TMiR 2025-12: Year in review, React2Shell (RCE, DOS, SCE, oh my)

Full transcript at ReactifluxMain ContentReact2Shell vulnerabilityInitial announcementFollowup denial-of-service CVE and source code exposure CVEVercel bulletinCloudflareCloudflare report on exploit attemptsCloudflare outage on December 5, 2025Tech analysis: “Flight Protocol”Vuln is carefully crafted Promise deserialization + `new Function` evalPRs: Initial fixes, Promise cycles / function toString, more Promise cyclesGuillermo’s breakdownShruti’s breakdownComms critique“React is rainbow colored (function types)”What does this mean for React and RSC adoption going forward?When I go back and look at react.dev now \[…\] it feels half-finishedReact Native year in reviewMore CSS supportExpo EAS hostingRN 0.78: React 19 supportLynx launchedRN 0.79: JSC moving to Community PackageRN 0.80: Freezing the legacy architectureRN 0.81: Android 16 support for edge to edge1.0 on the horizonVega OS launchedRN 0.82: Only new architectureExpo App AwardsRN 0.83: New Devtools - no breaking changesReact year in reviewCRA deprecation, new install docs (Vite\!)Styled Components DeprecatedReleases: 19.2 (Activity, useEffectEvent), Compiler 1.0Research: View Transitions canary, perf, concurrent stores, “throw a promise” deprecated (but not merged yet)“Async React” and the ecosystemReact FoundationReact growth skyrocketsReact Router RSC support, TanStack Start WIP RSC, WakuDan’s RSC explainers (he had a bunch of things to say)Remix v3 Jam recap (not React but relevant)Mark went from frustrated (<a href="https://blog.isquaredsoftware.com/2025/06/rea