This week I pulled Create React App out of one project and wrote the plan to pull it out of another. Both were from 2022 and 2023, and both still worked. That is the deceptive part: still working and still being the right way to do it are different things, and between the two, four large changes happened in React that do not announce themselves.
None of this is rumour. All four are on the official blog, with dates. The compiler already deletes your useMemo
React Compiler reached 1.0 on October 7, 2025. Not beta, not an experiment: it automatically memoizes components and hooks, works in React and React Native, and installs through Babel, Vite or Rsbuild.
What that means in practice is that most of your useMemo and useCallback stopped being your job. You wrote them to avoid re-renders; the compiler does that optimization at build time, without rewriting anything.
There is one installation detail that catches people: if you had eslint-plugin-react-compiler, it is gone. You remove it and use eslint-plugin-react-hooks@latest, because the compiler's lint rules now ship inside its recommended and recommended-latest presets.
The compiler leans on the Rules of React. If a component breaks them, the compiler detects it and skips that component rather than optimizing it wrongly. Which means linter warnings stopped being cosmetic: they now decide whether your code gets optimized at all. If you serve Server Components, you now have a patch calendar
On December 3, 2025, React published a critical vulnerability in React Server Components: CVE-2025-55182, CVSS 10.0, the maximum score. An unauthenticated attacker could craft an HTTP request to any Server Function endpoint that, when deserialized by React, achieved remote code execution on the server.
It affected react-server-dom-webpack, react-server-dom-parcel and react-server-dom-turbopack in versions 19.0, 19.1.0, 19.1.1 and 19.2.0. Fixed in 19.0.1, 19.1.2 and 19.2.1.
And the list of affected frameworks is the list of what people actually use: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc and rwsdk.
Eight days later came the second batch. On December 11 two more were published: Denial of service (CVE-2025-55184, CVE-2025-67779 and CVE-2026-23864, CVSS 7.5): malicious requests to Server Function endpoints caused infinite loops that hang the process, eat CPU, and end in crashes or out-of-memory. Source code exposure (CVE-2025-55183, CVSS 5.3): a request could return the source of your Server Functions.
The detail in that last one is worth reading carefully, because it decides whether it touches you:
Only secrets hardcoded in the source are exposed. Ones coming from process.env are not. So: if you ever pasted a key straight into a file with 'use server' to test something, that is the file.
The operational conclusion is simple and it isn't about React: if your app serves Server Components, it stopped being a dependency you update when there's time. And if you use neither RSC nor a server, none of these reach you. React 19.3 shipped things that used to be solved outside React
It came out on September 9, 2026, days ago. animates elements as they enter, exit, move or resize, using the browser's View Transition API:
React picks which animation to run based on how the tree changed: enter, exit, update or share. And when the same state update should animate differently depending on why it happened, addTransitionType marks the cause:
Fragment refs solve wanting to touch the DOM of a group of elements without wrapping it in a div you never needed:
The FragmentInstance carries a deliberately small set of methods: addEventListener, removeEventListener, dispatchEvent, focus, focusLast, blur, observeUsing, unobserveUsing, getClientRects, getRootNode, compareDocumentPosition and scrollIntoView.
observeUsing is the one I care about: attaching an IntersectionObserver to a list without manufacturing a container just to have something to hold.