TMiR 2025-12: Year in review, React2Shell (RCE, DOS, SCE, oh my)

Transcript and URLs 𐄁 Creators & Guests Mark Erikson - Host Carl Vitullo - Producer ★ Support this podcast ★ Reply on Bluesky (00:00) - 2026-09: React 19.3; a eulogy to software engineering? (01:08) - New Releases (01:09) - Redux has a unified docs site now (03:39) - React-Redux `useSignalSelector` hook alphas (04:13) - Vite+ 1.0 (06:10) - Vitest 5 (06:30) - Vinext 1.0 (07:01) - Lovable OJ vite-mostly-compatible dev server (07:37) - Preact 11 (08:23) - MSW 3 (09:28) - React Router 8.4 (09:47) - Remix 3 RC (10:43) - Shopify bought Tailwind (11:01) - Jotai 3 (11:59) - Poimandres Glyph typography engine (13:05) - Vidact (14:14) - Tanner Linsley’s Redact (15:19) - TMiR has a new website! (16:31) - Sponsored by Cloudways Velocity (17:32) - Main content (17:34) - React 19.3 is out! (17:45) - View Transition support (18:43) - Fragment Refs (19:43) - `use(browser())` API (21:30) - Oops bundle is bigger (22:37) - bundlejs.org (23:52) - React Devtools 8.0 (25:25) - "React Now Rusted All The Way Out" (26:10) - React concurrent store prototyping??? (27:23) - A eulogy for the software engineer | Dave Kiss (30:42) - We are all product engineers now | Laurie Voss (41:25) - "Do Frameworks Matter Anymore?" | Brooks Lybrand (41:50) - "How do you care when nobody else does?" | François Best (42:23) - “What motivates you to build software for others anymore?” | Sebastien Lorber (46:04) - AI Contribution Policies (56:05) - Lightning rounds (56:07) - Nobody pays for open source. We can force them to. | Laurie Voss (59:19) - Agent hacking swarms (59:48) - Schema Benchmarks 7 month update (01:00:37) - State of Devs 2026 (01:02:50) - some quick misc thoughts about why MCP is so much better than CLIs | Rhys Sullivan (01:05:43) - The Grand Unifying Architecture of Frontend | Ryan Carniato (01:06:52) - Simon Willison: 2026 in LLMs So Far (01:07:35) - Shopify switching from React Native to native apps (01:08:07) - Discord migrated to RN New Architecture (01:08:31) - Conferences (React, Javascript) (01:08:34) - React India, Oct 30 (01:08:43) - React Summit NY, Nov 17 (01:08:49) - React Day Berlin, Dec 4

Transcript and URLs 𐄁 Creators & Guests Mark Erikson - Host Carl Vitullo - Producer ★ Support this podcast ★ Reply on Bluesky (00:00) - tmir-2026-08 (00:55) - New releases (01:02) - Waku 1.0 (RC) (03:01) - Preact 11.0.0-rc.1 (03:56) - Mobx 7.0 (04:32) - Next 16.3 (06:55) - React Native 0.87 (07:47) - TanStack Table 9 (09:25) - TC39 “Composites” proposal (~ replaces Records and Tuples) (10:44) - Solid 2.0 RC (13:39) - Bun 1.4 (17:18) - Github stacked PRs in public preview (21:38) - Main Content (21:42) - React core-ish (21:49) - New ReactDOM `use(browser())` API (22:47) - React Foundation website updated (23:18) - Big Next.js AMA in /r/reactjs (23:49) - React Compiler support in OXC (25:21) - Biome and Bun 1.4 have initial support as well (25:45) - The asteroid currently hitting frontend web development (32:36) - Scott Tolinski’s “True Cost of AI Coding” survey and video (37:51) - Josh Goldberg stepped back from OSS work (40:53) - Software Stewardship Lab announced (Daniel Roe et al) (42:11) - Humanity in OSS (46:47) - Cursor switched from Solid to React (47:46) - Lovable moved off Next to TanStack Start (49:00) - Ryan Carniato’s async Solid articles (49:33) - Slew of Github competitors: Tangled, Cloudflare Artifacts, Netlify Source, Cursor Origin (55:55) - Git at Any Scale (57:14) - Lightning round (57:16) - npm.report (57:51) - Supplier Security Questionnaire, Andrew Nesbitt (58:58) - Everything I own, owned, Chaz Schlarp (01:02:33) - The sorry state of Skill distribution (01:03:46) - Conferences (01:03:48) - ZurichJS Sep 11 (01:04:47) - React Alicante Sep 23-24 (01:05:09) - Outro

