[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/react (source)	19.2.17 → 19.3.0
@types/react (source)	17.0.38 → 17.0.93
@types/react-dom (source)	19.2.3 → 19.3.0
@types/react-dom (source)	17.0.11 → 17.0.26
eslint-plugin-react-hooks (source)	4.6.0 → 4.6.2
react (source)	19.2.7 → 19.3.1
react-dom (source)	19.2.7 → 19.3.1

---

Release Notes

facebook/react (eslint-plugin-react-hooks)

v4.6.2

Compare Source

v4.6.1

Compare Source

react/react (react)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37845 by @​unstubbable and @​eps1lon)

v19.3.0

Compare Source

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #​31975, #​31987, #​31996, #​31999, #​32001, #​32002, #​32028, #​32029, #​32031, #​32034, #​32038, #​32041, #​32050, #​32090, #​32105, #​32254, #​32379, #​32422, #​32462, #​32540, #​32545, #​32585, #​32599, #​32611, #​32612, #​32617, #​32651, #​32653, #​32656, #​32664, #​32699, #​32723, #​32734, #​32751, #​32752, #​32760, #​32761, #​32764, #​32772, #​32790, #​32819, #​32820, #​32822, #​32833, #​32849, #​33094, #​33191, #​33200, #​33206, #​33293, #​33330, #​33331, #​33332, #​33357, #​33362, #​33433, #​33576, #​34374, #​34450, #​34481, #​34500, #​34502, #​34510, #​34511, #​34539, #​35567, #​35564, #​35485, #​35380, #​35063, #​35060, #​34676, #​36917, #​35337, #​35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #​32465, #​32613, #​32619, #​32654, #​32660, #​32682, #​32722, #​32813, #​32814, #​33056, #​33058, #​33093, #​34069, #​34103, #​34544, #​34545, #​37062, #​37061, #​37060, #​36047, #​36010, #​35642, #​35641, #​35637, #​35630, #​34935, #​37457, #​37408, #​37326, #​37251, #​37171, #​37169, #​37168, #​37167, #​37166, #​37165, #​37164, #​37163, #​37162, #​37161, #​37160, #​37125, #​37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #​37143, #​37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #​37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #​35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #​37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #​36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #​36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #​36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #​36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #​36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #​35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #​35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #​35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #​35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #​35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #​36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #​34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #​34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #​34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #​36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #​35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #​34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #​35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #​34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #​35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #​37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #​37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #​37113)
• Only remove properties from Host Singletons on release (@​gnoff #​37112)
• Don't invoke effects on moved children in StrictMode (@​sophiebits #​36948)
• Throw a clearer error when a rejected Promise is incorrectly instrumented (@​eps1lon #​36328)
• Fix context propagation into Suspense fallbacks (@​acdlite #​36160)
• Fix context propagation through suspended Suspense boundaries (@​acdlite #​35839)
• Fix useDeferredValue getting stuck (@​gaearon #​36134)
• Update useActionState error message to say "action state" instead of "form state" (@​rickhanlonii #​35790)
• Don't warn when rendering data block scripts (@​eps1lon #​35953)
• Treat fibers with alternates as mounted in getNearestMountedFiber (@​sebmarkbage #​35578)
• Always instrument the lazy initializer thenable (@​gnoff #​35521)
• Annotate cascading updates for DevTools performance tracks in DEV (@​huntie #​34961)
• Resolve the .default export of a React.lazy as the canonical value (@​sebmarkbage #​34906)
• Limit owner stacks to 10 frames (@​eps1lon #​34864)
• Ensure useEffectEvent reads latest values in forwardRef and memo() components (@​eps1lon #​34831)

React DOM

• Copy source onto the synthetic toggle event (@​lazerg #​37389)
• Update HTML parser rules for the new <select> parser (@​josepharhar #​34804)
• Update defaultValue for type="number" inputs to match other input types (@​sophiebits #​36980)
• Avoid setting innerHTML when it hasn't changed (@​sophiebits #​36949)
• Forward the nonce option in ReactDOM.preloadModule() (@​UditDewan #​36851)
• Support fetchPriority for module resources (@​TheAlexLichter #​36835)
• Track stylesheet preloads when explicitly preloaded to avoid unnecessary suspension (@​gnoff #​36386)
• Suggest correct casing for the misspelled credentialless iframe attribute (@​vmx906 #​36322)
• Add credentialless as a recognized boolean attribute for iframes (@​vmx906 #​36148)
• Prevent reentrant finishedTask from calling completeAll multiple times (@​gnoff #​36287)
• Update the CSS shorthand property list (@​kidonng #​35636)
• Support the maskType SVG prop (@​sleitor #​35921)
• Add support for onFullscreenChange and onFullscreenError events (@​chirokas #​34621)
• Include submitter in submit events (@​eps1lon #​35590)
• Fire onReset when automatically resetting forms (@​eps1lon #​35176)
• Use the FormData submitter parameter (@​jenseng #​29028)
• Fix form status reset when component state is updated (@​eps1lon #​34075)
• Batch updates from resize events until the next frame (@​eps1lon #​35117)

