React, React Native, and Jest harden the stack

The month's most significant theme was hardening: React Native fixed critical crashes, patched a remote code execution vulnerability, and reduced security risks across platforms. Key fixes included a critical shell-quote RCE , a crash when setting percentage borderRadius on Android images [2], and a keyboard focus fix on iOS [3]. This maintenance had real cost: the deep copy of ArrayBuffers on React Native was eliminated [2], and FileIoHandler saw a security risk reduction . Those fixes landed on top of framework evolution, with React Native confirming variable font support across all platforms [4], and deprecating fabricEnabled [5].

React itself focused on fiber and server-rendering correctness. Host Singleton children of Fragments are now collected , a change that makes it safe to wrap host components in fragments. Fragments also fixed a listener leak when refs re-attach . Flight added 'pending_weak' to its thenable protocol , letting servers hand off responsibilities for pending data without blocking. Server-rendering costs were tightened and double-fetching prevented .

React DevTools removed the Timeline profiler tab and pivoted to the React Performance panel . A profiler search feature and a fix for nested HOC unwrapping accompanied that pivot. Meanwhile, the React Compiler slashed codegen time by 70% , a substantial win for teams already heavy on compiler-driven development, and Jest replaced its aging watchers [1] with a stripped-down runtime while fixing a module caching bug that broke virtual mocks .

Jest also patched cache corruption and ESM namespace collisions and brought its resolver up to Node-compatible module handling . Supply-chain scrutiny hit issues like tearing down worker farms before they leak and fixing ESM namespace collisions . Teams already on the latest stable patches should see the most impact from the React and React Native security fixes; an upgrade to those versions is the clear priority.