs More details below 👇

*Very* cool use of typed attr() for grid placement! 😀 dev.to/madsstoumann...

Guitar Chords in CSS

In my previous article, I looked into the new, improved attr() method in CSS. I was over the moon...

dev.to

Today we're sharing that View Transitions and Activity are ready to try in the experimental channel, along with docs and updates on other areas we're actively working on: react.dev/blog/2025/04...

React Labs: View Transitions, Activity, and more – React

The library for web and native user interfaces

react.dev

React 19.1 has just been released! Check out the latest updates here: github.com/facebook/rea...

Release 19.1.0 (March 28, 2025) · facebook/react

Owner Stack An Owner Stack is a string representing the components that are directly responsible for rendering a particular component. By combining Owner Stacks with Component Stacks, you can bette...

github.com

For the uninitiated, AsyncLocalStorage is a Node API (nodejs.org/api/async_co...) that's been adopted by other server runtimes. But we really need it in the browser too, and that's where github.com/tc39/proposa... comes in. Really hoping it moves forward, it will be huge

GitHub - tc39/proposal-async-context: Async Context for JavaScript

Async Context for JavaScript. Contribute to tc39/proposal-async-context development by creating an account on GitHub.

github.com

Writing docs today. I really enjoy doing so, but I have to constantly struggle against my nature of writing exhaustive long form wall of texts to make them actually useful. I need to get better at drawing charts and creating visual representations..

If you have two useQuery with different staleTime, would you expect isStale returned from that useQuery to: * Change individually as each staleTime passes? * Change together when shortest staleTime has passed? * Have access to both of the above as separate isGloballyStale/isLocallyStale?

📢 After more than 11 years of working at Adverity in various positions, I’ve decided to look for new challenges in 2025. 🚀 I'm excited to share that starting in January, I'll be joining the Frontend Platform Team at @sentry.io.

Building Next.js locally to test the latest React canary reminded me my Mac actually does have fans. Feels good to give it some exercise every once in a while.

Oh wow, rollup-plugin-preserve-directives is almost at 30k weekly downloads, it's probably time to make a stable release.. 🙄 I should probably add a pipeline and tests too, especially with all the new directives flying around, I just wish days had more hours.

Here's what's up! * Caring for kids, dog and house * Migrating a dashboard to app router and React Query.. * ..debugging some app router RQ bugs 😬 * Attempting general solution for making authenticated requests during suspense SSR - PoC working * Building a homebrewing fermentation temp controller

This account has been sleeping for a while, but seems like a good time to fire it up!