{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"This Month in React","title":"TMiR 2025-12: Year in review, React2Shell (RCE, DOS, SCE, oh my)","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/0f9a0980\"></iframe>","width":"100%","height":180,"duration":5990,"description":"Full transcript at Reactiflux\nMain Content\nReact2Shell vulnerabilityInitial announcementFollowup denial-of-service CVE and source code exposure CVE\nVercel bulletin\nCloudflareCloudflare report on exploit attempts\nCloudflare outage on December 5, 2025\nTech analysis: “Flight Protocol”\nVuln is carefully crafted Promise deserialization + `new Function` eval\nPRs: Initial fixes, Promise cycles / function toString, more Promise cycles\nGuillermo’s breakdown\nShruti’s breakdown\nComms critique\n“React is rainbow colored (function types)”\nWhat does this mean for React and RSC adoption going forward?\nWhen I go back and look at react.dev now \\[…\\] it feels half-finished\nReact Native year in reviewMore CSS support\nExpo EAS hosting\nRN 0.78: React 19 support\nLynx launched\nRN 0.79: JSC moving to Community Package\nRN 0.80: Freezing the legacy architecture\nRN 0.81: Android 16 support for edge to edge\n1.0 on the horizon\nVega OS launched\nRN 0.82: Only new architecture\nExpo App Awards\nRN 0.83: New Devtools - no breaking changes\nReact year in reviewCRA deprecation, new install docs (Vite\\!)\nStyled Components Deprecated\nReleases: 19.2 (Activity, useEffectEvent), Compiler 1.0\nResearch: View Transitions canary, perf, concurrent stores, “throw a promise” deprecated (but not merged yet)\n“Async React” and the ecosystem\nReact Foundation\nReact growth skyrockets\nReact Router RSC support, TanStack Start WIP RSC, Waku\nDan’s RSC explainers (he had a bunch of things to say)\nRemix v3 Jam recap (not React but relevant)\nMark went from frustrated (CRA) to excited (ReactConf, foundation, team efforts)\n⚡ Lightning round ⚡\nTS 7 progress update\nNPM classic tokens revoked\nGitHub Actions planned work\nGithub Action pricing change and immediate about-face\nStacked diffs proposal in the works?\nAnthropic bought Bun\nSVG Clickjacking from Lyra (SVG filters as logic gates??)\nDan Abramov’s RSC Explorer: https://rscexplorer.dev/ , https://overreacted.io/introducing-rsc-explorer/\nInstant-loading Github repo explorer using...","thumbnail_url":"https://img.transistorcdn.com/VQ58MIgeEU5co-s4Wg8b0RSpkM4utvXUCdcYT5mMzKM/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS82M2Nj/OThkNDJmMzg0YjEz/NjRkYWFjMGJjZTY1/ZTI1Mi5qcGc.webp","thumbnail_width":300,"thumbnail_height":300}