Transcript and links 𐄁 Creators & Guests Mark Erikson - Host Carl Vitullo - Producer ★ Support this podcast ★ Reply on Bluesky (00:00) - This Month in React July 2026 (01:27) - New releases (01:29) - Vite+ Beta (02:41) - TypeScript 7.0 released (03:56) - Open PR for “content mappers” to typecheck templates other than JSX (04:57) - Johnson Chu made a compatibility layer to drop-in for unsupported tools (05:18) - OXC type-aware linting stable (06:00) - NPM v12 and new security defaults (07:00) - Dependabot supports a configurable delay (07:37) - More React RSC security tweaks for 19.x (08:06) - Main Content (08:07) - React org updates (08:22) - “Leadership Council” and Working Group structure on the new team page (11:11) - Stub governance docs for the Leadership Council (14:37) - Rick Hanlon update on the React team using a “stage” process internally (15:39) - Pete Hunt and Nick Schrock join Vercel to run Frameworks/Next and Agent DX (17:16) - Poimandres published a charter (20:20) - For instance, WebGL text rendering (21:30) - React-alikes (21:40) - Octane from Dominic Gannaway (28:27) - Ryan Carniato: "React’s staying power is because of complacency" (29:12) - “Do people think FE innovation is dead? (30:31) - Parallel articles on Solid 2.0 with async, and Remix 3 (32:22) - "no benchmark […] has captured the relationship between reactivity and rendering" (35:04) - ReactBench to measure AI code quality from Aidan Bai (36:37) - Alex Russell thinks everyone is screwing up state management (47:41) - Aurora Scharff rewrote the Suspense docs page to cover how it works (48:22) - And a post on RSC performance patterns (48:41) - TanStack removed RSCs from the website (51:04) - Mark is experimenting with perf improvements for RTK v3 (57:36) - Making referential stability a type (59:17) - Porffor native compiler upcoming alpha (59:39) - Perry cross-compiles Claude Code bundle (01:00:17) - Marker (01:02:04) - Goodbye, forever, probably. (01:08:41) - Conferences (01:08:53) - Sep 11: ZurichJS, Switzerland (01:09:14) - Sep 25-26: React Alicante, Spain

Transcript and URLs ★ Support this podcast ★ Reply on Bluesky (00:00) - This Month in React: June News Roundup (00:11) - Intros (02:24) - [React Router 8](https://remix.run/blog/react-router-v8) (05:29) - [Babel 8](https://babeljs.io/blog/2026/06/16/8.0.0/) (07:05) - [Astro 7](https://astro.build/blog/astro-7/) (09:03) - [TS 7.0 RC](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0-rc/) (09:31) - ESM only, no programmatic API right now (10:31) - [Nub JS](https://nubjs.com/), from Zod creator (14:03) - [Legend List 3.0 with DOM support](https://x.com/jmeistrich/status/2059922504320225316) (14:34) - [TSRX revamped the syntax](https://tsrx.dev/blog/rethinking-tsrx) (16:18) - React Core news (16:22) - [React Compiler in Rust is rolling out](https://bsky.app/profile/sebastienlorber.com/post/3moibsmtqjk2x) (16:47) - [PR was merged after testing at Meta and improved](https://github.com/react/react/pull/36173#issuecomment-4608356402) (17:24) - [Oxlint, SWC, RSPack, Next all integrating](https://bsky.app/profile/sebastienlorber.com/post/3moibsmtqjk2x%20) (17:40) - [Rolldown tried integrating directly but removed due to binary size increase](https://x.com/evanyou/status/2069593612153987373) (18:08) - [Bun tried optimizing the Rust Compiler code](https://gist.github.com/Jarred-Sumner/84df369c35216f40d61d1ea9f95771c2) (18:47) - Other core improvements (19:07) - [Fragment Refs have been documented](https://react.dev/reference/react/Fragment#fragmentinstance) in canary (21:31) - React DevTools MCP tools, including [component tree](https://github.com/react/react/pull/36597) and [perf analysis](https://github.com/react/react/pull/36598) APIs (22:18) - React Foundation progress (22:29) - There’s a(n early) [react.foundation](https://react.foundation/) website, advertising funding for maintainers and community groups (25:30) - They’re gonna have a booth at [Chain React at the end of July](https://chainreactconf.com/) (26:01) - [Why is Meta destroying its engineering organization?](https://newsletter.pragmaticengineer.com/p/why-is-meta-destroying-its-engineering) (32:36) - [AI demands more engineering discipline. Not less](https://charitydotwtf.substack.com/p/ai-demands-more-engineering-discipline) (40:41) - Christoph Nakazawa posted his [“Modern Engineering Values” and how he uses AI](https://cpojer.net/posts/modern-engineering-values) (42:31) - [Cloudflare