If this month has a single theme, it's the cost of rewriting things. Bun, pnpm and even a slice of Vite showed up in new implementations within a few weeks, and Evan You said outright that AI will soon make maintaining your own fork of a dependency normal. Meanwhile React quietly closed out two long-running experimental stories, and Vitest 5 promised speed while dropping a few comfortable leniencies.
Here's what actually matters for day-to-day work.
React 19.3: animations and Fragment refs, no flags required
The release landed on September 9, and its headline features will be familiar to anyone who followed React Labs. <ViewTransition> and Fragment refs are now stable.
<ViewTransition> wraps part of the tree and animates it via the browser's View Transition API. It only fires on updates marked as Transitions: startTransition, a <Suspense> reveal, useDeferredValue. A plain setState doesn't trigger an animation. I think that's the right call: urgent updates should show up immediately.
Fragment refs fix an old annoyance. Attaching an IntersectionObserver to a group of sibling elements used to mean adding a wrapper div and breaking your layout. Now a ref on <Fragment> gives you a FragmentInstance with focus, addEventListener, observeUsing and scrollIntoView, which operate on the children as a group.
For SSR projects, the most interesting small addition is browser from react-dom:
import { Suspense, use, ViewTransition } from 'react';
import { browser } from 'react-dom';
function TimeZone() {
use(browser());
return <p>{Intl.DateTimeFormat().resolvedOptions().timeZone}</p>;
}
export function Clock() {
return (
<ViewTransition update="auto" default="none">
<Suspense fallback="…">
<TimeZone />
</Suspense>
</ViewTransition>
);
}On the server the component suspends and the fallback goes into the HTML. On the client, after hydration, it renders normally. The const [mounted, setMounted] = useState(false) pattern I've seen in every other Next.js project finally has an official replacement.
One thing that may surprise you after upgrading: in Strict Mode, effects are now double-invoked during hydration too. In dev this will expose effects without proper cleanup. Not a React bug, but expect a few "it suddenly broke" moments.
The Rust wave: Bun, pnpm and someone else's dev server
Bun 1.4 (August 20) has been rewritten from Zig to Rust. The team added 1,517 tests from the Node.js test suite and claims 5× lower idle CPU and up to 35% less memory. Those are vendor numbers, but the methodology in the post is spelled out in detail. Read the breaking-changes section before upgrading: Bun now reports itself as Node.js 26 (NODE_MODULE_VERSION 147, so native addons need rebuilding), Bun.YAML parses yes/no/on/off as strings, and new monorepos default to the isolated linker.
pnpm 12 (August 26) is also in Rust, and the move is nearly painless: commands, settings and the lockfile carry over. The one trap is that latest on npm still points to v11:
pnpm self-update latest-12Two things can bite in CI: unknown keys in pnpm-workspace.yaml are now an error (when the version is pinned), and git dependencies on GitHub/GitLab/Bitbucket resolve over HTTPS only. If private repos were pulled over SSH, you'll need git config url.insteadOf.
Now the most interesting part. Lovable rewrote the dev-server layer of Vite in Rust, calling it OJ, for its preview sandboxes, of which it runs about a million a day. The reported results: median sandbox acquisition time dropped from 14.5 to 3 seconds, and memory use fell by roughly 6.5×.
Evan You disputed the benchmark, and fairly so. Lovable had compared its bundled mode with unbundled Vite. In an apples-to-apples comparison, cold start is nearly the same: 1,315 ms versus 1,528 ms. Memory, though, really is dramatically different: 115 MB versus 1,751 MB. For a company packing sandboxes onto hosts, that's the metric that counts.
More interesting than the numbers is Evan's own conclusion. AI makes reimplementation dramatically cheaper, so instead of thousands of low-quality PRs upstream, every company may maintain its own "slop fork" tuned to its constraints. He's not sure whether that's good. Neither am I. For open source it means fragmentation: a fork doesn't automatically get upstream security fixes. For teams it means the "rewriting is expensive" argument gets weaker every month.
