FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Update dependency react-dom [SECURITY] by renovate[bot] · Pull Request #27 · Web-Dev-Collaborative/lambda2 · GitHub

/ lambda2 Public

Update dependency react-dom [SECURITY] - #27

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-react-dom-vulnerability
ConversationCommits (1)ChecksFiles changed
Open

Update dependency react-dom [SECURITY]#27
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-react-dom-vulnerability

Conversation

renovate Bot commented Aug 8, 2024 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
react-dom (source) ^15.3.1 → ^19.0.0
react-dom (source) ^15.3.2 → ^19.0.0
react-dom (source) 16.2.0 → 16.2.1
react-dom (source) ^15.6.1 → ^16.0.0
react-dom (source) ^15.5.4 → ^16.0.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Cross-Site Scripting in react-dom

CVE-2018-6341 / GHSA-mvjj-gqq2-p4hw

More information

Details

Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:

  • be a server-side React app
  • be rendered to HTML using ReactDOMServer
  • include an attribute name from user input in an HTML tag
Recommendation

If you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

react/react (react-dom)

v19.2.8

Compare Source

v19.2.7

Compare Source

React Server Components

v19.2.6

Compare Source

React Server Components

v19.2.5

Compare Source

React Server Components

v19.2.4

Compare Source

React Server Components

v19.2.3

Compare Source

React Server Components

v19.2.2

Compare Source

React Server Components

v19.2.1

Compare Source

React Server Components

v19.2.0

Compare Source

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features
  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools
New React DOM Features
  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.
Notable changes
  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId
All Changes
React
React DOM
React Server Components
React Reconciler

v19.1.9

Compare Source

v19.1.8

Compare Source

React Server Components

v19.1.7

Compare Source

React Server Components

v19.1.6

Compare Source

React Server Components

v19.1.5

Compare Source

React Server Components

v19.1.4

Compare Source

React Server Components

v19.1.3

Compare Source

React Server Components

v19.1.2

Compare Source

React Server Components

v19.1.1

Compare Source

React

v19.1.0

Compare Source

Owner Stack

An Owner Stack is a string representing the components that are directly responsible for rendering a particular component. You can log Owner Stacks when debugging or use Owner Stacks to enhance error overlays or other development tools. Owner Stacks are only available in development builds. Component Stacks in production are unchanged.

  • An Owner Stack is a development-only stack trace that helps identify which components are responsible for rendering a particular component. An Owner Stack is distinct from a Component Stacks, which shows the hierarchy of components leading to an error.
  • The captureOwnerStack API is only available in development mode and returns a Owner Stack, if available. The API can be used to enhance error overlays or log component relationships when debugging. #​29923, #​32353, #​30306,
    #​32538, #​32529, #​32538
React
  • Enhanced support for Suspense boundaries to be used anywhere, including the client, server, and during hydration. #​32069, #​32163, #​32224, #​32252
  • Reduced unnecessary client rendering through improved hydration scheduling #​31751
  • Increased priority of client rendered Suspense boundaries #​31776
  • Fixed frozen fallback states by rendering unfinished Suspense boundaries on the client. #​31620
  • Reduced garbage collection pressure by improving Suspense boundary retries. #​31667
  • Fixed erroneous “Waiting for Paint” log when the passive effect phase was not delayed #​31526
  • Fixed a regression causing key warnings for flattened positional children in development mode. #​32117
  • Updated useId to use valid CSS selectors, changing format from :r123: to «r123». #​32001
  • Added a dev-only warning for null/undefined created in useEffect, useInsertionEffect, and useLayoutEffect. #​32355
  • Fixed a bug where dev-only methods were exported in production builds. React.act is no longer available in production builds. #​32200
  • Improved consistency across prod and dev to improve compatibility with Google Closure Compiler and bindings #​31808
  • Improve passive effect scheduling for consistent task yielding. #​31785
  • Fixed asserts in React Native when passChildrenWhenCloningPersistedNodes is enabled for OffscreenComponent rendering. #​32528
  • Fixed component name resolution for Portal #​32640
  • Added support for beforetoggle and toggle events on the dialog element. #​32479
React DOM
  • Fixed double warning when the href attribute is an empty string #​31783
  • Fixed an edge case where getHoistableRoot() didn’t work properly when the container was a Document #​32321
  • Removed support for using HTML comments (e.g. <!-- -->) as a DOM container. #​32250
  • Added support for <script> and <template> tags to be nested within <select> tags. #​31837
  • Fixed responsive images to be preloaded as HTML instead of headers #​32445
use-sync-external-store
  • Added exports field to package.json for use-sync-external-store to support various entrypoints. #​25231
React Server Components
  • Added unstable_prerender, a new experimental API for prerendering React Server Components on the server #​31724
  • Fixed an issue where streams would hang when receiving new chunks after a global error #​31840, #​31851
  • Fixed an issue where pending chunks were counted twice. #​31833
  • Added support for streaming in edge environments #​31852
  • Added support for sending custom error names from a server so that they are available in the client for console replaying. #​32116
  • Updated the server component wire format to remove IDs for hints and console.log because they have no return value #​31671
  • Exposed registerServerReference in client builds to handle server references in different environments. #​32534
  • Added react-server-dom-parcel package which integrates Server Components with the Parcel bundler #​31725, #​32132, #​31799, #​32294, #​31741

