Your Framework Just Changed the Rules. Here's What Your Team Ships Next.

The stuff under your designs moved this year. The React Compiler went stable. Two frameworks now disagree about who owns the render tree. And CSS gained a few tricks that make old design hacks unnecessary. None of this shows up in a mockup, but all of it changes what your team can ship and how fast. Let me catch you up.

Delete the memo code, but keep your tests

The React Compiler shipped stable in October 2025. The pitch: stop hand-writing useMemo and useCallback, and let the compiler handle it. When one engineer turned it on in a production Next.js app, most of it worked. The word "most" is doing the heavy lifting.

The breaks were subtle. A live form preview froze because React Hook Form uses interior mutability the compiler can't reason about. A chart click handler started reading stale data once the stabilizing useCallback was gone. Neither showed up as a loud crash. Without tests, both would have shipped.

So the cleanup is real, but it is not a one-click delete. Keep the hooks that cross into a system the compiler can't see: chart libraries, canvas, third-party SDKs, or a genuinely expensive computation. Delete the rest. Every memo hook that stays should have a comment saying why.

The badge that means nothing

Here is the trap that costs debugging hours. React DevTools shows a Memo badge on compiled components, and it is easy to read that as "this got optimized." It doesn't mean that. The same migration write-up found the badge showing on a component that was mutating a prop and breaking React rules.

The badge only tells you the compiler is wired up. It says nothing about whether the component is actually being optimized, or whether it opted out. If your team treats the badge as a green light, they will assume performance wins that aren't there. Tell them to use the Profiler to verify, and to run the lint rules first. The lint step is where the visible cleanup happens, and it works even before you enable the compiler.

Who owns the tree, and why it's now a real choice

For a while, React Server Components meant Next.js. That changed in April 2026, when TanStack Start added RSC support with a different bet. Next.js owns the tree: every component is a Server Component by default, and 'use client' marks the exits. TanStack flips it. The client owns the tree, and server work happens through explicit functions you wire into loaders.

The numbers are worth bringing to a review. Building the same content dashboard in both, TanStack Start shipped about 40 percent less client JavaScript, 116KB against 193KB, and built in 1.3 seconds against 5.1. But Next.js was faster to set up and easier to reason about for content pages, and it is more production-ready for RSC right now.

The pick depends on what you're building. Content-heavy site with few mutations, Next.js maps cleanly. Dashboard or internal tool where the client already owns the interaction, TanStack's model of "fetch server UI as a data primitive" fits better.

Server rendering means server-side threats

The cost of going server-side got concrete. The H1 2026 recap tracks an RSC vulnerability chain that started with React2Shell, an unauthenticated remote code execution flaw scored a perfect 10.0 in December 2025. By May, a coordinated Next.js release covered middleware bypasses, SSRF, XSS, cache poisoning, and denial of service.

The pointed lesson: middleware is not a security boundary. Next.js docs warned about this for years, and teams read it as boilerplate. The advisory cycle made it real. Put authorization in server-side data access and route handlers, not only in middleware.

This reframes what a framework upgrade is. It is security work now, not occasional dependency cleanup. If you run production Next.js, patching next and react-server-dom-* packages current belongs in your operating model, not your backlog.

CSS caught up to your hacks

While the JavaScript layer churned, CSS gained tools that retire old workarounds. The hairline border trick is the practical one: box-shadow: 0 0 0 1px rgba(0,0,0,0.08) gives you a crisp one-pixel edge with zero offset and zero blur. One property doing the border, instead of a separate border line that doubles paint cost and breaks on non-integer pixel radii. Open the inspector on a Linear card or a Stripe input and that is what you'll find.

Bigger picture, the new border-shape property solves the old headache of putting a border on a custom shape. clip-path clips everything, including your border, so decorated shapes were a mess. border-shape shapes the element and lets borders, shadows, and outlines follow that shape. If your team relied on SVG hacks for cut corners or blobs, some of that is now plain CSS. Support is Chromium-only so far, so treat it as progressive enhancement, not a baseline.

The deep cut

The thread across all of this: the gap between a design spec and what ships is shrinking, and it's moving in your favor if you catch it. A hairline that used to be two declarations is one. A decorated shape that needed SVG is a CSS property. Memoization your engineers hand-tuned is now the compiler's job. Each of these frees your team from a workaround, but only if someone tells the designers the constraint is gone.

The concrete move: at your next design review, ask which of your current "we can't do that cleanly" rules are still true. Some of them expired this year. The specs written against old limits are quietly overbuilt, and simpler ones will ship faster and paint cheaper.

Three questions for your team

1. Which components still carry useMemo and useCallback without a comment explaining why? Those are candidates to delete, and the ones with real reasons (charts, canvas, SDKs) are the ones to keep and document.

2. Are we treating framework upgrades as security work? If our auth logic lives only in middleware, when do we move it into route handlers and data access?

3. Which of our design constraints are leftovers from before border-shape, corner-shape, and the hairline trick? Pull that list into the next review and cut the specs that no longer need a workaround.