bought VoidZero](https://voidzero.dev/posts/voidzero-cloudflare) (43:34) - NPM / security updates (43:38) - [Github Actions allows enforcing pinned action SHAs](https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/) (44:11) - [GitHub Actions Has a Package Manager, and It Might Be the Worst](https://nesbitt.io/2025/12/06/github-actions-package-manager.html) (45:17) - [NPM 12 will disable install scripts and Git deps by default](https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/) (46:15) - Code optimization still matters! (46:43) - [TanStack Table cut memory in v9 by 90% on large lists by optimizing JS objects](https://tanstack.com/blog/tanstack-table-v9-memory-performance) and [optimized TS perf](https://tanstack.com/blog/tanstack-table-v9-typescript-performance) (47:15) - [Pierre Diffs was significantly optimized](https://pierre.computer/writing/on-rendering-diffs) - has to handle virtualization, syntax highlighting, source loading (48:27) - [CompileCat is a new optimizing compiler to improve JS execution after bundling](https://github.com/isaac-mason/compilecat), similar to Closure Compiler. ([the RSPack team says they’re working on something similar](https://x.com/jiahan_c/status/2065630866668453898) ) (51:12) - [Mark’s React-Redux /+ signals draft perf PR](https://github.com/reduxjs/react-redux/pull/2318) and [updated React-Redux benchmarks repo](https://github.com/reduxjs/react-redux-benchmarks) (52:41) - [Aurora Scharff’s preferred RSC component architecture](https://aurorascharff.no/posts/component-architecture-for-react-server-components/) (53:24) - [Lovable projects now use TanStack Start by default](https://lovable.dev/blog/building-apps-using-tanstack-start)

Transcript and URLs ★ Support this podcast ★ Reply on Bluesky (00:00) - Interview (00:55) - Some podcast meta (01:49) - New Releases (01:51) - [TS v7 beta](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0-beta/) (05:15) - [Rolldown 1.0](https://voidzero.dev/posts/announcing-rolldown-1-0) (06:51) - [Fate 1.0](https://fate.technology/posts/fate-1.0) (09:48) - Main Content (09:56) - React Core (10:09) - React team status after Meta layoffs? (14:59) - [React Compiler port to Rust still in progress](https://x.com/poteto/status/2056865079543681329), latest [PR](https://github.com/facebook/react/pull/36173) (15:54) - [Tanner Linsley is "projecting" React](https://tannerlinsley.com/posts/projecting-react) (it's definitely not a fork) (21:38) - [Tests are the new moat](https://saewitz.com/tests-are-the-new-moat) (23:32) - [Brooks Lybrand thoughts on React + community after React Miami](https://brookslybrand.com/posts/react-miami-2026.html) (25:04) - [TanStack is exploring how to expose Server Components](https://tanstack.com/blog/react-server-components) (27:19) - [Who Owns the Tree](https://tanstack.com/blog/who-owns-the-tree) (27:31) - [RSCs in TanStack](https://frontendmasters.com/blog/react-server-components-in-tanstack/) (28:12) - [Remix v3 beta preview](https://remix.run/blog/remix-3-beta-preview) (28:35) - Both Remix and TanStack are exploring "what if no React"? (36:11) - [TSRX](https://tsrx.dev/), a variant on JSX (41:52) - Security! Everything is compromised (42:04) - [TanStack Router compromised](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem), and [Socket analysis](https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack) (46:58) - [TanStack followup with followup hardening](https://tanstack.com/blog/incident-followup) (47:10) - [Nx monorepo tool compromised](https://nx.dev/blog/nx-console-v18-95-0-postmortem) as a result (52:02) - React2Shell recaps from [Lachlan Davidson](https://lachlan.nz/blog/the-react2shell-story/) and [Sylvie](https://sylvie.fyi/posts/react2shell/) (52:25) - [Next 16.2.5 and more React CVEs](https://github.com/vercel/next.js/releases/tag/v16.2.5) (53:19) - [NPM adds “staged packages”](https://docs.npmjs.com/staged-publishing) and [E18E adds guidance](https://e18e.dev/docs/publishing.html#staged-packages) (54:50) - [PNPM 11 defaults to min release age](https://socket.dev/blog/pnpm-11-adds-new-supply-chain-protection-defaults), NPM 12 will [block by default](https://github.com/npm/rfcs/pull/868) (57:59) - [Review your GH Actions, people!](https://github.com/e18e/ecosystem-issues/issues/266) (59:13) - Mark posted his big AI blog posts. [Part 1: Fears and Journey](https://blog.isquaredsoftware.com/2026/05/ai-thoughts-part-1-fears-opinions-journey/) (01:08:39) - Outro