v19.0.8

Compare Source

v19.0.7

Compare Source

React Server Components

v19.0.6

Compare Source

React Server Components

v19.0.5

Compare Source

React Server Components

v19.0.4

Compare Source

React Server Components

v19.0.3

Compare Source

React Server Components

v19.0.2

Compare Source

React Server Components

v19.0.1

Compare Source

React Server Components

v19.0.0

Compare Source

Below is a list of all new features, APIs, deprecations, and breaking changes. Read React 19 release post and React 19 upgrade guide for more information.

Note: To help make the upgrade to React 19 easier, we’ve published a react@​18.3 release that is identical to 18.2 but adds warnings for deprecated APIs and other changes that are needed for React 19. We recommend upgrading to React 18.3.1 first to help identify any issues before upgrading to React 19.

New Features
React
  • Actions: startTransition can now accept async functions. Functions passed to startTransition are called “Actions”. A given Transition can include one or more Actions which update state in the background and update the UI with one commit. In addition to updating state, Actions can now perform side effects including async requests, and the Action will wait for the work to finish before finishing the Transition. This feature allows Transitions to include side effects like fetch() in the pending state, and provides support for error handling, and optimistic updates.
  • useActionState: is a new hook to order Actions inside of a Transition with access to the state of the action, and the pending state. It accepts a reducer that can call Actions, and the initial state used for first render. It also accepts an optional string that is used if the action is passed to a form action prop to support progressive enhancement in forms.
  • useOptimistic: is a new hook to update state while a Transition is in progress. It returns the state, and a set function that can be called inside a transition to “optimistically” update the state to expected final value immediately while the Transition completes in the background. When the transition finishes, the state is updated to the new value.
  • use: is a new API that allows reading resources in render. In React 19, use accepts a promise or Context. If provided a promise, use will suspend until a value is resolved. use can only be used in render but can be called conditionally.
  • ref as a prop: Refs can now be used as props, removing the need for forwardRef.
  • Suspense sibling pre-warming: When a component suspends, React will immediately commit the fallback of the nearest Suspense boundary, without waiting for the entire sibling tree to render. After the fallback commits, React will schedule another render for the suspended siblings to “pre-warm” lazy requests.
React DOM Client
  • <form> action prop: Form Actions allow you to manage forms automatically and integrate with useFormStatus. When a <form> action succeeds, React will automatically reset the form for uncontrolled components. The form can be reset manually with the new requestFormReset API.
  • <button> and <input> formAction prop: Actions can be passed to the formAction prop to configure form submission behavior. This allows using different Actions depending on the input.
  • useFormStatus: is a new hook that provides the status of the parent <form> action, as if the form was a Context provider. The hook returns the values: pending, data, method, and action.
  • Support for Document Metadata: We’ve added support for rendering document metadata tags in components natively. React will automatically hoist them into the <head> section of the document.
  • Support for Stylesheets: React 19 will ensure stylesheets are inserted into the <head> on the client before revealing the content of a Suspense boundary that depends on that stylesheet.
  • Support for async scripts: Async scripts can be rendered anywhere in the component tree and React will handle ordering and deduplication.
  • Support for preloading resources: React 19 ships with preinit, preload, prefetchDNS, and preconnect APIs to optimize initial page loads by moving discovery of additional resources like fonts out of stylesheet loading. They can also be used to prefetch resources used by an anticipated navigation.
React DOM Server
  • Added prerender and prerenderToNodeStream APIs for static site generation. They are designed to work with streaming environments like Node.js Streams and Web Streams. Unlike renderToString, they wait for data to load for HTML generation.
React Server Components
  • RSC features such as directives, server components, and server functions are now stable. This means libraries that ship with Server Components can now target React 19 as a peer dependency with a react-server export condition for use in frameworks that support the Full-stack React Architecture. The underlying APIs used to implement a React Server Components bundler or framework do not follow semver and may break between minors in React 19.x. See docs for how to support React Server Components.
Deprecations
  • Deprecated: element.ref access: React 19 supports ref as a prop, so we’re deprecating element.ref in favor of element.props.ref. Accessing will result in a warning.
  • react-test-renderer: In React 19, react-test-renderer logs a deprecation warning and has switched to concurrent rendering for web usage. We recommend migrating your tests to @​testing-library/react or @​testing-library/react-native
Breaking Changes

React 19 brings in a number of breaking changes, including the removals of long-deprecated APIs. We recommend first upgrading to 18.3.1, where we've added additional deprecation warnings. Check out the upgrade guide for more details and guidance on codemodding.

React
  • New JSX Transform is now required: We introduced a new JSX transform in 2020 to improve bundle size and use JSX without importing React. In React 19, we’re adding additional improvements like using ref as a prop and JSX speed improvements that require the new transform.
  • Errors in render are not re-thrown: Errors that are not caught by an Error Boundary are now reported to window.reportError. Errors that are caught by an Error Boundary are reported to console.error. We’ve introduced onUncaughtError and onCaughtError methods to createRoot and hydrateRoot to customize this error handling.
  • Removed: propTypes: Using propTypes will now be silently ignored. If required, we recommend migrating to TypeScript or another type-checking solution.
  • Removed: defaultProps for functions: ES6 default parameters can be used in place. Class components continue to support defaultProps since there is no ES6 alternative.
  • Removed: contextTypes and getChildContext: Legacy Context for class components has been removed in favor of the contextType API.
  • Removed: string refs: Any usage of string refs need to be migrated to ref callbacks.
  • Removed: Module pattern factories: A rarely used pattern that can be migrated to regular functions.
  • Removed: React.createFactory: Now that JSX is broadly supported, all createFactory usage can be migrated to JSX components.
  • Removed: react-test-renderer/shallow: This has been a re-export of react-shallow-renderer since React 18. If needed, you can continue to use the third-party package directly. We recommend using @​testing-library/react or @​testing-library/react-native instead.
React DOM
  • Removed: react-dom/test-utils: We’ve moved act from react-dom/test-utils to react. All other utilities have been removed.
  • Removed: ReactDOM.render, ReactDOM.hydrate: These have been removed in favor of the concurrent equivalents: ReactDOM.createRoot and ReactDOM.hydrateRoot.
  • Removed: unmountComponentAtNode: Removed in favor of root.unmount().
  • Removed: ReactDOM.findDOMNode: You can replace ReactDOM.findDOMNode with DOM Refs.
Notable Changes
React
  • <Context> as a provider: You can now render <Context> as a provider instead of <Context.Provider>.
  • Cleanup functions for refs: When the component unmounts, React will call the cleanup function returned from the ref callback.
  • useDeferredValue initial value argument: When provided, useDeferredValue will return the initial value for the initial render of a component, then schedule a re-render in the background with the deferredValue returned.
  • Support for Custom Elements: React 19 now passes all tests on Custom Elements Everywhere.
  • StrictMode changes: useMemo and useCallback will now reuse the memoized results from the first render, during the second render. Additionally, StrictMode will now double-invoke ref callback functions on initial mount.
  • UMD builds removed: To load React 19 with a script tag, we recommend using an ESM-based CDN such as esm.sh.
React DOM
  • Diffs for hydration errors: In the case of a mismatch, React 19 logs a single error with a diff of the mismatched content.
  • Compatibility with third-party scripts and extensions: React will now force a client re-render to fix up any mismatched content caused by elements inserted by third-party JS.
TypeScript Changes

The most common changes can be codemodded with npx types-react-codemod@latest preset-19 ./path-to-your-react-ts-files.

