chore(deps): update react monorepo (major)

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@types/react (source)	18.3.31 → 19.3.0
@types/react-dom (source)	18.3.7 → 19.3.0
eslint-plugin-react-hooks (source)	5.2.0 → 7.1.1
react (source)	18.3.1 → 19.3.0
react-dom (source)	18.3.1 → 19.3.0

---

Release Notes

facebook/react (eslint-plugin-react-hooks)

v7.1.1

Compare Source

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

• Add deprecated no-op component-hook-factories rule for backwards compatibility. (@​mofeiZ in #​36307)

v7.1.0

Compare Source

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

• Add ESLint v10 support. (@​azat-io in #​35720)
• Skip compilation for non-React files to improve performance. (@​josephsavona in #​35589)
• Fix exhaustive deps bug with Flow type casting. (@​jorge-cab in #​35691)
• Fix useEffectEvent checks in component syntax. (@​jbrown215 in #​35041)
• Improved set-state-in-effect validation with fewer false negatives. (@​jorge-cab in #​35134, @​josephsavona in #​35147, @​jackpope in #​35214, @​chesnokov-tony in #​35419, @​jsleitor in #​36107)
• Improved ref validation for non-mutating functions and event handler props. (@​josephsavona in #​35893, @​kolvian in #​35062)
• Compiler now reports all errors instead of stopping at the first. (@​josephsavona in #​35873–#​35884)
• Improved source locations and error display in compiler diagnostics. (@​nathanmarks in #​35348, @​josephsavona in #​34963)

v7.0.1

Compare Source

• Disallowed passing inline useEffectEvent values as JSX props to guard against accidental propagation. (#​34820 by @​jf-eirinha)
• Switch to export = so eslint-plugin-react-hooks emits correct types for consumers in Node16 ESM projects. (#​34949 by @​karlhorky)
• Tightened the typing of configs.flat so the configs export is always defined. (#​34950 by @​poteto)
• Fix named import runtime errors. (#​34951, #​34953 by @​karlhorky)

v7.0.0

Compare Source

This release slims down presets to just 2 configurations (recommended and recommended-latest), and all compiler rules are enabled by default.

• Breaking: Removed recommended-latest-legacy and flat/recommended configs. The plugin now provides recommended (legacy and flat configs with all recommended rules), and recommended-latest (legacy and flat configs with all recommended rules plus new bleeding edge experimental compiler rules). (@​poteto in #​34757)

v6.1.1

Compare Source

Note: 6.1.0 accidentally allowed use of recommended without flat config, causing errors when used with ESLint v9's defineConfig() helper. This has been fixed in 6.1.1.

• Fix recommended config for flat config compatibility. The recommended config has been converted to flat config format. Non-flat config users should use recommended-legacy instead. (@​poteto in #​34700)
• Add recommended-latest and recommended-latest-legacy configs that include React Compiler rules. (@​poteto in #​34675)
• Remove unused NoUnusedOptOutDirectives rule. (@​poteto in #​34703)
• Remove hermes-parser and dependency. (@​poteto in #​34719)
• Remove @babel/plugin-proposal-private-methods dependency. (@​ArnaudBarre and @​josephsavona in #​34715)
• Update for Zod v3/v4 compatibility. (@​kolian and @​josephsavona in #​34717)

v6.1.0

Compare Source

Note: Version 6.0.0 was mistakenly released and immediately deprecated and untagged on npm. This is the first official 6.x major release and includes breaking changes.

• Breaking: Require Node.js 18 or newer. (@​michaelfaith in #​32458)
• Breaking: Flat config is now the default recommended preset. Legacy config moved to recommended-legacy. (@​michaelfaith in #​32457)
• New Violations: Disallow calling use within try/catch blocks. (@​poteto in #​34040)
• New Violations: Disallow calling useEffectEvent functions in arbitrary closures. (@​jbrown215 in #​33544)
• Handle React.useEffect in addition to useEffect in rules-of-hooks. (@​Ayc0 in #​34076)
• Added react-hooks settings config option that to accept additionalEffectHooks that are used across exhaustive-deps and rules-of-hooks rules. (@​jbrown215) in #​34497

v6.0.0

Compare Source

Accidentally released. See 6.1.0 for the actual changes.

