Who contributed to Meta on July 30, 2026?

5 developers shipped this update, including eps1lon, fallintoplace, Sam Zhou, Dawid Małecki, and Peter Abbondanzo.

What were the notable Meta updates?

[Flight] Port ReplyServer traversal guards to FlightClient, [DOM] Blur focused descendants in Fragment refs, and Wire the Android pull model in C++ behind the feature flag (#57579).

REACT HARDENS FLIGHT CLIENT AGAINST UNTRUSTED INPUT, FRAGMENT BLUR BUG FIXED

By RepoJournal · Filed 06:59 UTC on July 30, 2026 · About Meta

5 people shipped this

Dawid Małecki @coado 3 cited

eps1lon @eps1lon 1 cited

fallintoplace @fallintoplace 1 cited

Sam Zhou @SamChou19815 1 cited

Peter Abbondanzo @Abbondanzo 1 cited

React added traversal guards to Flight Client to defend against prototype pollution attacks, while a separate fix ensures Fragment refs properly blur nested focused elements.

React's Flight layer got defense-in-depth coverage [1] with guards ported from ReplyServer to FlightClient, protecting against catastrophic vulnerabilities if untrusted input reaches the serialization layer. In parallel, a Fragment DOM bug [2] landed that fixes a regression where blur() would miss focused elements nested inside Fragment host children, treating nested active elements as part of the Fragment scope. On the React Native side, the team is rolling out the Android pull model for real with wiring complete behind a feature flag [3], making the commit thread signal transaction availability while the UI thread pulls and applies at mount time, matching iOS/macOS behavior. The changes are byte-for-byte identical when the flag is off (default), and include Robolectric test coverage [4] validating the notification path. Maestro test isolation landed [5] to retry only failing iOS flows in isolated processes, preventing transient driver failures from restarting the full suite. Flow config got modernized [6] to use the new glob ignore system, and a new feature flag [7] gates transparent tint color handling on Images.

Action items

→ Review Flight Client changes for your serialization pipeline, particularly if handling any external input facebook/react [plan]
→ Test Fragment blur behavior in your app if using Fragment refs with nested focus management facebook/react [monitor]
→ Monitor enableMountingCoordinatorPullModelAndroid flag rollout on Android for pull model adoption facebook/react-native [monitor]

References

[1] [Flight] Port ReplyServer traversal guards to FlightClient ↗ facebook/react
[2] [DOM] Blur focused descendants in Fragment refs ↗ facebook/react
[3] Wire the Android pull model in C++ behind the feature flag (#57579) facebook/react-native
[4] Add JVM tests for the Android pull model plumbing (#57583) facebook/react-native
[5] Make Maestro iOS retries flow-specific (#57749) facebook/react-native
[6] Switch to the new glob system of ignore in react-native flowconfig (#57758) facebook/react-native
[7] Add enableImageTransparentTintColor feature flag (#57607) facebook/react-native

Quick answers

What shipped in Meta on July 30, 2026?: React added traversal guards to Flight Client to defend against prototype pollution attacks, while a separate fix ensures Fragment refs properly blur nested focused elements. In total, 12 commits and 2 pull requests landed.
Who contributed to Meta on July 30, 2026?: 5 developers shipped this update, including eps1lon, fallintoplace, Sam Zhou, Dawid Małecki, and Peter Abbondanzo.
What were the notable Meta updates?: [Flight] Port ReplyServer traversal guards to FlightClient, [DOM] Blur focused descendants in Fragment refs, and Wire the Android pull model in C++ behind the feature flag (#57579).

REACT DEVTOOLS GAINS PROFILER SEARCH, REACT NATIVE FIXES ANIMATION INITIALIZATION

React's Profiler just got the component search feature developers have been requesting, while React Native patches a critical animation backend timing issue across 13 commits and 2 PRs.

javascript 16 shipped

Meta Aug 5

REACT NATIVE PLUGS TWO CRITICAL CRASHES ACROSS ANDROID AND iOS

A percentage borderRadius on Android Images and a Debug/Release build swap on iOS are both fixed overnight, clearing two silent production killers from the pipeline.

javascript 5 shipped

Meta Aug 4

REACT DEVTOOLS KILLS TIMELINE PROFILER, PIVOTS TO PERFORMANCE PANEL

React DevTools is retiring its built-in Timeline profiler and steering users to the browser's native Performance tracks instead, ripping out 74 files of dead code in the process.

javascript 16 shipped

Meta Aug 3

REACT NATIVE QUIETLY UPGRADES CODE FORMATTER INTERNALS

One commit landed on React Native master overnight, and it's all infrastructure.

javascript 1 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.