Skip to main content

Newsletter Roundup — Week of August 31 📬

· 8 min read
Gergely Sipos
Gergely Sipos
Frontend Architect

What caught our eye this week across JavaScript Weekly #799, React Status #488, and Node Weekly #638 — and what it means for the Aliz stack.

React Ecosystem​

Lovable Migrates 400-Route App from Next.js to TanStack Start​

Lovable moved nearly 400 routes and 850K+ lines of code from Next.js to TanStack Start, running both frameworks in parallel behind a proxy during migration with shared code between them. This is one of the largest documented Next.js-to-TanStack migrations so far.

Aliz stack connection: A significant real-world validation of TanStack as a full framework option. We recommend TanStack Query for data fetching; TanStack Start is still maturing as a full-stack framework but clearly handles production scale.

Two Critical Next.js RCEs Patched​

Two critical unauthenticated remote code execution vulnerabilities in Next.js have been patched. Action item: Update to Next.js 16.3.3 or 15.5.24 immediately if you're running affected versions.

React Canary: browser() API and Parallel Transitions​

React's Canary channel shipped two notable features:

  • A browser() API for components that can't render on the server — use(browser()) stops server rendering and leaves the <Suspense> fallback, then renders client-side.
  • Parallel transitions are now on by default in Canary builds (including React Native), already in production at Meta and potentially landing in React 19.3.

TanStack Query 5.102: Simpler query/infiniteQuery Methods​

TanStack Query 5.102.0 ships new query and infiniteQuery methods on QueryClient, intended to replace fetchQuery/fetchInfiniteQuery. Dominik Dorfmeister calls it "the biggest release since v5."

Aliz stack connection: Directly relevant to our TanStack Query recommendation. The new API is simpler and worth adopting as teams upgrade.

Oxlint Gets React Compiler Support​

Oxlint now includes 22 rules that run React Compiler's own validation passes. Oxc also ships a package applying automatic memoization, claiming over 10× faster than the Babel plugin.

Aliz stack connection: As Oxlint approaches ESLint feature parity, the React Compiler integration makes it even more compelling for teams already using the React Compiler.

Other React Highlights​

  • Waku 1.0 RC — minimal RSC-first React framework, API-frozen with type-safe navigation and experimental cached route shells.
  • Ionic Framework v9 — mobile-first UI toolkit returns after two years with React Router 6 support.
  • Rifm 1.0 — dependency-free hook for formatted/masked inputs without cursor-position loss.
  • GTKX 1.5 — native GTK Linux desktop apps with React, now with React Hook Form integration.
  • Streamdown 2.6 — Vercel's streaming Markdown renderer for AI use cases.

JavaScript Ecosystem​

Bun 1.4: Rewritten in Rust, Massively Improved​

The headline release of the week: Bun 1.4 rewrites Bun from Zig to Rust and ships an enormous list of improvements. Key numbers:

  • +1,517 newly passing Node.js tests — the biggest compatibility jump since Bun 1.0. node:http, node:fs, node:cluster, and node:stream pass 97%+ of Node's own tests.
  • Memory usage down 13–48% for HTTP servers (e.g., Fastify drops from 233 MB to 120 MB).
  • CPU idle usage down 5×, startup 50% faster on Linux.
  • New built-in APIs: Bun.Image, Bun.WebView (headless browser automation), Bun.markdown, Bun.cron(), Bun.Terminal.
  • Compatibility: Playwright, Next.js 16, Vitest, and Nuxt now work on Bun.
  • New CLI tools: bun audit fix, bun dedupe, bun prune, bun run --parallel, bun test --parallel.
  • Profiling in Markdown: --cpu-prof-md and --heap-prof-md output profiles as Markdown tables — grep-able, LLM-friendly, SSH-compatible.

Aliz stack connection: Bun is not in our recommended stack, but v1.4's compatibility leap makes it a serious consideration for teams wanting faster dev tooling. The Node.js test pass rates are now high enough that many projects could try it as a drop-in replacement.

