TMiR 2025-09: React 19.2 on the horizon; npm is still getting compromised

About this episode

The episode discusses upcoming React updates, npm security issues, and various modern development topics.

[00:52] New releases [00:54] TanStack Start 1.0 RC! [01:13] react-window 2.0 rewrite [01:44] Apollo Client 4.0 [01:59] Redux Toolkit 2.9.0 [02:47] Main Content [02:52] React 19.2 coming soon? [03:24] in canary, with docs [07:18] last React Labs post mention [11:43] useEffectEvent in canary and has docs [15:47] Compiler inferring function names [16:08] Docs for eslint-plugin-react-hooks , including rules and compiler issues [17:15] React Native 1.0 on the horizon [22:02] “React Won by Default – And It's Killing Frontend Innovation” [22:18] Inevitable HN argument [27:54] Ricky on Ryan Carniato’s stream talking about scheduling and demoing using modern React features [33:41] Server Components [33:44] React Router RSC framework mode preview [34:36] also middleware is now stable [34:44] Krasimir Tsonev’s “Can I Use RSC Today?” support matrix and experimental Forket “RSC without a framework” build tool [35:43] RSBuild support for RSCs [35:55] Useful post on parallel and recursive route rendering [36:35] All the NPM compromises and malware this month [39:47] npm package maintainer Qix [39:48] CrowdStrike npm Packages [40:16] GitHub Actions npm Token Theft [41:01] GitHub response [42:00]…

People in this episode

Hosts: Mark Erikson, Mo Khazali, Carl Vitullo

Topics covered

• React updates
• npm security
• frontend development
• React Native
• modern CSS
• server components

Keywords

• React 19.2
• npm compromises
• Redux Toolkit
• React Native
• server components
• modern CSS
• eslint-plugin-react-hooks

Mentioned in this episode

Organizations: CrowdStrike, GitHub

Products: React 19.2, TanStack Start 1.0 RC, react-window 2.0, Apollo Client 4.0, Redux Toolkit 2.9.0, React Native 1.0, eslint-plugin-react-hooks, RSBuild, Forket

Books & works: React Won by Default – And It's Killing Frontend Innovation, What You Need to Know about Modern CSS, A very lovely writeup of the evolution of css zoom

More episodes of This Month in React

• TMiR 2026-05: Who even is on the Core team anymore, TanStack got pwn'd bad · June 6, 2026 · 1h 10m
• Mark & Carl talk with Swizec Teller about using AI at work · May 7, 2026 · 1h 4m
• TMiR 2026-02: CloudFlare remakes Next with AI; Vercel big mad. We talk too much about AI Agents · March 3, 2026 · 1h 6m
• TMiR 2026-01: Oops more CVEs. AI has React "skills", Astro exits and Tailwind struggles · February 5, 2026 · 1h 6m
• TMiR 2025-12: Year in review, React2Shell (RCE, DOS, SCE, oh my) · December 31, 2025 · 1h 40m
• TMiR 2025-11: Cloudflare outage, ongoing npm hacks, React Router is getting RSCs · November 30, 2025 · 1h 3m