This Week In React #277: TanStack RSC, React2Dos, Next.js, MUI, Base UI | Pulsar, Nitro Fetch, Flow, Agent React DevTools | HTML-in-Canvas, Yuku

#react #reactnative

Hi everyone, Seb and Jan here 👋!

This week we finally have an experimental version of TanStack RSC! A new React DoS vulnerability affects Server Functions, so you probably need to upgrade React again. There are also important releases from the MUI team, and Styled Components is still alive!

On the React Native side, we got a new universal Haptics library, and a much faster fetch alternative. We heard VisionCamera 5 is around the corner.

Let's dive in!

💡 Subscribe to the official newsletter to receive an email every week!

💸 Sponsor

The fastest Postgres + MySQL database

PlanetScale Metal runs on blazing-fast NVMe in your favorite hyperscaler clouds. Get high-performance, reliability, and the best DX available for Postgres and MySQL.

Companies like Cash App, Cursor, and MyFitnessPal trust PlanetScale for their Tier 0 databases.

With PlanetScale, you get:

The best performance with local NVMe
AI integration with our MCP, skills, and automatic schema recommendations
Built-in query observability with Insights
Pricing from $5/mo

Migrate your database today

⚛️ React

TanStack - React Server Components Your Way

Two weeks ago, we covered the TanStack Start RSC sneak peek that Tanner offered us at React Paris. And now, they are available as an experimental feature!

My highlights remain mostly the same:

Primitives: RSCs are supported through 3 primitive APIs that permit to manipulate RSCs as any other stream of data, immediately compatible with existing tools such as React Query, TanStack Router loaders, localStorage, CDNs and HTTP caches. It is entirely opt-in and does not impose a server-first approach nor any framework convention, giving you total freedom on how to compose those primitives.
Composite Components: The server renders a RSC with slots that get filled by the client. You don’t need ’use client’ directives, although they are supported. This new concept creates an explicit boundary between the server and the client. It should be possible to co-locate client/server components in the same file this way.
No Server Actions: A design decision for security reasons. Recent React CVEs affecting other RSC frameworks were due to Server Functions handling Flight payloads and don't apply to TanStack Start, as Jack Herrington explains in this video.

What strikes me is just how different this is from Next.js. It feels more like a library than a framework, and more in sync with the philosophy that initially attracted me to React.

💸 PostHog - How we built automatic clustering for LLM traces
🔐 React2DoS (CVE-2026-23869): When the Flight Protocol Crashes at Takeoff - A new Denial-of-Service vulnerability affects the React Flight Protocol when deserializing Server Functions payloads. If you use Server Functions, upgrade asap to React 19.2.5 or Next.js 16.2.3
👀 Next.js PR - Node.js streams: Fork points - The SSR/RSC throughput is limited due to the use of standard Web Streams. The PR shows ongoing work to provide support for faster but non-standard Node.js streams, though the experimental.useNodeStreams feature flag. Accordingly to this former Vercel article about Web Streams, the outcome could be quite significant.
🗓️ dotJS 2026 - 🇫🇷 Paris - 18 September - Call For Papers for dotJS is open until April 28th 6 PM CET, submit now your talk proposals for the conference!
📜 GitHub - The uphill climb of making diff lines performant - GitHub cut the rendering cost their React-based PR diff view. What worked includes using fewer DOM nodes and event handler, simpler CSS selectors, TanStack Virtual for large PRs, removing scattered useEffect, and more.
📜 If You Can't See the Boundary, You Can't Reason About the System - Explains the need to visually see the boundary of Client/Server components on the current page, and introduces a Next.js App Router tool to highlight those boundaries.
📜 Contributing Callsite Revalidation Opt-out to React Router - Explains how React Router and React Query behave differently regarding revalidation after a mutation, and motivations to contribute a new unstable_defaultShouldRevalidate API to React Router.
📜 The Vertical Codebase - Colocate files by vertical features to scale your React codebase.
📜 Logging in Next.js with LogLayer: Instrumentation, Console Override, and Structured Logs - Gives you one logging model across all runtimes.
📜 Now more then ever, you need to master custom ESLint rules - Deep dive into writing custom ESLint rules, with concrete React-focused examples, such as preventing useEffect antipatterns).
📜 Next.js use cache: remote: A Distributed Cache in One Line - By default, the Cache Components feature works in memory, but it’s possible to cache data across serverless instances to increase cache hits.
💸 Certificates.dev - Boost your skills with up to 6 live bootcamps led by Aurora Scharff and get React certified with our Mid & Senior bundles
📦 Material UI and MUI X 9.0 - This large release re-aligns the versions of the core design system and the advanced components. MUI moves from v7 straight to v9, and introduces the first Base UI-backed primitives in the codebase with new NumberField and Menubar components. MUI X also received several improvements, adding new Chat and Scheduler components in alpha.
📦 Base UI 1.4 - One-Time Password field (preview), update a Toast, many bug fixes
📦 Unhead 3.0 - Streaming <head> component for any framework
📦 Storm - Terminal UI framework based on React - This new TUI addresses limitations of Ink, with cell-level diffing and dual-speed rendering architecture.
📦 Styled Components 6.4 - React Server Components support, performance optimizations, RN improvements, and more - The historical CSS-in-JS lib is in “maintenance mode” and yet it received a quite significant update!
📦 React Aria 1.17 - Expandable rows in Table, window scrolling in Virtualizer, dependency consolidation, sub-path imports
📦 Isolet - Package any component into a self-contained, isolated widget
📦 Remocn - Production-ready animations, transitions, and scenes for Remotion
🎙️ Syntax.fm 955 - Next.js Vendor Lock-in No More

💸 Sponsor

Still writing tests manually?

Notion, Dropbox and LaunchDarkly have found a new testing paradigm - and they can't imagine working without it. Built by ex-Palantir engineers, Meticulous autonomously creates a continuously evolving suite of E2E UI tests that delivers near-exhaustive coverage with zero developer effort - impossible to deliver by any other means.

It works like magic in the background:

Near-exhaustive coverage on every test run
No test creation
No maintenance (seriously)
Zero flakes (built on a deterministic browser)

🤨 Curious? Book in a time to learn more

📱 React-Native

Pulsar - Haptic Feedback Library

Meet Pulsar, a new library from Software Mansion that makes implementing haptic feedback much easier. Comes with SDKs for React Native, native iOS, and Android. See also the intro video.