Next.js Adapters, TanStack RSC & Axios Hack

Devs, rejoice—or don't. Next.js adapters let you escape Vercel jail, TanStack Start flips the server components script, and Axios just got pwned in a supply chain nightmare.

Next.js Breaks Free, TanStack Rebels, Axios Bleeds: React's Wild Week — theAIcatchup

Key Takeaways

  • Next.js adapters enable true multi-platform deploys without lock-in.
  • TanStack Start offers a flexible, less opinionated alternative to Next.js RSC.
  • Axios supply chain hack demands immediate dep audits across React projects.

Your deploys just got a lifeline. Or did they? Next.js 16.2’s new Adapter API means you can finally shove it onto any platform without Vercel holding the keys. Real people — that’s you, the harried full-stack dev juggling AWS, Netlify, and Cloudflare — won’t have to rewrite half your app for a hosting switch.

But here’s the thing. Vercel’s still pulling strings. They promise an “Ecosystem Working Group,” but partners swear off roadmap votes. Feedback? Sure. Early peeks? Fine. Real power? Nah. Smells like controlled chaos.

Can Next.js Adapters Really Free You from Vercel?

Short answer: Mostly. Built with OpenNext, Netlify, the usual suspects. Stable, typed, versioned. Public test suite to boot — Vercel uses it themselves. No more half-baked features breaking your edge runtime dreams.

“Partners will not participate in Next.js design decisions and roadmap, but can still impact it through feedback. They will be kept in the loop early, have time to adapt, and get direct support to fix adapter breakage.”

That’s the Ecosystem Working Group line. Noble. But let’s call it what it is: Vercel’s velvet glove over an iron fist. They built Next.js; they own the soul. Adapters? A concession to reality. Your apps run smoother cross-platform now. Progress.

TanStack Start, though. Tanner Linsley’s Paris talk dropped a bomb. React Server Components preview — and it’s not Next.js 2.0. Primitives for you to compose. RSC payloads as text streams. Cache ‘em, sync ‘em, whatever. No forced ‘use client’ directives; composite components draw the server-client line explicitly.

No Server Actions. Security first, says Tanner. Use server functions with validation instead. Feels… refreshing. Like React circa 2015, before frameworks swallowed your choices whole.

Is TanStack Start the Anti-Next.js React Needs?

Damn right it might be. Next.js? Opinionated beast. TanStack? Library vibes. Incremental adoption. Co-locate server/client in one file? Probably. More glue code, sure — but you decide the glue. No vendor lock-in creeping up your leg.

Tanner nails it: We deserve options. React’s meta-framework wars echo jQuery plugin hell — too many toys, fragmented ecosystems. My hot take? TanStack fragments further, but sparks innovation. Next.js dominates deploys; TanStack wins hearts of purists. Bold prediction: By 2026, half your team begs for TanStack on the next greenfield.

React Compiler to Rust. WIP, AI-ported. Same algo, Rust Babel AST. Passes all fixture tests. Integrates with Babel, SWC, OXC. Faster compiles? Maybe. But Rust port screams overkill — React’s already bloated. Why not fix the real compiler bugs first?

React Native 0.85 drops next week. No fireworks, but steady grind. Unistyles, ExecuTorch for mobile. Solid, if unexciting.

And Axios. Hacked. Supply chain style. Major compromise. Change your passwords, audit deps, enable 2FA yesterday.

“Axios has been compromised in a major supply chain attack. Stay safe and make sure to adopt security best practices!”

Understatement of the year. NPM’s wild west strikes again. Left-pad 2.0. Your HTTP client’s tainted — nuke it, fork if you must. Devs pay for OSS complacency.

TanStack Router’s signal graph refactor. Fine-grained subs, efficient. router.state still public. Nice.

React PR for Trusted Types. XSS armor. Use policy.createHTML on dangerouslySetInnerHTML. Baseline now — good call.

Next.js experimental.useOffline. Retries, offline hook. Handy for PWAs.

TanStack Query ESLint rule: prefer-query-options. Pedantic, but clean.

Why Does the Axios Hack Scare React Devs Most?

Supply chain attacks aren’t new — Codecov, SolarWinds — but Axios? Ubiquitous. Millions of repos. One bad publish, and your API calls leak creds. Real impact: Midnight audits, dep-freeze panic. Hype dies; security checklists live forever.

Lingui for i18n. Lightweight, dev-first. Skip if you’re not global yet.

Articles worth your time: When to use startTransition (expensive renders only). Hoistable SVG defs — colocate, don’t centralize. ProseMirror speed hacks. Shimmer skeletons that sync. Fiber explainer.

Events: dotJS 2026 Paris. Early bird till April 14. dotAI too.

Inertia 3.0 for SPAs with server routers. Niche, but React-friendly.

This week’s React? Freedom teases, hacks bite, choices multiply. Devs, pick wisely — or watch your stack crumble.


🧬 Related Insights

Frequently Asked Questions

What is Next.js Adapter API?

Stable API in 16.2 for hosting Next.js anywhere — Netlify, AWS, etc. Typed, tested, no compromises.

How does TanStack Start differ from Next.js?

Less opinionated. Flexible RSC primitives, no Server Actions, library over framework.

Is Axios safe after the hack?

No. Compromised in supply chain attack. Update, audit, consider alternatives like Ky.

Elena Vasquez
Written by

Senior editor and generalist covering the biggest stories with a sharp, skeptical eye.

Frequently asked questions

What is Next.js Adapter API?
Stable API in 16.2 for hosting Next.js anywhere — Netlify, AWS, etc. Typed, tested, no compromises.
How does TanStack Start differ from Next.js?
Less opinionated. Flexible RSC primitives, no Server Actions, library over framework.
Is Axios safe after the hack?
No. Compromised in supply chain attack. Update, audit, consider alternatives like Ky.

Worth sharing?

Get the best AI stories of the week in your inbox — no noise, no spam.

Originally reported by dev.to

Stay in the loop

The week's most important stories from theAIcatchup, delivered once a week.