Next.js security fix, Agentic React, Flat Rate CDN

Next.js Security Update for a Critical Upstream Issue

Next.js shipped an urgent security update for a serious upstream problem that could lead to remote code execution in some apps using next/og on Node.js. Versions 16.2.0 to 16.3.5 are affected, and the fix is available in v16.3.6

---

⚡️ Sponsor: Avos News

A research desk used to cost six figures. Yours costs nothing.

Avos's agents read your sources overnight and print one private edition each morning.

📙 Articles / Tutorials / News

React Activity: When A Render No Longer Guarantees an Effect

The tricky part of <Activity> isn’t state, it’s timing. This article explains why hidden components can still render, why Effects may not run, and why StrictMode matters more than ever

React doesn't need a state management tool, I said. Then I built one.

Štěpán Granát explains why Context can be a nice home for shared state but often hurts performance, then introduces react-arven, a small library that combines your existing React state into one provider while avoiding unnecessary re-renders with selectors and stable actions

React Agentic Engineering 2026

This post looks at how tools like Next.js, MUI, Storybook, and Playwright are now making themselves easier for AI agents to use by shipping docs, skills, and MCP servers

Introducing Flat Rate CDN

Vercel’s new Flat Rate CDN gives Pro teams a fixed monthly CDN bill, with spike protection built in, so sudden traffic jumps won’t turn into surprise costs

---

📦 Projects / Packages / Tools

Modern React Guidance

An agent skill designed for AI coding assistants like Cursor or GitHub Copilot to teach them how to write modern React 19+ code. It covers all the latest features like Actions, the new use() hook, React Compiler, and <ViewTransition>

Great UI

Beautiful React components built with Tailwind CSS for quick use in your app

React Simple Maps

A React library for building SVG map charts with small, composable components rather than a big chart config system. You can bring your own GeoJSON or TopoJSON files and build maps much like any other React layout

---

Sponsor the newsletter

If you’re building something for the Next.js community, consider sponsoring this newsletter and putting it in front of 7,100+ Next.js developers.

---

🌈 Related

React Now Rusted All The Way Out

This isn’t Next.js-specific, but it is a useful look at where React Compiler tooling is heading. A team moved a large React app from the Babel-based compiler to the new Rust version and saw much faster compile times, plus better support for common JavaScript patterns

How Turbopack chunks your JavaScript

A helpful explanation into how Turbopack splits JavaScript in Next.js, and why chunking is really a tradeoff between fewer requests and less code shipped

React Server Functions Are More Than Mutations

The author shows how Server Functions can do more than mutations by powering read requests and streamed updates

𝕏 Hono or Elysia

If you’ve seen both names but weren’t sure how they differ, this is a good quick read. Hono keeps things small, simple, and close to web standards, while Elysia adds more built-in features, stronger typing, and Bun-focused speed