React 19.3 shipped — and quietly admitted Trusted Types never worked

Every item below was fetch-verified before it entered the corpus. Links go to the primary source; the entry link goes to the full argument, with dates and caveats.

⚡ Act on this

React 19.3 is stable — and it is the first version where Trusted Types actually works. 19.3 shipped 2026-09-09. The headline is that <ViewTransition> and Fragment Refs graduated from experimental. The buried line matters more if you run a strict CSP. Trusted Types is a browser feature that says: code may not hand a raw string to a dangerous sink like innerHTML — it must hand over a typed object your sanitizer minted. React's old behaviour was to coerce everything with '' + value before touching the DOM. That coercion turned your minted object back into a plain string, which the browser then rejected. So the policy you configured was doing nothing. 19.3 stops coercing. If you enforce require-trusted-types-for 'script', you need React ≥19.3 — earlier versions cannot satisfy it. → security · react-core

Expo Go now requires you to be logged in — on both sides. SDK 57: scanning the QR code fails unless you are signed into the same account in the terminal and in the app. Scoped to the latest iOS Expo Go (Android is stated as coming), and it does not apply to simulators or development builds — which is one more argument for moving off Expo Go once you are past prototyping. → rn-versions

pnpm 12 closed a supply-chain hole you may not know you had. pnpm 12 is the Rust rewrite, and deliberately not a migration — commands, flags and the lockfile format carry over. Two things do change. Git specifiers for GitHub/GitLab/Bitbucket are now identities, always resolving over HTTPS with no SSH URL in the lockfile, so SSH access moves to git's url.insteadOf. And an unrecognized key in pnpm-workspace.yaml is now reported rather than ignored — which matters because a misspelled minimumReleaseAge used to disable install-age gating silently. A typo was switching off a supply-chain control and nothing said so. → build

Moved

Vitest 5 and Jest 30.5 shipped within a fortnight and converged on the same API. Vitest 5 publishes its numbers as a reproducible benchmark suite: −53% on a deps-heavy app, −15% to −25% on vm pools and Browser Mode, and ±3% where environment setup already dominates. That last figure is the useful one — if your reporter says environment 79%, your test speed is a jsdom-version problem and a faster runner will not fix it. Jest 30.5 independently added the same headline feature, per-argument mocking, plus describe-level retries. → testing

Zod 4.5 mostly retires the "Zod is the slow one" tradeoff. z.compile() pre-compiles a schema for ~3–9× faster parsing, z.validate() is a boolean fast path up to 16× faster on invalid data, and memory dropped ~9×. The bundle-size argument for Valibot survives; the runtime-speed one largely does not. → forms

Expo Modules 2.0 makes Nitro's headline claim stale. Expo's early look replaces the result-builder DSL with annotated plain Swift/Kotlin (@ExpoModule, @JS, @Record). The number that moves a recommendation: SDK 56 already put Expo Module calls on par with Turbo Modules, and the @JS path is a further 2.5–5.6× on synchronous calls. Nitro's marketing line of "~100× vs Expo Modules" was measured against a version that no longer exists, and the entry now says so. Status discipline: iOS-only and undocumented in SDK 57, official beta in SDK 58. → native

executorch v0.10 is a ground-up rewrite, not an upgrade. Opaque C++ task modules became inspectable TypeScript pipelines over a native runtime core, with per-silicon delegates across 130+ pre-exported model variants (Core ML/ANE, MLX, Vulkan). Take 0.10.1, which fixes iOS use_frameworks! build failures. The legacy entry point exists but is deprecated. → ondevice-ai

Also moved: Jotai 3 (ESM-only, React 18+, Node ≥22.12; atomFamily and the Babel plugins split into their own packages) · Formisch 1.0 leaves pre-1.0 across eight frameworks · Margelo joined Callstack (Nitro, VisionCamera and mmkv stay open source) · React DevTools 8.0 removed the Timeline profiler tab — React profiling now lives in the browser's own Performance panel, so any runbook that says "open Timeline" is out of date.

