React &amp; Next.js

Next.js fixes September 2026 image and cache vulnerabilities

Next.js 16.3.8 and 15.5.27 fix a critical and a high-severity issue. Check whether Image Optimization uses remotePatterns, whether a self-hosted Pages Router uses SSG or ISR, and whether catch-all or cache-preview features are enabled before patching and retesting.

Next.js revises its September security release to seven vulnerabilities

Next.js revised its September security notice to seven vulnerabilities. Two more issues remain pending upstream coordination; verify the current advisory before upgrading.

Next.js publishes a security update for an upstream issue

Next.js advised patching to 16.3.6 or 15.5.26 on 22 September; the update addresses an upstream Satori issue affecting some ImageResponse usage.

easy1 min read

What is JSX and how does the browser run it?

JSX is XML-like syntax compiled to React.createElement calls; it differs from HTML via className and camelCase; browsers never see JSX, only transpiled JS.

Kent C. Dodds Fixes Accidental Monorepo with Workspaces

Kent C. Dodds consolidated four deployable apps into a proper npm workspace, deleting three nested lockfiles and adding minimal Nx caching. The migration exposed hardcoded paths and invalid package aliases that broke production once Node enforced package…

Cloudflare Sandboxes Cut Container Heartbeat Plumbing

Kent C. Dodds replaced Cloudflare Containers with Sandboxes, deleting heartbeat and shutdown logic for his FFmpeg pipeline. PR #729 uses one-shot exec() inside the existing queue worker, cutting deploy surface and eliminating long-lived service orchestration.

Kent C. Dodds Adds SQLite FTS5 to Vector Search

Kent C. Dodds added SQLite FTS5 to Vectorize embeddings after semantic search missed exact matches like "React Testing Library." The hybrid pipeline uses Reciprocal Rank Fusion. If your search fails on API names, add BM25 backup, not bigger embedding models.

Vercel Connect replaces env tokens with runtime OIDC

Vercel Connect Public Beta replaces static env tokens with short-lived, task-scoped credentials exchanged at runtime via OIDC. Agents request least-privilege access per job instead of holding long-lived shared secrets, eliminating manual rotation when…

Vercel ships AI Gateway, Workflow SDK, and Sandbox for agents

Vercel Agent Stack unifies hundreds of models, durable workflows, and isolated microVMs for production agents. One endpoint routes across providers, checkpoints resume failed runs, and sandboxes isolate unreviewed code.

Vercel Ship 2026: agent stack, eve framework, and microservices

Vercel Ship 2026 unveils open-source eve framework and Vercel Services for microservices July 1. Vercel is repositioning as agentic infrastructure with Connect credentials and expanded Python backends. Evaluate if your next agent deploys here instead of AWS.

Next.js 16.2 brings 67-100% faster server Fast Refresh

Next.js 16.2 Turbopack brings Server Fast Refresh to Node.js, cutting reload times 67-100% and compile times 400-900%. Only changed modules reload, not whole chains. WASM Workers, SRI, and dynamic import tree shaking land; upgrade to cut dev latency.

Next.js 16.2 adds agent-native dev tooling

Next.js 16.2 bundles version-matched docs with create-next-app, hitting 100% on framework evals versus 79% without. Browser errors now forward to terminal and a dev server lock file prevents agent confusion. Upgrade if you use AI coding agents.

Next.js 16.2 ships stable Adapter API for all platforms

Next.js 16.2 ships a stable Adapter API co-built with OpenNext, Netlify, and Cloudflare. The typed build contract lets any platform target full framework fidelity using the same public hooks Vercel uses. Stop reverse-engineering build output.

What are keys in React lists and why are they important?

Whether you understand React's reconciliation identity tracking. Keys are unique identifiers that let React match items across renders, preserving DOM state and avoiding unnecessary recreation.

Would you use getServerSideProps or getStaticProps for private user data?

Tests SSR vs SSG privacy. Use getServerSideProps: it runs per-request with auth cookies. getStaticProps bakes HTML/JSON at build time, leaking private data across users. Red flag: suggesting ISR or revalidation for authenticated data.

How would you implement a basic protected route in React?

Hold auth in useState, pass user to protected components, and return Navigate to login when absent.

How do you manage Next.js env variables on Vercel and use NEXT_PUBLIC_?

Set DB strings in Vercel dashboard without NEXT_PUBLIC_; consume in server code only. NEXT_PUBLIC_ inlines values into the browser JS bundle, leaking them to all users.

How do you enable basic i18n routing in Next.js?

This tests your knowledge of the built-in Pages Router i18n configuration in next.config.js. A good answer exports an i18n object with locales array, defaultLocale, and optionally localeDetection.

What is Next.js Middleware and a real-world auth use case?

This tests request interception before a route renders. A good answer defines Middleware as pre-request code using NextRequest and NextResponse, often on the Edge Runtime, with auth redirects as an example.