Transcript ★ Support this podcast ★ Reply on Bluesky (00:00) - This Month in React April (00:26) - Introductions (02:36) - What convinced you AI code tools were worth using? (04:24) - Using early ChatGPT for DB migrations (06:59) - Watching AI use a command-line (08:16) - Background chat agents (08:58) - Staying very hands-on while using AI tools (11:00) - Driving AI closely without reading its code (17:50) - Mark's workflow; OpenCode with CodeNomad UI, plus IDE+git UI. Opus 4.6 on API (20:39) - Swizec's workflow, latest Cursor on Opus (23:58) - Carl's workflow, mostly ClaudeCode but looking at custom orchestrators (25:23) - Exploring fully autonomous agents (28:08) - Mark's AI debugging work in React core (31:42) - Value of providing more context (33:58) - AI-owned documentation (37:09) - Using good engineering practices still matters? (40:47) - How do you know the right code to make? (42:49) - Good communication still matters (45:13) - What will "review" look like in the future? (46:17) - Automating functionality tests with deployment practices (51:49) - What behaviors belong to the agent, and what fundamentally can't be part of the agent? (56:17) - Impacts of LLMs on software engineering? (01:03:22) - A superpower right now is a domain expert who can kind of code

Transcript and links(00:00) - This Month in React February 2026 (01:46) - New releases (01:50) - [TS 6.0 beta](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0-beta/)/! (last TS impl release; stricter defaults) (02:34) - [Yarn 6 preview](https://yarn6.netlify.app/blog/2026-01-28-yarn-6-preview/) (rewritten in Rust) (02:52) - [Electrobun](https://blackboard.sh/electrobun/docs/) (Tauri alternative) (03:31) - [React Native Gesture Handler v3](https://blog.swmansion.com/introducing-gesture-handler-3-0-hook-based-api-deeper-reanimated-integration-more-9185b0c8e305) (04:20) - [Next polyfills improved WebStreams and upstreaming to Node](https://vercel.com/blog/we-ralph-wiggumed-webstreams-to-make-them-10x-faster) (05:25) - [Webpack 2026 roadmap](https://webpack.js.org/blog/2026-04-02-roadmap-2026/) (05:53) - [Lodash maintenance roadmap](https://socket.dev/blog/inside-lodash-security-reset) (07:07) - [Gatsby React 19 support](https://www.gatsbyjs.com/docs/reference/release-notes/v5.16/) , [styled-components RSC support](https://styled-components.com/releases#[email protected]) (07:54) - [npmx.dev](https://npmx.dev/) (alternate NPM site UI) (08:43) - [eslint-plugin-react-render-types](https://github.com/HorusGoul/eslint-plugin-react-render-types) (typed children) (09:54) - Main Content (09:55) - React Core updates: (09:56) - [React Foundation officially launched](https://react.dev/blog/2026/02/24/the-react-foundation) (12:28) - Docs updates: [/`useActionState/`](https://github.com/reactjs/react.dev/pull/8284) (merged), [/`use/`](https://github.com/reactjs/react.dev/pull/8305) and [RSC sandboxes](https://github.com/reactjs/react.dev/pull/8300) (wip) (14:23) - [React Native 0.84 released](https://reactnative.dev/blog/2026/02/11/react-native-0.84) (17:47) - [Hermes WASM support](https://x.com/tmikov/status/2023821160241393839) , [Hermes Node compat CLI](https://x.com/tmikov/status/2024609186936660170) (18:43) - “State of…” survey results (18:43) - [State of JS 2025 results](https://2025.stateofjs.com/en-US) (19:06) - [State of React 2025 results](https://2025.stateofreact.com/en-US) (19:51) - [Aurora Scharff’s conclusion](https://2025.stateofreact.com/en-US/conclusion/) (20:44) - [Josh Comeau’s takes on the results](https://bsky.app/profile/joshwcomeau.com/post/3mf642css6227) (21:28) - [API pain points](https://2025.stateofreact.com/en-US/features/#main_apis_pain_points) (21:53) - [State of React