Solid 2.0 RC​

Solid 2.0 reaches Release Candidate — async lives in the reactive graph, createResource/batch/startTransition are gone, and SolidStart becomes a start: true flag on the Vite plugin. API is frozen.

Electron 44​

Electron 44 drops 32-bit support, requires macOS 13+, aligns clipboard with the W3C Clipboard API, adds net.WebSocket, and supports window opacity on Linux.

Other JavaScript Highlights​

  • MicroLighter — 2KB syntax highlighter using the CSS Custom Highlights API, no DOM manipulation.
  • TermDOM — build terminal UIs with HTML, CSS and DOM; v0.1.5 adds CSS Grid support.
  • Formisch 1.0 — framework-agnostic schema-based form library driven by Valibot, supporting eight frameworks.
  • Stryker Mutator 10.0 — mutation testing tool to verify your test suite actually catches bugs.
  • Plotly.js 4.0 — interactive data visualization library major release.
  • ESLint 10.9 — latest patch release of ESLint.

Node.js Ecosystem​

Node.js 26.8: Built-in ZIP Support​

Node.js 26.8.0 can now read and write ZIP archives without third-party dependencies, plus the REPL gets basic syntax highlighting. Node 24.20.0 (LTS) also landed with backported features including package maps, permission auditing, and node:stream/iter.

Aliz stack connection: Built-in ZIP support removes a common dependency (archiver, adm-zip) from Node scripts and CI pipelines. Worth adopting in build tooling.

pnpm 12: Rewritten in Rust​

pnpm 12 rewrites the package manager in Rust while keeping all v11 commands, flags, and lockfile format. A global node now follows the version your project pins. Note: npm's latest tag still points to pnpm 11 — use pnpm self-update next-12 to upgrade.

Aliz stack connection: We recommend npm as our package manager, but teams using pnpm get a significant performance boost. The Rust rewrite trend continues across the JS toolchain.

Node.js Interactive 2026 Recap​

Node.js Interactive returned at RenderATL with talks on AI integration, supply chain security, WinterCG becoming Ecma TC55, QUIC/HTTP3 progress, and Node's shift to one major release per year.

Node.js AI Contribution Policy​

The Node.js project merged official AI use guidelines into its contributing docs: PRs with AI code you haven't understood or tested can be closed unreviewed, bot-opened PRs need pre-approval, and AI must not be used to claim "good first issue" tasks.

Other Node Highlights​

  • Better Auth 1.7 — standards-based OAuth server with DPoP, per-API token rules, device code flow, and MCP auth.
  • SVGO 4.1 — Node-powered SVG optimizer with stricter XML validation and security improvements.
  • Electron 44 — cross-listed from JS section above.
  • AWS Lambda Node.js 26 runtime — now available in preview.

What This Means for the Aliz Stack​

Key threads connecting back to our Recommended Tech Stack:

  • Bun gets serious. The Rust rewrite, 1,500+ new Node.js test passes, and 48% memory reduction make Bun 1.4 the first release where compatibility is high enough for production consideration. Still not in our stack, but worth evaluating for developer tooling.
  • TanStack ecosystem keeps growing. Lovable's 400-route migration validates TanStack Start at scale, and TanStack Query 5.102 ships its biggest API improvement since v5.
  • Critical Next.js security patches. Two unauthenticated RCEs — update immediately if running affected versions.
  • React Compiler tooling matures. Oxlint's React Compiler integration (22 rules, 10× faster memoization) makes the compiler more accessible, especially alongside ESLint.
  • Rust rewrites continue. Bun (Zig → Rust) and pnpm 12 (JS → Rust) join the trend we've been tracking. Our Vite bet continues to benefit via Rolldown.
  • Node.js gains ZIP and policy. Built-in ZIP in Node 26.8 removes common dependencies; the new AI contribution policy sets a precedent for open source projects.

Further Reading​