# TMiR 2025-09: React 19.2 on the horizon; npm is still getting compromised

Page: https://stenobird.com/podcast/this-month-in-react-5941373/tmir-2025-09-react-19-2-on-the-horizon-npm-is-still-getting-compromised
Text version: https://stenobird.com/podcast/this-month-in-react-5941373/tmir-2025-09-react-19-2-on-the-horizon-npm-is-still-getting-compromised.md
Podcast: [This Month in React](https://stenobird.com/podcast/this-month-in-react-5941373)
Published: 2025-10-01T01:59:19+00:00
Episode link: https://share.transistor.fm/s/5e21ada9
Audio file: https://op3.dev/e/media.transistor.fm/5e21ada9/ebc1169f.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/this-month-in-react-5941373/episodes/tmir-2025-09-react-19-2-on-the-horizon-npm-is-still-getting-compromised
Duration seconds: 3737

## Resource

[00:52] New releases [00:54] TanStack Start 1.0 RC! [01:13] react-window 2.0 rewrite [01:44] Apollo Client 4.0 [01:59] Redux Toolkit 2.9.0 [02:47] Main Content [02:52] React 19.2 coming soon? [03:24] in canary, with docs [07:18] last React Labs post mention [11:43] useEffectEvent in canary and has docs [15:47] Compiler inferring function names [16:08] Docs for eslint-plugin-react-hooks , including rules and compiler issues [17:15] React Native 1.0 on the horizon [22:02] “React Won by Default – And It's Killing Frontend Innovation” [22:18] Inevitable HN argument [27:54] Ricky on Ryan Carniato’s stream talking about scheduling and demoing using modern React features [33:41] Server Components [33:44] React Router RSC framework mode preview [34:36] also middleware is now stable [34:44] Krasimir Tsonev’s “Can I Use RSC Today?” support matrix and experimental Forket “RSC without a framework” build tool [35:43] RSBuild support for RSCs [35:55] Useful post on parallel and recursive route rendering [36:35] All the NPM compromises and malware this month [39:47] npm package maintainer Qix [39:48] CrowdStrike npm Packages [40:16] GitHub Actions npm Token Theft [41:01] GitHub response [42:00] ⚡ Lightning round ⚡ [42:03] Porting Modern TypeScript to Run on DOS [42:35] Cloudflare DDOSed themselves with a bad useEffect fetch [43:11] A very lovely writeup of the evolution of css zoom [43:56] What You Need to Know about Modern CSS [45:21] Fetch streams are great, but not for measuring upload/download progress [45:40] Why do browsers throttle JS timers? [46:01] “How Modern Browsers Work” deep dive, Addy Osmani [46:32] Biome: Stress-testing WIP noFloatingPromises lint rule [48:37] Bun: How bun install is so fast [49:23] Styled-Components fork for perf and React 19 compat [50:02] Vite SSR:…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/this-month-in-react-5941373/episodes/tmir-2025-09-react-19-2-on-the-horizon-npm-is-still-getting-compromised/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/this-month-in-react-5941373/tmir-2025-09-react-19-2-on-the-horizon-npm-is-still-getting-compromised.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.