Vitest 5: faster, but less forgiving
Requirements: Vite 6.4+ and Node.js 22.12+. The speedup is uneven, and the team is honest about it. On a dependency-heavy app in vmThreads, run time dropped by 53%. Where everything is dominated by jsdom with isolation, the difference is within ±3%.
I'm more interested in what will break:
clearMocksnow defaults totrue, so mocks no longer carry call history between tests;- an un-awaited
expect(promise).resolvesis no longer a warning but a test failure; - locators in Browser Mode are strict:
getByText('Item')won't matchItem 1anymore.
All of these are improvements. But in an older project they will surface tests that have been passing by accident for years. Upgrade on a separate branch. Nice extras: Trace View for step-by-step replay of browser tests, and vitest doctor, which runs your suite with alternative configs and suggests a faster one.
Tailwind Labs joins Shopify
Announced September 9. Tailwind CSS stays MIT-licensed and the team keeps maintaining it, but Tailwind Plus and ui.sh are closed to new customers. Framework users have nothing to worry about for now. If you were planning to buy Plus for your team, though, that plan needs to change.
Safari 27 finally fixes top-level await
For years Safari's module loader was built on an abandoned proposal, hence the mysterious "cannot access before initialization" errors. Safari 27 rewrote it from scratch. Top-level await now works reliably in every major browser, and you can remove the async IIFE wrappers that lived in your code "just in case".
AI: more than "write me a component"
The piece that sparked the most discussion was Nolan Lawson's essay about the "asteroid" that has hit frontend development. Some of his observations are hard to argue with. Frontend code is less risky to hand to an unsupervised agent than a database migration. Cursor and Viget migrated to React because agents know React best, so "agent experience" is starting to outweigh DX. He sees three ways forward: teaching agents to pick MPAs like Astro over SPAs, making sites that work well for agents, and cleaning up vibe-coded projects as a consultant.
I agree with the point about React in the training data: I see agents reach for an SPA where Astro would do. I'm less convinced by the pessimism about education. An agent answers questions well, but you still have to know which question to ask.
The flip side of the AI boom is visible at the OpenJS Foundation. Its CNA is pausing all security work from September 17 to October 6 because volunteers are burning out under a flood of LLM-generated vulnerability reports. Express has joined the pause. Actively exploited vulnerabilities will still get a response.
On the tooling side:
- Transformers.js 4.3 added structured output (JSON) and WebGPU in Safari 26+, so in-browser local models now work on iPhone too;
@shadcn/lintis a linter "for agents": it forbids raw colors and restyling<Button>from outside, steering the model back to your tokens;- Linear described how agents inflated its test suite and CI bill, and how rewriting type-aware ESLint rules as plain AST checks cut lint time by 55%.
Security: two things worth checking
Attackers are mass-scanning exposed Vite dev servers to pull .env files through a server.fs.deny bypass. It's fixed in Vite 7.3.2 and 8.0.5. If you run a dev server with --host on a shared environment, upgrade today.
npm added stage-only tokens: CI stages a release, and a maintainer approves it with 2FA. A sensible intermediate step for anyone not yet on trusted publishing.
Also worth knowing
- Remix 3 is in RC and now fully React-free; the final release is scheduled for October 2.
- htmx 4.0 moved to the Fetch API, and attribute inheritance is now opt-in.
- Firefox 154 brought
sibling-index()andsibling-count()into Baseline. - TC39 in Tokyo is considering
join,includesand chunking for iterator helpers for Stage 4.
Checklist for this week
- Upgrade Vite if you're below 7.3.2 / 8.0.5, no discussion needed.
- Run React 19.3 in dev with Strict Mode and watch your effects during hydration.
- Take Vitest 5 on a separate branch and budget time for fixing tests.
- pnpm 12 and Bun 1.4 can wait unless your CI is bottlenecked on installs. If it is, pnpm 12 is the cheapest win of the month.
The main takeaway isn't any single release. The line between "use what exists" and "rewrite it for ourselves" is moving, and AI is moving it faster than we can decide whether we like it.