Get the next post in your inbox
Frontend, AI and how teams ship. No spam, ever.
Quick hits
tsrs: a Rust type checker to try today
tsrs is a Rust port of the TypeScript 7 type checker, announced on October 20 by Cloudflare and VoidZero and incubated in the Oxc toolchain. The tsrs team reports early benchmarks of up to 8x faster and about 70% less memory than TypeScript 7.0 at the same worker count, with configurations matched together with the TypeScript team. Try it with pnpm add -D tsrs and pnpm exec tsrs --noEmit. The maintainers aim for a stable release against TypeScript 7.1. tsrs on GitHub · Announcement
Oxc logo, the project behind tsrs
React DevTools for agents
React's docs now describe react-devtools-cdt-mcp, an experimental package built on the experimental third-party developer tools API in Chrome DevTools MCP. It registers 12 react_* tools that Chrome DevTools MCP discovers automatically, so a coding agent can inspect the component tree, props, hooks, owners, source locations and render timing. The docs page includes a live sandbox with a tool console. React docs
React logo for React DevTools for agents
TanStack Hotkeys is in public beta
A newer TanStack library, now in public beta: type-safe keyboard shortcuts with devtools. It also covers Vim-style sequences and recorder UI helpers, and its cross-platform Mod key means Cmd on macOS and Ctrl elsewhere. TanStack Hotkeys on GitHub
TanStack logo for TanStack Hotkeys
React Native 0.88
The release turns on web-style event dispatching. The notes also list a few upgrade-affecting changes, such as the Babel preset now needing the inlinePlatform option. Release notes
React logo for React Native 0.88
Hydrogen 2026-10
Shopify says Hydrogen is now a library you add to your own framework, with starters for React Router and Next.js. Your app owns the server entry, the router and the build. Shopify changelog
Shopify logo for Hydrogen
Security
Patch React Server Components now
What happened: a crafted request can run code on a server that uses React Server Components, and the attacker does not need to log in.
React rates it critical, 9.5 on CVSS v4. It affects react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack before 19.0.9, 19.1.10, 19.2.9 and 19.3.1, and per the advisory only in rare cases where responses carry multiple typed arrays with an attacker-controlled value. Next.js ships the same fix in 16.4.1 and 15.5.28, together with a critical Image Optimization flaw and a Server Actions denial of service. React Status reports that a public proof of concept is now out.
Upgrade, redeploy and check what your lockfile resolves. Next.js 15 is now in Maintenance LTS, meaning critical bug fixes and security patches only, per the Next.js support policy. If you are staying on 15.x for now, apply the 15.5.28 security patches and plan the move to 16.x. React advisory · Next.js update · Next.js support policy
Frontend excellence
Soft navigations now show up in CrUX
Chrome now reports experimental soft navigation versions of the Core Web Vitals in CrUX, so a single-page app can be measured across the whole session and not only the first load. Per This Week In React, CrUX Vis has an "Include soft navigations" toggle, so you can compare your own site. Chrome announcement
AVIF is still the default for photos
In Jake Archibald's comparison, JPEG XL files are typically 15 to 25% larger than AVIF for lossy photos at default effort, and 30 to 90% larger for screenshots and illustrations. JPEG XL wins on lossless, and it can shrink existing JPEGs by 9 to 20% with no further loss. His default is AVIF 4:4:4, and he notes both encoders are improving fast, so re-run the numbers on your own assets. Jake Archibald
Logos: Simple Icons, trademarks of their owners.
Get the next issue in your inbox: subscribe to the newsletter. More articles: enpitech.dev/blog.
Nir