react/react (react)

v19.3.0

Compare Source

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #​31975, #​31987, #​31996, #​31999, #​32001, #​32002, #​32028, #​32029, #​32031, #​32034, #​32038, #​32041, #​32050, #​32090, #​32105, #​32254, #​32379, #​32422, #​32462, #​32540, #​32545, #​32585, #​32599, #​32611, #​32612, #​32617, #​32651, #​32653, #​32656, #​32664, #​32699, #​32723, #​32734, #​32751, #​32752, #​32760, #​32761, #​32764, #​32772, #​32790, #​32819, #​32820, #​32822, #​32833, #​32849, #​33094, #​33191, #​33200, #​33206, #​33293, #​33330, #​33331, #​33332, #​33357, #​33362, #​33433, #​33576, #​34374, #​34450, #​34481, #​34500, #​34502, #​34510, #​34511, #​34539, #​35567, #​35564, #​35485, #​35380, #​35063, #​35060, #​34676, #​36917, #​35337, #​35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #​32465, #​32613, #​32619, #​32654, #​32660, #​32682, #​32722, #​32813, #​32814, #​33056, #​33058, #​33093, #​34069, #​34103, #​34544, #​34545, #​37062, #​37061, #​37060, #​36047, #​36010, #​35642, #​35641, #​35637, #​35630, #​34935, #​37457, #​37408, #​37326, #​37251, #​37171, #​37169, #​37168, #​37167, #​37166, #​37165, #​37164, #​37163, #​37162, #​37161, #​37160, #​37125, #​37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #​37143, #​37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #​37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #​35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #​37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #​36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #​36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #​36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #​36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #​36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #​35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #​35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #​35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #​35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #​35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #​36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #​34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #​34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #​34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #​36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #​35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #​34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #​35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #​34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #​35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #​37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #​37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #​37113)
• Only remove properties from Host Singletons on release (@​gnoff #​37112)
• Don't invoke effects on moved children in StrictMode (@​sophiebits #​36948)
• Throw a clearer error when a rejected Promise is incorrectly instrumented (@​eps1lon #​36328)
• Fix context propagation into Suspense fallbacks (@​acdlite #​36160)
• Fix context propagation through suspended Suspense boundaries (@​acdlite #​35839)
• Fix useDeferredValue getting stuck (@​gaearon #​36134)
• Update useActionState error message to say "action state" instead of "form state" (@​rickhanlonii #​35790)
• Don't warn when rendering data block scripts (@​eps1lon #​35953)
• Treat fibers with alternates as mounted in getNearestMountedFiber (@​sebmarkbage #​35578)
• Always instrument the lazy initializer thenable (@​gnoff #​35521)
• Annotate cascading updates for DevTools performance tracks in DEV (@​huntie #​34961)
• Resolve the .default export of a React.lazy as the canonical value (@​sebmarkbage #​34906)
• Limit owner stacks to 10 frames (@​eps1lon #​34864)
• Ensure useEffectEvent reads latest values in forwardRef and memo() components (@​eps1lon #​34831)

React DOM

• Copy source onto the synthetic toggle event (@​lazerg #​37389)
• Update HTML parser rules for the new <select> parser (@​josepharhar #​34804)
• Update defaultValue for type="number" inputs to match other input types (@​sophiebits #​36980)
• Avoid setting innerHTML when it hasn't changed (@​sophiebits #​36949)
• Forward the nonce option in ReactDOM.preloadModule() (@​UditDewan #​36851)
• Support fetchPriority for module resources (@​TheAlexLichter #​36835)
• Track stylesheet preloads when explicitly preloaded to avoid unnecessary suspension (@​gnoff #​36386)
• Suggest correct casing for the misspelled credentialless iframe attribute (@​vmx906 #​36322)
• Add credentialless as a recognized boolean attribute for iframes (@​vmx906 #​36148)
• Prevent reentrant finishedTask from calling completeAll multiple times (@​gnoff #​36287)
• Update the CSS shorthand property list (@​kidonng #​35636)
• Support the maskType SVG prop (@​sleitor #​35921)
• Add support for onFullscreenChange and onFullscreenError events (@​chirokas #​34621)
• Include submitter in submit events (@​eps1lon #​35590)
• Fire onReset when automatically resetting forms (@​eps1lon #​35176)
• Use the FormData submitter parameter (@​jenseng #​29028)
• Fix form status reset when component state is updated (@​eps1lon #​34075)
• Batch updates from resize events until the next frame (@​eps1lon #​35117)