Native 2025](https://results.2025.stateofreactnative.com/en-US/) (24:29) - [How we rebuilt Next.js with AI in one week](https://blog.cloudflare.com/vinext/) (29:52) - CloudFlare v Vercel beef (35:42) - Carl Vitullo monologs about AI Agents (42:27) - AI productivity and impacts on our attention (44:42) - ["wrote a spec, pointed Claude at an Asana board, and went home"](https://x.com/rvivek/status/2026385957596111044) (47:26) - [Bits AI SRE | Datadog](https://www.datadoghq.com/product/ai/bits-ai-sre/) (51:04) - [ThoughtWorks opines on AI productivity impacts](https://simonwillison.net/2026/Feb/14/thoughtworks/) (01:00:28) - ⚡ Lightning round ⚡ (01:00:37) - [“Wall Street Raider” game modernization](https://www.wallstreetraider.com/story.html) (and uses Preact) (01:01:16) - [Github Stacked Diffs preview](https://x.com/jaredpalmer/status/2019817235163074881) , [faster Issues search](https://github.blog/changelog/2026-01-29-improved-search-for-github-issues-in-public-preview/) (01:02:08) - [Josh Comeau: Sprite animations](https://www.joshwcomeau.com/animation/sprites/) (01:02:26) - [Interop 2026](https://wpt.fyi/interop-2026), ([WebKit](https://webkit.org/blog/17818/announcing-interop-2026/), [Igalia](https://www.igalia.com/news/interop-2026.html)) (01:03:38) - Conferences ([React](https://react.dev/community/conferences), [Javascript](https://confs.tech/javascript)) Reply on Bluesky ★ Support this podcast ★

Full transcript and links ★ Support this podcast ★

Full transcript at ReactifluxMain ContentReact2Shell vulnerabilityInitial announcementFollowup denial-of-service CVE and source code exposure CVEVercel bulletinCloudflareCloudflare report on exploit attemptsCloudflare outage on December 5, 2025Tech analysis: “Flight Protocol”Vuln is carefully crafted Promise deserialization + `new Function` evalPRs: Initial fixes, Promise cycles / function toString, more Promise cyclesGuillermo’s breakdownShruti’s breakdownComms critique“React is rainbow colored (function types)”What does this mean for React and RSC adoption going forward?When I go back and look at react.dev now \[…\] it feels half-finishedReact Native year in reviewMore CSS supportExpo EAS hostingRN 0.78: React 19 supportLynx launchedRN 0.79: JSC moving to Community PackageRN 0.80: Freezing the legacy architectureRN 0.81: Android 16 support for edge to edge1.0 on the horizonVega OS launchedRN 0.82: Only new architectureExpo App AwardsRN 0.83: New Devtools - no breaking changesReact year in reviewCRA deprecation, new install docs (Vite\!)Styled Components DeprecatedReleases: 19.2 (Activity, useEffectEvent), Compiler 1.0Research: View Transitions canary, perf, concurrent stores, “throw a promise” deprecated (but not merged yet)“Async React” and the ecosystemReact FoundationReact growth skyrocketsReact Router RSC support, TanStack Start WIP RSC, WakuDan’s RSC explainers (he had a bunch of things to say)Remix v3 Jam recap (not React but relevant)Mark went from frustrated (CRA) to excited (ReactConf, foundation, team efforts)⚡ Lightning round ⚡TS 7 progress updateNPM classic tokens revokedGitHub Actions planned workGithub Action pricing change and immediate about-faceStacked diffs proposal in the works?Anthropic bought BunSVG Clickjacking from Lyra (SVG filters as logic gates??)Dan Abramov’s RSC Explorer: https://rscexplorer.dev/ , https://overreacted.io/introducing-rsc-explorer/Instant-loading Github repo explorer using RSCs: Without the blue barReact Router’s Take on RSCsHow AI Coding Agents hid a Timebomb in Our App(https://acusti.ca/blog/2025/12/16/react-compiler-silent-failures-and-how-to-fix-them/)Great history of web dev: 30 Years of <br> TagsNadia Makarevich’s latest deep dive: Bundle Size InvestigationExtensive ES2026 feature previewReact reconciler for Blender 3DThe “why” of React FiberAsync React articles from Aurora Scharff and Jack Herrington ★ Support this podcast ★

