--- title: This Week In React #303: TanStack, Next.js, Vinext,... description: This week's React newsletter covers TanStack's Redact, a smaller synchronous React-compatible runtime now working with Start, Next.js, Vinext, and Vite.... canonical: https://daily.dev/posts/this-week-in-react-303-tanstack-next-js-vinext-motion-react-hook-form-u0p1l3ek9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week In React #303: TanStack, Next.js, Vinext, Motion, React Hook Form | daily.dev og:description: This week's React newsletter covers TanStack's Redact, a smaller synchronous React-compatible runtime now working with Start, Next.js, Vinext, and Vite.... og:url: https://daily.dev/posts/this-week-in-react-303-tanstack-next-js-vinext-motion-react-hook-form-u0p1l3ek9 og:image: https://api.daily.dev/og/posts/U0P1L3eK9.png og:image:alt: This Week In React #303: TanStack, Next.js, Vinext, Motion, React Hook Form og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week In React #303: TanStack, Next.js, Vinext, Motion, React Hook Form **[This Week In React](https://daily.dev/sources/twir)** · 9 min read · 1 upvotes · 1 comments ## Summary This week's React newsletter covers TanStack's Redact, a smaller synchronous React-compatible runtime now working with Start, Next.js, Vinext, and Vite. Next.js has an upcoming November security release planned for November 3 with 7 medium-severity vulnerabilities. Owner is moving 10,000+ restaurant sites from Next.js to Astro islands, with p75 menu-page LCP going from 5.4s to 0.7s. React Native Windows 0.85 completes its New Architecture move, Expo Desktop v1 and Legend Spark are desktop projects, and Nitro v1 is in alpha with a core package decoupled from React Native. Node.js 26 became LTS, and a Brotli decoder RCE ('Node2Shell') led to Node.js and Bun security releases for apps decoding untrusted Brotli data. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Node2Shell vulnerability in Node.js and do I need to upgrade? Node2Shell is a remote code execution vulnerability in Node.js's Brotli decoder, patched in the October 2026 Node.js security releases. You should upgrade Node.js (or Bun, which also shipped a fix in 1.4.4) immediately if your app decodes Brotli data that comes from outside your control, since an attacker could trigger RCE through malicious compressed input. _Developers patching Brotli-related RCE bugs can track security releases like this on daily.dev._ ### What is TanStack Redact and how does it differ from regular React? Redact is a new TanStack project, originally an AI-driven experimental projection by Tanner Linsley, offering a smaller React-compatible runtime for the browser that already works with Start, Next.js, Vinext, and Vite. On the server, nothing changes since React still handles SSR and Server Components. Its main tradeoff is synchronous rendering, without React's time slicing, so a heavy render can still delay input. _Teams weighing lighter React-compatible runtimes against time-slicing tradeoffs can follow updates like this on daily.dev._ ### How much did switching from Next.js to Astro improve page load performance for Owner? Owner moved over 10,000 restaurant websites from Next.js to Astro, running React only in islands, and saw their p75 menu-page Largest Contentful Paint (LCP) drop from 5.4 seconds to 0.7 seconds. This illustrates the performance gains possible when reducing client-side React usage on content-heavy sites through islands architecture. _Developers comparing Next.js and Astro for performance can keep tabs on real migration results via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > the Node2Shell brotli thing is the scarier item buried in here, decoding untrusted brotli is common enough (any gzip-style middleware) that a lot of apps are exposed without realizing brotli was ever in the attack surface. already patched in node/bun but check if you're pinned to an older point release. ## Similar posts on daily.dev - [This Week In React \#281: Next.js, TanStack, Security, Redact, React Router, Waku, HTML React Parser](https://daily.dev/posts/this-week-in-react-281-next-js-tanstack-security-redact-react-router-waku-html-react-parser-f1w5h4euc) · This Week In React · 5 upvotes · 0 comments - [This Week In React \#271: Vinext, RSC, Activity, Async React, Next.js, TanStack](https://daily.dev/posts/this-week-in-react-271-vinext-rsc-activity-async-react-next-js-tanstack-hqvstjkju) · This Week In React · 1 upvotes · 0 comments - [This Week In React \#294: React Compiler, TanStack, Next.js, GTKX, Effect, shadcn, Preact, Unhead, RHF](https://daily.dev/posts/this-week-in-react-294-react-compiler-tanstack-next-js-gtkx-effect-shadcn-preact-unhead-rh-gmkibvd2t) · This Week In