React Server

• Add nonce to rendered import maps (@​mattcosta7 #​37339)
• Add an onBrowserBailout option to observe subtrees that defer to the browser (@​gnoff #​37193)
• Stop the caller's signal from retaining a finished render (@​unstubbable #​37315)
• Construct the render lifetime controller only when it is needed (@​unstubbable #​37357)
• Fix react-dom/server hanging on Deno (@​fraidev #​35235)
• Extend stack overflow recovery to retries in SSR (@​jackpope #​36977)
• Fix false-positive hydration mismatch on nonce attributes (@​MaxwellCohen #​37030)
• Guard shell-error callbacks instead of nulling them out on the request (@​eps1lon #​36916)
• Stop firing onAllReady after the shell errored (@​eps1lon #​36903)
• Treat an incomplete tree as an error during error recovery (@​acdlite #​36911)
• Fix non-script modulepreload tracking (@​fallintoplace #​36564)
• Finalize postponed nextSegmentId after the prelude flush (@​gaojude #​36779)
• Preserve referrerPolicy in image preload headers (@​ulises-jeremias #​36803)
• Allow pending work to specialize abort reasons (@​gnoff #​36586)
• Abort tasks that suspend after aborting during render (@​gnoff #​36585)
• Finish abort in a scheduled task (@​gnoff #​36580)
• Fix aborts during resumed rendering (@​gnoff #​36584)
• Track abort state on the request (@​gnoff #​36583)
• Model external work scheduling explicitly in the fb bundle (@​gnoff #​36576)
• Continue reporting aborted task errors after a fatal abort (@​gnoff #​36575)
• Disallow abort reentrancy (@​gnoff #​36574)
• Stop transpiling computed property names (@​eps1lon #​36542)
• Fix crash when capturing the callsite of a stalled use() of a rejected Flight chunk (@​lubieowoce #​36544)
• Double invoke effects in Strict Mode during hydration (@​eps1lon #​35961)
• Add additional task reentrancy protections in Fizz (@​gnoff #​36291)
• Don't outline Suspense boundaries with suspensey CSS during shell flush (@​gnoff #​35824)
• Push a stalled use() to the owner stack and debug task (@​eps1lon #​35226)
• Fix useId tracking on replay (@​gnoff #​35518)
• Correctly handle replaying when hydrating (@​gnoff #​35494)
• Simplify the createSuspenseBoundary path (@​sebmarkbage #​35087)
• Unify preamble-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35068)
• Unify prerender-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35067)
• Push halted awaits to the owner stack for late-arriving I/O info (@​unstubbable #​35019)
• Include all Node.js APIs in the Bun entrypoint for react-dom/server (@​RiskyMH #​34193)
• Detach a Suspense boundary after flushing its segment (@​gnoff #​34694)

