
Hey guys,
Welcome to another edition of Import React by Cosden Solutions!
It’s already week two of 2026! This edition dives into 10+ years of React performance from Vercel, the very real RSC security fallout, and a hard look at where Server Actions fall short.
Enjoy!
⚡️ The Latest In React
👏 Vercel Shares 10+ Years of React Performance Best Practices
This post introduces React Best Practices, a practical framework from Vercel that captures 10+ years of real-world React and Next.js performance lessons. Instead of chasing micro optimizations, it focuses on high-impact issues like async waterfalls, bundle size, and unnecessary re-renders, ordered by what actually moves metrics first. Each rule includes examples, impact ratings, and guidance that works for both humans and AI coding agents. Great if you want a clearer mental model for React performance and a checklist you can actually apply.
🔭 How to Steal Any React Component (Using Fiber + LLMs)
This article shows a clever (and slightly unsettling) way to reconstruct React components directly from a live website, without source code. By digging into React Fiber data in the browser and using an LLM to rebuild components from props and HTML output, the author walks through a repeatable reverse-engineering workflow. It’s less about stealing code and more about understanding how React actually works under the hood. Great if you want a deeper mental model of React internals, or a reminder that frontend code is never truly private.
🚨 The React RSC Security Crisis Explained
This is a good breakdown of the recent React Server Components security failures and why they caught so many teams off guard. It explains how React2Shell and follow up CVEs broke the client/server boundary, leading to real-world RCE, DoS, and source code leaks, often without any “bad” user code. The article is valuable because it goes beyond panic headlines and shows what actually went wrong, why infra defenses failed, and what teams should do now. Essential reading if you ship Next.js App Router or React 19 in production.
🚦 Don’t Fetch with Server Actions (Here’s the Proof)
This article answers a question many React devs have asked lately, can Server Actions replace fetch for client-side data loading? Through real benchmarks, it shows that while it works technically, Server Actions serialize requests, killing parallelism and massively slowing real apps. The piece is useful because it cuts through hype with clear measurements, practical examples, and a firm conclusion. If you’re using Next.js and tempted to overuse Server Actions, this will save you pain.
🎁 Cosden Code now has a free tier
I opened up a new free tier of Cosden Code, The first two lessons of every module are now free so people can get a real feel for the platform, the teaching style, the built-in IDE, and the AI mentor, before going further. It's meant to be hands-on from day one, try it yourself before committing (no credit card required), especially with TypeScript, projects, and a ton of new courses dropping early this year.
Quick Links
Everything you actually need to know about act() in React tests, when to use it, when not to, and how to avoid warnings.
React diagram components plus a UI library, built for visualizing flows and complex systems.
If your TanStack Form validation runs but errors don’t show, this is probably why.
A polished set of animated Heroicons using Motion, ready to drop into React apps.
A deep technical breakdown of React2Shell, how prototype pollution in RSC led to real-world RCE.
Astro 6 Beta brings a new dev server, better prod parity, and built-in CSP support.
A study of 470 PRs found AI-assisted code had ~1.7× more issues.
A practical guide to profiling React performance (React DevTools + Chrome Performance Tracks) and fixing the usual culprits such as re-renders, bundle bloat, and INP.
🧠 AI & General Programming
📰 A new place to read your newsletters
We’re trying out a free app for reading newsletters called Khaki. The interface is clean, distraction-free, and only shows the newsletters I’m subscribed to, no noise of everything else in my usual inbox. We’re loving it and think you would too. Get beta access with your Gmail and code NEWSLETTER. (sponsored)
❌ Don’t Fall Into the Anti-AI Hype
This is a clear, first-hand account from a systems programmer on how AI has already changed daily programming. antirez explains, with concrete examples, how LLMs now handle real production work, from debugging Redis to writing C libraries, faster than humans alone. The value here isn’t hype or fear, but a pragmatic mindset shift, coding is becoming more about problem framing and judgment than typing. A great read in my opinion if you’re unsure whether to lean into AI or resist it.
🐰 Bun vs Node for React SSR
This post is a great real world case study of swapping Node for Bun to speed up React SSR in production, without rewriting the app. Tim walks through the benchmarks, the Kubernetes tuning, and what changed when Bun’s faster startup and lower overhead hit real traffic. The big takeaway is practical, better throughput, lower latency, faster scaling, and even cost wins, all from changing the runtime. Worth a click if you care about SSR performance or you’re curious whether Bun is ready for serious workloads.
💔 Web Dependencies Are Broken, Can We Fix Them?
Lea Verou makes a strong case that web dependency management is fundamentally broken, and bundlers have become the “price of admission” for basic code reuse. She walks through today’s bad options, shipping node_modules, relying on CDNs, “browser” bundles, import maps, and explains why they all fall apart once dependencies have dependencies. The useful bit is the bigger picture, why this hurts DX, security, and even web standards, plus what could change (like better import maps and platform-level solutions).
📆 Why JavaScript Date Calculations Are Still Hard (And How to Do Them Safely)
This is a short, memorable story about how JavaScript Date can go very wrong in real life, even with code that looks perfectly reasonable. Phil breaks down how time zones, overflow, and mutability combine to produce a wildly incorrect result, and why it’s so hard to spot.
🔎 Why Software Engineers Need a Healthy Dose of Cynicism
This piece argues that a small amount of cynicism is actually healthy for software engineers, especially in big tech. Sean explains why understanding org politics, incentives, and tradeoffs doesn’t make you a sell-out, it helps you get real work shipped. It challenges the idea that “good engineering” exists outside compromise, and reframes influence as a skill, not a moral failure. Useful if you’ve ever felt frustrated, disillusioned, or unsure how to do meaningful work inside a large company.
How to Learn React in 2026 (Without Getting Left Behind)
The truth is that in 2026, learning React is no longer enough. What used to work in the past no longer does, and if you want success in this career as a React developer, you have to adapt.
To really be able to learn React successfully in 2026, you have to both learn the React fundamentals and also learn how to use AI to write your code. Both of these are important. You need to know your React fundamentals like components, props, hooks, and so on, to be able to use and direct AI effectively to write your code for you.
See you next week,
Darius Cosden