"Instant" isn't a performance budget you hit by trying harder. It's a pass/fail check on whether a route's shell can render without touching the network, and a single misplaced Suspense boundary is enough to fail it.
What to put in the shared package, what never belongs there, and the pnpm symlink problems Metro still finds a way to resurface.
The rollout order that keeps a silent skip from becoming a production regression, lint first, fix what it flags, then clean up the old memoization.
Shai-Hulud showed the pattern. Here's the concrete playbook for keeping a self-replicating worm out of your dependency tree.
A self-replicating worm hit 500+ packages by stealing publish tokens. npm's fix removes the tokens instead of trusting them harder.
JavaScript's Date object finally has a real replacement, and it's usable in production sooner than you'd think.
Anchor positioning and customizable selects both have real browser support now. Here's what to drop, what to keep, and where the gaps still bite.
The native compiler is 8-12x faster. The programmatic API isn't ready yet, and that's where teams get burned.
Benefits, challenges, and the role of AI.
A small JavaScript function for the pseudo-class CSS never gave us.