React Native 0.88.0 reached npm on Wednesday, October 15, and the release post landed this morning. It is the third release in a row with no user-facing breaking changes, which is a sentence I could not have written about this framework at any point in the previous eight years. Underneath that calm headline sits the biggest runtime change since the New Architecture went default: events now travel the W3C EventTarget path by default, and iOS gets the SceneDelegate entry point that Xcode 27 is about to make mandatory. Meanwhile Next.js shipped two critical remote code execution fixes on the same Wednesday, for the third security release in four weeks. Both sides of the React world had a loud week.
Here is what mattered in React and React Native for October 12 to 18, 2026.
News
React Native 0.88: web events by default, SceneDelegate, no breaking changes
React Native 0.88 switches event dispatching to the web model: a real capture phase down to the target, a bubble phase back up, and stopPropagation() and preventDefault() that are no longer a React Native reimplementation of the DOM. The imperative API (addEventListener on a native ref) is Canary only for now. Your event props keep their names, their synthetic event objects and their order, so for app code the answer to “what changes” is nothing. The code that should worry is anything reaching into the old plugin registry, because that path is behind an internal flag and scheduled for removal.
The item that will actually cost you an afternoon is SceneDelegate. Starting with the iOS 27 SDK, Apple requires the UIScene lifecycle, and UIKit apps built with Xcode 27 fail to launch without it. 0.88 adds two RCTReactNativeFactory entry points for it, single scene only, with the AppDelegate path still working. The community template already uses it; existing apps move the entry point to a SceneDelegate.swift, forward URL and user-activity callbacks to RCTLinkingManager, and add a UIApplicationSceneManifest key. Also in the release: fontVariationSettings on Text and TextInput on both platforms, ArrayBuffer arguments and return values in Java TurboModules, React 19.3.0, Metro 0.87, and a hardened Swift Package Manager preview with a stated plan: default in 0.89, CocoaPods removed in a later release. Deprecations worth a grep: InitializeCore (use react-native/setup-env), the experimental_background* style prefixes, and iOS-only InputAccessoryView, which points you at react-native-keyboard-controller’s KeyboardStickyView instead.
My take: do the SceneDelegate migration this sprint even if you are not upgrading yet, because Xcode 27 does not care which React Native version you run. The rest of 0.88 is the kind of release you want: large internal surgery, zero app-level breakage. We have shipped apps through enough 0.6x upgrades to appreciate how unusual that is. Our react-native-screens guide covers the iOS 26 header changes that come along for the ride.
Next.js 16.4.1 and 15.5.28 fix two critical RCEs
On October 14 Vercel published Next.js 16.4.1 and 15.5.28 with three advisories. Two are critical: unauthenticated remote code execution in use cache functions returning typed arrays (16.0.0 to 16.4.0, no workaround, Vercel says upgrade even if you have no such function), and unauthenticated RCE in the Image Optimization API with SVG files, a memory bug in an upstream library that affects every version back to 10.0.0 when Next.js runs on glibc Linux. The workaround for the second is sharp 0.35.5 or newer. The third is a high-severity denial of service through Server Actions in App Router, 13.0.0 onward. 16.4.2 followed on the 15th with Turbopack fixes and no security content.
This is the third Next.js security release this digest has covered in four weeks, after the next/og RCE on September 22 and the seven-advisory batch on September 30. Opinion: if your Next.js upgrade still goes through a quarterly planning meeting, change that this month. Pin a floor of 15.5.28 or 16.4.1 in CI and let Dependabot do the rest.
Expo SDK 58 is out, built for iOS 27
Expo SDK 58 shipped on October 15 and [email protected] became latest on npm the next day. It bundles React Native 0.88, uses the scene-based lifecycle so apps launch on iOS 27, and stops reading geometry from UIScreen.main because iPhone apps become resizable on iOS 27. There is a whole section on iPhone Duo (the foldable): a vertical rail replaces most bars, SafeAreaView matters in more places, Expo UI gains ArrangementView, and a new expo-hinge package reports the fold angle. Xcode 27 replaces Simulator.app with Device Hub, so Expo CLI learned to boot simulators through it, and the expo-device-hub dev tools plugin streams every simulator and emulator into your browser. The most interesting new package is expo-app-intents (alpha): Swift inline modules in an app-intents directory expose actions to Siri, Shortcuts, Spotlight and Apple Intelligence, delivered to JavaScript. Expo Go for SDK 58 reaches the stores “within a few weeks”. Related: EAS CLI 25.0.0 on the same day makes simulator preview links authenticated by default, with --public-link to opt back out.
