React forms done right

React forms done right
7 minutes by Vu Nguyen

Forms are not just about UI; they are a complex state problem with validation, async checks, server round-trips, and accessibility overlapping each other. Vu walks through the form mental model and builds three practical archetypes: a lightweight React 19 server action form, a multi-step wizard using TanStack Form, and a high-performance editable table. He compares the trade-offs of native React 19 versus client-side libraries.

Still writing tests manually? Meticulous AI is here.
sponsored by Meticulous

Most teams are forced to make the tradeoff between better coverage and more maintenance effort. But top engineering teams like Notion, Dropbox, Wealthsimple and LaunchDarkly have discovered a new testing paradigm. Built by ex-Palantir engineers, Meticulous creates and maintains E2E UI tests that covers every edge case of your web app without any developer effort - making it the only tool to improve both product quality and dev velocity.

Props, composers, and providers: The composition pattern we're converging on
11 minutes by Maxime Grébauval

Frontend components get messy fast: props drilled too deep, one component doing too much, rows needing a new prop for every variation. To fight this, Maxime suggests when to add complexity. Start with plain props, move to compound components when shapes multiply, add a Composer and Provider pattern when the same UI needs data from multiple sources, and lift state behind a shared contract when it needs to cross component boundaries. Each step up costs indirection, so you only climb when a real pain demands it.

The absolute state of management
5 minutes by Alex Russell

React popularized misleading terms like "state management" for tools that are really just thin data caches without query support, persistence, or conflict resolution. These systems break down at scale and handle real-time sync poorly. Better solutions exist using CRDTs and proper sync engines, but most developers only discover this when adding real-time collaboration. Redux and Apollo are signs of unmet need, not solutions to it.

How to build a user menu in React with invoker popover commands
4 minutes by Sergio Xalambrí

Sergio explains how to build a simple user menu in React using the browser's Popover API and Invoker Commands instead of React state. He shows how to create a menu that opens, closes, and handles common interactions with less code. He also covers TypeScript support, basic styling, and when this approach works best compared to using a full menu or dialog library.

Weaponizing and defending the React flight protocol: Deserialization sinks in RSCs
28 minutes by Durgesh Pawar

While React Server Components rely on the custom Flight protocol to stream interactive UIs, this same mechanism introduces powerful deserialization sinks that attackers can exploit. Durgesh breaks down the mechanics behind the CVSS 10.0 “React2Shell” vulnerability to show how protocol manipulation can lead to remote code execution. It also covers a practical, ranked set of defenses, from strict schema validation to CSRF hardening, for securing React applications against these structural risks.

And the most popular article from the last issue was:

• I stopped destructuring everything