SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

React 19 hit by critical RCE flaw; compiler hits 1.0 and View Transitions land

0
·33 views

The React Compiler reached version 1.0 on October 7, 2025, automating component memoization for React and React Native and effectively replacing manual use of useMemo and useCallback in most cases. On December 3, 2025, a critical vulnerability (CVE-2025-55182, CVSS 10.0) was disclosed in React Server Components, allowing unauthenticated remote code execution via malicious HTTP requests to Server Function endpoints; patched versions 19.0.1, 19.1.2, and 19.2.1 were released. Eight days later, additional CVEs covering denial-of-service attacks and source code exposure of hardcoded secrets in Server Functions were published, with fixes arriving in 19.0.4, 19.1.5, and 19.2.4. Applications serving React Server Components are directly affected and should treat React upgrades as urgent security patches rather than routine maintenance. Separately, React also shipped native support for the browser View Transition API, enabling animations for elements as they enter, exit, move, or resize.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Per-requirement retrieval lifted a freelance proposal tool's recall, while hybrid search and reranking hurt

A developer built GigBid, a multi-agent copilot that matches freelance job posts against a portfolio and drafts proposals citing evidence for human approval. Testing on 180 synthetic dev jobs showed that adding BM25 to dense retrieval lowered Recall@5 from 0.528 to 0.418 when the whole job post was used as the query. Splitting each post into individual requirements and retrieving for each one raised Recall@5 to 0.821 and reached 0.947 with fusion and an outcome boost. A cross-encoder reranker reduced performance, so the developer kept it only as a relevance threshold to decide whether a skill is evidenced. The author reports that the retrieval layer, not the agents, presented the largest surprises, and that results were replicated on open-weight Qwen models.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Proven: a coding agent's ticket closes only after a Kane test fails, then passes

A developer built Proven, a ticket board for the Kane CLI hackathon, to stop coding agents from marking work done without evidence. Each ticket's plain-English Kane test is frozen and must fail on the current app before any change is made. After the agent's fix, Kane must pass the test, and a receipt linking the red and green runs is recorded. Closed tickets are rechecked with fresh runs, which caught a regression in the demo shop where a second ticket broke an earlier one. The tool currently supports only static web apps, and receipts are tamper-evident rather than tamper-proof.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

After SMS-Activate's closure, buyers should compare SMS delivery rates, not just prices

SMS-Activate has shut down, prompting a search for replacement providers used for receiving verification codes. The author, who runs the service SMSBulk, argues that price lists are misleading and that delivery rates per service and country matter more. Measured rates are only published when at least 20 concluded orders from three or more customers exist, with lower-volume pairs shown as High, Medium, or Low estimates instead. SMSBulk reports 39 of its 562 service-country pairs have measured rates, including some best-sellers that deliver only about one time in three. The post also describes an automatic refund if no code arrives within 20 minutes, while delivered codes are non-refundable, and it advises checking delivery rates and refund rules before comparing prices.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Norbert Wiener, el padre de la cibernética y sus advertencias sobre el control de la IA

The article profiles Norbert Wiener, the 20th-century mathematician known for his absent-minded anecdotes at MIT, while highlighting his deeper significance. It describes his upbringing under his demanding father Leo, a polyglot scholar who pushed him through an intense educational regime from early childhood. The piece argues that Wiener identified feedback loops, control and communication as the common foundation of intelligent systems, complementing the work of Turing, von Neumann and Shannon. It also notes that he warned early on about the alignment and control problem now central to debates on advanced artificial intelligence.

0 comments Read more at DEV Community