  • Removed deprecated TypeScript types:
    • ReactChild (replacement: React.ReactElement | number | string)
    • ReactFragment (replacement: Iterable<React.ReactNode>)
    • ReactNodeArray (replacement: ReadonlyArray<React.ReactNode>)
    • ReactText (replacement: number | string)
    • VoidFunctionComponent (replacement: FunctionComponent)
    • VFC (replacement: FC)
    • Moved to prop-types: Requireable, ValidationMap, Validator, WeakValidationMap
    • Moved to create-react-class: ClassicComponentClass, ClassicComponent, ClassicElement, ComponentSpec, Mixin, ReactChildren, ReactHTML, ReactSVG, SFCFactory
  • Disallow implicit return in refs: refs can now accept cleanup functions. When you return something else, we can’t tell if you intentionally returned something not meant to clean up or returned the wrong value. Implicit returns of anything but functions will now error.
  • Require initial argument to useRef: The initial argument is now required to match useState, createContext etc
  • Refs are mutable by default: Ref objects returned from useRef() are now always mutable instead of sometimes being immutable. This feature was too confusing for users and conflicted with legit cases where refs were managed by React and manually written to.
  • Strict ReactElement typing: The props of React elements now default to unknown instead of any if the element is typed as ReactElement
  • JSX namespace in TypeScript: The global JSX namespace is removed to improve interoperability with other libraries using JSX. Instead, the JSX namespace is available from the React package: import { JSX } from 'react'
  • Better useReducer typings: Most useReducer usage should not require explicit type arguments.
    For example, 
    -useReducer<React.Reducer<State, Action>>(reducer)
+useReducer(reducer)
    or 
    -useReducer<React.Reducer<State, Action>>(reducer)
+useReducer<State, Action>(reducer)
All Changes
React

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from e941dc2 to 6401083 Compare April 15, 2026 16:57
renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] Apr 15, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 6401083 to 1c44a7b Compare May 2, 2026 23:26
renovate Bot changed the title Update dependency react-dom [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] May 2, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 1c44a7b to 034fbfb Compare May 14, 2026 02:57
renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] May 14, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 034fbfb to c349333 Compare May 17, 2026 12:04
renovate Bot changed the title Update dependency react-dom [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] May 17, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from c349333 to b154d2b Compare May 23, 2026 11:17
renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] May 23, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from b154d2b to 6469d2a Compare May 26, 2026 18:15
renovate Bot changed the title Update dependency react-dom [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] May 26, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 6469d2a to 26d577e Compare May 30, 2026 16:29
renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] May 30, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 26d577e to 4430b38 Compare June 7, 2026 03:31
renovate Bot changed the title Update dependency react-dom [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] Jun 7, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 4430b38 to 85d4f8b Compare June 13, 2026 08:03
renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] Jun 13, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 85d4f8b to 72fd2f2 Compare June 14, 2026 20:11
renovate Bot changed the title Update dependency react-dom [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] Jun 14, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 72fd2f2 to 716a5c8 Compare June 21, 2026 03:45

mergify Bot commented Jun 21, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] Jun 21, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 716a5c8 to 7fe412d Compare June 25, 2026 04:17

mergify Bot commented Jun 25, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

renovate Bot changed the title Update dependency react-dom [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] Jun 25, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 7fe412d to 43d61a4 Compare July 18, 2026 03:57

mergify Bot commented Jul 18, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] Jul 18, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 43d61a4 to 3c3f555 Compare July 30, 2026 08:03
renovate Bot changed the title Update dependency react-dom [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] Jul 30, 2026

mergify Bot commented Jul 30, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 3c3f555 to 879accb Compare August 1, 2026 14:53
renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] Aug 1, 2026

mergify Bot commented Aug 1, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 879accb to 51a13ad Compare August 6, 2026 04:15

mergify Bot commented Aug 6, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

renovate Bot changed the title Update dependency react-dom [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] Aug 6, 2026
renovate Bot force-pushed the renovate/npm-react-dom-vulnerability branch from 51a13ad to cb557fb Compare August 15, 2026 16:24

mergify Bot commented Aug 15, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

renovate Bot changed the title Update dependency react-dom to v16.2.1 [SECURITY] Update dependency react-dom [SECURITY] Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

Back | FazBrowse Home | New Git URL