i dont understand, you’d have to do the same in react?

mostly this code injection comes from trusted sources like your CMS. if you’re displaying arbitrary user input then yeah better sanitize it but thats a problem common to all frameworks react included

as for perf i mean the main thing is “are you downloading 100kb just for the framework” whereas many svelte apps come in under 10kb. beyond that agree it doesnt really matter

It's 136.4kB minified (react+react-dom), for a zero app is crazy. The app size that will justify 136.4kB is probably 700kB which is 836.3kB total, is also crazy. So no hello world argument because it sucks (in engineering metrics) at all range of apps.

According to https://web.dev/optimizing-content-efficiency-javascript-sta... the js size budget is about 800kB minified (1s to parse/compile). So if an app max out the budget, the framework part is considerably 17.05%.

Not bad, but if the median of react app is around 300kB which means the framework part is 45.4%. This is bad!