It's kinda crazy how React went from "it's just a super lightweight rendering library, bro" to "whoopsie, our server-side execution layer's complex custom data-format serializer had a prototype-pollution bug and now it's a CVE-10 RCE."