TMiR 2025-09: React 19.2 on the horizon; npm is still getting compromised


  • (00:00) - This Month In React - September 2025 (SM)
  • (00:52) - New releases
  • (00:54) - [TanStack Start 1.0 RC!](https://tanstack.com/blog/announcing-tanstack-start-v1)
  • (01:13) - [`react-window` 2.0 rewrite](https://react-window.vercel.app/)
  • (01:44) - [Apollo Client 4.0](https://www.apollographql.com/blog/announcing-apollo-client-4-0)
  • (01:59) - [Redux Toolkit 2.9.0](https://github.com/reduxjs/redux-toolkit/releases/tag/v2.9.0)
  • (02:47) - Main Content
  • (02:52) - [React 19.2 coming soon?](https://bsky.app/profile/ricky.fm/post/3lzt6yvs6o22r)
  • (03:24) - [ in canary, with docs](https://react.dev/reference/react/Activity)
  • (07:18) - [last React Labs post mention](https://react.dev/blog/2025/04/23/react-labs-view-transitions-activity-and-more#activity)
  • (11:43) - [`useEffectEvent` in canary and has docs](https://react.dev/reference/react/useEffectEvent)
  • (15:47) - [Compiler inferring function names](https://github.com/facebook/react/pull/34410)
  • (16:08) - [Docs for `eslint-plugin-react-hooks`](https://react.dev/reference/eslint-plugin-react-hooks), including rules and compiler issues
  • (17:15) - [React Native 1.0 on the horizon](https://youtu.be/GPtopk4y2LI?si=JoZVprPW33szn-6D)
  • (22:02) - [“React Won by Default – And It's Killing Frontend Innovation”](https://www.lorenstew.art/blog/react-won-by-default/)
  • (22:18) - Inevitable [HN argument](https://news.ycombinator.com/item?shownew&id=45252715)
  • (27:54) - [Ricky on Ryan Carniato’s stream](https://www.youtube.com/watch?v=3vw6EAmruEU) talking about scheduling and demoing using modern React features
  • (33:41) - Server Components
  • (33:44) - [React Router RSC framework mode preview](https://remix.run/blog/rsc-framework-mode-preview)
  • (34:36) - also [middleware is now stable](https://remix.run/blog/middleware)
  • (34:44) - Krasimir Tsonev’s [“Can I Use RSC Today?” support matrix](https://rsc.krasimirtsonev.com/) and experimental [Forket “RSC without a framework” build tool](https://krasimirtsonev.com/blog/article/vanilla-react-server-components-with-no-framework)
  • (35:43) - [RSBuild support for RSCs](https://bsky.app/profile/ebey.bsky.social/post/3lyf6vixick26)
  • (35:55) - Useful post on [parallel and recursive route rendering](https://twofoldframework.com/blog/parallel-and-recursive-route-rendering-with-rsc)
  • (36:35) - All the NPM compromises and malware this month
  • (39:47) - [npm package maintainer Qix](https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack)
  • (39:48) - [CrowdStrike npm Packages](https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages)
  • (40:16) - [GitHub Actions npm Token Theft](https://socket.dev/blog/nx-supply-chain-attack-investigation-github-actions-workflow-exploit)
  • (41:01) - [GitHub response](https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/)
  • (42:00) - ⚡ Lightning round ⚡
  • (42:03) - [Porting Modern TypeScript to Run on DOS](https://jimb.ly/2025/09/23/qauntumpulse-from-steam-to-floppy/)
  • (42:35) - [Cloudflare DDOSed themselves with a bad `useEffect` fetch](https://blog.cloudflare.com/deep-dive-into-cloudflares-sept-12-dashboard-and-api-outage/?amp%253But)
  • (43:11) - [A very lovely writeup of the evolution of css `zoom`](https://www.bocoup.com/blog/the-webs-most-tolerated-feature)
  • (43:56) - [What You Need to Know about Modern CSS](https://frontendmasters.com/blog/what-you-need-to-know-about-modern-css-2025-edition/)
