[Snyk] Upgrade react from 19.2.8 to 19.3.0

[posit-snyk-bot]

Snyk has created this PR to upgrade react from 19.2.8 to 19.3.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 204 versions ahead of your current version.

• The recommended version was released 23 days ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: react

• 19.3.0 - 2026-09-09
  

  Below is a list of all new features, APIs, and bug fixes.

  Read the React 19.3 release post for more information.

  New React Features

  • <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@ sebmarkbage, @ jackpope, @ gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
  • Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@ jackpope, @ sebmarkbage, @ eps1lon, @ Dhakshin2007, @ chirokas, @ teamleaderleo, @ fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

  New React DOM Features

  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@ gnoff: #37143, #37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@ gnoff #37193)

  Notable changes

  • Enable Trusted Types API integration (@ rickhanlonii #35816)
  • Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@ acdlite #37290)
  • Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@ hoxyq, @ eps1lon: #37104, #37203, #37491)

  All Changes

  React

  • Fast Refresh Fixes
    • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@ sophiebits #36965)
    • Fix Fast Refresh so edits to a memo() comparison function take effect (@ sophiebits #36964)
    • Fix Fast Refresh crash when an edit changes the kind of a component's type (@ sophiebits #36963)
    • Unify hot reload type resolution for Fast Refresh (@ sophiebits #36962)
    • Fix Fast Refresh to remount correctly when an edit changes the component kind (@ sophiebits #36950)
    • Double invoke effects in StrictMode after Fast Refresh (@ eps1lon #35962)
  • Performance Track Fixes
    • Prevent crash when accessing $$typeof in Performance Tracks (@ eps1lon #35679)
    • Handle non-string function names in Performance Tracks (@ eps1lon #35659)
    • Use minus (-) instead of en dash for removed props in Performance Tracks (@ eps1lon #35649)
    • Handle arrays with bigints in deep objects in Performance Tracks (@ eps1lon #35648)
    • Don't enumerate typed array props in Performance Tracks in DEV (@ UditDewan #36913)
    • Bail out of diffing wide objects and arrays in Performance Tracks (@ eps1lon #34742)
    • Clear potentially large performance measures in DEV (@ hoxyq #34803)
    • Fix missing else branch for renders with no props change in Performance Tracks (@ hoxyq #34837)
  • Activity Fixes
    • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@ sophiebits #36947)
    • Hide portal contents when an Activity is hidden (@ acdlite #35091)
    • Prevent metadata hoisting in hidden <Activity> trees (@ ronnakamoto #34983)
    • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@ acdlite #35074)
    • Don't unhide a node if a direct parent Offscreen is still hidden (@ sebmarkbage #34821)
    • Don't show internal <Offscreen> component in error messages (@ rickhanlonii #35763)
  • Warn in DEV when a component appears to have been unblocked by a conditional use() (@ hoxyq, @ eps1lon: #37104, #37203, #37491)
  • Render transitions independently instead of entangling them into a single render (@ acdlite #37290)
  • Fix hang when updating a dehydrated boundary inside a hidden tree (@ gaearon #37135)
  • Don't reacquire Host Singletons during dev effect validation (@ gnoff #37113)
  • Only remove properties from Host Singletons on release (@ gnoff #37112)
  • Don't invoke effects on moved children in StrictMode (@ sophiebits #36948)
  • Throw a clearer error when a rejected Promise is incorrectly instrumented (@ eps1lon #36328)
  • Fix context propagation into Suspense fallbacks (@ acdlite #36160)
  • Fix context propagation through suspended Suspense boundaries (@ acdlite #35839)
  • Fix useDeferredValue getting stuck (@ gaearon #36134)
  • Update useActionState error message to say "action state" instead of "form state" (@ rickhanlonii #35790)
  • Don't warn when rendering data block scripts (@ eps1lon #35953)
  • Treat fibers with alternates as mounted in getNearestMountedFiber (@ sebmarkbage #35578)
  • Always instrument the lazy initializer thenable (@ gnoff #35521)
  • Annotate cascading updates for DevTools performance tracks in DEV (@ huntie #34961)
  • Resolve the .default export of a React.lazy as the canonical value (@ sebmarkbage #34906)
  • Limit owner stacks to 10 frames (@ eps1lon #34864)
  • Ensure useEffectEvent reads latest values in forwardRef and memo() components (@ eps1lon #34831)

