Intermediate everything in React & Next.js
Next.js fixes September 2026 image and cache vulnerabilities
Next.js 16.3.8 and 15.5.27 fix a critical and a high-severity issue. Check whether Image Optimization uses remotePatterns, whether a self-hosted Pages Router uses SSG or ISR, and whether catch-all or cache-preview features are enabled before patching and retesting.
Next.js revises its September security release to seven vulnerabilities
Next.js revised its September security notice to seven vulnerabilities. Two more issues remain pending upstream coordination; verify the current advisory before upgrading.
Next.js publishes a security update for an upstream issue
Next.js advised patching to 16.3.6 or 15.5.26 on 22 September; the update addresses an upstream Satori issue affecting some ImageResponse usage.
Purpose of Outlet in React Router v6 nested routes
Outlet renders the matched child route inside a parent layout, enabling shared chrome with swappable content; configure nested routes and place Outlet where children render.
Session auth in Next.js with API routes and middleware
Login route sets a signed httpOnly cookie, middleware validates the session at the edge and redirects, server components read the session.
localStorage vs httpOnly cookie for auth tokens
LocalStorage is JS-readable so XSS steals it; httpOnly cookies are JS-invisible blocking XSS theft but exposed to CSRF, mitigated by SameSite and tokens.
Testing a component that consumes React Context
Render inside the Context.Provider with a value, or omit it to exercise the default; use a custom render wrapper for reuse.
Kent C. Dodds Fixes Accidental Monorepo with Workspaces
Kent C. Dodds consolidated four deployable apps into a proper npm workspace, deleting three nested lockfiles and adding minimal Nx caching. The migration exposed hardcoded paths and invalid package aliases that broke production once Node enforced package…
Cloudflare Sandboxes Cut Container Heartbeat Plumbing
Kent C. Dodds replaced Cloudflare Containers with Sandboxes, deleting heartbeat and shutdown logic for his FFmpeg pipeline. PR #729 uses one-shot exec() inside the existing queue worker, cutting deploy surface and eliminating long-lived service orchestration.
Kent C. Dodds Adds SQLite FTS5 to Vector Search
Kent C. Dodds added SQLite FTS5 to Vectorize embeddings after semantic search missed exact matches like "React Testing Library." The hybrid pipeline uses Reciprocal Rank Fusion. If your search fails on API names, add BM25 backup, not bigger embedding models.
Vercel Connect replaces env tokens with runtime OIDC
Vercel Connect Public Beta replaces static env tokens with short-lived, task-scoped credentials exchanged at runtime via OIDC. Agents request least-privilege access per job instead of holding long-lived shared secrets, eliminating manual rotation when…
Vercel ships AI Gateway, Workflow SDK, and Sandbox for agents
Vercel Agent Stack unifies hundreds of models, durable workflows, and isolated microVMs for production agents. One endpoint routes across providers, checkpoints resume failed runs, and sandboxes isolate unreviewed code.
Vercel Ship 2026: agent stack, eve framework, and microservices
Vercel Ship 2026 unveils open-source eve framework and Vercel Services for microservices July 1. Vercel is repositioning as agentic infrastructure with Connect credentials and expanded Python backends. Evaluate if your next agent deploys here instead of AWS.
Next.js 16.2 brings 67-100% faster server Fast Refresh
Next.js 16.2 Turbopack brings Server Fast Refresh to Node.js, cutting reload times 67-100% and compile times 400-900%. Only changed modules reload, not whole chains. WASM Workers, SRI, and dynamic import tree shaking land; upgrade to cut dev latency.
Next.js 16.2 adds agent-native dev tooling
Next.js 16.2 bundles version-matched docs with create-next-app, hitting 100% on framework evals versus 79% without. Browser errors now forward to terminal and a dev server lock file prevents agent confusion. Upgrade if you use AI coding agents.
Next.js 16.2 ships stable Adapter API for all platforms
Next.js 16.2 ships a stable Adapter API co-built with OpenNext, Netlify, and Cloudflare. The typed build contract lets any platform target full framework fidelity using the same public hooks Vercel uses. Stop reverse-engineering build output.
How do you manage database connections in serverless Next.js API routes?
This tests serverless concurrency and connection limits. A strong answer notes lambda scaling exhausts DB connections, advocates connection pooling or serverless drivers, and caches the client globally.
What drives your choice between Zustand and Redux Toolkit at scale?
What it tests: matching state philosophy to constraints, not hype. Outline: weigh Zustand's minimal footprint against Redux Toolkit's DevTools and structured async patterns. Red flag: claiming one is always better regardless of team size or debugging needs.
How do you ensure a complex form is fully accessible?
Pair labels to inputs, move focus to first error on submit, and link aria-invalid to aria-describedby.
What is the Virtual DOM and why does React use it?
This tests reconciliation as declarative abstraction, not raw speed. Good answers define VDOM as in-memory UI synced to the real DOM, explain declarative state mapping, and note fibers enable incremental rendering.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles