Get the next post in your inbox
Frontend, AI and how teams ship. No spam, ever.
Quick hits
Chrome 157 ships HTML-in-Canvas as stable
Google's Chrome team says that after an origin trial, Chrome 157 ships the API for drawing real, interactive DOM elements into 2D, WebGL and WebGPU canvases, with DevTools support. Rich UI inside canvas scenes no longer means rebuilding it by hand. Feature-detect before you rely on it.
Chrome logo for Chrome 157 ships HTML-in-Canvas as stable
Discord is rebuilding its client in Rust and leaving Electron and React Native
Discord's CTO says the desktop client moves to Rust with GPUI, the UI framework from Zed, while mobile keeps native interfaces over Rust code shared with desktop. A screenshot he shared shows a process using about 290 MB of memory. That is one claimed snapshot, not a benchmark, and there is no release date yet. One of the best-known Electron and React Native apps is leaving both, so it is a good moment to measure where your own app's ceiling is before anyone asks you to.
Inven Global · The Verge, via React Status
Discord logo for Discord is rebuilding its client in Rust and leaving Electron and React Native
Claude message threads enter public beta
Anthropic launched message threads in public beta on November 2. A thread parameter lets an agent send only its new messages plus the previous response ID instead of resending the whole conversation, and Anthropic reports about a 35% median drop in time to first token for 500k to 1M token requests. Threads expire 5 minutes after the last request. This one is a game-changer for long agent sessions in your editor or product: they get cheaper to continue. Confirm the exact parameter names in the docs before you build on it.
Claude logo for Claude message threads enter public beta
Next.js is testing navigation on pointerdown, and Go route handlers
Two experimental Next.js PRs: router.experimental_prepare() starts a navigation on pointerdown and commits it on click, and route.go files let a route handler run as a Go worker next to your React app. The first targets the small delay between pressing and releasing a link. The second shows the team looking at native languages for CPU-heavy server work. Both are experiments, so watch them rather than ship them.
Next.js logo for Next.js is testing navigation on pointerdown, and Go route handlers
Parcel 3 alpha is a Rust rewrite with React Compiler support
Per the Parcel 3 alpha post, Parcel's core is now a Rust binary with no Node dependency, with cold builds up to 100x faster than v2. It adds native support for Tailwind (without PostCSS), React Compiler and MDX. A bundler that needs no Node install and understands the React Compiler is worth a branch. Treat the speed figure as the team's claim and measure your own project.
Parcel logo for Parcel 3 alpha is a Rust rewrite with React Compiler support
Redux Toolkit 2.14 lands, and 3.0 gets a roadmap
Mark Erikson's roadmap puts RTK 3.0 six to eight months out, ESM-only, with a modest set of breaking changes. A run of 2.x releases ships the groundwork first, starting with 2.14. If Redux Toolkit is in your stack, you now know the migration shape months ahead.
Redux logo for Redux Toolkit 2.14 lands, and 3.0 gets a roadmap
Two tools to try: Skullet and Reticle
Skullet renders your real component invisibly with sample data, measures it and draws a matching skeleton to cut layout shift. Reticle is an open-source SDK that gives a coding agent runtime perception of your running web or desktop app, so it can inspect what it built. Both are cheap experiments for a branch: one for loading states, one for agents that inspect their own work.
Skullet and Reticle logos for Two tools to try: Skullet and Reticle
Vercel folds the Next.js Data Cache into Runtime Cache
Per React Status, the move brings bigger allocations but new per-read and per-write pricing, and Hobby teams migrate on November 29. Check the dates and prices against your own traffic before the migration reaches you.
Vercel changelog · Vercel blog
Vercel logo for Vercel folds the Next.js Data Cache into Runtime Cache
Frontend excellence
Node.js 27 alpha starts the new release model
Per This Week In React, the first alpha brings V8 15.6 and npm 12.1, becomes Current in April 2027 and LTS in October 2027. Node 26 is now the LTS line. No more even and odd numbers to reason about, so plan upgrades by the calendar.
Node.js logo for Node.js 27 alpha starts the new release model
Read: React.lazy and the hidden 300 ms delay
A React.lazy component always suspends on its first render, and React throttles Suspense reveals to 300 ms to avoid flicker, which can show up as an unexplained pause. If a lazy route feels slower than its bundle size says, this is the first place to look.
Read: logo for React.lazy and the hidden 300 ms delay
Read: writable derived state instead of syncing with useEffect
Use clientData ?? serverData instead of an effect that copies server data into local state and wipes user edits on refetch. One line removes a whole class of stale-form bugs.
Read: logo for writable derived state instead of syncing with useEffect
Vitest 5.1 and Storybook 11 beta
Vitest 5.1 adds --since-last-run, interactive snapshot review and a Trace View on failure by default. Storybook 11.0 is in beta. Faster feedback in CI, and a major Storybook to try on a branch.
Vitest 5.1 · Storybook 11 beta
Vitest and Storybook logos for Vitest 5.1 and Storybook 11 beta
Security
Patch Next.js to 16.4.5 or 15.5.29
What happened: Next.js published its November security release on November 3, and most of its advisories involve Cache Components. Next.js lists seven advisories. The release post rates the cross-tenant cache disclosure High: it happens when unstable_cache and use cache are combined (GHSA-mfr8-8qww-v76h). The others reported include cache poisoning in self-hosted apps, cookie exposure through the x-middleware-set-cookie header and an SVG rejection bypass in Image Optimization. Why it matters: the fix is a version bump, and the bug class is in features many teams adopted recently.
Patch logo for Patch Next.js to 16.4.5 or 15.5.29
GitHub Actions will block pull_request_target by default from December 2
What happened: GitHub is changing the default so public repositories can no longer run pull_request_target workflows unless an Actions event policy allows it. It covers public repositories on Free, Team and Enterprise Cloud. GitHub starts in evaluate mode and runs brownouts on November 9 and November 16, 16:00 to 18:00 UTC, before enforcement. Why it matters: the trigger was behind several supply-chain compromises, and any workflow that labels or comments on fork PRs with it needs an audit before December 2.
Logos: Simple Icons, trademarks of their owners.
Get the next issue in your inbox: subscribe to the newsletter. More articles: enpitech.dev/blog.
Nir
GitHub logo for GitHub Actions will block pull_request_target by default from December 2
