📨 #291: ReactBench, Security, TSRX, React Aria, dx-styles, TanStack, Forms, GTKX | SPM, Binary Props, Bundle Mode, Metro, Worklets, Metrognome, Whisper | Oxlint, Yuku, pnpm, Rolldown, Astro, Lightning, magic-string

Hi everyone, Seb and Jan here 👋!

This week we have React and Next.js security patches. React Aria becomes first-class in shadcn. A benchmark grades coding agents at real React tasks. The rise of TSRX and its upcoming framework.

On the mobile side, Swift Package Manager support is finally coming.

A TC39 meeting is in progress, we'll share the proposal updates next week. Oxlint type-aware linting is ready for prime-time. Meanwhile, Yuku explains how it outperforms Oxc at parsing JS.

Let's dive in!

As always, thanks for supporting us on your favorite platform:

• 🦋 Bluesky
• ✖️ X / Twitter
• 👔 LinkedIn
• 👽 Reddit

Don't miss the next email!

One of the few things I regularly read to keep up with the React world.

Theo BrowneFounder of ping.gg - Youtuber

💸 Sponsor

The fastest Postgres + MySQL database

PlanetScale Metal runs on blazing-fast NVMe in your favorite hyperscaler clouds. Get high-performance, reliability, and the best DX available for Postgres and MySQL.

Companies like Cash App, Cursor, and MyFitnessPal trust PlanetScale for their Tier 0 databases.

With PlanetScale, you get:

• The best performance with local NVMe
• AI integration with our MCP, skills, and automatic schema recommendations
• Built-in query observability with Insights
• Pricing from $5/mo

Migrate your database today

⚛️ React

• 💸 Product for Engineers - LLMs are picking winners. Here’s how to become one
• 🐦 Pete Hunt joins Vercel to lead Next.js and run Frameworks - The React pioneer is back! He is the one who bet early on React for Instagram Web and convinced many of us to try it despite a lukewarm initial public reception.
• 🐦 Tim Neutkens about TypeScript 7 support in Next.js 16.3 - next build uses the TS API, which will only be available in TypeScript 7.1. Until it’s released, you will be able to use experimental.useTypeScriptCli: typechecking will happen through the tsc CLI.
• 🔐 React - Denial of Service in Server Functions - A high vulnerability patched in 19.0.8, 19.1.9, 19.2.8.
• 🔐 Next.js - July 2026 Security Release - Next.js shipping its first pre-announced monthly security release, fixing 4 high and 5 medium vulnerabilities patched in v16.2.11 and v15.5.21.
• 👀 React.dev PR - Dynamic OG images for docs pages - The React website now has dynamic social cards rendered with Satori.
• 📊 ReactBench - Evaluates frontier coding agents on production React work - The Million.js team (React Scan, React Doctor) launches a benchmark grading coding agents on real React tasks, checking behavior, performance, accessibility, and code quality. GPT 5.6 leads and is 6x more cost-efficient than Fable 5.
• 📜 TSRX in TanStack Start: what we like, and three bugs we filed - Pragmatic feedback on TSRX, a TypeScript-based JSX extension, using TanStack Start and React. By the way, Dominic Gannaway (creator of TSRX and former React/Svelte core team member) is working on Octane.js, a promising framework based on TSRX, keeping React's programming model while compiling everything ahead of time.
• 📜 Inside TanStack Table V9 Reactivity - Deep dive into TanStack Table's new reactive and framework-agnostic core, built on a shared atom interface that each adapter implements with its framework's primitives. React isn't signal-based, so its adapter uses TanStack Store instead. This enables granular updates through selectors and unlocks React Compiler compatibility.
• 📜 React Hook Form Avoids State. TanStack Form Scopes It - Comparing 2 different form models: native registered inputs vs controlled inputs with fine-grained updates.
• 📜 Do we need state management libraries anymore? - Nearly all state management libs converge on useSyncExternalStore, and you can implement one in ~50 lines you understand.
• 📜 Props, Composers, and Providers: the composition pattern we're converging on - An opinionated React composition ladder with a naming convention that makes the intent explicit.
• 📜 Advanced React State Boundaries in a Real Next.js App
• 💸 Puter.js - The backend for AI-generated apps. One-shot builds with up to 90% fewer tokens. Auth, Storage, DB, AI & more. No API keys needed
• 📦 shadcn CLI 4.13.1 - Add React Aria support - The shadcn CLI, ui library, and docs now have first-class support for the React Aria headless primitive library, alongside Base UI and Radix UI. Use the shadcn create/init --base aria flag at
• 📦 dx-styles - zero-runtime CSS-in-TS library with typed recipes, token contracts, and RSC support - The maintainer of Linaria and Pigment CSS explains why styled(Component) is a design mistake and introduces a new CSS-in-TS library based on years of experience in this field.
• 📦 Vite Plugin React 0.5.28 - RSC runtime optimizations
• 📦 GTKX 1.0 RC - The React framework for Linux - A general platform for driving GLib and GObject from TypeScript.
• 📦 React Hook Form 7.82 - Add setValue({delayError}), improve getDirtyFields perf
• 📦 Jotai 3.0 alpha - Modernizing the package, ESM, React 18+
• 📦 TanStack Devtools Rspack 0.1 - Devtools supports Rspack, full feature parity to Vite
• 📦 Astryx 0.1.5 - AspectRatio fit, useHotkeys, CollapsibleGroup dividers/density, per-block CodeBlock, and more

