TMiR 2025-11: Cloudflare outage, ongoing npm hacks, React Router is getting RSCs

About this episode

The episode discusses the recent Cloudflare outage, ongoing npm security issues, and updates on React Router and the React ecosystem.

Transcript and show notes TMiR on Bluesky [00:13] Intro [01:00] New releases [01:04] BetterAuth 1.4 [02:47] Immer 11 , RTK 2.11 [06:00] Storybook 10 [06:22] 0.1 version of Remix team’s “event interaction” package [08:04] Main content [08:08] Ecosystem panel discussion of React Foundation at React Summit NY [14:46] React Concurrent Stores: Polyfill , React-Redux POC [17:52] React Router and transition usage [18:08] Matt Brophy and Ricky discussing nuances of behavior, use with React Router [22:53] The State of TanStack, Two Years of Full-Time OSS [25:57] TanStack DB 0.5 [31:01] Tanner teasing a WIP TanStack Start RSC implementation [32:25] State of the web ecosystem [33:13] Cloudflare November outage postmortem [36:10] "What if people don't want to create things" [39:39] “When Everyone’s a Developer, How Do We Promote the Web Platform Over React?” [45:53] Related, “Dead Framework Theory” from last month [48:12] Alex Russell’s latest stats on web devices and network budgets [51:48] Npm attack, Shai-Hulud round 2 [52:06] Analysis of its evolution in code from Sept [55:23] Our plan for a more secure npm supply chain from September [55:29] NPM update on token management changes…

People in this episode

Hosts: Mark Erikson, Mo Khazali, Carl Vitullo

Topics covered

• Cloudflare outage
• npm security
• React Router
• React ecosystem
• TanStack updates
• web development

Keywords

• Cloudflare
• npm hacks
• React Router
• TanStack
• web ecosystem
• BetterAuth
• Immer
• Storybook
• XSLT
• TypeScript

Mentioned in this episode

Organizations: React Foundation, React Summit NY, TanStack, Cloudflare, npm

Products: BetterAuth 1.4, Immer 11, RTK 2.11, Storybook 10, TanStack DB 0.5, TS 6.0, XSLT

More episodes of This Month in React

• TMiR 2026-05: Who even is on the Core team anymore, TanStack got pwn'd bad · June 6, 2026 · 1h 10m
• Mark & Carl talk with Swizec Teller about using AI at work · May 7, 2026 · 1h 4m
• TMiR 2026-02: CloudFlare remakes Next with AI; Vercel big mad. We talk too much about AI Agents · March 3, 2026 · 1h 6m
• TMiR 2026-01: Oops more CVEs. AI has React "skills", Astro exits and Tailwind struggles · February 5, 2026 · 1h 6m
• TMiR 2025-12: Year in review, React2Shell (RCE, DOS, SCE, oh my) · December 31, 2025 · 1h 40m
• TMiR 2025-10: Post-conf; React 19.2, React Foundation, React Native removing old architecture. Next.js has too many directives · October 31, 2025 · 1h 14m