There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it. A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately. react.dev/blog/2025/12...

A critical vulnerability in React Server Components (CVE-2025-55182) affects React 19 and frameworks, including Next.js (CVE-2025-66478). All users should upgrade to the latest patched version in their release line. nextjs.org/blog/CVE-20...

I moved to Bluesky for higher quality content that I’m more aligned with which is true to some extent. However I realized what I really like about it is *less* content and that I like zero even better. So I think I’m getting off of Bluesky as well. I didn’t need better social media but none.

Tbh, I like the AI DJ voice on Spotify trained on Xavier Jernigan. It adds value over just randomly playing tracks.

React 19.1 enables Server Components in Parcel with React Stable (not only canary)! Just released Parcel v2.14.3 with the corresponding update. 🥳

You can pass sub-classed Promises to React such as in use() with the fields status and value or reason. This allows React synchronously read the value without waiting on a microtask. This is much faster but it also ensures compat when someone needs flushSync(). Microtasks are bad, mkay.

New York, New York, New York so good they named it thrice+. New York County is Manhattan. New York City is larger than the county and includes the five boroughs. New York State includes all of them. The city is Manhattan, i.e. New York County. The Tri-State area is the New York metropolitan area.

Man, I love mainstream health science so much. It’s just so simple when you ignore all the made up stuff from influencers.

I've been working through a lot of browser bugs lately but tbh I wouldn't trade it for less ambitious work from browser vendors. I can do a lot more with a buggy API than no API at all.

Asking an AI "Are you sure?" to get a better result is this generation's "Millennial pause".

The new iOS 18.4 Beta is the first on-device build that has working Scroll-Driven Animations on iPhone. It's not on by default there yet. Unfortunately, it feels a little jittery. Like the frame-rate isn't quite right or something it getting rounded to integers. bsky.app/profile/bram...

Chrome DevTools is now going to ignore list `node:` by default. github.com/ChromeDevToo... This is great news for using Chrome Inspector to inspect servers (like the Next.js server). If you've added custom rules and moved away from the default. I recommend adding ^node: to your ignore list.

View Transitions are basically magic. Not in the sense that it just works. It's trying to model showmanship in a way that breaks the physics of the rendering engine. It's like semi-transparent ghosts walking through walls. That's why it has to break out of the normal layout and painting flow. 🪄

Now that the dust has settled on the funny naming of the experimental Taint APIs. Have you tried them? Did you find them useful? Did they help protect against any mistakes? react.dev/reference/re... react.dev/reference/re... en.wikipedia.org/wiki/Taint_c...

I'm working on built-in profiling of both Client and Server Components in Chrome DevTools Performance tab. Thanks to the new performance.measure() extensions. h/t Andrés Olivares This works in any RSC environment. In fact, this screenshot is running RSC for Parcel. h/t @devongovett.bsky.social

If you use auth with refresh tokens that have automatic reuse detection. I.e. if an auth token is expired, you can request a new one using the refresh token only once. How do YOU on your site deal with the race condition where opening multiple tabs/requests at once logs the user out? Not at all?

Catch the gotcha? This cache entry is specific to only a specific user because it uses the current user to compute its output. It means the current user must be part of the cache key otherwise this cache entry could leak between users. "use cache" handles this automatically for closures.

Don't sleep on this. While we do have some static parameterization for storage location. We don't actually want dynamic parameterization in the cache directive. That would be too early. It should be able to parameterize it using the content of the function and only that. nextjs.org/blog/our-jou...

I missed having 90% @danabra.mov in my feed.

👋