Don't miss the next email!

People always ask how I keep up to date, it's This Week In React.

Jack HerringtonPrincipal Engineer - Youtuber

💸 Sponsor

Ship AI generated code safely with Meticulous.

Claude writes your code. Claude reviews your code. Claude fixes the review comments. And somehow, you're the one getting paged at 2am when it breaks in prod.

Fortunately, top AI-driven teams like Dropbox, Notion, LaunchDarkly, and Wiz rely on Meticulous to run 1000s of e2e UI tests autonomously, covering every user flow, edge case, role and permutation. Built by ex-Palantir engineers, Meticulous gives you near-exhaustive coverage in weeks, without any developer effort.

It works like magic in the background:

• Near-exhaustive coverage on every test run
• No test creation
• No maintenance (seriously)
• Zero flakes (built on a deterministic browser)

Check it out - and see why one engineering leader at Dropbox said that “once we started using Meticulous, we couldn’t imagine working without it.”

📱 React-Native

• 💸 Sentry - How Simon Grimm debugs a real React Native app in production. Watch on demand.
• 👀 React Native PR - Swift Package Manager cherry-picked and backported to RN 0.87 - Long-awaited support finally available in v0.87 rc.2.
• 💬 React Native RFC - Binary Props - Phasing folly::dynamic out of Fabric's Android update pipeline - When RN updates props on Android, it serializes every changed prop into a folly::dynamic object. The proposed fix will write prop diffs into a single shared binary. The result is ~257 µs → ~36 µs per view per frame on an entry-level phone. For 200 animated views: 64.3ms → 17.1ms total.
• 🎨 Redraw Playground Examples - Interactive gallery of vector rendering examples: variable strokes, distance-field effects, SVG rendering, and GPU shaders
• 🎨 Keyframer Animation Recipes - A collection of interactive examples where animations run on Reanimated v4 and Gesture Handler
• 📣 Expo Agent - Ending the closed beta and winding the project down
• 📜 How Worklets Bundle Mode accidentally fixed Hermes V1 memory regression - Hermes V1 attaches debugging metadata to eval calls, which Worklets rely on for production animations. Bundle Mode bypasses eval by exposing the precompiled bundle directly to UI runtimes.
• 📜 Which React Native Animation Library Should You Use for Performance? - A look into how Animated, Reanimated, and Ease perform under different animation types. The animation test harness collects data on how each one of them runs under real-world scenarios. Collected data compares UI + JS frame drops, memory, and JS-CPU busyness.
• 📜 What Does a Server-State Client Cost You Per Request? - Measure the CPU overhead of using Relay, Zustand, React Query, and RTK Query within a React Native app.
• 📜 Building a ChatGPT-Style AI Chat App in React Native with RAG & Streaming - Margelo showing how to build a native-feeling chat UI in React Native.
• 📜 How I Added NFC Habit Verification to a React Native App
• 📜 A Step-By-Step Guide to Super App Development With Re.Pack 5
