ES2026 reaches Stage 4 with six features that fix longstanding language pain points rather than adding new capabilities. The Temporal API replaces the broken Date object with immutable, timezone-explicit types like Temporal.PlainDate, Temporal.ZonedDateTime, and Temporal.Instant, ending the era of reaching for date-fns or Luxon by default. Explicit resource management adds the using and await using declarations, which automatically call Symbol.dispose or Symbol.asyncDispose on block exit, eliminating the try/finally boilerplate around database connections and file handles. Error.isError() correctly identifies Error instances across iframe and worker realm boundaries where instanceof fails. Array.fromAsync() collects async iterables in one line, Import Attributes add a with { type: 'json' } syntax for secure typed imports, and Math.sumPrecise() uses compensated summation to avoid IEEE 754 accumulation errors. Polyfill and runtime support is broadly available across Node.js 22+, Chrome 127+, and TypeScript 5.2+.
Node.js 24.15.0, codenamed Krypton, is the latest LTS release on the v24 line and ships several SEMVER-MINOR additions alongside stability promotions. require(esm) and the module compile cache are both marked stable, ending experimental status for two widely anticipated module features. The built-in SQLite module is promoted to release candidate status, and its DatabaseSync API gains a limits property. New CLI flags include --max-heap-size for heap tuning and --require-module/--no-require-module for controlling ESM loading. The crypto module adds raw key format support to KeyObject APIs and updates root certificates to NSS 3.121. The http2 module gets an http1Options parameter for HTTP/1 fallback configuration, and the test runner gains worker ID exposure for concurrent test runs and SIGINT interrupt reporting. npm is updated to 11.12.1 and SQLite to 3.52.0.
TanStack Start introduces React Server Components as opt-in, client-driven primitives rather than a server-owned component tree, distinguishing itself from Next.js App Router's server-first model. RSC output is treated as a React Flight stream that can be fetched, cached via TanStack Query with explicit cache keys and staleTime, and streamed through TanStack Router loaders just like any other loader data. GET-based server functions can also be cached at the CDN layer with standard Cache-Control headers. TanStack Start explicitly avoids the 'use server' directive in favor of typed createServerFn RPCs backed by the Seroval serialization format, which the team credits with immunity to the React2Shell CVE that affects Next.js's Flight-based server functions. A new Composite Components primitive lets the server expose typed slot props that client components fill, inverting the usual server-owns-tree model. RSC support is currently experimental in TanStack Start RC.
Effect Without Effect-TS: Algebraic Thinking in Plain TypeScript
TAG: TYPESCRIPT
Christian Ekrem argues that the core ideas behind Effect-TS — typed errors as values, explicit dependencies, and composable async pipelines — can be applied in plain TypeScript without adopting the full library. The pattern centers on a 10-line Result type (a discriminated union of { ok: true; value: T } and { ok: false; error: E }) and returning Promise<Result<T, E>> instead of throwing. Dependencies are made explicit by passing a typed SignupDeps object as a function parameter rather than relying on module-scope imports, which eliminates the need for mocking libraries in tests and makes the full capability surface readable from the signature. A small andThen helper implements flatMap for async results, enabling pipeline composition without nesting. The author is honest about the limits: composition past four or five steps becomes verbose, error unions multiply across module boundaries, and structured concurrency remains a genuine gap where Effect-TS's fiber model has no plain-TS equivalent.
This visual guide explains how CPU hardware behavior — cache lines, SIMD lanes, and branch prediction — directly determines JavaScript performance. The central insight is that CPUs fetch memory in 64-byte cache lines, so Array-of-Structures layouts waste most of each line on fields not being read, causing cache misses and ALU stalls. The Structure of Arrays (SoA) pattern, used by Unity DOTS, Bevy, Three.js instanced meshes, and Box2D, keeps hot numeric data in parallel Float32Array or Int32Array buffers so every cache line is fully utilized. Benchmarks show the SoA approach reducing a loop over 100,000 3D positions from 8–15ms to 0.3–0.8ms — more than a 10x speedup. Additional V8-specific advice covers using typed arrays for numeric columns to avoid tagged-pointer type checks, and keeping object shapes stable at construction time to maintain V8 hidden class fast paths.
