Our delivery analytics page loaded every GPS point for a city into the browser to draw a heatmap. At 1.2 million points the tab froze for 40 seconds and sometimes crashed. How we measured where the time went, moved aggregation to the server with grid binning, and rendered the result with a WebGL layer.
We moved a checkout form to React 19 form actions and used useFormStatus to disable the submit button while submitting. The button never disabled and customers double-submitted orders. useFormStatus only reads the status of a parent form, and we called it in the component that rendered the form.
Invoices generated in the browser with jsPDF printed Polish, Vietnamese and Japanese names as random symbols. The 14 standard PDF fonts only cover a Latin-1-style character set. How we embedded a Unicode TTF font, subset it to keep files small, and tested names from every market.
We replaced a phone number input with a design-system web component. The form looked identical, but the server received no phone field and required validation never fired. Inputs inside shadow DOM do not belong to the outer form. How formAssociated and ElementInternals fix submission, validation and reset.
We wrapped each row of a 1,500-item list in React.memo, yet typing in a filter box re-rendered every row. Each render passed a new style object and a new onSelect function, so the shallow prop comparison always failed. How we found it with the Profiler and fixed it with stable references.
After enabling React Compiler we removed our manual useMemo calls, and the order table became slower than before. The compiler had bailed out of that component because it mutated an array during render. How we found which components were compiled, fixed the rule violations and verified the result.
A single GraphQL request with deeply nested author, posts and comments fields took 40 seconds and saturated every API pod, because the schema allowed unlimited depth and list sizes. The defensive controls we added: depth and complexity limits, page caps, persisted queries and an introspection policy.
After splitting our frontend and API onto separate subdomains, users logged in and were then treated as anonymous by every API call. The session cookie was host-only and fetch did not send credentials. How cookie scoping works across subdomains, the CORS settings that go with it, and the trade-offs.
A routine dependency update moved us to ESLint 9, and lint failed in CI and every editor: ESLint couldn't find an eslint.config file. ESLint 9 uses flat config by default and ignores .eslintrc. How we migrated a TypeScript and React project, kept Prettier out of the way, and avoided the common traps.