Denial of service and source code exposure in React Server Components

Post by hmcdona1 » Tue, Dec 16, 2025, 6:07 AM UTC

rustystump wrote: post #219

hmcdona1 wrote: post #65

Earlier quoted context omitted.

I would highly recommend just checking out TanStack Router/Start instead. It fills a different niche, with a slightly different approach, that the Next.js app router just hasn't prioritized enabling anymore. What app router has become has its ideal uses, but if you explicitly preferred the DX of the pages router, you might enjoy TanStack Router/Start even more.

Tanstack anything has breaking changes constantly and they all exist in perpetual alpha states. It also has jumped on the rsc train with the same complexity pitfalls. Some libs in the stack are great but they were made pre rsc fad.

If you're using an alpha library then that's on you for not expecting breaking changes. They have plenty of 1.0+ libraries that do not receive any breaking changes between major releases and have remained stable for well over a year.

Also, you're just wrong? You literally cannot serve RSC components _at all_ even in TanStack Start yet. Even when support for them is added it will be opt-in for only certain kinds of RPC functions and they will work slightly differently than they do in Next.js app router(where they are the default everywhere). RPC != RSC.

Plus you can always stick to using TanStack Router exclusively (zero server at all) and you never will even have to worry about anything to do with RSCs...

Post by brazukadev » Sat, Dec 20, 2025, 11:50 AM UTC

danabramov wrote: post #157

dizlexic wrote: post #126

I'm not going to let go my argument with Dan Abramov on x 3 years ago where he held up rsc as an amazing feature and i told him over and over he was making a foot gun. tahdah! I'm a nobody PHP dev. He's a brilliant developer. I can't understand why he couldn't see this coming.

For what it’s worth, I’ve just built an app for myself with RSC, and I’m still a huge fan of this way of building and structuring web software. I agree I underestimated the likelihood of bugs like this in the protocol, though that’s different from most discussions I’ve had about RSC (where concerns were about user code). The protocol itself has a fairly limited surface area (the serializer and deserializer are a few…

RSC is not a protocol, that is probably one of the reasons it is bad and affected only NextJS - most other server framework struggled and gave up this mistake that was React Server.

Re: Denial of service and source code exposure in React Server Components

Re: Denial of service and source code exposure in React Server Components