• 💸 Drizz - AI writes 50% of your code now. Why are you still writing test scripts by hand? Vision AI mobile testing for iOS and Android
• 📦 Vision Camera 5.1 - Locked focus adaptiveness on Android, CameraX upgrade
• 📦 Gesture Handler 3.1 - Hover support in Touchable, keyboard tap persistence fix
• 📦 Metro 0.87 - Optional dependencies enabled by default, ~5% faster cold builds
• 📦 Worklets 0.11 - Bytecode worklets in Legacy Eval Mode, Hermes V1 memory workaround
• 📦 Agent Device 0.20 - Redesigned gesture execution, Maestro compatibility through a typed engine, reusable and replayable scripts
• 📦 Skia 2.9 - Font.measureText on Web, OpenGL graceful failure
• 📦 WebGPU 0.6 - YUV conversion for Android camera frames, iOS simulator fixes
• 📦 Sentry 8.19 - Aggregate TurboModule call counts, historical tombstones from Android's ApplicationExitInfo
• 📦 Argent 0.16 - Tool-server event log, end-to-end flows without agent, tar-upload for remote files
• 📦 Whisper.rn - React Native bindings for OpenAI Whisper and NVIDIA Parakeet automatic speech recognition (ASR) through whisper.cpp
• 📦 Expo Apple Targets 5.0 - Easier target variants
• 📦 Nitro Godot - Embed Godot Engine in React Native via Nitro Modules
• 📦 Playback Controls - System media UI control without audio playback
• 📦 Expo Libghostty - Ghostty terminal view for Expo/React Native
• 📦 RN Date - High-performance native date library, powered by C++ and Nitro Modules
• 🤖 Metrognome - An AI Agent for Measured React Native Performance Fixes
• 🤖 Pure Module Skill - Scaffold pure JSI/C++ modules from TurboModule templates
• ️🎙️ RNR 367 - Ask Us Anything - Robin and Mazen tackle listener questions on React Native, AI, mobile development, Expo Router, Flutter, performance, and consulting.

🔀 Other

• 📜 Engineering Yuku’s High-Performance Parsers with Data-Oriented Design - Yuku outperforms the Oxc parser by using data-oriented design. The textbook AST node optimizes for developer readability but is not machine-efficient. Yuku designs the AST nodes' data structure to optimize their memory layout and access patterns.
• 📜 Fetch Is Not Enough - Why Request/Response fall short for servers, and a proposal for a unified serve() API that would work across Node, Deno, Bun, and Workers.
• 📦 Oxlint 1.75 - Type-Aware Linting Stable - The Oxc team released a stable version of tsgolint 7.0, based on TypeScript v7 and following its versioning scheme. This enables the --type-aware and --type-check flags in Oxlint, as well as 43 additional type-aware rules.
• 📦 pnpm 11.11-11.14 - Workspace release management, pnpm doctor, pnpm access - pnpm can now version and release a monorepo workspace, supporting .changesets
• 📦 Rolldown 1.2 - HMR, watcher, tree-shaking, sourcemaps improvements and many fixes
• 📦 Astro 7.1 - Pagination URLs control, CSP control for inline scripts/styles, run multiple dev servers
• 📦 Lightning CSS 1.33 - Support for alpha(), @position-try, ::search-text, ::highlight
• 📦 magic-string 1.0 - Small, fast utility for manipulating source code strings and generating sourcemaps

🤭 Fun

See ya! 👋