React · 12 upvotes · 1 comments - [Issue \#485: TanStack's new look, and life without RSC — React Status](https://daily.dev/posts/issue-485-tanstack-s-new-look-and-life-without-rsc-react-status-bppdq9g5d) · React Status · 1 upvotes · 0 comments --- Tags: [#react](https://daily.dev/tags/react), [#nodejs](https://daily.dev/tags/nodejs), [#nextjs](https://daily.dev/tags/nextjs), [#react-native](https://daily.dev/tags/react-native), [#tanstack](https://daily.dev/tags/tanstack) [View this post on daily.dev](https://daily.dev/posts/this-week-in-react-303-tanstack-next-js-vinext-motion-react-hook-form-u0p1l3ek9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week In React #303: TanStack, Next.js, Vinext, Motion, React Hook Form","url":"https://daily.dev/posts/this-week-in-react-303-tanstack-next-js-vinext-motion-react-hook-form-u0p1l3ek9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-react-303-tanstack-next-js-vinext-motion-react-hook-form-u0p1l3ek9"},"datePublished":"2026-10-28T19:31:33.969Z","dateModified":"2026-10-28T21:33:16.121Z","description":"This week's React newsletter covers TanStack's Redact, a smaller synchronous React-compatible runtime now working with Start, Next.js, Vinext, and Vite....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4bb08af819de0f3b1acf2f4dd3b63513?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4bb08af819de0f3b1acf2f4dd3b63513?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"This Week In React","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"This Week In React","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e734a56ebd144c30a747abff7d8bc6e8","url":"https://daily.dev/sources/twir"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/this-week-in-react-303-tanstack-next-js-vinext-motion-react-hook-form-u0p1l3ek9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"react,nodejs,nextjs,react-native,tanstack","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"This Week In React","item":"https://daily.dev/sources/twir"},{"@type":"ListItem","position":3,"name":"This Week In React #303: TanStack, Next.js, Vinext, Motion, React Hook Form"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-react-303-tanstack-next-js-vinext-motion-react-hook-form-u0p1l3ek9","comment":[{"@type":"Comment","text":"the Node2Shell brotli thing is the scarier item buried in here, decoding untrusted brotli is common enough (any gzip-style middleware) that a lot of apps are exposed without realizing brotli was ever in the attack surface. already patched in node/bun but check if you’re pinned to an older point release.","datePublished":"2026-10-31T18:12:07.124Z","url":"https://daily.dev/posts/U0P1L3eK9#c-xpqEa0sJp","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-react-303-tanstack-next-js-vinext-motion-react-hook-form-u0p1l3ek9#faq","mainEntity":[{"@type":"Question","name":"What is the Node2Shell vulnerability in Node.js and do I need to upgrade?","acceptedAnswer":{"@type":"Answer","text":"Node2Shell is a remote code execution vulnerability in Node.js's Brotli decoder, patched in the October 2026 Node.js security releases. You should upgrade Node.js (or Bun, which also shipped a fix in 1.4.4) immediately if your app decodes Brotli data that comes from outside your control, since an attacker could trigger RCE through malicious compressed input. Developers patching Brotli-related RCE bugs can track security releases like this on daily.dev."}},{"@type":"Question","name":"What is TanStack Redact and how does it differ from regular React?","acceptedAnswer":{"@type":"Answer","text":"Redact is a new TanStack project, originally an AI-driven experimental projection by Tanner Linsley, offering a smaller React-compatible runtime for the browser that already works with Start, Next.js, Vinext, and Vite. On the server, nothing changes since React still handles SSR and Server Components. Its main tradeoff is synchronous rendering, without React's time slicing, so a heavy render can still delay input. Teams weighing lighter React-compatible runtimes against time-slicing tradeoffs can follow updates like this on daily.dev."}},{"@type":"Question","name":"How much did switching from Next.js to Astro improve page load performance for Owner?","acceptedAnswer":{"@type":"Answer","text":"Owner moved over 10,000 restaurant websites from Next.js to Astro, running React only in islands, and saw their p75 menu-page Largest Contentful Paint (LCP) drop from 5.4 seconds to 0.7 seconds. This illustrates the performance gains possible when reducing client-side React usage on content-heavy sites through islands architecture. Developers comparing Next.js and Astro for performance can keep tabs on real migration results via daily.dev."}}]} ```