Work with us
Have a product or AI idea?
Tell us what you want to build and we'll suggest a practical first step.
Between October 2025 and February 2026, four things happened to React that matter to anyone running it in production. The compiler reached 1.0, React 19.2 shipped a set of long-awaited APIs, Server Components had their first critical security incident, and Meta handed React to an independent foundation. If you run a product on React, or you are deciding whether to build one on it, each of these affects a decision you will make this year.
This guide covers what changed, what we think is ready for production, and where it still pays to wait.
Where React stands in March 2026
The current major version is React 19, released on December 5, 2024 (opens in a new tab). The latest minor is React 19.2, released October 1, 2025 (opens in a new tab). Here is the short version of what each piece does.
| Feature | Shipped in | What it gives you |
|---|---|---|
Actions, useActionState, useOptimistic | 19.0 | Pending, error and optimistic states for async updates and forms |
use | 19.0 | Read a promise or context during render, including inside conditions |
| Server Components and Server Functions | 19.0 | Render on the server and call server code from the client |
ref as a prop, <Context> as provider | 19.0 | Less boilerplate: forwardRef is no longer needed for new components |
<Activity /> | 19.2 | Hide part of the UI while keeping its state, and pre-render screens the user is likely to open |
useEffectEvent | 19.2 | Pull non-reactive logic out of an Effect so it stops re-running |
Partial pre-rendering in react-dom | 19.2 | Serve a static shell from a CDN and fill in dynamic parts later |
| React Compiler 1.0 | October 2025 | Automatic memoization at build time |
React Compiler 1.0: adopt it for new code
The React team released React Compiler 1.0 on October 7, 2025 (opens in a new tab). It is a build-time tool that memoizes components and hooks for you, so most useMemo, useCallback and React.memo calls become unnecessary. It can also memoize code after an early return, which hand-written memoization cannot do.
Meta reports that in the Meta Quest Store, initial loads and cross-page navigations improved by up to 12%, and some interactions became more than 2.5 times faster, with memory use unchanged. The React team adds that results will vary by app, so treat those numbers as a reason to test, and measure your own.
Practical points for adoption:
- It works with React 17 and up. On 17 or 18 you set a minimum target and add the
react-compiler-runtimepackage. - New projects get it easily. Expo SDK 54 enables it by default, and
create-viteandcreate-next-appoffer compiler-enabled templates. - Next.js support is stable. Next.js 16 (opens in a new tab) promoted the
reactCompileroption out of experimental. It is still off by default, and Vercel warns that builds will be slower because the compiler runs through Babel. - The lint rules are useful on their own. The compiler's checks now ship in
eslint-plugin-react-hooks, and you can turn them on without enabling the compiler.
For an existing codebase, follow the incremental adoption path the React team describes. Turn it on for one area, run your end-to-end tests, then widen it. Leave existing useMemo and useCallback calls in place unless you have tests that cover them, because removing them can change what the compiler outputs. If your test coverage is thin, pin the exact compiler version so an upgrade cannot change behavior without you noticing.
Our view: enable the compiler on any new React project, and run the lint rules on every existing one today. Rolling the compiler out across a large legacy app can wait until you have the end-to-end coverage to catch a behavior change.
Actions and use: adopt them where you have forms
Actions are the most useful part of React 19 for everyday product work. An Action is an async function run inside a transition. React tracks its pending state, surfaces errors, and lets you show an optimistic result with useOptimistic while the request is in flight.
For most teams, this means less custom code around form submission. A signup or checkout form that used to need three or four pieces of state for loading, errors and optimistic updates can lean on useActionState and useFormStatus instead. Design-system components can read the parent form's status with useFormStatus without passing props down.
The use API reads a promise or a context during render. Unlike hooks, you can call it inside an if statement. Use it when a framework or data library hands you a promise. Avoid creating promises inside a Client Component render and passing them to use, because a new promise on every render will keep suspending.
These APIs are stable and have been in production frameworks since React 19 shipped. If you are still on React 18, the upgrade to 19 is worth planning for this reason alone.
Server Components: adopt through a framework, and patch quickly
Server Components let you render parts of the UI on the server, keep data fetching and secrets out of the browser bundle, and send less JavaScript to the client. Server Functions, marked with the "use server" directive, let a Client Component call server code directly.
Two cautions come with them.
Use a framework. The React 19 announcement states that Server Components are stable for app developers, but the lower-level APIs that bundlers and frameworks build on do not follow semver between 19.x minors. In practice, that means picking a framework that supports them, such as Next.js App Router or React Router, and letting it manage the React version.
Treat Server Functions as public endpoints. On December 3, 2025, the React team disclosed CVE-2025-55182 (opens in a new tab), a critical (CVSS 10.0) remote code execution flaw in how React decoded payloads sent to Server Function endpoints. It affected React 19.0 through 19.2.0 and frameworks including Next.js, React Router and Waku. An app could be exposed even without any Server Functions of its own, as long as it supported Server Components. Further denial-of-service and source-exposure issues followed later in December.
Server Components are still worth using for most new web products. Using them safely means you:
- Keep React and your framework on the latest patch release, and subscribe to both security feeds.
- Check auth and validate input inside every Server Function, the same way you would in an API route.
- Upgrade even if your host has added firewall rules. The React team described those mitigations as temporary.
If your team cannot commit to patching within days of an advisory, a client-rendered app with a separate API carries less exposure.
The React Foundation: what it changes for you
On February 24, 2026, the React Foundation launched (opens in a new tab) under the Linux Foundation. React, React Native and JSX are now owned by the foundation instead of Meta. The founding Platinum members are Amazon, Callstack, Expo, Huawei, Meta, Microsoft, Software Mansion and Vercel, and Seth Webster is executive director.
The board, with one representative per member, handles funding and programs. Technical direction stays with the people who contribute to and maintain React. A provisional leadership council is still working out that technical governance structure, and repositories and infrastructure are still being transferred.
For a company choosing a stack, this mostly lowers risk. React no longer depends on one company's priorities, and several firms that build on it now fund it together. Nothing about the code or the APIs changed on launch day, so there is nothing to migrate.
What to adopt now and what to wait on
| Decision | Our recommendation |
|---|---|
| Upgrade from React 18 to 19 | Plan it now. Actions, ref as a prop and the 19.x security patches are reason enough. |
| React Compiler on new projects | Turn it on from day one. |
| React Compiler on a large existing app | Turn on the lint rules now. Roll out the compiler area by area once end-to-end tests cover the key flows. |
| Server Components | Use them through a framework, with a patching process in place. |
useEffectEvent | Use it where an Effect re-runs because of values it only reads. |
<Activity /> | Try it for tabs and back navigation where keeping state matters. |
| Partial pre-rendering | Use it through your framework's caching model (Cache Components in Next.js 16). Avoid wiring prerender and resume yourself. |
| Building your own Server Components bundler | Wait. Those APIs can still break between minors. |
Planning a React build or upgrade?
The right move depends on the size of your codebase, your test coverage and how fast your team can ship a security patch. If you want a second opinion on your stack or an upgrade plan, book a free 30-min call (opens in a new tab) and we will talk it through with you.
Related service: Custom Software Development