  • (45:21) - [Fetch streams are great, but not for measuring upload/download progress](https://jakearchibald.com/2025/fetch-streams-not-for-progress/)
  • (45:40) - [Why do browsers throttle JS timers?](https://nolanlawson.com/2025/08/31/why-do-browsers-throttle-javascript-timers/)
  • (46:01) - [“How Modern Browsers Work” deep dive, Addy Osmani](https://addyo.substack.com/p/how-modern-browsers-work)
  • (46:32) - [Biome: Stress-testing WIP `noFloatingPromises` lint rule](https://vercel.com/blog/stress-testing-biomes-nofloatingpromises-lint-rule)
  • (48:37) - [Bun: How `bun install` is so fast](https://bun.com/blog/behind-the-scenes-of-bun-install)
  • (49:23) - [Styled-Components fork for perf and React 19 compat](https://www.sanity.io/blog/cut-styled-components-into-pieces-this-is-our-last-resort)
  • (50:02) - [Vite SSR: Custom `getStaticProps`](https://www.patron.com/blog/post/vite-ssr-getstaticprops-replacement/)
  • (50:11) - [Dominic Gannaway’s new framework Ripple](https://github.com/trueadm/ripple)
  • (50:35) - [Remix v3: MJ hints “iframe-like async primitives”](https://x.com/mjackson/status/1971816432427298951)
  • (51:57) - [React Native RFC to remove Old Architecture](https://github.com/react-native-community/discussions-and-proposals/pull/929)
  • (52:28) - [Cloudflare’s new “Cap’n Web” RPC; GraphQL alternative?](https://blog.cloudflare.com/capnweb-javascript-rpc-library/)
  • (55:26) - [Expo UI: Building SwiftUI apps](https://docs.expo.dev/guides/expo-ui-swift-ui/)
  • (55:57) - [TanStack DB: An interactive guide](https://frontendatscale.com/blog/tanstack-db/)
  • (56:21) - [TS 6.0: may switch to `strict` options by default](https://github.com/microsoft/TypeScript/issues/62333)
  • (57:28) - [Shopify’s RN New Architecture migration](https://shopify.engineering/react-native-new-architecture)
  • (57:42) - [The Bloat of Edge-Case First Libraries](https://43081j.com/2025/09/bloat-of-edge-case-libraries)
  • (58:51) - Conferences ([React](https://react.dev/community/conferences), [Javascript](https://confs.tech/javascript))
  • (58:53) - [React Alicante](https://reactalicante.es/) Oct 2-4
  • (59:13) - [React Conf is back, Oct 7-8](https://bsky.app/profile/react.dev/post/3lmcp4mhmfk2l) Las Vegas, NV, USA
  • (59:29) - [Remix Jam](https://remix.run/jam/2025), Oct 10, Toronto ON, CA
  • (59:43) - [ViteConf](https://viteconf.amsterdam/) Oct 9-10 Amsterdam, Netherlands
  • (59:52) - [JSConf North America](https://events.linuxfoundation.org/jsconf-north-america/) Oct 14-16 Chesapeake Bay, MD, USA
  • (01:00:03) - [JSConf Chile](https://jsconf.cl/) Oct 24-25 Santiago, Chile
  • (01:00:10) - [React Native London](https://www.reactnativelondon.co.uk/) Oct 30-31
  • (01:00:22) - [React India](https://www.reactindia.io/) Oct 31 Nov 1 Goa, India
  • (01:00:26) - [Wey Wey Web](https://www.weyweyweb.com/) Nov 17-18 Malaga, Spain
  • (01:00:39) - [React Summit](https://reactsummit.us/) Nov 18-21 New York, NY, USA
  • (01:00:48) - [React Advanced](https://reactadvanced.com/) Nov 28th, London UK
  • (01:01:08) - Outro
★ Support this podcast ★

Creators and Guests

Mark Erikson
Host
Mark Erikson
An engineer maintaining Redux and Redux Toolkit, working at Replay.io to make smarter AI chat bots and debuggers using time travel.
Mo
Host
Mo
Head of Mobile at Theodo, a software consultancy that does native app development for iOS and Android
Carl Vitullo
Producer
Carl Vitullo
Solopreneur just vibing, posts are probably bullshit. Community lead at Reactiflux, the largest chat community of React professionals.
TMiR 2025-09: React 19.2 on the horizon; npm is still getting compromised
Broadcast by