Transcript and show notesTMiR on Bluesky[00:13] Intro[01:00] New releases[01:04] BetterAuth 1.4[02:47] Immer 11, RTK 2.11[06:00] Storybook 10[06:22] 0.1 version of Remix team’s “event interaction” package[08:04] Main content[08:08] Ecosystem panel discussion of React Foundation at React Summit NY[14:46] React Concurrent Stores: Polyfill, React-Redux POC[17:52] React Router and transition usage[18:08] Matt Brophy and Ricky discussing nuances of behavior, use with React Router[22:53] The State of TanStack, Two Years of Full-Time OSS[25:57] TanStack DB 0.5[31:01] Tanner teasing a WIP TanStack Start RSC implementation[32:25] State of the web ecosystem[33:13] Cloudflare November outage postmortem[36:10] "What if people don't want to create things"[39:39] “When Everyone’s a Developer, How Do We Promote the Web Platform Over React?”[45:53] Related, “Dead Framework Theory” from last month[48:12] Alex Russell’s latest stats on web devices and network budgets[51:48] Npm attack, Shai-Hulud round 2[52:06] Analysis of its evolution in code from Sept[55:23] Our plan for a more secure npm supply chain from September[55:29] NPM update on token management changes[55:34] ⚡ Lightning round ⚡[55:38] TS 6.0 hopefully Feb 2026, 7.0 (native) soon after (more details in the TypeScript.fm podcast)[56:03] Latest TC39 proposal updates[56:32] Chrome (and other browsers) wants to remove XSLT from the web platform[57:14] “Your URL is Your State”, and David K’s “Goodbye, useState” talk[57:46] Aiden Bai’s “React Grab” util[58:39] Creating a custom Node module loader to import from Bittorrent[59:22] Ryan Carniato’s stream on researching “async signals”[59:33] Details of building Node’s TS type stripping support[59:58] The Web Animation Performance Tier List[01:00:14] Conferences (React, Javascript)[01:00:22] CFPs[01:01:01] React Paris (Also a community survey)[01:01:12] JSWorld CFP closes Dec 31, notifies by Feb 1[01:01:18] Ending (00:00) - This Month in React - November Episode (SM) (00:13) - Intro (01:00) - New releases (01:04) - [BetterAuth 1.4](https://www.better-auth.com/blog/1-4) (02:47) - [Immer 11](https://github.com/immerjs/immer/releases/tag/v11.0.0), [RTK 2.11](https://github.com/reduxjs/redux-toolkit/releases/tag/v2.11.0) (06:00) - [Storybook 10](https://storybook.js.org/blog/storybook-10/) (06:22) - [0.1 version of Remix team’s “event interaction” package](https://github.com/remix-run/remix/tree/main/packages/interaction) (08:04) - Main content (08:08) - [Ecosystem panel](https://gitnation.com/contents/panel-discussion-the-future-of-react-and-its-ecosystem) discussion of React Foundation at React Summit NY (14:46) - React Concurrent Stores: [Polyfill](https://github.com/thejustinwalsh/react-concurrent-store), [React-Redux POC](https://github.com/reduxjs/react-redux/pull/2263) (17:52) - React Router and transition usage (18:08) - [Matt Brophy and Ricky discussing nuances of behavior, use with React Router](https://github.com/reactwg/async-react/discussions/5) (22:53) - [The State of TanStack, Two Years of Full-Time OSS](https://tanstack.com/blog/tanstack-2-years) (25:57) - [TanStack DB 0.5](https://tanstack.com/blog/tanstack-db-0.5-query-driven-sync) (31:01) - [Tanner teasing a WIP TanStack Start RSC implementation](https://x.com/tannerlinsley/status/1983999424486633931) (32:25) - State of the web ecosystem (33:13) - [Cloudflare November outage postmortem](https://blog.cloudflare.com/18-november-2025-outage/) (36:10) - ["What if people don't want to create things"](https://macwright.com/2025/10/21/what-if-they-dont-want-to.html) (39:39) - [“When Everyone’s a Developer, How Do We Promote the Web Platform Over React?”](https://webtechnology.news/when-everyones-a-developer-how-do-we-promote-the-web-platform-over-react/) (45:53) - Related, [“Dead Framework Theory”](https://aifoc.us/dead-framework-theory/) from last month (48:12) - [Alex Russell’s latest stats on web devices and network budgets](https://infrequently.org/2025/11/performance-inequality-gap-2026/) (51:48) - Npm attack, [Shai-Hulud round 2](https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains) (52:06) - [Analysis of its evolution in code](https://www.aikido.dev/blog/bugs-in-shai-hulud-debugging-the-desert) from Sept (55:23) - [Our plan for a more secure npm supply chain](https://github.blog/...