Episode Details
Back to EpisodesTMiR 2025-12: Year in review, React2Shell (RCE, DOS, SCE, oh my)
Season 2
Episode 12
Published 5 months ago
Description
Full transcript at Reactiflux
Main Content
- React2Shell vulnerability
- Initial announcement
- Cloudflare
- Tech analysis: “Flight Protocol”
- Vuln is carefully crafted Promise deserialization + `new Function` eval
- PRs: Initial fixes, Promise cycles / function toString, more Promise cycles
- Guillermo’s breakdown
- Shruti’s breakdown
- Comms critique
- “React is rainbow colored (function types)”
- What does this mean for React and RSC adoption going forward?
- When I go back and look at react.dev now \[…\] it feels half-finished
- React Native year in review
- More CSS support
- Expo EAS hosting
- RN 0.78: React 19 support
- Lynx launched
- RN 0.79: JSC moving to Community Package
- RN 0.80: Freezing the legacy architecture
- RN 0.81: Android 16 support for edge to edge
- 1.0 on the horizon
- Vega OS launched
- RN 0.82: Only new architecture
- Expo App Awards
- RN 0.83: New Devtools - no breaking changes
- React year in review
- CRA deprecation, new install docs (Vite\!)
- Styled Components Deprecated
- Releases: 19.2 (Activity, useEffectEvent), Compiler 1.0
- Research: View Transitions canary, perf, concurrent stores, “throw a promise” deprecated (but not merged yet)
- “Async React” and the