  React DOM

  • Copy source onto the synthetic toggle event (@ lazerg #37389)
  • Update HTML parser rules for the new <select> parser (@ josepharhar #34804)
  • Update defaultValue for type="number" inputs to match other input types (@ sophiebits #36980)
  • Avoid setting innerHTML when it hasn't changed (@ sophiebits #36949)
  • Forward the nonce option in ReactDOM.preloadModule() (@ UditDewan #36851)
  • Support fetchPriority for module resources (@ TheAlexLichter #36835)
  • Track stylesheet preloads when explicitly preloaded to avoid unnecessary suspension (@ gnoff #36386)
  • Suggest correct casing for the misspelled credentialless iframe attribute (@ vmx906 #36322)
  • Add credentialless as a recognized boolean attribute for iframes (@ vmx906 #36148)
  • Prevent reentrant finishedTask from calling completeAll multiple times (@ gnoff #36287)
  • Update the CSS shorthand property list (@ kidonng #35636)
  • Support the maskType SVG prop (@ sleitor #35921)
  • Add support for onFullscreenChange and onFullscreenError events (@ chirokas #34621)
  • Include submitter in submit events (@ eps1lon #35590)
  • Fire onReset when automatically resetting forms (@ eps1lon #35176)
  • Use the FormData submitter parameter (@ jenseng #29028)
  • Fix form status reset when component state is updated (@ eps1lon #34075)
  • Batch updates from resize events until the next frame (@ eps1lon #35117)

  React Server

  • Add nonce to rendered import maps (@ mattcosta7 #37339)
  • Add an onBrowserBailout option to observe subtrees that defer to the browser (@ gnoff #37193)
  • Stop the caller's signal from retaining a finished render (@ unstubbable #37315)
  • Construct the render lifetime controller only when it is needed (@ unstubbable #37357)
  • Fix react-dom/server hanging on Deno (@ fraidev #35235)
  • Extend stack overflow recovery to retries in SSR (@ jackpope #36977)
  • Fix false-positive hydration mismatch on nonce attributes (@ MaxwellCohen #37030)
  • Guard shell-error callbacks instead of nulling them out on the request (@ eps1lon #36916)
  • Stop firing onAllReady after the shell errored (@ eps1lon #36903)
  • Treat an incomplete tree as an error during error recovery (@ acdlite #36911)
  • Fix non-script modulepreload tracking (@ fallintoplace #36564)
  • Finalize postponed nextSegmentId after the prelude flush (@ gaojude #36779)
  • Preserve referrerPolicy in image preload headers (@ ulises-jeremias #36803)
  • Allow pending work to specialize abort reasons (@ gnoff #36586)
  • Abort tasks that suspend after aborting during render (@ gnoff #36585)
  • Finish abort in a scheduled task (@ gnoff #36580)
  • Fix aborts during resumed rendering (@ gnoff #36584)
  • Track abort state on the request (@ gnoff #36583)
  • Model external work scheduling explicitly in the fb bundle (@ gnoff #36576)
  • Continue reporting aborted task errors after a fatal abort (@ gnoff #36575)
  • Disallow abort reentrancy (@ gnoff

[posit-snyk-bot]

This minor version upgrade from React 19.2.8 to 19.3.0 contains no breaking changes and is considered a safe upgrade. [4]

The release primarily stabilizes two features that were previously experimental: <ViewTransition> and Fragment Refs. [2, 3] It also introduces several new additive features and bug fixes.

Key New Features (Not Breaking):

• <ViewTransition> is now stable: This component allows for easier animation of UI elements as they enter, exit, or change, using the browser's native View Transition API. [1, 2]
• Fragment Refs are now stable: You can now attach a ref to a <Fragment> to manage focus or events for a group of sibling elements without needing a wrapper <div>. [1, 4]
• use(browser()): A new hook to opt specific components out of server-side rendering, which is useful for components that rely on browser-only APIs. [2]
• Improved Trusted Types Support: Enhances security by correctly handling Trusted Types objects, preventing them from being coerced into strings. [1, 3]

This upgrade consists of new features and bug fixes, and no migration effort is required. [4]

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.