TkDodo argues against the prevalent horizontal codebase structure — splitting code into components/, hooks/, types/, and utils/ directories — because it groups by technical type rather than by domain, creating implicit coupling with no clear boundaries. The Sentry codebase is cited as a cautionary example: a top-level components/ directory with 200+ files where PageFilters-related code is scattered across components/pageFilters, types/core, and utils/withPageFilters. The proposed alternative is a vertical structure where all code related to a domain lives together in a single directory regardless of file type, aligned with how feature teams actually own product surfaces. Shared code that crosses verticals should become its own vertical, and boundaries between verticals should be enforced with tools like eslint-plugin-boundaries or pnpm workspaces with explicit package.json exports. The author notes that AI agents benefit from the same structural properties as humans — clear boundaries, fast feedback loops — making this worth investing in even in AI-assisted codebases.
Why TanStack Start Is Not Vulnerable to React2Shell
Jack Herrington explains the React2Shell CVE and why TanStack Start's RSC implementation avoids the vulnerability that affects Next.js. React2Shell is not a flaw in React Server Components themselves but in how Next.js routes all server functions through a predictable slash endpoint, keeps that endpoint active even on sites with no server functions defined, and relies on the React Flight data format whose object-reference traversal mechanism enables arbitrary code execution by manipulating the payload. TanStack Start differs on all three points: server function endpoints are derived from the module file path rather than a fixed URL, no server function infrastructure is included unless explicitly defined, and it uses Seroval instead of Flight — a format where past CVEs were permanently patched without the single-payload shell injection vector that persists in Flight.
ES2026 reaches Stage 4 with six features that fix longstanding language pain points rather than adding new capabilities. The Temporal API replaces the broken Date object with immutable, timezone-explicit types like Temporal.PlainDate, Temporal.ZonedDateTime, and Temporal.Instant, ending the era of reaching for date-fns or Luxon by default. Explicit resource management adds the using and await using declarations, which automatically call Symbol.dispose or Symbol.asyncDispose on block exit, eliminating the try/finally boilerplate around database connections and file handles. Error.isError() correctly identifies Error instances across iframe and worker realm boundaries where instanceof fails. Array.fromAsync() collects async iterables in one line, Import Attributes add a with { type: 'json' } syntax for secure typed imports, and Math.sumPrecise() uses compensated summation to avoid IEEE 754 accumulation errors. Polyfill and runtime support is broadly available across Node.js 22+, Chrome 127+, and TypeScript 5.2+.
Why TanStack Start Is Not Vulnerable to React2Shell
Jack Herrington explains the React2Shell CVE and why TanStack Start's RSC implementation avoids the vulnerability that affects Next.js. React2Shell is not a flaw in React Server Components themselves but in how Next.js routes all server functions through a predictable slash endpoint, keeps that endpoint active even on sites with no server functions defined, and relies on the React Flight data format whose object-reference traversal mechanism enables arbitrary code execution by manipulating the payload. TanStack Start differs on all three points: server function endpoints are derived from the module file path rather than a fixed URL, no server function infrastructure is included unless explicitly defined, and it uses Seroval instead of Flight — a format where past CVEs were permanently patched without the single-payload shell injection vector that persists in Flight.
Node.js 24.15.0, codenamed Krypton, is the latest LTS release on the v24 line and ships several SEMVER-MINOR additions alongside stability promotions. require(esm) and the module compile cache are both marked stable, ending experimental status for two widely anticipated module features. The built-in SQLite module is promoted to release candidate status, and its DatabaseSync API gains a limits property. New CLI flags include --max-heap-size for heap tuning and --require-module/--no-require-module for controlling ESM loading. The crypto module adds raw key format support to KeyObject APIs and updates root certificates to NSS 3.121. The http2 module gets an http1Options parameter for HTTP/1 fallback configuration, and the test runner gains worker ID exposure for concurrent test runs and SIGINT interrupt reporting. npm is updated to 11.12.1 and SQLite to 3.52.0.
TanStack Start introduces React Server Components as opt-in, client-driven primitives rather than a server-owned component tree, distinguishing itself from Next.js App Router's server-first model. RSC output is treated as a React Flight stream that can be fetched, cached via TanStack Query with explicit cache keys and staleTime, and streamed through TanStack Router loaders just like any other loader data. GET-based server functions can also be cached at the CDN layer with standard Cache-Control headers. TanStack Start explicitly avoids the 'use server' directive in favor of typed createServerFn RPCs backed by the Seroval serialization format, which the team credits with immunity to the React2Shell CVE that affects Next.js's Flight-based server functions. A new Composite Components primitive lets the server expose typed slot props that client components fill, inverting the usual server-owns-tree model. RSC support is currently experimental in TanStack Start RC.
