In partnership with
Hey guys,
Welcome to another edition of Import React by Cosden Solutions!
This week got a little existential. A hiring manager's "explain the virtual DOM" interview question turned into a 300+ comment argument about whether senior devs are frauds or the question itself is broken. Meanwhile the TanStack team quietly admitted their own RSC bet didn't hold up, and a new React "successor" showed up arguing you don't need a virtual DOM at all.
1,000+ Claude Prompts Top Professionals Actually Use at Work
Claude can be your analyst, editor, and strategist.
But most professionals are using it to fix grammar.
These 1,000+ Claude prompts take it from grammar tool to your most powerful AI work assistant.
Sign up for Superhuman AI and get:
1,000+ ready-to-use Claude prompts to get real work done in minutes — researched, tested, and used by professionals at Google, Microsoft, and NASA
Superhuman AI newsletter (4 min daily) so you keep learning new AI tools and skills to stay ahead in your career — the prompts are just the beginning
⚡ Latest in React
An interviewer on r/reactjs asked senior React candidates to explain the virtual DOM from memory, no Googling, no AI. His result: in years of asking, exactly one candidate got there. The replies split hard — one side says it's the single most basic question a senior React dev should be able to answer, the other says the virtual DOM stopped being something anyone actually thinks about years ago and calling it fundamental is outdated. One senior dev running his own startup admitted he'd fail the question too. Go see which side you land on.
Tanner Linsley built tanstack.com's content pipeline around React Server Components specifically to keep a giant markdown/syntax-highlighting stack off the client — and it worked. Then he asked the question that unraveled it: if the dependency got small enough to ship, would you still need RSC at all? He found out the hard way, with real Lighthouse numbers on both sides of the decision. The full account is worth the read if you've ever reached for RSC to hide a dependency problem instead of solving it.
Dominic Gannaway — the guy who built Inferno — is back with Octane: same hooks, same Suspense, same actions, but compiled ahead of time. No virtual DOM, no rules of hooks, no hand-maintained dependency arrays. The homepage has a live counter demo running right in the page and a full playground to poke at. Worth five minutes just to see the compiler explain itself — it ships a doctor command that diagnoses your own misconfigurations before they bite you.
Not obscure-hooks advanced — boundary-condition advanced: closing a popover exactly when a URL changes without an extra render, detecting a browser-only API safely through SSR, keeping an infinite-query cache and a detail view in sync, and passing an RSC snapshot into client context without lying about how "live" it is. The write-up walks through why the obvious Effect-based fix is wrong for each one — and what actually holds up.
After React2Shell — the CVSS 10.0 RCE that hit an estimated 968,000+ exposed instances last year — Vercel is done shipping security patches ad hoc. Next.js now publishes advance notice roughly monthly, similar to how Django and Kubernetes handle it. The first scheduled release already covers 9 vulnerabilities, several rated high severity.
Quick Links
Three open memory leaks in Next.js itself — a router LRU cache that doesn't count its own keys, a retained RSC render tree on client disconnects, and middleware timeouts the sandbox never releases. If your self-hosted Next app slowly climbs in memory, it's probably not your code.
Pairing TSRX with TanStack Start — a genuine DX win client-side (control flow and scoped styles inline instead of scattered across files), but they found three real SSR seams and filed them upstream rather than quietly working around them.
Lee Robinson's "Rust Is Eating JavaScript," updated for 2026 — his 2021 prediction mostly came true: Turbopack's the default Next.js bundler, Rolldown replaced esbuild and Rollup in Vite, and even pnpm shipped an experimental Rust install engine.
Vercel Labs is experimenting with compiling plain TypeScript to native binaries — no Node, no V8, ~2ms startup. Early (41 stars), but the "tells you exactly which lines can't compile statically" approach is a nice touch.
pnpm 11.11–11.14 shipped native workspace release management, a pnpm doctor diagnostic command, and a path-traversal fix.
A genuinely useful structured-logging convention from Sentry — stable domain.action event names, scoped dot-notation attribute keys, primitives only. Comes with copy-paste prompts if you want an agent to set up the ESLint rules for you.
🧠 AI & General
Your shared Claude chats may have been indexed by Google. Reddit users found that shared Claude conversations and Artifacts were showing up in Google search results over the weekend — some reportedly containing medical records and kids' contact info. Anthropic says it was remediated and that only links posted somewhere public (not sent privately) end up searchable. Full story here — worth checking Settings → Privacy → Shared Chats regardless.
Anthropic used Claude to find real weaknesses in cryptographic algorithms — not implementation bugs, flaws in the math itself. One attack cut the effective key strength of a NIST post-quantum signature candidate in half; another sped up attacks on reduced-round AES by 200–800x. Neither affects anything in production today, but the discovery process (three days, a billion output tokens, mostly autonomous) is the more interesting part.
Anthropic quietly deleted over 80% of Claude Code's system prompt for its newest models with no measurable regression. The write-up on what changed is a good context-engineering read even if you don't use Claude Code — the shift is from rigid rules toward giving the model well-designed tools and letting judgment do the rest.
"LLMs reward expertise," not prompting tricks. Sean Goedecke's take, anchored on Terence Tao's since-viral ChatGPT conversation about a math conjecture: the skill that actually matters when working with an LLM is domain expertise, not cleverly-worded prompts. If you have a real theory of your own codebase, you can push a model much harder than someone with none.
A companion piece worth pairing with it: "you don't have to be smart if you can think clearly" — his argument that the gap between a "smart" engineer and a "strong" one shows up exactly when the answer doesn't come instantly, and that grinding through uncertainty methodically beats waiting for a flash of insight.
That's it for this week. See you next Thursday.
— Darius