New on the board

File uploads got an entry, on evidence rather than noise. Probing all 34 census-cohort apps found 7 carrying a dedicated upload library, splitting into three different problems rather than three competing products: react-dropzone is the input (5 apps), @uppy/* is providers and a file-manager UI (1), tus-js-client is resumability and needs a tus-capable server (1). The React Native side is named as thin rather than papered over: no cohort RN app carries one. → uploads

nuqs finally got named. The state entry already described "URL params for view state" as a decision axis and attached no library to it. nuqs is that library — type-safe view state in the query string, a third bucket beside client and server state rather than a competitor to either. It is in production at Sentry, Cal.com, Supabase and Documenso. → state

Three agent-tooling rows, one from the React team. react-devtools-cdt-mcp is not an MCP server — it is a library you import in the page so chrome-devtools-mcp can discover React's inspection tools (experimental, web-only). Rozenite puts plug-and-play panels inside React Native DevTools, auto-disabled in production builds. Simlock fixes what the others cause — several agents fighting over one simulator — with a single primitive: lease a device. → observability · ai-devtools

Worth reading

What It Actually Takes to Migrate Discord to the New Architecture — the post-flip half nobody writes. Their ticket breakdown: rendering/layout 47%, crashes 16%, the migration itself 14%, performance 13%, input 11%. Flipping the switch is one seventh of the work. Three implicit contracts that changed underneath them are worth knowing before you hit them — the sharpest being view flattening. Fabric may skip creating a native view for a <View> that does not need one, and it re-decides that on every commit. Accessibility props are on the list that force a real view. So toggling accessibilityElementsHidden mid-gesture can swap the view your gesture was attached to, and the gesture silently dies. One prop fixes it: collapsable={false}. → native

React Native navigation, measured — the same app built four times, profiled on one Android device. Cold start: react-native-navigation 316 ms · React Navigation v7 358 ms · navigation 398 ms · Expo Router 917 ms. Peak RAM: 195 / 214 / 241 / 308 MB. All four hold ~60 FPS, so the difference is startup and memory, not smoothness. The why beats the ranking: Expo Router's gap is not Reanimated (measured at ~62 ms) — it is a 2× bigger bundle evaluating 106 JS modules at boot against 36–43. Reanimated is the RAM story instead, worth ~125 MB via the second Hermes runtime Worklets spins up. Read his caveats before quoting the table. → nav

Styling Linear for the future with StyleX — the first detailed non-Meta production migration to StyleX. The selection criteria are the durable part: build-time generation, styling-at-a-distance made deliberately hard, predictable cross-file merge, and — stated as first-class — agent ergonomics. Payoff: ~20–35% less main-thread CPU on view-heavy pages. Cost: parent and global selectors get harder, and holding the line needs lint plus a type-aware cross-file checker. → styling

Bridgeless: races with concurrent JS runtimes — a rule for anyone maintaining a C++ module. Under the old bridge a reload was strictly sequential, so a process-global pointer was safe by construction: only one runtime generation could ever touch it. Bridgeless starts the new instance before the old finishes draining, so two are alive at once for seconds. A background query finishing in that window schedules its callback onto whatever the global now points at — the wrong runtime. The fix generalizes: give each generation its own liveness flag, capture it at construction, check it when the work runs. → native

Agentic Coding: Bet on the Primitives — kept because it argues against this corpus's own default. A high-level library is prepaid implementation labour, bought with flexibility; when labour was scarce that trade was obviously worth it, and agentic coding moved the crossover toward primitives. He spikes it concretely (D3 vs Recharts) and argues the other side himself: without an agentic workflow the old maths still applies, commodity UI belongs on the happy path, and an agent collapses the cost of writing a layer, not of judging it. → charts

Didn't keep — and why

The corpus's negative space. Six newsletters and a first-party watch produced 348 links this pass; 54 became keeps. A few of the more interesting refusals, each with the signal that would reopen it:

• Remix 3.0 RC — pre-ship. It has a firm date though: it releases 2026-10-02 at Remix Jam, which is when we look again.
• TanStack Charts 0.16 — "officially in alpha, ready to be field-tested" is not a recommendation we can pass on. Reopen at beta, or a named production user.
• EAS Simulator — Expo's cloud simulators for agents look genuinely useful, and they are built on top of agent-device and Argent, which this corpus already recommends. But it is waitlist-gated early access, so there is nothing a reader can act on. Same treatment Expo Tuft got last pass.
• Lynx 4.0.2 — the release body is empty. There is nothing to verify a major-line claim against, so it was skipped as unverifiable rather than guessed at. Plus ~30 routine version bumps triaged and dropped.

Under the hood

The advocate pass — a mandatory hostile re-read of our own skips — flipped Rozenite back in, and the reason is worth recording: it had been skipped as "too early and untracked", but untracked was the gap, not evidence of immaturity. The spot-check overturned an older call too: rifm's cap skip listed "recurrence" as its reopen signal, recurrence happened, and the original reasoning turned out to be thin — so forms gained a masking clause. Six overdue predictions were challenged: three held, three weakened, none overturned.

Gates: lint clean · 1976 gold rows · 139/139 eval · every added URL machine-reverified · coverage clean on all five coverable issues. 29 entries touched, one new.