Hey guys,
Welcome to another edition of Import React by Cosden Solutions!
Stack Overflow took 1,442 questions last month, which is not a typo. Someone pulled the React Flight protocol apart and found the CVSS 10.0 gadget chain came down to two lines missing one check. And r/reactjs spent the week collectively confessing to the same mistake, which is probably the one you made too.
Let's get into it.
SPONSORED
Three days in Berlin, three concurrent stages, and 85 sessions built for React Native developers shipping production-grade, high-performance cross-platform apps with the New Architecture. Learn from the people building it — engineers from Meta, Amazon, Shopify, Expo, and Callstack — then take it further at hands-on workshops, roundtables, and a leadership summit for staff and principal engineers. One ticket unlocks it all: 8 concurrent dev events, including agentic codingCon and more!
⚡️ The Latest In React
🔁 What's the Hardest Thing to Understand in React?
Someone a year into React asked r/reactjs why maximum update depth errors keep blindsiding them, and the thread turned into a group confession. The top answer has more than double the upvotes of the question itself, and it's two words long. The best comment in there also happens to diagnose OP's exact error in a single sentence.
🕳️ Weaponizing the React Flight Protocol
React Server Components don't send HTML over the wire, or JSON — they send Flight, a streaming format that reconstructs executable references and RPC endpoints from a stream of text. December's React2Shell was a CVSS 10.0 unauthenticated RCE in that layer, and the entire gadget chain traces back to a two-line loop missing one check. Walks it end to end, then ranks the defenses.
🔀 Yelp Moved 1.4 Million Lines From Flow to TypeScript
Three years and seven months, 570 packages, and one rule they set on day one: never turn the typechecker off, not even temporarily. That constraint killed every fast approach and forced them to run Flow and TypeScript side by side in production the entire way. Type coverage went from 83% to 96%. Typechecking broke exactly once.
🪜 Props, Composers, and Providers
Orus ended up with props drilled four layers deep to reach a single leaf component, so they built a ladder: plain props, then compound components, then a Composer with swappable Providers, then lifted state behind a contract. The useful part is the costing — every rung names the specific pain that earns it, plus the reasons not to climb.
📊 TanStack Charts
TanStack has a charting library now, and the pitch isn't the API, it's the catalog — a hundred-odd live examples running from Sankey diagrams and streamgraphs to an orthographic globe and a playback scrubber you can actually drag. Grammar-of-graphics under the hood, closest in spirit to Observable Plot. Fair warning: you'll lose twenty minutes in there.
🧱 TanStack Table V9 Is Stable
Two years of refactors that quietly turned into a full rewrite, though most of the API you know survived it. The state layer moved onto TanStack Store, the new plugin architecture is tree-shakable so the average table ships smaller, and there's proper React Compiler compatibility. Cell spanning and cell selection are new. Migration guide has the rest.
Quick Links
The ReactCon Berlin lineup is live — 85 talks across three stages, including engineers from Meta, Shopify and Expo on what's actually landed with the New Architecture. Worth a scan if you're working out where this year's conference budget goes. (sponsored)
rshono — A minimal React Server Components framework: Hono for the server, Rspack for the build, one required file and nine exports. No file-system routing, no <Link>, no <Image>. Claims a 60kB initial payload and a 492ms cold build.
next-nuke — Finds every .next in your repo, sizes them, deletes, and optionally reinstalls. The real point is Turborepo: deleting .next alone can get silently restored from the .turbo cache, so the clean rebuild you thought you did is the old build.
Plate — A rich-text editor framework for React built on Slate, shipped as shadcn-installable plugins and components rather than a dependency you wrap. 16k stars, and there's a live AI editor demo on the homepage.
When a Job Offer Becomes a Zero-Day — Lazarus is running fake recruiter pitches at defense engineers, one built on a real Lockheed Martin job description. Ends in a Windows zero-day Microsoft patched on August 11. The delivery is SEO'd fake company sites.
Where an AI Watermark Can Hide in Plain Text — Anthropic is now marking Claude's plain-text output. It isn't hidden characters; the mark lives in which words the model picks, which is why it survives copy-paste.
No, Local Models Will Not Win — The case against local inference is batching, not quality. A GPU serves hundreds of users for roughly what it costs to serve one, so a home rig burns around 30× the resources for the same work.
🧠 AI & General Programming
💀 Stack Overflow Took 1,442 Questions Last Month
March 2014 was the peak at 207,204 in a single month. July 2026 brought in 1,442 — a 99.3% drop, and down 78% on July 2025 alone. The number isn't an estimate or a scrape either, it's a nine-line SQL query anyone can run against Stack Exchange's own public database, which is the part that stings.
🥊 "Code Was Never the Hard Part" Is an Insult to All Programmers
If coding is easy, why were there ever leetcode interviews, 10x rockstar job ads, and burnout long before AI existed? Why is SICP not a coffee-table book? Senko runs that argument all the way down, then turns it around on the people who insist figuring out what to build is the real work.
📐 What's the Best Programming Language for Coding Agents?
The claim doing the rounds is that dynamic languages are more token-efficient, with one widely cited post putting the gap at 2.6× and J winning outright. Dan Luu pre-registered his guesses, then had agents implement a full zstd decoder and Pandoc in each language. It doesn't hold, and the reason is in how the original evals were built.
🪦 The End of No Code
Bending Spoons just bought Airtable for $1.28 billion, and this post — written by someone who worked there for years and still loves the product — reads it as the moment no-code jumped the shark. His replacement isn't another platform. It's Linux, a coding agent, and a stack you could have picked in 2004.
See you next week,
Darius