--- title: This Week In React #291: ReactBench, Security, TSRX,... description: Weekly roundup covering React and Next.js security patches (React 19.x DoS fix, Next.js July 2026 security release), ReactBench benchmarking coding agents on... canonical: https://daily.dev/posts/this-week-in-react-291-reactbench-security-tsrx-react-aria-dx-styles-tanstack-forms-gtkx-poeyvgfsu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week In React #291: ReactBench, Security, TSRX, React Aria, dx-styles, TanStack, Forms, GTKX | daily.dev og:description: Weekly roundup covering React and Next.js security patches (React 19.x DoS fix, Next.js July 2026 security release), ReactBench benchmarking coding agents on... og:url: https://daily.dev/posts/this-week-in-react-291-reactbench-security-tsrx-react-aria-dx-styles-tanstack-forms-gtkx-poeyvgfsu og:image: https://api.daily.dev/og/posts/PoeYvgFSu.png og:image:alt: This Week In React #291: ReactBench, Security, TSRX, React Aria, dx-styles, TanStack, Forms, GTKX og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week In React #291: ReactBench, Security, TSRX, React Aria, dx-styles, TanStack, Forms, GTKX **[This Week In React](https://daily.dev/sources/twir)** · 9 min read · 9 upvotes · 1 comments ## Summary Weekly roundup covering React and Next.js security patches (React 19.x DoS fix, Next.js July 2026 security release), ReactBench benchmarking coding agents on real React tasks, TSRX and the upcoming Octane.js framework, shadcn adding first-class React Aria support, and dx-styles zero-runtime CSS-in-TS library. React Native highlights include Swift Package Manager support backported to RN 0.87, a Binary Props RFC promising major Android prop update performance gains, and multiple library releases (Metro 0.87, Worklets 0.11, Vision Camera 5.1, Gesture Handler 3.1). The tooling section covers Oxlint 1.75 stable type-aware linting, pnpm 11.11-11.14 workspace release management, Rolldown 1.2, Astro 7.1, and Lightning CSS 1.33. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the React security advisory GHSA-wx67-qw84-cm4g fix and which versions are patched? It fixes a high-severity denial of service vulnerability in React Server Functions. The patch is included in React versions 19.0.8, 19.1.9, and 19.2.8, so any application still on an earlier 19.x release remains exposed until upgraded. _Teams tracking React security patches can follow advisories like this one on daily.dev._ ### What vulnerabilities did the Next.js July 2026 security release fix and which versions include the patch? Next.js shipped its first pre-announced monthly security release fixing 4 high-severity and 5 medium-severity vulnerabilities, patched in versions 16.2.11 and 15.5.21. This marks a shift toward a regular, scheduled security release cadence for the framework rather than ad hoc patches. _daily.dev helps developers stay ahead of Next.js security releases before they ship to production._ ### What performance improvement does the React Native Binary Props RFC propose for Android prop updates? The proposed RFC phases out folly::dynamic objects from Fabric's Android prop update pipeline, replacing per-prop serialization with a single shared binary diff. Benchmarks show per-view-per-frame cost dropping from roughly 257 microseconds to 36 microseconds, cutting total time for 200 animated views from 64.3ms to 17.1ms on an entry-level phone. _Developers optimizing React Native animation performance can track proposals like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@sebastienlorber** · 0 upvotes > This week we have React and Next.js security patches. React Aria becomes first-class in shadcn. A benchmark grades coding agents at real React tasks. The rise of TSRX and its upcoming framework. > > On the mobile side, Swift Package Manager support is finally coming. > > A TC39 meeting is in progress, we'll share the proposal updates next week. Oxlint type-aware linting is ready for prime-time. Meanwhile, Yuku explains how it outperforms Oxc at parsing JS. ## Similar posts on daily.dev - [This Week In React \#279: Compiler, TSRX, StyleX, XState, Hook Form, TanStack, shadcn, Chakra, Inertia, Mantine](https://daily.dev/posts/this-week-in-react-279-compiler-tsrx-stylex-xstate-hook-form-tanstack-shadcn-chakra-inerti-kavpas8k2) · This Week In React · 15 upvotes · 0 comments - [This Week In React \#294: React Compiler, TanStack, Next.js, GTKX, Effect, shadcn, Preact, Unhead, RHF](https://daily.dev/posts/this-week-in-react-294-react-compiler-tanstack-next-js-gtkx-effect-shadcn-preact-unhead-rh-gmkibvd2t) · This Week In React · 12 upvotes · 1 comments - [This Week In React \#277: TanStack RSC, React2Dos, Next.js, MUI, Base UI, Aria, StyledComponents, Storm](https://daily.dev/posts/this-week-in-react-277-tanstack-rsc-react2dos-next-js-mui-base-ui-aria-styledcomponents-sto-1rid3wosh) · This Week In React · 16 upvotes · 1 comments - [This Week In React \#284: TanStack Start, Compiler, React Router, Forms, TypeGPU, React