React Server

• Add nonce to rendered import maps (@​mattcosta7 #​37339)
• Add an onBrowserBailout option to observe subtrees that defer to the browser (@​gnoff #​37193)
• Stop the caller's signal from retaining a finished render (@​unstubbable #​37315)
• Construct the render lifetime controller only when it is needed (@​unstubbable #​37357)
• Fix react-dom/server hanging on Deno (@​fraidev #​35235)
• Extend stack overflow recovery to retries in SSR (@​jackpope #​36977)
• Fix false-positive hydration mismatch on nonce attributes (@​MaxwellCohen #​37030)
• Guard shell-error callbacks instead of nulling them out on the request (@​eps1lon #​36916)
• Stop firing onAllReady after the shell errored (@​eps1lon #​36903)
• Treat an incomplete tree as an error during error recovery (@​acdlite #​36911)
• Fix non-script modulepreload tracking (@​fallintoplace #​36564)
• Finalize postponed nextSegmentId after the prelude flush (@​gaojude #​36779)
• Preserve referrerPolicy in image preload headers (@​ulises-jeremias #​36803)
• Allow pending work to specialize abort reasons (@​gnoff #​36586)
• Abort tasks that suspend after aborting during render (@​gnoff #​36585)
• Finish abort in a scheduled task (@​gnoff #​36580)
• Fix aborts during resumed rendering (@​gnoff #​36584)
• Track abort state on the request (@​gnoff #​36583)
• Model external work scheduling explicitly in the fb bundle (@​gnoff #​36576)
• Continue reporting aborted task errors after a fatal abort (@​gnoff #​36575)
• Disallow abort reentrancy (@​gnoff #​36574)
• Stop transpiling computed property names (@​eps1lon #​36542)
• Fix crash when capturing the callsite of a stalled use() of a rejected Flight chunk (@​lubieowoce #​36544)
• Double invoke effects in Strict Mode during hydration (@​eps1lon #​35961)
• Add additional task reentrancy protections in Fizz (@​gnoff #​36291)
• Don't outline Suspense boundaries with suspensey CSS during shell flush (@​gnoff #​35824)
• Push a stalled use() to the owner stack and debug task (@​eps1lon #​35226)
• Fix useId tracking on replay (@​gnoff #​35518)
• Correctly handle replaying when hydrating (@​gnoff #​35494)
• Simplify the createSuspenseBoundary path (@​sebmarkbage #​35087)
• Unify preamble-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35068)
• Unify prerender-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35067)
• Push halted awaits to the owner stack for late-arriving I/O info (@​unstubbable #​35019)
• Include all Node.js APIs in the Bun entrypoint for react-dom/server (@​RiskyMH #​34193)
• Detach a Suspense boundary after flushing its segment (@​gnoff #​34694)