Effect Without Effect-TS: Algebraic Thinking in Plain TypeScript
Christian Ekrem argues that the core ideas behind Effect-TS — typed errors as values, explicit dependencies, and composable async pipelines — can be applied in plain TypeScript without adopting the full library. The pattern centers on a 10-line Result type (a discriminated union of { ok: true; value: T } and { ok: false; error: E }) and returning Promise<Result<T, E>> instead of throwing. Dependencies are made explicit by passing a typed SignupDeps object as a function parameter rather than relying on module-scope imports, which eliminates the need for mocking libraries in tests and makes the full capability surface readable from the signature. A small andThen helper implements flatMap for async results, enabling pipeline composition without nesting. The author is honest about the limits: composition past four or five steps becomes verbose, error unions multiply across module boundaries, and structured concurrency remains a genuine gap where Effect-TS's fiber model has no plain-TS equivalent.
This visual guide explains how CPU hardware behavior — cache lines, SIMD lanes, and branch prediction — directly determines JavaScript performance. The central insight is that CPUs fetch memory in 64-byte cache lines, so Array-of-Structures layouts waste most of each line on fields not being read, causing cache misses and ALU stalls. The Structure of Arrays (SoA) pattern, used by Unity DOTS, Bevy, Three.js instanced meshes, and Box2D, keeps hot numeric data in parallel Float32Array or Int32Array buffers so every cache line is fully utilized. Benchmarks show the SoA approach reducing a loop over 100,000 3D positions from 8–15ms to 0.3–0.8ms — more than a 10x speedup. Additional V8-specific advice covers using typed arrays for numeric columns to avoid tagged-pointer type checks, and keeping object shapes stable at construction time to maintain V8 hidden class fast paths.
TkDodo argues against the prevalent horizontal codebase structure — splitting code into components/, hooks/, types/, and utils/ directories — because it groups by technical type rather than by domain, creating implicit coupling with no clear boundaries. The Sentry codebase is cited as a cautionary example: a top-level components/ directory with 200+ files where PageFilters-related code is scattered across components/pageFilters, types/core, and utils/withPageFilters. The proposed alternative is a vertical structure where all code related to a domain lives together in a single directory regardless of file type, aligned with how feature teams actually own product surfaces. Shared code that crosses verticals should become its own vertical, and boundaries between verticals should be enforced with tools like eslint-plugin-boundaries or pnpm workspaces with explicit package.json exports. The author notes that AI agents benefit from the same structural properties as humans — clear boundaries, fast feedback loops — making this worth investing in even in AI-assisted codebases.
ES2026 reached Stage 4 with six targeted fixes for longstanding JavaScript pain points. The Temporal API replaces the broken Date object with immutable, timezone-explicit types — Temporal.PlainDate, Temporal.ZonedDateTime, and Temporal.Instant — ending the default reliance on date-fns and Luxon. Explicit Resource Management adds using and await using declarations that call Symbol.dispose automatically on block exit, eliminating try/finally boilerplate around database connections. Additional additions include Error.isError() for cross-realm Error detection, Array.fromAsync(), Import Attributes with a with { type: 'json' } syntax, and Math.sumPrecise() for IEEE 754 accuracy. Support lands in Node.js 22+, Chrome 127+, and TypeScript 5.2+.
Node.js 24.15.0 (Krypton) promoted require(esm) and the module compile cache to stable, ending months of experimental status. The built-in SQLite module reached release candidate and gained a limits property on DatabaseSync. New CLI flags --max-heap-size and --require-module round out a release focused on stabilization over new APIs.
On the framework and security front, TanStack Start's RSC implementation deliberately avoids the 'use server' directive, using createServerFn RPCs backed by Seroval serialization instead. This architecture makes it immune to the React2Shell CVE that affects Next.js's Flight-based server functions, as detailed by both the TanStack blog and Jack Herrington's video analysis.
Key Takeaways
ES2026 Stage 4 makes the Temporal API and Explicit Resource Management (using/await using) production-ready — start migrating away from date-fns and manual try/finally cleanup patterns now.
Node.js 24.15.0 stabilizes require(esm) and ships a built-in SQLite RC — two long-awaited features that reduce dependency on third-party modules.
TanStack Start's Seroval-based server functions are architecturally immune to the React2Shell CVE that threatens Next.js Flight endpoints, making security posture a real differentiator in RSC framework choice.