Aria, shadcn, XState](https://daily.dev/posts/this-week-in-react-284-tanstack-start-compiler-react-router-forms-typegpu-react-aria-shadcn--vvzhkro2w) · This Week In React · 17 upvotes · 0 comments - [Issue \#485: TanStack's new look, and life without RSC — React Status](https://daily.dev/posts/issue-485-tanstack-s-new-look-and-life-without-rsc-react-status-bppdq9g5d) · React Status · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#react](https://daily.dev/tags/react), [#typescript](https://daily.dev/tags/typescript), [#react-native](https://daily.dev/tags/react-native) [View this post on daily.dev](https://daily.dev/posts/this-week-in-react-291-reactbench-security-tsrx-react-aria-dx-styles-tanstack-forms-gtkx-poeyvgfsu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week In React #291: ReactBench, Security, TSRX, React Aria, dx-styles, TanStack, Forms, GTKX","url":"https://daily.dev/posts/this-week-in-react-291-reactbench-security-tsrx-react-aria-dx-styles-tanstack-forms-gtkx-poeyvgfsu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-react-291-reactbench-security-tsrx-react-aria-dx-styles-tanstack-forms-gtkx-poeyvgfsu"},"datePublished":"2026-07-22T17:40:59.971Z","dateModified":"2026-09-13T19:16:39.253Z","description":"Weekly roundup covering React and Next.js security patches (React 19.x DoS fix, Next.js July 2026 security release), ReactBench benchmarking coding agents on...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4bb08af819de0f3b1acf2f4dd3b63513?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4bb08af819de0f3b1acf2f4dd3b63513?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"This Week In React","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"This Week In React","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e734a56ebd144c30a747abff7d8bc6e8","url":"https://daily.dev/sources/twir"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/this-week-in-react-291-reactbench-security-tsrx-react-aria-dx-styles-tanstack-forms-gtkx-poeyvgfsu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,webdev,react,typescript,react-native","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"This Week In React","item":"https://daily.dev/sources/twir"},{"@type":"ListItem","position":3,"name":"This Week In React #291: ReactBench, Security, TSRX, React Aria, dx-styles, TanStack, Forms, GTKX"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-react-291-reactbench-security-tsrx-react-aria-dx-styles-tanstack-forms-gtkx-poeyvgfsu","comment":[{"@type":"Comment","text":"This week we have React and Next.js security patches. React Aria becomes first-class in shadcn. A benchmark grades coding agents at real React tasks. The rise of TSRX and its upcoming framework.\nOn the mobile side, Swift Package Manager support is finally coming.\nA TC39 meeting is in progress, we’ll share the proposal updates next week. Oxlint type-aware linting is ready for prime-time. Meanwhile, Yuku explains how it outperforms Oxc at parsing JS.","datePublished":"2026-07-22T17:45:02.223Z","url":"https://daily.dev/posts/PoeYvgFSu#c-CIPUfInl6","author":{"@type":"Person","name":"Sébastien Lorber","url":"https://daily.dev/sebastienlorber","image":"https://avatars0.githubusercontent.com/u/749374?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-react-291-reactbench-security-tsrx-react-aria-dx-styles-tanstack-forms-gtkx-poeyvgfsu#faq","mainEntity":[{"@type":"Question","name":"What does the React security advisory GHSA-wx67-qw84-cm4g fix and which versions are patched?","acceptedAnswer":{"@type":"Answer","text":"It fixes a high-severity denial of service vulnerability in React Server Functions. The patch is included in React versions 19.0.8, 19.1.9, and 19.2.8, so any application still on an earlier 19.x release remains exposed until upgraded. Teams tracking React security patches can follow advisories like this one on daily.dev."}},{"@type":"Question","name":"What vulnerabilities did the Next.js July 2026 security release fix and which versions include the patch?","acceptedAnswer":{"@type":"Answer","text":"Next.js shipped its first pre-announced monthly security release fixing 4 high-severity and 5 medium-severity vulnerabilities, patched in versions 16.2.11 and 15.5.21. This marks a shift toward a regular, scheduled security release cadence for the framework rather than ad hoc patches. daily.dev helps developers stay ahead of Next.js security releases before they ship to production."}},{"@type":"Question","name":"What performance improvement does the React Native Binary Props RFC propose for Android prop updates?","acceptedAnswer":{"@type":"Answer","text":"The proposed RFC phases out folly::dynamic objects from Fabric's Android prop update pipeline, replacing per-prop serialization with a single shared binary diff. Benchmarks show per-view-per-frame cost dropping from roughly 257 microseconds to 36 microseconds, cutting total time for 200 animated views from 64.3ms to 17.1ms on an entry-level phone. Developers optimizing React Native animation performance can track proposals like this on daily.dev."}}]} ```