If you are still deciding on Expo at all, the what is Expo explainer is the place to start. The practical note from SDK 58 is that iOS 27 and iPhone Duo are a layout project, not a flag you flip.
Releases
- React 19.3.1 on October 14, with 19.2.9, 19.1.10 and 19.0.9 backports. One line: an improved transport protocol for React Server Components. The
backportdist-tag now points at 19.1.10. - react-native-gesture-handler 3.4.0 (October 16) adds iOS Swift Package Manager build support, a new
immediatePressOutprop onTouchable, and dispatchesonPressInwhen the native press starts on Android. 2.33.1 on thelegacytag collects the same batch of fixes for the 2.x line. - react-native-screens 4.30.0 (October 13) is about iOS 27 and iPhone Duo in Stack v4: on iOS 26+ screens are laid out under an opaque header through the safe area instead of UIKit’s extended layout,
useHeaderHeightreports the minimized bar height, and the newunstable_safeAreaEdgesprop lets a screen override the insets.Tabs.HostgetsprominentScreenKeyfor iOS 27. 5.0.0-alpha.4 is onnext. - React Navigation 7.x train on October 13: native-stack 7.21.0 adds
visibilityPriorityand submenu descriptions on header items plus options to hide item backgrounds; core 7.24.0 accepts getters on screens for lazy requires. v8 alphas keep climbing (native-stack 8.0.0-alpha.59). - React Native Skia went from 3.4.1 to 3.7.0 in the week, eight releases: Skia m157,
onSizedeprecated, the snapshot view API that arrived in 3.2 a fortnight ago removed again in 3.6.0, nothing presented while an iOS app is backgrounded, Dawn FIFO swapchain fixes on Android. Last week I said stay onreact-native-skia@2for production. Eight releases and one removed API later, I am not changing that advice. Our Skia guide has the migration notes. - react-native-fast-image 10.0.0 (October 12) renames the Android package to
com.fastimage, removes thefallbackprop and sourcesonProgressfrom the native views; 10.1.0 addssource.diskCacheto keep an image off disk and 10.1.1 (Saturday) fixescacheOnlymisses firingonLoad. Good timing: Friday’s post on this site is about image handling. - react-native-svg 15.16.0 (October 15) raises the iOS and tvOS deployment target to 15.1 for Xcode 27, brings back the Android tap sound, and bumps its test app to 0.88. See our react-native-svg tutorial if you are new to it.
- Node 26.12.0 (Current) adds
http.websocketMask()andwebsocketUnmask()and throws on missing WebAssembly support; 24.22.0 LTS getscrypto.parsePKCS12(), a generic MAC API and GCM-SIV cipher modes. - @react-native-documents/viewer 4.0.2 and picker 12.0.3 on Saturday; Stream Chat React Native 9.10.0 ports the AI components from the JS SDK; TanStack Query 5.104.4 and a Router/Start train on the 16th; Lucide 1.56 to 1.59; Storybook 10.6.2 and 11.0.0-alpha.6; Vue 3.5.44 and 3.6.0-rc.12; Angular 22.2.3.
Worth reading
Expo’s blog published a customer story on October 14, TeamReach relaunching with OTA updates, which is more useful than most case studies because it is specific about what over-the-air updates changed in their release process.
On r/reactnative the week belonged to builders. What I learned going from React Native to Swift to build an Apple Watch app is the honest kind of cross-over post. 136 animated components for Expo, free and open source is worth a bookmark. Web search in an on-device LLM app via a hidden WebView is the sort of trick our WebView guide warns you to sandbox properly, and Nitro WebView 0.2.1 is a reminder that the Nitro rewrite of that component is moving. Also: reverse engineering a Xiaomi TV remote into an Expo app, letting your agent test the RN app it just wrote, and This Week In React Native #301 for a second curation to compare against this one.
react.dev was quiet. On this site this week: PDF viewers in React Native on Wednesday and image loading, caching and resizing on Friday. If you shipped something I missed, tell me in the comments and it goes in next Monday.