React Server Components

• Keep an element pending while a referenced row is resolving (@​unstubbable #​37542)
• Fix RangeError from exponential debug info growth (@​unstubbable #​37481)
• Abort the cache signal when debug objects are retained (@​unstubbable #​37342)
• Transfer key validation of lazy nodes when they are unwrapped (@​unstubbable #​37258)
• Add pending_weak to the Flight thenable protocol (@​acdlite #​37154)
• Outline and dedupe repeated strings (@​gaearon #​37147)
• Port Reply Server traversal guards to the Flight Client (@​eps1lon #​37144)
• Define Flight chunk .then with Object.defineProperty (@​eps1lon #​37109)
• Support Turbopack's experimental array format for chunks (@​sampoder #​37095)
• Limit fake JSX call site stacks to 10 frames (@​timneutkens #​37086)
• Improve performance when decoding Flight replies (@​gnoff #​37090)
• Recognize Node 22+ V8 frames for Promise statics in debug info (@​gaearon #​36969)
• Tailor the warning for binary data serialized through toJSON (Node Buffer) (@​unstubbable #​36873)
• Resolve models before JSON.stringify for faster serialization (@​mhart #​36795)
• Prune debug info when chunks error (@​gnoff #​36782)
• Avoid main-thread stalls from large debug strings (@​unstubbable #​36570)
• Fix stranded row content under Node stream backpressure (@​unstubbable #​36516)
• Fix dropped FormData entries in decodeReplyFromBusboy (@​unstubbable #​36468)
• Harden types and improve performance of Flight replies (@​eps1lon #​36425)
• Add more cycle protections to Flight replies (@​eps1lon #​36236)
• Transport AggregateError.errors (@​eps1lon #​36156)
• Bail out early when a backing entry for Blob deserialization is not a Blob (@​eps1lon #​36055)
• Clear chunk reason after successful module initialization (@​unstubbable #​36024)
• Add support for transporting Error.cause (@​eps1lon #​35810)
• Walk parsed JSON instead of using a reviver for faster RSC payload parsing (@​timneutkens #​35776)
• Skip transferReferencedDebugInfo during debug info resolution (@​unstubbable #​35795)
• Add unstable_allowPartialStream option to Flight Client (@​unstubbable #​35731)
• Fix encodeReply for JSX with temporary references (@​unstubbable #​35730)
• Fix debug channel flag in Node.js renderToPipeableStream (@​feedthejim #​35724)
• Fix stack overflow in visitAsyncNode with deep async chains (@​unstubbable #​35612)
• Allow Server Components to render context providers from client modules (@​rickhanlonii #​35675)
• Allow overriding request.timeOrigin via options.startTime (@​lubieowoce #​35598)
• Warn once if eval is disabled in the dev environment (@​eps1lon #​35661)
• Restore original function name in dev server callstacks served with unsafe-eval (@​eps1lon #​35650)
• Fix react-markup types for server references (@​eps1lon #​35634)
• Add more DoS mitigations to Flight replies and harden Flight (@​unstubbable #​35632)
• Allow cyclic references to be serialized when unwrapping lazy elements (@​unstubbable #​35471)
• Improve cyclic thenable detection in Flight reply server (@​cvan20191 #​35369)
• Add extra loop protection to Flight reply server (@​sebmarkbage #​35351)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage #​35345)
• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Never parse then functions in Flight replies (@​sebmarkbage #​35289)
• Patch Flight reply server with fixes from Flight Client (@​sebmarkbage #​35277)
• Complete the list of Node.js internal Promise awaits (@​eps1lon #​35161)
• Reduce risk of maximum call stack exceeded when emitting async sequences (@​eps1lon #​35159)
• Fix pending chunks count for streams and async iterables in DEV (@​unstubbable #​35143)
• Fix broken byte stream parsing caused by buffer detachment (@​unstubbable #​35127)
• Fix hasReadable flag in Node.js clients' debug channel (@​unstubbable #​35039)
• Fix debug info filtering to include later resolved I/O (@​unstubbable #​35036)
• Cache the value when visiting the same I/O or Promise along different paths (@​sebmarkbage #​35005)
• Clone subsequent I/O nodes when resolved more than once (@​sebmarkbage #​35003)
• Fix hang after resolving cyclic references (@​unstubbable #​34988)
• Allow passing DEV-only startTime as an option (@​sebmarkbage #​34912)
• Ignore bound-anonymous-fn resources as they're not considered I/O (@​sebmarkbage #​34911)
• Fix detached ArrayBuffer error when streaming typed arrays (@​unstubbable #​34849)
• Exclude RSC stream if the stream resolves in a task (@​sebmarkbage #​34838)
• Forward the current environment when forwarding I/O entries (@​sebmarkbage #​34836)
• Look for moved debug info when logging component performance track (@​sebmarkbage #​34839)
• Respect displayName of Promise instances on the server (@​sebmarkbage #​34825)
• Avoid unnecessary indirection when serializing debug info (@​unstubbable #​34797)
• Fix preload as attribute for stylesheets (@​unstubbable #​34760)
• Don't serialize toJSON in debug path and omit wide arrays (@​sebmarkbage #​34759)
• Add support for <Activity> (@​eps1lon #​34697)

v19.2.9: 19.2.9 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37844 by @​unstubbable and @​eps1lon)

v19.2.8: 19.2.8 (July 21st, 2026)

Compare Source

React Server Components

• Performance improvements when decoding
  (#​37087 by @​eps1lon)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 04:59 AM, on day 1 of the month (* 0-4 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e65bc38d-1f26-4b38-8308-0fe979b622e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}