React &amp; Next.js

Next.js fixes September 2026 image and cache vulnerabilities

Next.js 16.3.8 and 15.5.27 fix a critical and a high-severity issue. Check whether Image Optimization uses remotePatterns, whether a self-hosted Pages Router uses SSG or ISR, and whether catch-all or cache-preview features are enabled before patching and retesting.

Next.js revises its September security release to seven vulnerabilities

Next.js revised its September security notice to seven vulnerabilities. Two more issues remain pending upstream coordination; verify the current advisory before upgrading.

Next.js publishes a security update for an upstream issue

Next.js advised patching to 16.3.6 or 15.5.26 on 22 September; the update addresses an upstream Satori issue affecting some ImageResponse usage.

advanced1 min read

Tearing and useSyncExternalStore in concurrent React

Tearing is inconsistent UI when an interruptible render reads a changed external store mid-pass; useSyncExternalStore subscribes and forces consistent snapshots, re-rendering synchronously on change.

advanced1 min read

Runtime CSS-in-JS performance pitfalls in SSR Next.js

Runtime libs serialize styles per render, need style collection on the server, risk FOUC and double work in App Router.

Kent C. Dodds Fixes Accidental Monorepo with Workspaces

Kent C. Dodds consolidated four deployable apps into a proper npm workspace, deleting three nested lockfiles and adding minimal Nx caching. The migration exposed hardcoded paths and invalid package aliases that broke production once Node enforced package…

Cloudflare Sandboxes Cut Container Heartbeat Plumbing

Kent C. Dodds replaced Cloudflare Containers with Sandboxes, deleting heartbeat and shutdown logic for his FFmpeg pipeline. PR #729 uses one-shot exec() inside the existing queue worker, cutting deploy surface and eliminating long-lived service orchestration.

Kent C. Dodds Adds SQLite FTS5 to Vector Search

Kent C. Dodds added SQLite FTS5 to Vectorize embeddings after semantic search missed exact matches like "React Testing Library." The hybrid pipeline uses Reciprocal Rank Fusion. If your search fails on API names, add BM25 backup, not bigger embedding models.

Vercel Connect replaces env tokens with runtime OIDC

Vercel Connect Public Beta replaces static env tokens with short-lived, task-scoped credentials exchanged at runtime via OIDC. Agents request least-privilege access per job instead of holding long-lived shared secrets, eliminating manual rotation when…

Vercel ships AI Gateway, Workflow SDK, and Sandbox for agents

Vercel Agent Stack unifies hundreds of models, durable workflows, and isolated microVMs for production agents. One endpoint routes across providers, checkpoints resume failed runs, and sandboxes isolate unreviewed code.

Vercel Ship 2026: agent stack, eve framework, and microservices

Vercel Ship 2026 unveils open-source eve framework and Vercel Services for microservices July 1. Vercel is repositioning as agentic infrastructure with Connect credentials and expanded Python backends. Evaluate if your next agent deploys here instead of AWS.

Next.js 16.2 brings 67-100% faster server Fast Refresh

Next.js 16.2 Turbopack brings Server Fast Refresh to Node.js, cutting reload times 67-100% and compile times 400-900%. Only changed modules reload, not whole chains. WASM Workers, SRI, and dynamic import tree shaking land; upgrade to cut dev latency.

Next.js 16.2 adds agent-native dev tooling

Next.js 16.2 bundles version-matched docs with create-next-app, hitting 100% on framework evals versus 79% without. Browser errors now forward to terminal and a dev server lock file prevents agent confusion. Upgrade if you use AI coding agents.

Next.js 16.2 ships stable Adapter API for all platforms

Next.js 16.2 ships a stable Adapter API co-built with OpenNext, Netlify, and Cloudflare. The typed build contract lets any platform target full framework fidelity using the same public hooks Vercel uses. Stop reverse-engineering build output.

How does React's scheduler prioritize updates with Fiber?

Tests cooperative scheduling. Cover Fiber's incremental units, the Scheduler's time-slicing loop, and Lanes where SyncLane and InputContinuousLane outrank DefaultLane. Red flag: claiming React uses a separate thread or that batching alone handles priority.

What is a Fiber in React Fiber architecture?

Tests reconciler internals. Strong answers define a Fiber as a unit of work with child, sibling, return, and alternate pointers; explain the linked-list tree enables incremental traversal; and note alternate connects current and work-in-progress trees.

How would you design auth for ISR pages without losing cache benefits?

Tests cache segmentation and dynamic boundaries in Next.js. Propose a static ISR shell for anonymous users, then fetch personalized data client-side or via dynamic server paths when cookies are present.

How can you use Edge Middleware for auth and trade-offs versus getServerSideProps?

Middleware checks cookies/JWT for fast Edge rewrites/redirects; getServerSideProps uses full Node.js for heavy sessions with colder starts.

Implement a custom next/image loader for a self-hosted service

Tests next/image loader contract and URL construction. A strong answer defines a function taking src, width, and quality; returns a URL string for your service; and wires it via the loader prop or loaderFile config.