React Server Components

• Keep an element pending while a referenced row is resolving (@​unstubbable #​37542)
• Fix RangeError from exponential debug info growth (@​unstubbable #​37481)
• Abort the cache signal when debug objects are retained (@​unstubbable #​37342)
• Transfer key validation of lazy nodes when they are unwrapped (@​unstubbable #​37258)
• Add pending_weak to the Flight thenable protocol (@​acdlite #​37154)
• Outline and dedupe repeated strings (@​gaearon #​37147)
• Port Reply Server traversal guards to the Flight Client (@​eps1lon #​37144)
• Define Flight chunk .then with Object.defineProperty (@​eps1lon #​37109)
• Support Turbopack's experimental array format for chunks (@​sampoder #​37095)
• Limit fake JSX call site stacks to 10 frames (@​timneutkens #​37086)
• Improve performance when decoding Flight replies (@​gnoff #​37090)
• Recognize Node 22+ V8 frames for Promise statics in debug info (@​gaearon #​36969)
• Tailor the warning for binary data serialized through toJSON (Node Buffer) (@​unstubbable #​36873)
• Resolve models before JSON.stringify for faster serialization (@​mhart #​36795)
• Prune debug info when chunks error (@​gnoff #​36782)
• Avoid main-thread stalls from large debug strings (@​unstubbable #​36570)
• Fix stranded row content under Node stream backpressure (@​unstubbable #​36516)
• Fix dropped FormData entries in decodeReplyFromBusboy (@​unstubbable #​36468)
• Harden types and improve performance of Flight replies (@​eps1lon #​36425)
• Add more cycle protections to Flight replies (@​eps1lon #​36236)
• Transport AggregateError.errors (@​eps1lon #​36156)
• Bail out early when a backing entry for Blob deserialization is not a Blob (@​eps1lon #​36055)
• Clear chunk reason after successful module initialization (@​unstubbable #​36024)
• Add support for transporting Error.cause (@​eps1lon #​35810)
• Walk parsed JSON instead of using a reviver for faster RSC payload parsing (@​timneutkens #​35776)
• Skip transferReferencedDebugInfo during debug info resolution (@​unstubbable #​35795)
• Add unstable_allowPartialStream option to Flight Client (@​unstubbable #​35731)
• Fix encodeReply for JSX with temporary references (@​unstubbable #​35730)
• Fix debug channel flag in Node.js renderToPipeableStream (@​feedthejim #​35724)
• Fix stack overflow in visitAsyncNode with deep async chains (@​unstubbable #​35612)
• Allow Server Components to render context providers from client modules (@​rickhanlonii #​35675)
• Allow overriding request.timeOrigin via options.startTime (@​lubieowoce #​35598)
• Warn once if eval is disabled in the dev environment (@​eps1lon #​35661)
• Restore original function name in dev server callstacks served with unsafe-eval (@​eps1lon #​35650)
• Fix react-markup types for server references (@​eps1lon #​35634)
• Add more DoS mitigations to Flight replies and harden Flight (@​unstubbable #​35632)
• Allow cyclic references to be serialized when unwrapping lazy elements (@​unstubbable #​35471)
• Improve cyclic thenable detection in Flight reply server (@​cvan20191 #​35369)
• Add extra loop protection to Flight reply server (@​sebmarkbage #​35351)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage #​35345)
• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Never parse then functions in Flight replies (@​sebmarkbage #​35289)
• Patch Flight reply server with fixes from Flight Client (@​sebmarkbage #​35277)
• Complete the list of Node.js internal Promise awaits (@​eps1lon #​35161)
• Reduce risk of maximum call stack exceeded when emitting async sequences (@​eps1lon #​35159)
• Fix pending chunks count for streams and async iterables in DEV (@​unstubbable #​35143)
• Fix broken byte stream parsing caused by buffer detachment (@​unstubbable #​35127)
• Fix hasReadable flag in Node.js clients' debug channel (@​unstubbable #​35039)
• Fix debug info filtering to include later resolved I/O (@​unstubbable #​35036)
• Cache the value when visiting the same I/O or Promise along different paths (@​sebmarkbage #​35005)
• Clone subsequent I/O nodes when resolved more than once (@​sebmarkbage #​35003)
• Fix hang after resolving cyclic references (@​unstubbable #​34988)
• Allow passing DEV-only startTime as an option (@​sebmarkbage #​34912)
• Ignore bound-anonymous-fn resources as they're not considered I/O (@​sebmarkbage #​34911)
• Fix detached ArrayBuffer error when streaming typed arrays (@​unstubbable #​34849)
• Exclude RSC stream if the stream resolves in a task (@​sebmarkbage #​34838)
• Forward the current environment when forwarding I/O entries (@​sebmarkbage #​34836)
• Look for moved debug info when logging component performance track (@​sebmarkbage #​34839)
• Respect displayName of Promise instances on the server (@​sebmarkbage #​34825)
• Avoid unnecessary indirection when serializing debug info (@​unstubbable #​34797)
• Fix preload as attribute for stylesheets (@​unstubbable #​34760)
• Don't serialize toJSON in debug path and omit wide arrays (@​sebmarkbage #​34759)
• Add support for <Activity> (@​eps1lon #​34697)

v19.2.9: 19.2.9 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37844 by @​unstubbable and @​eps1lon)

v19.2.8: 19.2.8 (July 21st, 2026)

Compare Source

React Server Components

• Performance improvements when decoding
  (#​37087 by @​eps1lon)

v19.2.7

Compare Source

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #​36566)

v19.2.6

Compare Source

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #​36425)

v19.2.5

Compare Source

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #​36236)

v19.2.4

Compare Source

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #​35632)

v19.2.3

Compare Source

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #​35351)

v19.2.2

Compare Source

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #​35289, #​35345)

v19.2.1

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

v19.2.0

Compare Source

Below is a list of all new features, APIs, and bug fixes.

Read the [React 19.2 release post](https:

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @terrestris/eslint-config-typescript-react@6.0.0
npm error Found: eslint-plugin-react-hooks@7.1.1
npm error node_modules/eslint-plugin-react-hooks
npm error   dev eslint-plugin-react-hooks@"7.1.1" from the root project
npm error
npm error Could not resolve dependency:
npm error peer eslint-plugin-react-hooks@"^5.1.0" from @terrestris/eslint-config-typescript-react@6.0.0
npm error node_modules/@terrestris/eslint-config-typescript-react
npm error   dev @terrestris/eslint-config-typescript-react@"6.0.0" from the root project
npm error
npm error Conflicting peer dependency: eslint-plugin-react-hooks@5.2.0
npm error node_modules/eslint-plugin-react-hooks
npm error   peer eslint-plugin-react-hooks@"^5.1.0" from @terrestris/eslint-config-typescript-react@6.0.0
npm error   node_modules/@terrestris/eslint-config-typescript-react
npm error     dev @terrestris/eslint-config-typescript-react@"6.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-13T17_48_56_496Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-13T17_48_56_496Z-debug-0.log