Everything in React & Next.js
Next.js fixes September 2026 image and cache vulnerabilities
Next.js 16.3.8 and 15.5.27 fix a critical and a high-severity issue. Check whether Image Optimization uses remotePatterns, whether a self-hosted Pages Router uses SSG or ISR, and whether catch-all or cache-preview features are enabled before patching and retesting.
Next.js revises its September security release to seven vulnerabilities
Next.js revised its September security notice to seven vulnerabilities. Two more issues remain pending upstream coordination; verify the current advisory before upgrading.
Next.js publishes a security update for an upstream issue
Next.js advised patching to 16.3.6 or 15.5.26 on 22 September; the update addresses an upstream Satori issue affecting some ImageResponse usage.
Purpose of Outlet in React Router v6 nested routes
Outlet renders the matched child route inside a parent layout, enabling shared chrome with swappable content; configure nested routes and place Outlet where children render.
Tearing and useSyncExternalStore in concurrent React
Tearing is inconsistent UI when an interruptible render reads a changed external store mid-pass; useSyncExternalStore subscribes and forces consistent snapshots, re-rendering synchronously on change.
Session auth in Next.js with API routes and middleware
Login route sets a signed httpOnly cookie, middleware validates the session at the edge and redirects, server components read the session.
localStorage vs httpOnly cookie for auth tokens
LocalStorage is JS-readable so XSS steals it; httpOnly cookies are JS-invisible blocking XSS theft but exposed to CSRF, mitigated by SameSite and tokens.
Testing a component that consumes React Context
Render inside the Context.Provider with a value, or omit it to exercise the default; use a custom render wrapper for reuse.
Runtime CSS-in-JS performance pitfalls in SSR Next.js
Runtime libs serialize styles per render, need style collection on the server, risk FOUC and double work in App Router.
What is JSX and how does the browser run it?
JSX is XML-like syntax compiled to React.createElement calls; it differs from HTML via className and camelCase; browsers never see JSX, only transpiled JS.
Kent C. Dodds Fixes Accidental Monorepo with Workspaces
Kent C. Dodds consolidated four deployable apps into a proper npm workspace, deleting three nested lockfiles and adding minimal Nx caching. The migration exposed hardcoded paths and invalid package aliases that broke production once Node enforced package…
Cloudflare Sandboxes Cut Container Heartbeat Plumbing
Kent C. Dodds replaced Cloudflare Containers with Sandboxes, deleting heartbeat and shutdown logic for his FFmpeg pipeline. PR #729 uses one-shot exec() inside the existing queue worker, cutting deploy surface and eliminating long-lived service orchestration.
Kent C. Dodds Adds SQLite FTS5 to Vector Search
Kent C. Dodds added SQLite FTS5 to Vectorize embeddings after semantic search missed exact matches like "React Testing Library." The hybrid pipeline uses Reciprocal Rank Fusion. If your search fails on API names, add BM25 backup, not bigger embedding models.
Vercel Connect replaces env tokens with runtime OIDC
Vercel Connect Public Beta replaces static env tokens with short-lived, task-scoped credentials exchanged at runtime via OIDC. Agents request least-privilege access per job instead of holding long-lived shared secrets, eliminating manual rotation when…
Vercel ships AI Gateway, Workflow SDK, and Sandbox for agents
Vercel Agent Stack unifies hundreds of models, durable workflows, and isolated microVMs for production agents. One endpoint routes across providers, checkpoints resume failed runs, and sandboxes isolate unreviewed code.
Vercel Ship 2026: agent stack, eve framework, and microservices
Vercel Ship 2026 unveils open-source eve framework and Vercel Services for microservices July 1. Vercel is repositioning as agentic infrastructure with Connect credentials and expanded Python backends. Evaluate if your next agent deploys here instead of AWS.
Next.js 16.2 brings 67-100% faster server Fast Refresh
Next.js 16.2 Turbopack brings Server Fast Refresh to Node.js, cutting reload times 67-100% and compile times 400-900%. Only changed modules reload, not whole chains. WASM Workers, SRI, and dynamic import tree shaking land; upgrade to cut dev latency.
Next.js 16.2 adds agent-native dev tooling
Next.js 16.2 bundles version-matched docs with create-next-app, hitting 100% on framework evals versus 79% without. Browser errors now forward to terminal and a dev server lock file prevents agent confusion. Upgrade if you use AI coding agents.
Next.js 16.2 ships stable Adapter API for all platforms
Next.js 16.2 ships a stable Adapter API co-built with OpenNext, Netlify, and Cloudflare. The typed build contract lets any platform target full framework fidelity using the same public hooks Vercel uses. Stop reverse-engineering build output.
How do you manage database connections in serverless Next.js API routes?
This tests serverless concurrency and connection limits. A strong answer notes lambda scaling exhausts DB connections, advocates connection pooling or serverless drivers, and caches the client globally.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles