From b440d6698f6e21d56a78b10f625bd23191183588 Mon Sep 17 00:00:00 2001
From: Oke Kehinde <55279370+okeken@users.noreply.github.com>
Date: Mon, 10 Nov 2025 19:22:50 +0000
Subject: [PATCH 01/35] fix(links): update internal links (#8136)
---
.github/ISSUE_TEMPLATE/3-framework.yml | 4 ++--
src/components/Layout/HomeContent.js | 2 +-
.../react-labs-what-we-have-been-working-on-march-2023.md | 4 ++--
src/content/blog/2024/12/05/react-19.md | 2 +-
src/content/learn/add-react-to-an-existing-project.md | 4 ++--
src/content/learn/synchronizing-with-effects.md | 2 +-
src/content/learn/typescript.md | 2 +-
src/content/learn/you-might-not-need-an-effect.md | 4 ++--
src/content/learn/your-first-component.md | 2 +-
src/content/reference/react-dom/client/createRoot.md | 2 +-
src/content/reference/react-dom/client/index.md | 2 +-
src/content/reference/react-dom/index.md | 2 +-
src/content/reference/react-dom/preinit.md | 2 +-
src/content/reference/react-dom/preinitModule.md | 2 +-
src/content/reference/react-dom/preload.md | 2 +-
src/content/reference/react-dom/preloadModule.md | 2 +-
src/content/reference/react-dom/server/index.md | 2 +-
src/content/reference/react-dom/static/index.md | 2 +-
src/content/reference/react/useEffect.md | 6 +++---
src/content/reference/rsc/directives.md | 2 +-
src/content/reference/rsc/use-client.md | 2 +-
21 files changed, 27 insertions(+), 27 deletions(-)
diff --git a/.github/ISSUE_TEMPLATE/3-framework.yml b/.github/ISSUE_TEMPLATE/3-framework.yml
index a47295e1e..87f03a660 100644
--- a/.github/ISSUE_TEMPLATE/3-framework.yml
+++ b/.github/ISSUE_TEMPLATE/3-framework.yml
@@ -8,11 +8,11 @@ body:
value: |
## Apply to be included as a recommended React framework
- _This form is for framework authors to apply to be included as a recommended [React framework](https://react.dev/learn/start-a-new-react-project). If you are not a framework author, please contact the authors before submitting._
+ _This form is for framework authors to apply to be included as a recommended [React framework](https://react.dev/learn/creating-a-react-app). If you are not a framework author, please contact the authors before submitting._
Our goal when recommending a framework is to start developers with a React project that solves common problems like code splitting, data fetching, routing, and HTML generation without any extra work later. We believe this will allow users to get started quickly with React, and scale their app to production.
- While we understand that many frameworks may want to be featured, this page is not a place to advertise every possible React framework or all frameworks that you can add React to. There are many great frameworks that offer support for React that are not listed in our guides. The frameworks we recommend have invested significantly in the React ecosystem, and collaborated with the React team to be compatible with our [full-stack React architecture vision](https://react.dev/learn/start-a-new-react-project#which-features-make-up-the-react-teams-full-stack-architecture-vision).
+ While we understand that many frameworks may want to be featured, this page is not a place to advertise every possible React framework or all frameworks that you can add React to. There are many great frameworks that offer support for React that are not listed in our guides. The frameworks we recommend have invested significantly in the React ecosystem, and collaborated with the React team to be compatible with our [full-stack React architecture vision](https://react.dev/learn/creating-a-react-app#which-features-make-up-the-react-teams-full-stack-architecture-vision).
To be included, frameworks must meet the following criteria:
diff --git a/src/components/Layout/HomeContent.js b/src/components/Layout/HomeContent.js
index 9cc26bdaa..f9b785db4 100644
--- a/src/components/Layout/HomeContent.js
+++ b/src/components/Layout/HomeContent.js
@@ -270,7 +270,7 @@ export function HomeContent() {
+ href="/learn/creating-a-react-app">
Get started with a framework
diff --git a/src/content/blog/2023/03/22/react-labs-what-we-have-been-working-on-march-2023.md b/src/content/blog/2023/03/22/react-labs-what-we-have-been-working-on-march-2023.md
index 1bc78149d..df1fd085d 100644
--- a/src/content/blog/2023/03/22/react-labs-what-we-have-been-working-on-march-2023.md
+++ b/src/content/blog/2023/03/22/react-labs-what-we-have-been-working-on-march-2023.md
@@ -31,7 +31,7 @@ The biggest change is that we introduced [`async` / `await`](https://github.com/
Now that we have data fetching pretty well sorted, we're exploring the other direction: sending data from the client to the server, so that you can execute database mutations and implement forms. We're doing this by letting you pass Server Action functions across the server/client boundary, which the client can then call, providing seamless RPC. Server Actions also give you progressively enhanced forms before JavaScript loads.
-React Server Components has shipped in [Next.js App Router](/learn/start-a-new-react-project#nextjs-app-router). This showcases a deep integration of a router that really buys into RSC as a primitive, but it's not the only way to build a RSC-compatible router and framework. There's a clear separation for features provided by the RSC spec and implementation. React Server Components is meant as a spec for components that work across compatible React frameworks.
+React Server Components has shipped in [Next.js App Router](/learn/creating-a-react-app#nextjs-app-router). This showcases a deep integration of a router that really buys into RSC as a primitive, but it's not the only way to build a RSC-compatible router and framework. There's a clear separation for features provided by the RSC spec and implementation. React Server Components is meant as a spec for components that work across compatible React frameworks.
We generally recommend using an existing framework, but if you need to build your own custom framework, it is possible. Building your own RSC-compatible framework is not as easy as we'd like it to be, mainly due to the deep bundler integration needed. The current generation of bundlers are great for use on the client, but they weren't designed with first-class support for splitting a single module graph between the server and the client. This is why we're now partnering directly with bundler developers to get the primitives for RSC built-in.
@@ -92,7 +92,7 @@ Since our last update, we've tested an experimental version of prerendering inte
## Transition Tracing {/*transition-tracing*/}
-The Transition Tracing API lets you detect when [React Transitions](/reference/react/useTransition) become slower and investigate why they may be slow. Following our last update, we have completed the initial design of the API and published an [RFC](https://github.com/reactjs/rfcs/pull/238). The basic capabilities have also been implemented. The project is currently on hold. We welcome feedback on the RFC and look forward to resuming its development to provide a better performance measurement tool for React. This will be particularly useful with routers built on top of React Transitions, like the [Next.js App Router](/learn/start-a-new-react-project#nextjs-app-router).
+The Transition Tracing API lets you detect when [React Transitions](/reference/react/useTransition) become slower and investigate why they may be slow. Following our last update, we have completed the initial design of the API and published an [RFC](https://github.com/reactjs/rfcs/pull/238). The basic capabilities have also been implemented. The project is currently on hold. We welcome feedback on the RFC and look forward to resuming its development to provide a better performance measurement tool for React. This will be particularly useful with routers built on top of React Transitions, like the [Next.js App Router](/learn/creating-a-react-app#nextjs-app-router).
* * *
In addition to this update, our team has made recent guest appearances on community podcasts and livestreams to speak more on our work and answer questions.
diff --git a/src/content/blog/2024/12/05/react-19.md b/src/content/blog/2024/12/05/react-19.md
index 65bf42757..4e9aad8e8 100644
--- a/src/content/blog/2024/12/05/react-19.md
+++ b/src/content/blog/2024/12/05/react-19.md
@@ -355,7 +355,7 @@ For more information, see [React DOM Static APIs](/reference/react-dom/static).
Server Components are a new option that allows rendering components ahead of time, before bundling, in an environment separate from your client application or SSR server. This separate environment is the "server" in React Server Components. Server Components can run once at build time on your CI server, or they can be run for each request using a web server.
-React 19 includes all of the React Server Components features included from the Canary channel. This means libraries that ship with Server Components can now target React 19 as a peer dependency with a `react-server` [export condition](https://github.com/reactjs/rfcs/blob/main/text/0227-server-module-conventions.md#react-server-conditional-exports) for use in frameworks that support the [Full-stack React Architecture](/learn/start-a-new-react-project#which-features-make-up-the-react-teams-full-stack-architecture-vision).
+React 19 includes all of the React Server Components features included from the Canary channel. This means libraries that ship with Server Components can now target React 19 as a peer dependency with a `react-server` [export condition](https://github.com/reactjs/rfcs/blob/main/text/0227-server-module-conventions.md#react-server-conditional-exports) for use in frameworks that support the [Full-stack React Architecture](/learn/creating-a-react-app#which-features-make-up-the-react-teams-full-stack-architecture-vision).
diff --git a/src/content/learn/add-react-to-an-existing-project.md b/src/content/learn/add-react-to-an-existing-project.md
index 5d3d44005..f98bece42 100644
--- a/src/content/learn/add-react-to-an-existing-project.md
+++ b/src/content/learn/add-react-to-an-existing-project.md
@@ -20,7 +20,7 @@ Let's say you have an existing web app at `example.com` built with another serve
Here's how we recommend to set it up:
-1. **Build the React part of your app** using one of the [React-based frameworks](/learn/start-a-new-react-project).
+1. **Build the React part of your app** using one of the [React-based frameworks](/learn/creating-a-react-app).
2. **Specify `/some-app` as the *base path*** in your framework's configuration (here's how: [Next.js](https://nextjs.org/docs/app/api-reference/config/next-config-js/basePath), [Gatsby](https://www.gatsbyjs.com/docs/how-to/previews-deploys-hosting/path-prefix/)).
3. **Configure your server or a proxy** so that all requests under `/some-app/` are handled by your React app.
@@ -149,7 +149,7 @@ root.render();
Notice how the original HTML content from `index.html` is preserved, but your own `NavigationBar` React component now appears inside the `
diff --git a/src/content/reference/react-dom/client/index.md b/src/content/reference/react-dom/client/index.md
index a00422023..b612d7ba6 100644
--- a/src/content/reference/react-dom/client/index.md
+++ b/src/content/reference/react-dom/client/index.md
@@ -4,7 +4,7 @@ title: Client React DOM APIs
-The `react-dom/client` APIs let you render React components on the client (in the browser). These APIs are typically used at the top level of your app to initialize your React tree. A [framework](/learn/start-a-new-react-project#full-stack-frameworks) may call them for you. Most of your components don't need to import or use them.
+The `react-dom/client` APIs let you render React components on the client (in the browser). These APIs are typically used at the top level of your app to initialize your React tree. A [framework](/learn/creating-a-react-app#full-stack-frameworks) may call them for you. Most of your components don't need to import or use them.
diff --git a/src/content/reference/react-dom/index.md b/src/content/reference/react-dom/index.md
index b79b16db6..d01bd6562 100644
--- a/src/content/reference/react-dom/index.md
+++ b/src/content/reference/react-dom/index.md
@@ -21,7 +21,7 @@ These APIs can be imported from your components. They are rarely used:
These APIs can be used to make apps faster by pre-loading resources such as scripts, stylesheets, and fonts as soon as you know you need them, for example before navigating to another page where the resources will be used.
-[React-based frameworks](/learn/start-a-new-react-project) frequently handle resource loading for you, so you might not have to call these APIs yourself. Consult your framework's documentation for details.
+[React-based frameworks](/learn/creating-a-react-app) frequently handle resource loading for you, so you might not have to call these APIs yourself. Consult your framework's documentation for details.
* [`prefetchDNS`](/reference/react-dom/prefetchDNS) lets you prefetch the IP address of a DNS domain name that you expect to connect to.
* [`preconnect`](/reference/react-dom/preconnect) lets you connect to a server you expect to request resources from, even if you don't know what resources you'll need yet.
diff --git a/src/content/reference/react-dom/preinit.md b/src/content/reference/react-dom/preinit.md
index 117fccac8..5dcaaf933 100644
--- a/src/content/reference/react-dom/preinit.md
+++ b/src/content/reference/react-dom/preinit.md
@@ -4,7 +4,7 @@ title: preinit
-[React-based frameworks](/learn/start-a-new-react-project) frequently handle resource loading for you, so you might not have to call this API yourself. Consult your framework's documentation for details.
+[React-based frameworks](/learn/creating-a-react-app) frequently handle resource loading for you, so you might not have to call this API yourself. Consult your framework's documentation for details.
diff --git a/src/content/reference/react-dom/preinitModule.md b/src/content/reference/react-dom/preinitModule.md
index 97bb4dbc7..93a4a730f 100644
--- a/src/content/reference/react-dom/preinitModule.md
+++ b/src/content/reference/react-dom/preinitModule.md
@@ -4,7 +4,7 @@ title: preinitModule
-[React-based frameworks](/learn/start-a-new-react-project) frequently handle resource loading for you, so you might not have to call this API yourself. Consult your framework's documentation for details.
+[React-based frameworks](/learn/creating-a-react-app) frequently handle resource loading for you, so you might not have to call this API yourself. Consult your framework's documentation for details.
diff --git a/src/content/reference/react-dom/preload.md b/src/content/reference/react-dom/preload.md
index 5dcba10f7..e9d00fc60 100644
--- a/src/content/reference/react-dom/preload.md
+++ b/src/content/reference/react-dom/preload.md
@@ -4,7 +4,7 @@ title: preload
-[React-based frameworks](/learn/start-a-new-react-project) frequently handle resource loading for you, so you might not have to call this API yourself. Consult your framework's documentation for details.
+[React-based frameworks](/learn/creating-a-react-app) frequently handle resource loading for you, so you might not have to call this API yourself. Consult your framework's documentation for details.
diff --git a/src/content/reference/react-dom/preloadModule.md b/src/content/reference/react-dom/preloadModule.md
index ebc2fa6d0..944d438fc 100644
--- a/src/content/reference/react-dom/preloadModule.md
+++ b/src/content/reference/react-dom/preloadModule.md
@@ -4,7 +4,7 @@ title: preloadModule
-[React-based frameworks](/learn/start-a-new-react-project) frequently handle resource loading for you, so you might not have to call this API yourself. Consult your framework's documentation for details.
+[React-based frameworks](/learn/creating-a-react-app) frequently handle resource loading for you, so you might not have to call this API yourself. Consult your framework's documentation for details.
diff --git a/src/content/reference/react-dom/server/index.md b/src/content/reference/react-dom/server/index.md
index 943b610f2..1856acd71 100644
--- a/src/content/reference/react-dom/server/index.md
+++ b/src/content/reference/react-dom/server/index.md
@@ -4,7 +4,7 @@ title: Server React DOM APIs
-The `react-dom/server` APIs let you server-side render React components to HTML. These APIs are only used on the server at the top level of your app to generate the initial HTML. A [framework](/learn/start-a-new-react-project#full-stack-frameworks) may call them for you. Most of your components don't need to import or use them.
+The `react-dom/server` APIs let you server-side render React components to HTML. These APIs are only used on the server at the top level of your app to generate the initial HTML. A [framework](/learn/creating-a-react-app#full-stack-frameworks) may call them for you. Most of your components don't need to import or use them.
diff --git a/src/content/reference/react-dom/static/index.md b/src/content/reference/react-dom/static/index.md
index cec33be44..31ebc385b 100644
--- a/src/content/reference/react-dom/static/index.md
+++ b/src/content/reference/react-dom/static/index.md
@@ -4,7 +4,7 @@ title: Static React DOM APIs
-The `react-dom/static` APIs let you generate static HTML for React components. They have limited functionality compared to the streaming APIs. A [framework](/learn/start-a-new-react-project#full-stack-frameworks) may call them for you. Most of your components don't need to import or use them.
+The `react-dom/static` APIs let you generate static HTML for React components. They have limited functionality compared to the streaming APIs. A [framework](/learn/creating-a-react-app#full-stack-frameworks) may call them for you. Most of your components don't need to import or use them.
diff --git a/src/content/reference/react/useEffect.md b/src/content/reference/react/useEffect.md
index f67f56eda..da310c762 100644
--- a/src/content/reference/react/useEffect.md
+++ b/src/content/reference/react/useEffect.md
@@ -896,7 +896,7 @@ In this example, a cleanup function is not needed because the `MapWidget` class
### Fetching data with Effects {/*fetching-data-with-effects*/}
-You can use an Effect to fetch data for your component. Note that [if you use a framework,](/learn/start-a-new-react-project#full-stack-frameworks) using your framework's data fetching mechanism will be a lot more efficient than writing Effects manually.
+You can use an Effect to fetch data for your component. Note that [if you use a framework,](/learn/creating-a-react-app#full-stack-frameworks) using your framework's data fetching mechanism will be a lot more efficient than writing Effects manually.
If you want to fetch data from an Effect manually, your code might look like this:
@@ -1049,7 +1049,7 @@ Writing `fetch` calls inside Effects is a [popular way to fetch data](https://ww
This list of downsides is not specific to React. It applies to fetching data on mount with any library. Like with routing, data fetching is not trivial to do well, so we recommend the following approaches:
-- **If you use a [framework](/learn/start-a-new-react-project#full-stack-frameworks), use its built-in data fetching mechanism.** Modern React frameworks have integrated data fetching mechanisms that are efficient and don't suffer from the above pitfalls.
+- **If you use a [framework](/learn/creating-a-react-app#full-stack-frameworks), use its built-in data fetching mechanism.** Modern React frameworks have integrated data fetching mechanisms that are efficient and don't suffer from the above pitfalls.
- **Otherwise, consider using or building a client-side cache.** Popular open source solutions include [TanStack Query](https://tanstack.com/query/latest/), [useSWR](https://swr.vercel.app/), and [React Router 6.4+.](https://beta.reactrouter.com/en/main/start/overview) You can build your own solution too, in which case you would use Effects under the hood but also add logic for deduplicating requests, caching responses, and avoiding network waterfalls (by preloading data or hoisting data requirements to routes).
You can continue fetching data directly in Effects if neither of these approaches suit you.
@@ -1728,7 +1728,7 @@ function Page({ url, shoppingCart }) {
### Displaying different content on the server and the client {/*displaying-different-content-on-the-server-and-the-client*/}
-If your app uses server rendering (either [directly](/reference/react-dom/server) or via a [framework](/learn/start-a-new-react-project#full-stack-frameworks)), your component will render in two different environments. On the server, it will render to produce the initial HTML. On the client, React will run the rendering code again so that it can attach your event handlers to that HTML. This is why, for [hydration](/reference/react-dom/client/hydrateRoot#hydrating-server-rendered-html) to work, your initial render output must be identical on the client and the server.
+If your app uses server rendering (either [directly](/reference/react-dom/server) or via a [framework](/learn/creating-a-react-app#full-stack-frameworks)), your component will render in two different environments. On the server, it will render to produce the initial HTML. On the client, React will run the rendering code again so that it can attach your event handlers to that HTML. This is why, for [hydration](/reference/react-dom/client/hydrateRoot#hydrating-server-rendered-html) to work, your initial render output must be identical on the client and the server.
In rare cases, you might need to display different content on the client. For example, if your app reads some data from [`localStorage`](https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage), it can't possibly do that on the server. Here is how you could implement this:
diff --git a/src/content/reference/rsc/directives.md b/src/content/reference/rsc/directives.md
index fe614fb27..af04d5b41 100644
--- a/src/content/reference/rsc/directives.md
+++ b/src/content/reference/rsc/directives.md
@@ -10,7 +10,7 @@ Directives are for use in [React Server Components](/reference/rsc/server-compon
-Directives provide instructions to [bundlers compatible with React Server Components](/learn/start-a-new-react-project#full-stack-frameworks).
+Directives provide instructions to [bundlers compatible with React Server Components](/learn/creating-a-react-app#full-stack-frameworks).
diff --git a/src/content/reference/rsc/use-client.md b/src/content/reference/rsc/use-client.md
index 5a0a7d96b..4c6051977 100644
--- a/src/content/reference/rsc/use-client.md
+++ b/src/content/reference/rsc/use-client.md
@@ -41,7 +41,7 @@ export default function RichTextEditor({ timestamp, text }) {
}
```
-When a file marked with `'use client'` is imported from a Server Component, [compatible bundlers](/learn/start-a-new-react-project#full-stack-frameworks) will treat the module import as a boundary between server-run and client-run code.
+When a file marked with `'use client'` is imported from a Server Component, [compatible bundlers](/learn/creating-a-react-app#full-stack-frameworks) will treat the module import as a boundary between server-run and client-run code.
As dependencies of `RichTextEditor`, `formatDate` and `Button` will also be evaluated on the client regardless of whether their modules contain a `'use client'` directive. Note that a single module may be evaluated on the server when imported from server code and on the client when imported from client code.
From 27576f10bdfd57fa30977818b641c7b6c9d032ec Mon Sep 17 00:00:00 2001
From: Uladzislau Hramyka
Date: Fri, 14 Nov 2025 17:22:13 +0300
Subject: [PATCH 02/35] fix(useTransition): correct anchors pointing to
non-blocking updates section (#8143)
---
src/content/reference/react/useTransition.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/content/reference/react/useTransition.md b/src/content/reference/react/useTransition.md
index 923b6c0c9..426df1f7b 100644
--- a/src/content/reference/react/useTransition.md
+++ b/src/content/reference/react/useTransition.md
@@ -95,7 +95,7 @@ function SubmitButton({ submitAction }) {
#### Parameters {/*starttransition-parameters*/}
-* `action`: A function that updates some state by calling one or more [`set` functions](/reference/react/useState#setstate). React calls `action` immediately with no parameters and marks all state updates scheduled synchronously during the `action` function call as Transitions. Any async calls that are awaited in the `action` will be included in the Transition, but currently require wrapping any `set` functions after the `await` in an additional `startTransition` (see [Troubleshooting](#react-doesnt-treat-my-state-update-after-await-as-a-transition)). State updates marked as Transitions will be [non-blocking](#marking-a-state-update-as-a-non-blocking-transition) and [will not display unwanted loading indicators](#preventing-unwanted-loading-indicators).
+* `action`: A function that updates some state by calling one or more [`set` functions](/reference/react/useState#setstate). React calls `action` immediately with no parameters and marks all state updates scheduled synchronously during the `action` function call as Transitions. Any async calls that are awaited in the `action` will be included in the Transition, but currently require wrapping any `set` functions after the `await` in an additional `startTransition` (see [Troubleshooting](#react-doesnt-treat-my-state-update-after-await-as-a-transition)). State updates marked as Transitions will be [non-blocking](#perform-non-blocking-updates-with-actions) and [will not display unwanted loading indicators](#preventing-unwanted-loading-indicators).
#### Returns {/*starttransition-returns*/}
@@ -1246,7 +1246,7 @@ function Router() {
This is recommended for three reasons:
-- [Transitions are interruptible,](#marking-a-state-update-as-a-non-blocking-transition) which lets the user click away without waiting for the re-render to complete.
+- [Transitions are interruptible,](#perform-non-blocking-updates-with-actions) which lets the user click away without waiting for the re-render to complete.
- [Transitions prevent unwanted loading indicators,](#preventing-unwanted-loading-indicators) which lets the user avoid jarring jumps on navigation.
- [Transitions wait for all pending actions](#perform-non-blocking-updates-with-actions) which lets the user wait for side effects to complete before the new page is shown.
From 2534424ec6c433cc2c811d5a0bd5a65b75efa5f0 Mon Sep 17 00:00:00 2001
From: Soichiro Miki
Date: Sat, 15 Nov 2025 12:47:29 +0900
Subject: [PATCH 03/35] =?UTF-8?q?fix:=20Stop=20SmartyPants=20from=20alteri?=
=?UTF-8?q?ng=20TerminalBlock=20commands=20(like=20`--save-dev`=20to=20`?=
=?UTF-8?q?=E2=80=94save-dev`)=20(#8146)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
* Skip smartypants on TerminalBlock
* Improve TerminalBlock HTML tags
* Remove unnecessary TerminalBlock escapes from docs
* Bump DISK_CACHE_BREAKER
---
plugins/remark-smartypants.js | 22 +++++++++++++++++--
src/components/MDX/TerminalBlock.tsx | 10 +++++----
.../blog/2025/10/07/react-compiler-1.md | 18 +++++++--------
.../learn/build-a-react-app-from-scratch.md | 6 ++---
.../learn/react-compiler/installation.md | 2 +-
src/utils/compileMDX.ts | 2 +-
6 files changed, 40 insertions(+), 20 deletions(-)
diff --git a/plugins/remark-smartypants.js b/plugins/remark-smartypants.js
index f56f14b61..c819624ba 100644
--- a/plugins/remark-smartypants.js
+++ b/plugins/remark-smartypants.js
@@ -14,12 +14,24 @@ const visit = require('unist-util-visit');
const retext = require('retext');
const smartypants = require('retext-smartypants');
-function check(parent) {
+function check(node, parent) {
+ if (node.data?.skipSmartyPants) return false;
if (parent.tagName === 'script') return false;
if (parent.tagName === 'style') return false;
return true;
}
+function markSkip(node) {
+ if (!node) return;
+ node.data ??= {};
+ node.data.skipSmartyPants = true;
+ if (Array.isArray(node.children)) {
+ for (const child of node.children) {
+ markSkip(child);
+ }
+ }
+}
+
module.exports = function (options) {
const processor = retext().use(smartypants, {
...options,
@@ -43,8 +55,14 @@ module.exports = function (options) {
let startIndex = 0;
const textOrInlineCodeNodes = [];
+ visit(tree, 'mdxJsxFlowElement', (node) => {
+ if (['TerminalBlock'].includes(node.name)) {
+ markSkip(node); // Mark all children to skip smarty pants
+ }
+ });
+
visit(tree, ['text', 'inlineCode'], (node, _, parent) => {
- if (check(parent)) {
+ if (check(node, parent)) {
if (node.type === 'text') allText += node.value;
// for the case when inlineCode contains just one part of quote: `foo'bar`
else allText += 'A'.repeat(node.value.length);
diff --git a/src/components/MDX/TerminalBlock.tsx b/src/components/MDX/TerminalBlock.tsx
index bdcd8e466..0fd0160d6 100644
--- a/src/components/MDX/TerminalBlock.tsx
+++ b/src/components/MDX/TerminalBlock.tsx
@@ -79,13 +79,15 @@ function TerminalBlock({level = 'info', children}: TerminalBlockProps) {
-
-
- {message}
-
+
+
+ {message}
+
+
);
}
diff --git a/src/content/blog/2025/10/07/react-compiler-1.md b/src/content/blog/2025/10/07/react-compiler-1.md
index 5474c50d3..080f3586e 100644
--- a/src/content/blog/2025/10/07/react-compiler-1.md
+++ b/src/content/blog/2025/10/07/react-compiler-1.md
@@ -69,17 +69,17 @@ To install the compiler:
npm
-{`npm install --save-dev --save-exact babel-plugin-react-compiler@latest`}
+npm install --save-dev --save-exact babel-plugin-react-compiler@latest
pnpm
-{`pnpm add --save-dev --save-exact babel-plugin-react-compiler@latest`}
+pnpm add --save-dev --save-exact babel-plugin-react-compiler@latest
yarn
-{`yarn add --dev --exact babel-plugin-react-compiler@latest`}
+yarn add --dev --exact babel-plugin-react-compiler@latest
As part of the stable release, we've been making React Compiler easier to add to your projects and added optimizations to how the compiler generates memoization. React Compiler now supports optional chains and array indices as dependencies. These improvements ultimately result in fewer re-renders and more responsive UIs, while letting you keep writing idiomatic declarative code.
@@ -101,17 +101,17 @@ To install:
npm
-{`npm install --save-dev eslint-plugin-react-hooks@latest`}
+npm install --save-dev eslint-plugin-react-hooks@latest
pnpm
-{`pnpm add --save-dev eslint-plugin-react-hooks@latest`}
+pnpm add --save-dev eslint-plugin-react-hooks@latest
yarn
-{`yarn add --dev eslint-plugin-react-hooks@latest`}
+yarn add --dev eslint-plugin-react-hooks@latest
```js {6}
@@ -153,19 +153,19 @@ We have partnered with the Expo, Vite, and Next.js teams to add the compiler to
[Expo SDK 54](https://docs.expo.dev/guides/react-compiler/) and up has the compiler enabled by default, so new apps will automatically be able to take advantage of the compiler from the start.
-{`npx create-expo-app@latest`}
+npx create-expo-app@latest
[Vite](https://vite.dev/guide/) and [Next.js](https://nextjs.org/docs/app/api-reference/cli/create-next-app) users can choose the compiler enabled templates in `create-vite` and `create-next-app`.
-{`npm create vite@latest`}
+npm create vite@latest
-{`npx create-next-app@latest`}
+npx create-next-app@latest
## Adopt React Compiler incrementally {/*adopt-react-compiler-incrementally*/}
diff --git a/src/content/learn/build-a-react-app-from-scratch.md b/src/content/learn/build-a-react-app-from-scratch.md
index c74fa9afd..8a2142cf9 100644
--- a/src/content/learn/build-a-react-app-from-scratch.md
+++ b/src/content/learn/build-a-react-app-from-scratch.md
@@ -34,7 +34,7 @@ The first step is to install a build tool like `vite`, `parcel`, or `rsbuild`. T
[Vite](https://vite.dev/) is a build tool that aims to provide a faster and leaner development experience for modern web projects.
-{`npm create vite@latest my-app -- --template react-ts`}
+npm create vite@latest my-app -- --template react-ts
Vite is opinionated and comes with sensible defaults out of the box. Vite has a rich ecosystem of plugins to support fast refresh, JSX, Babel/SWC, and other common features. See Vite's [React plugin](https://vite.dev/plugins/#vitejs-plugin-react) or [React SWC plugin](https://vite.dev/plugins/#vitejs-plugin-react-swc) and [React SSR example project](https://vite.dev/guide/ssr.html#example-projects) to get started.
@@ -46,7 +46,7 @@ Vite is already being used as a build tool in one of our [recommended frameworks
[Parcel](https://parceljs.org/) combines a great out-of-the-box development experience with a scalable architecture that can take your project from just getting started to massive production applications.
-{`npm install --save-dev parcel`}
+npm install --save-dev parcel
Parcel supports fast refresh, JSX, TypeScript, Flow, and styling out of the box. See [Parcel's React recipe](https://parceljs.org/recipes/react/#getting-started) to get started.
@@ -56,7 +56,7 @@ Parcel supports fast refresh, JSX, TypeScript, Flow, and styling out of the box.
[Rsbuild](https://rsbuild.dev/) is an Rspack-powered build tool that provides a seamless development experience for React applications. It comes with carefully tuned defaults and performance optimizations ready to use.
-{`npx create-rsbuild --template react`}
+npx create-rsbuild --template react
Rsbuild includes built-in support for React features like fast refresh, JSX, TypeScript, and styling. See [Rsbuild's React guide](https://rsbuild.dev/guide/framework/react) to get started.
diff --git a/src/content/learn/react-compiler/installation.md b/src/content/learn/react-compiler/installation.md
index 92cf0b74e..6cce34c6b 100644
--- a/src/content/learn/react-compiler/installation.md
+++ b/src/content/learn/react-compiler/installation.md
@@ -114,7 +114,7 @@ Please refer to the [Next.js docs](https://nextjs.org/docs/app/api-reference/nex
Install `vite-plugin-babel`, and add the compiler's Babel plugin to it:
-{`npm install vite-plugin-babel`}
+npm install vite-plugin-babel
```js {3-4,16}
diff --git a/src/utils/compileMDX.ts b/src/utils/compileMDX.ts
index 807b50da5..c312f03fe 100644
--- a/src/utils/compileMDX.ts
+++ b/src/utils/compileMDX.ts
@@ -10,7 +10,7 @@ import {MDXComponents} from 'components/MDX/MDXComponents';
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
// ~~~~ IMPORTANT: BUMP THIS IF YOU CHANGE ANY CODE BELOW ~~~
-const DISK_CACHE_BREAKER = 10;
+const DISK_CACHE_BREAKER = 11;
// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
export default async function compileMDX(
From 4704ce62a00d41afcf0c471de325526ec24a71f7 Mon Sep 17 00:00:00 2001
From: Ricky
Date: Wed, 3 Dec 2025 10:41:04 -0500
Subject: [PATCH 04/35] blog post (#8170)
---
...ulnerability-in-react-server-components.md | 62 +++++++++++++++++++
src/content/blog/index.md | 6 ++
2 files changed, 68 insertions(+)
create mode 100644 src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
new file mode 100644
index 000000000..956670cc5
--- /dev/null
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -0,0 +1,62 @@
+---
+title: "Critical Security Vulnerability in React Server Components"
+author: The React Team
+date: 2025/12/03
+description: There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
+
+---
+
+December 3, 2025 by [The React Team](/community/team)
+
+---
+
+
+
+There is an unauthenticated remote code execution vulnerability in React Server Components.
+
+We recommend upgrading immediately.
+
+
+
+---
+
+On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.
+
+Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
+
+This vulnerability was disclosed as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182) and is rated CVSS 10.0.
+
+The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:
+
+* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
+* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
+* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)
+
+## Immediate Action Required {/*immediate-action-required*/}
+
+A fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.
+
+If your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.
+
+### Affected frameworks and bundlers {/*affected-frameworks-and-bundlers*/}
+
+Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
+
+We will update this post with upgrade instructions on how to upgrade as they become available.
+
+### Vulnerability overview {/*vulnerability-overview*/}
+
+[React Server Functions](https://react.dev/reference/rsc/server-functions) allow a client to call a function on a server. React provides integration points and tools that frameworks and bundlers use to help React code run on both the client and the server. React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client.
+
+An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. Further details of the vulnerability will be provided after the rollout of the fix is complete.
+
+### Timeline {/*timeline*/}
+
+* **November 29th**: Lachlan Davidson reported the security vulnerability via [Meta Bug Bounty](https://bugbounty.meta.com/).
+* **November 30th**: Meta security researchers confirmed and began working with the React team on a fix.
+* **December 1st**: A fix was created and the React team began working with affected hosting providers and open source projects to validate the fix, implement mitigations and roll out the fix
+* **December 3rd**: The fix was published to npm and the publicly disclosed as CVE-2025-55182.
+
+### Attribution {/*attribution*/}
+
+Thank you to [Lachlan Davidson](https://github.com/lachlan2k) for discovering, reporting, and working to help fix this vulnerability.
\ No newline at end of file
diff --git a/src/content/blog/index.md b/src/content/blog/index.md
index 10d277909..5a2f1b7f1 100644
--- a/src/content/blog/index.md
+++ b/src/content/blog/index.md
@@ -12,6 +12,12 @@ You can also follow the [@react.dev](https://bsky.app/profile/react.dev) account
+
+
+There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
+
+
+
Last week we hosted React Conf 2025. In this post, we summarize the talks and announcements from the event...
From 9c880bd13b9e754f652c1ce41715606fe366d278 Mon Sep 17 00:00:00 2001
From: Felix Traxler <43319771+FelixTraxler@users.noreply.github.com>
Date: Wed, 3 Dec 2025 17:39:29 +0100
Subject: [PATCH 05/35] fix: use correct function name (#8171)
---
src/content/reference/react/addTransitionType.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/content/reference/react/addTransitionType.md b/src/content/reference/react/addTransitionType.md
index 06020ab85..2557f0564 100644
--- a/src/content/reference/react/addTransitionType.md
+++ b/src/content/reference/react/addTransitionType.md
@@ -39,7 +39,7 @@ startTransition(() => {
#### Returns {/*returns*/}
-`startTransition` does not return anything.
+`addTransitionType` does not return anything.
#### Caveats {/*caveats*/}
From e2b59dab82146834e5e84911fb2ad4973d88cab9 Mon Sep 17 00:00:00 2001
From: Ricky
Date: Wed, 3 Dec 2025 11:49:15 -0500
Subject: [PATCH 06/35] add update instructions (#8172)
---
...ulnerability-in-react-server-components.md | 112 +++++++++++++++++-
1 file changed, 110 insertions(+), 2 deletions(-)
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
index 956670cc5..4da65a9ec 100644
--- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -44,19 +44,127 @@ Some React frameworks and bundlers depended on, had peer dependencies for, or in
We will update this post with upgrade instructions on how to upgrade as they become available.
+### Hosting Provider Mitigations {/*hosting-provider-mitigations*/}
+
+We have worked with a number of hosting providers to apply temporary mitigations.
+
+You should not depend on these to secure your app, and still update immediately.
+
### Vulnerability overview {/*vulnerability-overview*/}
[React Server Functions](https://react.dev/reference/rsc/server-functions) allow a client to call a function on a server. React provides integration points and tools that frameworks and bundlers use to help React code run on both the client and the server. React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client.
An unauthenticated attacker could craft a malicious HTTP request to any Server Function endpoint that, when deserialized by React, achieves remote code execution on the server. Further details of the vulnerability will be provided after the rollout of the fix is complete.
-### Timeline {/*timeline*/}
+## Update Instructions {/*update-instructions*/}
+
+### Next.js {/*update-next-js*/}
+
+All users should upgrade to the latest patched version in their release line:
+
+```bash
+npm install next@15.0.5 // for 15.0.x
+npm install next@15.1.9 // for 15.1.x
+npm install next@15.2.6 // for 15.2.x
+npm install next@15.3.6 // for 15.3.x
+npm install next@15.4.8 // for 15.4.x
+npm install next@15.5.7 // for 15.5.x
+npm install next@16.0.7 // for 16.0.x
+```
+
+If you are on Next.js 14.3.0-canary.77 or a later canary release, downgrade to the latest stable 14.x release:
+
+```bash
+npm install next@14
+```
+
+See the [Next.js changelog](https://nextjs.org/blog/CVE-2025-66478) for more info.
+
+### React Router {/*update-react-router*/}
+
+If you are using React Router's unstable RSC APIs, you should upgrade the following package.json dependencies if they exist:
+
+```bash
+npm install react@latest
+npm install react-dom@latest
+npm install react-server-dom-parcel@latest
+npm install react-server-dom-webpack@latest
+npm install @vitejs/plugin-rsc@latest
+```
+
+### Expo {/*expo*/}
+
+Upgrade to the latest `react-server-dom-webpack`:
+
+```bash
+npm install react@latest react-dom@latest react-server-dom-webpack@latest
+```
+
+### Redwood SDK {/*update-redwood-sdk*/}
+
+Ensure you are on rwsdk>=1.0.0-alpha.0
+
+For the latest beta version:
+
+```bash
+npm install rwsdk@latest
+```
+
+Upgrade to the latest `react-server-dom-webpack`:
+
+```bash
+npm install react@latest react-dom@latest react-server-dom-webpack@latest
+```
+
+See [Redwood docs](https://docs.rwsdk.com/migrating/) for more migration instructions.
+
+### Waku {/*update-waku*/}
+
+Upgrade to the latest `react-server-dom-webpack`:
+
+```bash
+npm install react@latest react-dom@latest react-server-dom-webpack@latest
+```
+
+### `@vitejs/plugin-rsc` {/*vitejs-plugin-rsc*/}
+
+Upgrade to the latest RSC plugin:
+
+```bash
+npm install react@latest react-dom@latest @vitejs/plugin-rsc@latest
+```
+
+### `react-server-dom-parcel` {/*update-react-server-dom-parcel*/}
+
+Update to the latest version:
+
+ ```bash
+ npm install react@latest react-dom@latest react-server-dom-parcel@latest
+ ```
+
+### `react-server-dom-turbopack` {/*update-react-server-dom-turbopack*/}
+
+Update to the latest version:
+
+ ```bash
+ npm install react@latest react-dom@latest react-server-dom-turbopack@latest
+ ```
+
+### `react-server-dom-webpack` {/*update-react-server-dom-webpack*/}
+
+Update to the latest version:
+
+ ```bash
+npm install react@latest react-dom@latest react-server-dom-webpack@latest
+ ```
+
+## Timeline {/*timeline*/}
* **November 29th**: Lachlan Davidson reported the security vulnerability via [Meta Bug Bounty](https://bugbounty.meta.com/).
* **November 30th**: Meta security researchers confirmed and began working with the React team on a fix.
* **December 1st**: A fix was created and the React team began working with affected hosting providers and open source projects to validate the fix, implement mitigations and roll out the fix
* **December 3rd**: The fix was published to npm and the publicly disclosed as CVE-2025-55182.
-### Attribution {/*attribution*/}
+## Attribution {/*attribution*/}
Thank you to [Lachlan Davidson](https://github.com/lachlan2k) for discovering, reporting, and working to help fix this vulnerability.
\ No newline at end of file
From 0828d503a27e04100cf37d9dedc5cf7eb3ca3817 Mon Sep 17 00:00:00 2001
From: "Sebastian \"Sebbie\" Silbermann"
Date: Wed, 3 Dec 2025 19:00:16 +0100
Subject: [PATCH 07/35] Update React releases (#8173)
---
src/components/MDX/Sandpack/template.ts | 4 ++--
src/components/MDX/SandpackWithHTMLOutput.tsx | 4 ++--
src/content/versions.md | 4 ++++
3 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/src/components/MDX/Sandpack/template.ts b/src/components/MDX/Sandpack/template.ts
index ed594887b..fa8c9e486 100644
--- a/src/components/MDX/Sandpack/template.ts
+++ b/src/components/MDX/Sandpack/template.ts
@@ -35,8 +35,8 @@ root.render(
eject: 'react-scripts eject',
},
dependencies: {
- react: '^19.2.0',
- 'react-dom': '^19.2.0',
+ react: '^19.2.1',
+ 'react-dom': '^19.2.1',
'react-scripts': '^5.0.0',
},
},
diff --git a/src/components/MDX/SandpackWithHTMLOutput.tsx b/src/components/MDX/SandpackWithHTMLOutput.tsx
index 49e980d32..51d06beaf 100644
--- a/src/components/MDX/SandpackWithHTMLOutput.tsx
+++ b/src/components/MDX/SandpackWithHTMLOutput.tsx
@@ -56,8 +56,8 @@ export default function formatHTML(markup) {
const packageJSON = `
{
"dependencies": {
- "react": "^19.2.0",
- "react-dom": "^19.2.0",
+ "react": "^19.2.1",
+ "react-dom": "^19.2.1",
"react-scripts": "^5.0.0",
"html-format": "^1.1.2"
},
diff --git a/src/content/versions.md b/src/content/versions.md
index abb32cec4..5b3cb2cd9 100644
--- a/src/content/versions.md
+++ b/src/content/versions.md
@@ -54,8 +54,12 @@ For versions older than React 15, see [15.react.dev](https://15.react.dev).
- [React 19 Deep Dive: Coordinating HTML](https://www.youtube.com/watch?v=IBBN-s77YSI)
**Releases**
+- [v19.2.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1921-dec-3-2025)
- [v19.2.0 (October, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1920-october-1st-2025)
+- [v19.1.2 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1912-dec-3-2025)
+- [v19.1.1 (July, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1911-july-28-2025)
- [v19.1.0 (March, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1910-march-28-2025)
+- [v19.0.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1901-dec-3-2025)
- [v19.0.0 (December, 2024)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1900-december-5-2024)
### React 18 {/*react-18*/}
From ac47e529733c38ee3e1d6aacca47e655843a2188 Mon Sep 17 00:00:00 2001
From: Daishi Kato
Date: Thu, 4 Dec 2025 11:58:20 +0900
Subject: [PATCH 08/35] Update upgrade instructions for React Server Components
(Waku section) (#8176)
---
...cal-security-vulnerability-in-react-server-components.md | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
index 4da65a9ec..aff8248ca 100644
--- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -123,9 +123,11 @@ See [Redwood docs](https://docs.rwsdk.com/migrating/) for more migration instruc
Upgrade to the latest `react-server-dom-webpack`:
```bash
-npm install react@latest react-dom@latest react-server-dom-webpack@latest
+npm install react@latest react-dom@latest react-server-dom-webpack@latest waku@latest
```
+See [Waku announcement](https://github.com/wakujs/waku/discussions/1823) for more migration instructions.
+
### `@vitejs/plugin-rsc` {/*vitejs-plugin-rsc*/}
Upgrade to the latest RSC plugin:
@@ -167,4 +169,4 @@ npm install react@latest react-dom@latest react-server-dom-webpack@latest
## Attribution {/*attribution*/}
-Thank you to [Lachlan Davidson](https://github.com/lachlan2k) for discovering, reporting, and working to help fix this vulnerability.
\ No newline at end of file
+Thank you to [Lachlan Davidson](https://github.com/lachlan2k) for discovering, reporting, and working to help fix this vulnerability.
From d8b1fe88a9b4991c9595c0228c16ee6d598fa176 Mon Sep 17 00:00:00 2001
From: Matt Carroll <7158882+mattcarrollcode@users.noreply.github.com>
Date: Thu, 4 Dec 2025 08:56:58 -0800
Subject: [PATCH 09/35] Upgrade Next from 15.1.0 to 15.1.9 (#8175)
---
package.json | 2 +-
yarn.lock | 112 +++++++++++++++++++++++++--------------------------
2 files changed, 57 insertions(+), 57 deletions(-)
diff --git a/package.json b/package.json
index c2a84b1ea..657be8877 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
"classnames": "^2.2.6",
"debounce": "^1.2.1",
"github-slugger": "^1.3.0",
- "next": "15.1.0",
+ "next": "15.1.9",
"next-remote-watch": "^1.0.0",
"parse-numeric-range": "^1.2.0",
"react": "^19.0.0",
diff --git a/yarn.lock b/yarn.lock
index 5b7d7bf96..a07b2f280 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1225,10 +1225,10 @@
unist-util-visit "^4.0.0"
vfile "^5.0.0"
-"@next/env@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/env/-/env-15.1.0.tgz#35b00a5f60ff10dc275182928c325d25c29379ae"
- integrity sha512-UcCO481cROsqJuszPPXJnb7GGuLq617ve4xuAyyNG4VSSocJNtMU5Fsx+Lp6mlN8c7W58aZLc5y6D/2xNmaK+w==
+"@next/env@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/env/-/env-15.1.9.tgz#3569b6dd6a9b0af998fc6e4902da6b9ed2fc36c9"
+ integrity sha512-Te1wbiJ//I40T7UePOUG8QBwh+VVMCc0OTuqesOcD3849TVOVOyX4Hdrkx7wcpLpy/LOABIcGyLX5P/SzzXhFA==
"@next/eslint-plugin-next@12.0.3":
version "12.0.3"
@@ -1237,45 +1237,45 @@
dependencies:
glob "7.1.7"
-"@next/swc-darwin-arm64@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.1.0.tgz#30cb89220e719244c9fa7391641e515a078ade46"
- integrity sha512-ZU8d7xxpX14uIaFC3nsr4L++5ZS/AkWDm1PzPO6gD9xWhFkOj2hzSbSIxoncsnlJXB1CbLOfGVN4Zk9tg83PUw==
-
-"@next/swc-darwin-x64@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-15.1.0.tgz#c24c4f5d1016dd161da32049305b0ddddfc80951"
- integrity sha512-DQ3RiUoW2XC9FcSM4ffpfndq1EsLV0fj0/UY33i7eklW5akPUCo6OX2qkcLXZ3jyPdo4sf2flwAED3AAq3Om2Q==
-
-"@next/swc-linux-arm64-gnu@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.1.0.tgz#08ed540ecdac74426a624cc7d736dc709244b004"
- integrity sha512-M+vhTovRS2F//LMx9KtxbkWk627l5Q7AqXWWWrfIzNIaUFiz2/NkOFkxCFyNyGACi5YbA8aekzCLtbDyfF/v5Q==
-
-"@next/swc-linux-arm64-musl@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.1.0.tgz#dfddbd40087d018266aa92515ec5b3e251efa6dd"
- integrity sha512-Qn6vOuwaTCx3pNwygpSGtdIu0TfS1KiaYLYXLH5zq1scoTXdwYfdZtwvJTpB1WrLgiQE2Ne2kt8MZok3HlFqmg==
-
-"@next/swc-linux-x64-gnu@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.1.0.tgz#a7b5373a1b28c0acecbc826a3790139fc0d899e5"
- integrity sha512-yeNh9ofMqzOZ5yTOk+2rwncBzucc6a1lyqtg8xZv0rH5znyjxHOWsoUtSq4cUTeeBIiXXX51QOOe+VoCjdXJRw==
-
-"@next/swc-linux-x64-musl@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.1.0.tgz#b82a29903ee2f12d8b64163ddf208ac519869550"
- integrity sha512-t9IfNkHQs/uKgPoyEtU912MG6a1j7Had37cSUyLTKx9MnUpjj+ZDKw9OyqTI9OwIIv0wmkr1pkZy+3T5pxhJPg==
-
-"@next/swc-win32-arm64-msvc@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.1.0.tgz#98deae6cb1fccfb6a600e9faa6aa714402a9ab9a"
- integrity sha512-WEAoHyG14t5sTavZa1c6BnOIEukll9iqFRTavqRVPfYmfegOAd5MaZfXgOGG6kGo1RduyGdTHD4+YZQSdsNZXg==
-
-"@next/swc-win32-x64-msvc@15.1.0":
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.1.0.tgz#4b04a6a667c41fecdc63db57dd71ca7e84d0946b"
- integrity sha512-J1YdKuJv9xcixzXR24Dv+4SaDKc2jj31IVUEMdO5xJivMTXuE6MAdIi4qPjSymHuFG8O5wbfWKnhJUcHHpj5CA==
+"@next/swc-darwin-arm64@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/swc-darwin-arm64/-/swc-darwin-arm64-15.1.9.tgz#7b95fc3b2cd5108b514c949c3bddb3a9b42a714e"
+ integrity sha512-sQF6MfW4nk0PwMYYq8xNgqyxZJGIJV16QqNDgaZ5ze9YoVzm4/YNx17X0exZudayjL9PF0/5RGffDtzXapch0Q==
+
+"@next/swc-darwin-x64@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/swc-darwin-x64/-/swc-darwin-x64-15.1.9.tgz#bda6b37e0deeb64f4139cc70b37e370bd3367be8"
+ integrity sha512-fp0c1rB6jZvdSDhprOur36xzQvqelAkNRXM/An92sKjjtaJxjlqJR8jiQLQImPsClIu8amQn+ZzFwl1lsEf62w==
+
+"@next/swc-linux-arm64-gnu@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-15.1.9.tgz#546717f65de5fa610cd211183bd1be63050ab1c4"
+ integrity sha512-77rYykF6UtaXvxh9YyRIKoaYPI6/YX6cy8j1DL5/1XkjbfOwFDfTEhH7YGPqG/ePl+emBcbDYC2elgEqY2e+ag==
+
+"@next/swc-linux-arm64-musl@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-15.1.9.tgz#3594f47a94fd52e1aba00f59793171de9386f71a"
+ integrity sha512-uZ1HazKcyWC7RA6j+S/8aYgvxmDqwnG+gE5S9MhY7BTMj7ahXKunpKuX8/BA2M7OvINLv7LTzoobQbw928p3WA==
+
+"@next/swc-linux-x64-gnu@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-15.1.9.tgz#77cc834636688e44fea4c9cee800649a4ed92b0d"
+ integrity sha512-gQIX1d3ct2RBlgbbWOrp+SHExmtmFm/HSW1Do5sSGMDyzbkYhS2sdq5LRDJWWsQu+/MqpgJHqJT6ORolKp/U1g==
+
+"@next/swc-linux-x64-musl@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-15.1.9.tgz#88783a8968d0c0e4f274b68569b73c19ee2feecb"
+ integrity sha512-fJOwxAbCeq6Vo7pXZGDP6iA4+yIBGshp7ie2Evvge7S7lywyg7b/SGqcvWq/jYcmd0EbXdb7hBfdqSQwTtGTPg==
+
+"@next/swc-win32-arm64-msvc@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-15.1.9.tgz#1b7024cee3eefe4bcf8f81e7cbffe6aeb15d32ea"
+ integrity sha512-crfbUkAd9PVg9nGfyjSzQbz82dPvc4pb1TeP0ZaAdGzTH6OfTU9kxidpFIogw0DYIEadI7hRSvuihy2NezkaNQ==
+
+"@next/swc-win32-x64-msvc@15.1.9":
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-15.1.9.tgz#92044825d0f9e017d6a27ab69fc8c8f5ca9dc239"
+ integrity sha512-SBB0oA4E2a0axUrUwLqXlLkSn+bRx9OWU6LheqmRrO53QEAJP7JquKh3kF0jRzmlYOWFZtQwyIWJMEJMtvvDcQ==
"@nodelib/fs.scandir@2.1.5":
version "2.1.5"
@@ -5797,12 +5797,12 @@ next-tick@^1.1.0:
resolved "https://registry.npmjs.org/next-tick/-/next-tick-1.1.0.tgz"
integrity sha512-CXdUiJembsNjuToQvxayPZF9Vqht7hewsvy2sOWafLvi2awflj9mOC6bHIg50orX8IJvWKY9wYQ/zB2kogPslQ==
-next@15.1.0:
- version "15.1.0"
- resolved "https://registry.yarnpkg.com/next/-/next-15.1.0.tgz#be847cf67ac94ae23b57f3ea6d10642f3fc1ad69"
- integrity sha512-QKhzt6Y8rgLNlj30izdMbxAwjHMFANnLwDwZ+WQh5sMhyt4lEBqDK9QpvWHtIM4rINKPoJ8aiRZKg5ULSybVHw==
+next@15.1.9:
+ version "15.1.9"
+ resolved "https://registry.yarnpkg.com/next/-/next-15.1.9.tgz#eaab46d7a57c881fadf748d8ba2a8c65ec27ad8f"
+ integrity sha512-OoQpDPV2i3o5Hnn46nz2x6fzdFxFO+JsU4ZES12z65/feMjPHKKHLDVQ2NuEvTaXTRisix/G5+6hyTkwK329kA==
dependencies:
- "@next/env" "15.1.0"
+ "@next/env" "15.1.9"
"@swc/counter" "0.1.3"
"@swc/helpers" "0.5.15"
busboy "1.6.0"
@@ -5810,14 +5810,14 @@ next@15.1.0:
postcss "8.4.31"
styled-jsx "5.1.6"
optionalDependencies:
- "@next/swc-darwin-arm64" "15.1.0"
- "@next/swc-darwin-x64" "15.1.0"
- "@next/swc-linux-arm64-gnu" "15.1.0"
- "@next/swc-linux-arm64-musl" "15.1.0"
- "@next/swc-linux-x64-gnu" "15.1.0"
- "@next/swc-linux-x64-musl" "15.1.0"
- "@next/swc-win32-arm64-msvc" "15.1.0"
- "@next/swc-win32-x64-msvc" "15.1.0"
+ "@next/swc-darwin-arm64" "15.1.9"
+ "@next/swc-darwin-x64" "15.1.9"
+ "@next/swc-linux-arm64-gnu" "15.1.9"
+ "@next/swc-linux-arm64-musl" "15.1.9"
+ "@next/swc-linux-x64-gnu" "15.1.9"
+ "@next/swc-linux-x64-musl" "15.1.9"
+ "@next/swc-win32-arm64-msvc" "15.1.9"
+ "@next/swc-win32-x64-msvc" "15.1.9"
sharp "^0.33.5"
nice-try@^1.0.4:
From 5876ed5a11bcef4d2838e5992afa544f9bac09d0 Mon Sep 17 00:00:00 2001
From: Vojtech Novak
Date: Fri, 5 Dec 2025 18:32:09 +0100
Subject: [PATCH 10/35] blog: update RSC security vulnerability guidance for
Expo (#8177)
---
...cal-security-vulnerability-in-react-server-components.md | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
index aff8248ca..90a549bc2 100644
--- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -94,11 +94,7 @@ npm install @vitejs/plugin-rsc@latest
### Expo {/*expo*/}
-Upgrade to the latest `react-server-dom-webpack`:
-
-```bash
-npm install react@latest react-dom@latest react-server-dom-webpack@latest
-```
+To learn more about mitigating, read the article on [expo.dev/changelog](https://expo.dev/changelog/mitigating-critical-security-vulnerability-in-react-server-components).
### Redwood SDK {/*update-redwood-sdk*/}
From e22544e68d6fffda33332771efe27034739f35a4 Mon Sep 17 00:00:00 2001
From: Sakutaro
Date: Sat, 6 Dec 2025 02:34:42 +0900
Subject: [PATCH 11/35] Add Vulnerability in React Server Components to
sidebarBlog.json (#8178)
---
src/sidebarBlog.json | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/sidebarBlog.json b/src/sidebarBlog.json
index 3497fdd0b..b048ba9ca 100644
--- a/src/sidebarBlog.json
+++ b/src/sidebarBlog.json
@@ -11,6 +11,13 @@
"path": "/blog",
"skipBreadcrumb": true,
"routes": [
+ {
+ "title": "Critical Security Vulnerability in React Server Components",
+ "titleForHomepage": "Vulnerability in React Server Components",
+ "icon": "blog",
+ "date": "December 03, 2025",
+ "path": "/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
+ },
{
"title": "React Conf 2025 Recap",
"titleForHomepage": "React Conf 2025 Recap",
From cffb6a7b7d00fbe09df5b40d1731e1055bff0900 Mon Sep 17 00:00:00 2001
From: "Sebastian \"Sebbie\" Silbermann"
Date: Thu, 11 Dec 2025 07:27:20 +0100
Subject: [PATCH 12/35] Specify that Effects run on commit, not render (#8162)
---
src/content/reference/react/useEffect.md | 26 +++++++++----------
.../reference/react/useLayoutEffect.md | 4 +--
2 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/src/content/reference/react/useEffect.md b/src/content/reference/react/useEffect.md
index da310c762..85389c62e 100644
--- a/src/content/reference/react/useEffect.md
+++ b/src/content/reference/react/useEffect.md
@@ -44,9 +44,9 @@ function ChatRoom({ roomId }) {
#### Parameters {/*parameters*/}
-* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. When your component is added to the DOM, React will run your setup function. After every re-render with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. After your component is removed from the DOM, React will run your cleanup function.
+* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. When your [component commits](/learn/render-and-commit#step-3-react-commits-changes-to-the-dom), React will run your setup function. After every commit with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. After your component is removed from the DOM, React will run your cleanup function.
-* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every re-render of the component. [See the difference between passing an array of dependencies, an empty array, and no dependencies at all.](#examples-dependencies)
+* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every commit of the component. [See the difference between passing an array of dependencies, an empty array, and no dependencies at all.](#examples-dependencies)
#### Returns {/*returns*/}
@@ -107,14 +107,14 @@ You need to pass two arguments to `useEffect`:
**React calls your setup and cleanup functions whenever it's necessary, which may happen multiple times:**
1. Your setup code runs when your component is added to the page *(mounts)*.
-2. After every re-render of your component where the dependencies have changed:
+2. After every commit of your component where the dependencies have changed:
- First, your cleanup code runs with the old props and state.
- Then, your setup code runs with the new props and state.
3. Your cleanup code runs one final time after your component is removed from the page *(unmounts).*
**Let's illustrate this sequence for the example above.**
-When the `ChatRoom` component above gets added to the page, it will connect to the chat room with the initial `serverUrl` and `roomId`. If either `serverUrl` or `roomId` change as a result of a re-render (say, if the user picks a different chat room in a dropdown), your Effect will *disconnect from the previous room, and connect to the next one.* When the `ChatRoom` component is removed from the page, your Effect will disconnect one last time.
+When the `ChatRoom` component above gets added to the page, it will connect to the chat room with the initial `serverUrl` and `roomId`. If either `serverUrl` or `roomId` change as a result of a commit (say, if the user picks a different chat room in a dropdown), your Effect will *disconnect from the previous room, and connect to the next one.* When the `ChatRoom` component is removed from the page, your Effect will disconnect one last time.
**To [help you find bugs,](/learn/synchronizing-with-effects#step-3-add-cleanup-if-needed) in development React runs setup and cleanup one extra time before the setup.** This is a stress-test that verifies your Effect's logic is implemented correctly. If this causes visible issues, your cleanup function is missing some logic. The cleanup function should stop or undo whatever the setup function was doing. The rule of thumb is that the user shouldn't be able to distinguish between the setup being called once (as in production) and a *setup* → *cleanup* → *setup* sequence (as in development). [See common solutions.](/learn/synchronizing-with-effects#how-to-handle-the-effect-firing-twice-in-development)
@@ -1145,7 +1145,7 @@ useEffect(() => {
#### Passing a dependency array {/*passing-a-dependency-array*/}
-If you specify the dependencies, your Effect runs **after the initial render _and_ after re-renders with changed dependencies.**
+If you specify the dependencies, your Effect runs **after the initial commit _and_ after commits with changed dependencies.**
```js {3}
useEffect(() => {
@@ -1242,7 +1242,7 @@ button { margin-left: 5px; }
#### Passing an empty dependency array {/*passing-an-empty-dependency-array*/}
-If your Effect truly doesn't use any reactive values, it will only run **after the initial render.**
+If your Effect truly doesn't use any reactive values, it will only run **after the initial commit.**
```js {3}
useEffect(() => {
@@ -1319,7 +1319,7 @@ export function createConnection(serverUrl, roomId) {
#### Passing no dependency array at all {/*passing-no-dependency-array-at-all*/}
-If you pass no dependency array at all, your Effect runs **after every single render (and re-render)** of your component.
+If you pass no dependency array at all, your Effect runs **after every single commit** of your component.
```js {3}
useEffect(() => {
@@ -1480,7 +1480,7 @@ Now that you're passing `c => c + 1` instead of `count + 1`, [your Effect no lon
### Removing unnecessary object dependencies {/*removing-unnecessary-object-dependencies*/}
-If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every render because the `options` object is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally)
+If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every commit because the `options` object is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally)
```js {6-9,12,15}
const serverUrl = 'https://localhost:1234';
@@ -1497,7 +1497,7 @@ function ChatRoom({ roomId }) {
const connection = createConnection(options); // It's used inside the Effect
connection.connect();
return () => connection.disconnect();
- }, [options]); // 🚩 As a result, these dependencies are always different on a re-render
+ }, [options]); // 🚩 As a result, these dependencies are always different on a commit
// ...
```
@@ -1583,7 +1583,7 @@ With this fix, typing into the input doesn't reconnect the chat. Unlike an objec
### Removing unnecessary function dependencies {/*removing-unnecessary-function-dependencies*/}
-If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every render because the `createOptions` function is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally)
+If your Effect depends on an object or a function created during rendering, it might run too often. For example, this Effect re-connects after every commit because the `createOptions` function is [different for every render:](/learn/removing-effect-dependencies#does-some-reactive-value-change-unintentionally)
```js {4-9,12,16}
function ChatRoom({ roomId }) {
@@ -1601,11 +1601,11 @@ function ChatRoom({ roomId }) {
const connection = createConnection();
connection.connect();
return () => connection.disconnect();
- }, [createOptions]); // 🚩 As a result, these dependencies are always different on a re-render
+ }, [createOptions]); // 🚩 As a result, these dependencies are always different on a commit
// ...
```
-By itself, creating a function from scratch on every re-render is not a problem. You don't need to optimize that. However, if you use it as a dependency of your Effect, it will cause your Effect to re-run after every re-render.
+By itself, creating a function from scratch on every re-render is not a problem. You don't need to optimize that. However, if you use it as a dependency of your Effect, it will cause your Effect to re-run after every commit.
Avoid using a function created during rendering as a dependency. Instead, declare it inside the Effect:
@@ -1775,7 +1775,7 @@ First, check that you haven't forgotten to specify the dependency array:
```js {3}
useEffect(() => {
// ...
-}); // 🚩 No dependency array: re-runs after every render!
+}); // 🚩 No dependency array: re-runs after every commit!
```
If you've specified the dependency array but your Effect still re-runs in a loop, it's because one of your dependencies is different on every re-render.
diff --git a/src/content/reference/react/useLayoutEffect.md b/src/content/reference/react/useLayoutEffect.md
index 5ae152b67..24b360404 100644
--- a/src/content/reference/react/useLayoutEffect.md
+++ b/src/content/reference/react/useLayoutEffect.md
@@ -47,9 +47,9 @@ function Tooltip() {
#### Parameters {/*parameters*/}
-* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. Before your component is added to the DOM, React will run your setup function. After every re-render with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. Before your component is removed from the DOM, React will run your cleanup function.
+* `setup`: The function with your Effect's logic. Your setup function may also optionally return a *cleanup* function. Before your [component commits](/learn/render-and-commit#step-3-react-commits-changes-to-the-dom), React will run your setup function. After every commit with changed dependencies, React will first run the cleanup function (if you provided it) with the old values, and then run your setup function with the new values. Before your component is removed from the DOM, React will run your cleanup function.
-* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every re-render of the component.
+* **optional** `dependencies`: The list of all reactive values referenced inside of the `setup` code. Reactive values include props, state, and all the variables and functions declared directly inside your component body. If your linter is [configured for React](/learn/editor-setup#linting), it will verify that every reactive value is correctly specified as a dependency. The list of dependencies must have a constant number of items and be written inline like `[dep1, dep2, dep3]`. React will compare each dependency with its previous value using the [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is) comparison. If you omit this argument, your Effect will re-run after every commit of the component.
#### Returns {/*returns*/}
From 2a0fed01500bd6e7f4214824b414729918a74c20 Mon Sep 17 00:00:00 2001
From: Ricky
Date: Thu, 11 Dec 2025 15:12:39 -0500
Subject: [PATCH 13/35] 12/11 blog post (#8193)
---
...ulnerability-in-react-server-components.md | 18 +-
...ode-exposure-in-react-server-components.md | 165 ++++++++++++++++++
src/content/blog/index.md | 6 +
src/content/versions.md | 3 +
src/sidebarBlog.json | 9 +-
5 files changed, 199 insertions(+), 2 deletions(-)
create mode 100644 src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
index 90a549bc2..3fe7c0bd2 100644
--- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -42,7 +42,7 @@ If your app’s React code does not use a server, your app is not affected by th
Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
-We will update this post with upgrade instructions on how to upgrade as they become available.
+See the [update instructions below](#update-instructions) for how to upgrade to these patches.
### Hosting Provider Mitigations {/*hosting-provider-mitigations*/}
@@ -156,6 +156,22 @@ Update to the latest version:
npm install react@latest react-dom@latest react-server-dom-webpack@latest
```
+
+### React Native {/*react-native*/}
+
+For React Native users not using a monorepo or `react-dom`, your `react` version should be pinned in your `package.json`, and there are no additional steps needed.
+
+If you are using React Native in a monorepo, you should update _only_ the impacted packages if they are installed:
+
+- `react-server-dom-webpack`
+- `react-server-dom-parcel`
+- `react-server-dom-turbopack`
+
+This is required to mitigate the security advisory, but you do not need to update `react` and `react-dom` so this will not cause the version mismatch error in React Native.
+
+See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomment-3617929832) for more information.
+
+
## Timeline {/*timeline*/}
* **November 29th**: Lachlan Davidson reported the security vulnerability via [Meta Bug Bounty](https://bugbounty.meta.com/).
diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
new file mode 100644
index 000000000..e1360226f
--- /dev/null
+++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
@@ -0,0 +1,165 @@
+---
+title: "Denial of Service and Source Code Exposure in React Server Components"
+author: The React Team
+date: 2025/12/11
+description: Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability. High vulnerability Denial of Service (CVE-2025-55184), and medium vulnerability Source Code Exposure (CVE-2025-55183)
+
+
+---
+
+December 11, 2025 by [The React Team](/community/team)
+
+---
+
+
+
+Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability.
+
+**These new vulnerabilities do not allow for Remote Code Execution.** The patch for React2Shell remains effective at mitigating the Remote Code Execution exploit.
+
+
+
+---
+
+The new vulnerabilities are disclosed as:
+
+- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5)
+- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
+
+These issues are present in the patches published last week.
+
+We recommend upgrading immediately due to the severity of the newly disclosed vulnerabilities.
+
+
+
+
+#### It’s common for critical CVEs to uncover follow‑up vulnerabilities. {/*its-common-for-critical-cves-to-uncover-followup-vulnerabilities*/}
+
+When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed.
+
+This pattern shows up across the industry, not just in JavaScript. For example, after [Log4Shell](https://nvd.nist.gov/vuln/detail/cve-2021-44228), additional CVEs ([1](https://nvd.nist.gov/vuln/detail/cve-2021-45046), [2](https://nvd.nist.gov/vuln/detail/cve-2021-45105)) were reported as the community probed the original fix.
+
+Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.
+
+
+
+Further details of these vulnerabilities will be provided after the rollout of the fixes are complete.
+
+## Immediate Action Required {/*immediate-action-required*/}
+
+These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](http://localhost:3000/blog/2025/12/03/critical-security-vulnerability-in-react-server-components).
+
+This includes versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:
+
+* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
+* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
+* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)
+
+Fixes were backported to versions 19.0.2, 19.1.3, and 19.2.2. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
+
+As before, if your app’s React code does not use a server, your app is not affected by these vulnerabilities. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities.
+
+
+
+#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/}
+
+If you already updated for the Critical Security Vulnerability, you will need to update again.
+
+
+
+### Affected frameworks and bundlers {/*affected-frameworks-and-bundlers*/}
+
+Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vite/rsc-plugin](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
+
+Please see [the instructions in the previous post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps.
+
+### Hosting Provider Mitigations {/*hosting-provider-mitigations*/}
+
+As before, we have worked with a number of hosting providers to apply temporary mitigations.
+
+You should not depend on these to secure your app, and still update immediately.
+
+### React Native {/*react-native*/}
+
+For React Native users not using a monorepo or `react-dom`, your `react` version should be pinned in your `package.json`, and there are no additional steps needed.
+
+If you are using React Native in a monorepo, you should update _only_ the impacted packages if they are installed:
+
+- `react-server-dom-webpack`
+- `react-server-dom-parcel`
+- `react-server-dom-turbopack`
+
+This is required to mitigate the security advisories, but you do not need to update `react` and `react-dom` so this will not cause the version mismatch error in React Native.
+
+See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomment-3617929832) for more information.
+
+## High Severity: Denial of Service {/*high-severity-denial-of-service*/}
+
+**CVE:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184)
+**Base Score:** 7.5 (High)
+
+Security researchers have discovered that a malicious HTTP request can be crafted and sent to any Server Functions endpoint that, when deserialized by React, can cause an infinite loop that hangs the server process and consumes CPU. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
+
+This creates a vulnerability vector where an attacker may be able to deny users from accessing the product, and potentially have a performance impact on the server environment.
+
+The patches published today mitigate by preventing the infinite loop.
+
+
+## Medium Severity: Source Code Exposure {/*low-severity-source-code-exposure*/}
+
+**CVE:** [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183)
+**Base Score**: 5.3 (Medium)
+
+A security researcher has discovered that a malicious HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument:
+
+```javascript
+'use server';
+
+export async function serverFunction(name) {
+ const conn = db.createConnection('SECRET KEY');
+ const user = await conn.createUser(name); // implicitly stringified, leaked in db
+
+ return {
+ id: user.id,
+ message: `Hello, ${name}!` // explicitly stringified, leaked in reply
+ }}
+```
+
+An attacker may be able to leak the following:
+
+```txt
+0:{"a":"$@1","f":"","b":"Wy43RxUKdxmr5iuBzJ1pN"}
+1:{"id":"tva1sfodwq","message":"Hello, async function(a){console.log(\"serverFunction\");let b=i.createConnection(\"SECRET KEY\");return{id:(await b.createUser(a)).id,message:`Hello, ${a}!`}}!"}
+```
+
+The patches published today prevent stringifying the Server Function source code.
+
+
+
+#### Only secrets in source code may be exposed. {/*only-secrets-in-source-code-may-be-exposed*/}
+
+Secrets hardcoded in source code may be exposed, but runtime secrets such as `process.env.SECRET` are not affected.
+
+The scope of the exposed code is limited to the code inside the Server Function, which may include other functions depending on the amount of inlining your bundler provides.
+
+Always verify against production bundles.
+
+
+
+---
+
+## Timeline {/*timeline*/}
+* **December 3rd**: Leak reported to Vercel and [Meta Bug Bounty](https://bugbounty.meta.com/) by [Andrew MacPherson](https://github.com/AndrewMohawk).
+* **December 4th**: Initial DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) by [RyotaK](https://ryotak.net).
+* **December 6th**: Both issues confirmed by the React team, and the team began investigating.
+* **December 7th**: Initial fixes created and the React team began verifying and planning new patch.
+* **December 8th**: Affected hosting providers and open source projects notified.
+* **December 10th**: Hosting provider mitigations in place and patches verified.
+* **December 11th**: Additional DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) and added to patch.
+* **December 11th**: Patches published and publicly disclosed as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) and [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).
+
+---
+
+## Attribution {/*attribution*/}
+
+Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc for reporting the initial Denial of Service vulnerability.
diff --git a/src/content/blog/index.md b/src/content/blog/index.md
index 5a2f1b7f1..30c4a3ffe 100644
--- a/src/content/blog/index.md
+++ b/src/content/blog/index.md
@@ -12,6 +12,12 @@ You can also follow the [@react.dev](https://bsky.app/profile/react.dev) account
+
+
+Security researchers have found and disclosed two additional vulnerabilities in React Server Components while attempting to exploit the patches in last week’s critical vulnerability...
+
+
+
There is an unauthenticated remote code execution vulnerability in React Server Components. A fix has been published in versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.
diff --git a/src/content/versions.md b/src/content/versions.md
index 5b3cb2cd9..62be00cc3 100644
--- a/src/content/versions.md
+++ b/src/content/versions.md
@@ -54,11 +54,14 @@ For versions older than React 15, see [15.react.dev](https://15.react.dev).
- [React 19 Deep Dive: Coordinating HTML](https://www.youtube.com/watch?v=IBBN-s77YSI)
**Releases**
+- [v19.2.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1922-dec-11-2025)
- [v19.2.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1921-dec-3-2025)
- [v19.2.0 (October, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1920-october-1st-2025)
+- [v19.1.3 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1913-dec-11-2025)
- [v19.1.2 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1912-dec-3-2025)
- [v19.1.1 (July, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1911-july-28-2025)
- [v19.1.0 (March, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1910-march-28-2025)
+- [v19.0.2 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1902-dec-11-2025)
- [v19.0.1 (December, 2025)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1901-dec-3-2025)
- [v19.0.0 (December, 2024)](https://github.com/facebook/react/blob/main/CHANGELOG.md#1900-december-5-2024)
diff --git a/src/sidebarBlog.json b/src/sidebarBlog.json
index b048ba9ca..e5da90fe9 100644
--- a/src/sidebarBlog.json
+++ b/src/sidebarBlog.json
@@ -11,11 +11,18 @@
"path": "/blog",
"skipBreadcrumb": true,
"routes": [
+ {
+ "title": "Denial of Service and Source Code Exposure in React Server Components",
+ "titleForHomepage": "Additional Vulnerabilities in RSC",
+ "icon": "blog",
+ "date": "December 11, 2025",
+ "path": "/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components"
+ },
{
"title": "Critical Security Vulnerability in React Server Components",
"titleForHomepage": "Vulnerability in React Server Components",
"icon": "blog",
- "date": "December 03, 2025",
+ "date": "December 3, 2025",
"path": "/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"
},
{
From 1a955f0323af1beda3123dfe9cec86b9c3c82c45 Mon Sep 17 00:00:00 2001
From: Ricky
Date: Thu, 11 Dec 2025 16:18:58 -0500
Subject: [PATCH 14/35] rm localhost link (#8194)
---
...rvice-and-source-code-exposure-in-react-server-components.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
index e1360226f..ed491cddc 100644
--- a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
+++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
@@ -47,7 +47,7 @@ Further details of these vulnerabilities will be provided after the rollout of t
## Immediate Action Required {/*immediate-action-required*/}
-These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](http://localhost:3000/blog/2025/12/03/critical-security-vulnerability-in-react-server-components).
+These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components).
This includes versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:
From 72f8998872ab958924a0ff1fda818fae48d5b031 Mon Sep 17 00:00:00 2001
From: Ricky
Date: Thu, 11 Dec 2025 17:15:41 -0500
Subject: [PATCH 15/35] Update instructions (#8195)
---
...ulnerability-in-react-server-components.md | 31 +++++++++++++------
...ode-exposure-in-react-server-components.md | 19 ++++++------
2 files changed, 31 insertions(+), 19 deletions(-)
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
index 3fe7c0bd2..d47730ecd 100644
--- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -58,27 +58,40 @@ An unauthenticated attacker could craft a malicious HTTP request to any Server F
## Update Instructions {/*update-instructions*/}
+
+
+These instructions have been updated to include the new vulnerabilities:
+
+
+- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5)
+- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
+
+See the [follow-up blog post](/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more info.
+
+
+
### Next.js {/*update-next-js*/}
All users should upgrade to the latest patched version in their release line:
```bash
-npm install next@15.0.5 // for 15.0.x
-npm install next@15.1.9 // for 15.1.x
-npm install next@15.2.6 // for 15.2.x
-npm install next@15.3.6 // for 15.3.x
-npm install next@15.4.8 // for 15.4.x
-npm install next@15.5.7 // for 15.5.x
-npm install next@16.0.7 // for 16.0.x
+npm install next@14.2.34 // for 14.x
+npm install next@15.0.6 // for 15.0.x
+npm install next@15.1.10 // for 15.1.x
+npm install next@15.2.7 // for 15.2.x
+npm install next@15.3.7 // for 15.3.x
+npm install next@15.4.9 // for 15.4.x
+npm install next@15.5.8 // for 15.5.x
+npm install next@16.0.9 // for 16.0.x
```
-If you are on Next.js 14.3.0-canary.77 or a later canary release, downgrade to the latest stable 14.x release:
+If you are on `next@14.3.0-canary.77` or a later canary release, downgrade to the latest stable 14.x release:
```bash
npm install next@14
```
-See the [Next.js changelog](https://nextjs.org/blog/CVE-2025-66478) for more info.
+See the [Next.js blog](https://nextjs.org/blog/security-update-2025-12-11) for the latest update instructions and the [previous changelog](https://nextjs.org/blog/CVE-2025-66478) for more info.
### React Router {/*update-react-router*/}
diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
index ed491cddc..54e4a8760 100644
--- a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
+++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
@@ -26,20 +26,15 @@ The new vulnerabilities are disclosed as:
- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5)
- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
-These issues are present in the patches published last week.
-
We recommend upgrading immediately due to the severity of the newly disclosed vulnerabilities.
-
-#### It’s common for critical CVEs to uncover follow‑up vulnerabilities. {/*its-common-for-critical-cves-to-uncover-followup-vulnerabilities*/}
-
-When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed.
+#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/}
-This pattern shows up across the industry, not just in JavaScript. For example, after [Log4Shell](https://nvd.nist.gov/vuln/detail/cve-2021-44228), additional CVEs ([1](https://nvd.nist.gov/vuln/detail/cve-2021-45046), [2](https://nvd.nist.gov/vuln/detail/cve-2021-45105)) were reported as the community probed the original fix.
+If you already updated for the Critical Security Vulnerability, you will need to update again.
-Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.
+Please see [the instructions in the previous post](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps.
@@ -61,9 +56,13 @@ As before, if your app’s React code does not use a server, your app is not aff
-#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/}
+#### It’s common for critical CVEs to uncover follow‑up vulnerabilities. {/*its-common-for-critical-cves-to-uncover-followup-vulnerabilities*/}
-If you already updated for the Critical Security Vulnerability, you will need to update again.
+When a critical vulnerability is disclosed, researchers scrutinize adjacent code paths looking for variant exploit techniques to test whether the initial mitigation can be bypassed.
+
+This pattern shows up across the industry, not just in JavaScript. For example, after [Log4Shell](https://nvd.nist.gov/vuln/detail/cve-2021-44228), additional CVEs ([1](https://nvd.nist.gov/vuln/detail/cve-2021-45046), [2](https://nvd.nist.gov/vuln/detail/cve-2021-45105)) were reported as the community probed the original fix.
+
+Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.
From e44d3b70a04e7ab23ccdc9cbd9d1dd8ece81cc0b Mon Sep 17 00:00:00 2001
From: Ricky
Date: Thu, 11 Dec 2025 18:55:34 -0500
Subject: [PATCH 16/35] Add additional DoS CVE (#8196)
---
...ode-exposure-in-react-server-components.md | 30 ++++++++++++++-----
1 file changed, 22 insertions(+), 8 deletions(-)
diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
index 54e4a8760..119317edc 100644
--- a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
+++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
@@ -23,16 +23,18 @@ Security researchers have found and disclosed two additional vulnerabilities in
The new vulnerabilities are disclosed as:
-- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5)
+- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) and [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779) (CVSS 7.5)
- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
We recommend upgrading immediately due to the severity of the newly disclosed vulnerabilities.
-#### The patches published last week are vulnerable. {/*the-patches-published-last-week-are-vulnerable*/}
+#### The patches published earlier are vulnerable. {/*the-patches-published-earlier-are-vulnerable*/}
-If you already updated for the Critical Security Vulnerability, you will need to update again.
+If you already updated for the Critical Security Vulnerability last week, you will need to update again.
+
+If you updated to 19.0.2, 19.1.3, and 19.2.2, [these are incomplete](#additional-fix-published) and you will need to update again.
Please see [the instructions in the previous post](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps.
@@ -44,13 +46,13 @@ Further details of these vulnerabilities will be provided after the rollout of t
These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components).
-This includes versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1 of:
+This includes versions 19.0.0, 19.0.1, 19.0.2, 19.1.0, 19.1.1, 19.1.2, 19.1.2, 19.2.0, 19.2.1 and 19.2.2 of:
* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)
-Fixes were backported to versions 19.0.2, 19.1.3, and 19.2.2. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
+Fixes were backported to versions 19.0.3, 19.1.4, and 19.2.3. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
As before, if your app’s React code does not use a server, your app is not affected by these vulnerabilities. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities.
@@ -94,7 +96,7 @@ See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomm
## High Severity: Denial of Service {/*high-severity-denial-of-service*/}
-**CVE:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184)
+**CVEs:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) and [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779)
**Base Score:** 7.5 (High)
Security researchers have discovered that a malicious HTTP request can be crafted and sent to any Server Functions endpoint that, when deserialized by React, can cause an infinite loop that hangs the server process and consumes CPU. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
@@ -103,6 +105,17 @@ This creates a vulnerability vector where an attacker may be able to deny users
The patches published today mitigate by preventing the infinite loop.
+
+
+#### Additional fix published {/*additional-fix-published*/}
+
+The original fix addressing the DoS in [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) was incomplete.
+
+This left versions 19.0.2, 19.1.3, 19.2.2 vulnerable. Versions 19.0.3, 19.1.4, 19.2.3 are safe.
+
+We've fixed the additional cases and filed [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779) for the vulnerable versions.
+
+
## Medium Severity: Source Code Exposure {/*low-severity-source-code-exposure*/}
@@ -154,11 +167,12 @@ Always verify against production bundles.
* **December 7th**: Initial fixes created and the React team began verifying and planning new patch.
* **December 8th**: Affected hosting providers and open source projects notified.
* **December 10th**: Hosting provider mitigations in place and patches verified.
-* **December 11th**: Additional DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) and added to patch.
+* **December 11th**: Additional DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) by Shinsaku Nomura.
* **December 11th**: Patches published and publicly disclosed as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) and [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).
+* **December 11th**: Missing DoS case found internally, patched and publicly disclosed as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).
---
## Attribution {/*attribution*/}
-Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc for reporting the initial Denial of Service vulnerability.
+Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc and Shinsaku Nomura of Bitforest Co., Ltd. for reporting the Denial of Service vulnerabilities.
From 9527378306f12e588c6f7db8499c96dc90cadf2b Mon Sep 17 00:00:00 2001
From: Ricky
Date: Thu, 11 Dec 2025 19:18:26 -0500
Subject: [PATCH 17/35] update nextjs instructions (#8197)
---
...itical-security-vulnerability-in-react-server-components.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
index d47730ecd..aa6f8f1ad 100644
--- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -62,10 +62,11 @@ An unauthenticated attacker could craft a malicious HTTP request to any Server F
These instructions have been updated to include the new vulnerabilities:
-
- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5)
- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
+They also include the additional case found, patched, and disclosed as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).
+
See the [follow-up blog post](/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more info.
From 1e74023dd276f15530bf7c3e3bb4f7420291c8b0 Mon Sep 17 00:00:00 2001
From: Matt Carroll <7158882+mattcarrollcode@users.noreply.github.com>
Date: Thu, 11 Dec 2025 17:01:10 -0800
Subject: [PATCH 18/35] [Blog] Update safe Next.js versions (#8199)
---
...ulnerability-in-react-server-components.md | 27 +++++++++++--------
1 file changed, 16 insertions(+), 11 deletions(-)
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
index aa6f8f1ad..ffef6119d 100644
--- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -20,9 +20,9 @@ We recommend upgrading immediately.
---
-On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.
+On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.
-Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
+Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
This vulnerability was disclosed as [CVE-2025-55182](https://www.cve.org/CVERecord?id=CVE-2025-55182) and is rated CVSS 10.0.
@@ -40,7 +40,7 @@ If your app’s React code does not use a server, your app is not affected by th
### Affected frameworks and bundlers {/*affected-frameworks-and-bundlers*/}
-Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
+Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vitejs/plugin-rsc](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
See the [update instructions below](#update-instructions) for how to upgrade to these patches.
@@ -76,16 +76,21 @@ See the [follow-up blog post](/blog/2025/12/11/denial-of-service-and-source-code
All users should upgrade to the latest patched version in their release line:
```bash
-npm install next@14.2.34 // for 14.x
-npm install next@15.0.6 // for 15.0.x
-npm install next@15.1.10 // for 15.1.x
-npm install next@15.2.7 // for 15.2.x
-npm install next@15.3.7 // for 15.3.x
-npm install next@15.4.9 // for 15.4.x
-npm install next@15.5.8 // for 15.5.x
-npm install next@16.0.9 // for 16.0.x
+npm install next@14.2.35 // for 13.3.x, 13.4.x, 13.5.x, 14.x
+npm install next@15.0.7 // for 15.0.x
+npm install next@15.1.11 // for 15.1.x
+npm install next@15.2.8 // for 15.2.x
+npm install next@15.3.8 // for 15.3.x
+npm install next@15.4.10 // for 15.4.x
+npm install next@15.5.9 // for 15.5.x
+npm install next@16.0.10 // for 16.0.x
+
+npm install next@15.6.0-canary.60 // for 15.x canary releases
+npm install next@16.1.0-canary.19 // for 16.x canary releases
```
+If you are on version `13.3` or later version of Next.js 13 (`13.3.x`, `13.4.x`, or `13.5.x`) please upgrade to version `14.2.35`.
+
If you are on `next@14.3.0-canary.77` or a later canary release, downgrade to the latest stable 14.x release:
```bash
From 2da4f7fbd90ddc09835c9f85d61fd5644a271abc Mon Sep 17 00:00:00 2001
From: Matt Carroll <7158882+mattcarrollcode@users.noreply.github.com>
Date: Thu, 11 Dec 2025 17:06:56 -0800
Subject: [PATCH 19/35] Update to Next.js 15.1.11 (#8200)
---
package.json | 2 +-
yarn.lock | 18 +++++++++---------
2 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/package.json b/package.json
index 657be8877..55fcc0a5b 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
"classnames": "^2.2.6",
"debounce": "^1.2.1",
"github-slugger": "^1.3.0",
- "next": "15.1.9",
+ "next": "15.1.11",
"next-remote-watch": "^1.0.0",
"parse-numeric-range": "^1.2.0",
"react": "^19.0.0",
diff --git a/yarn.lock b/yarn.lock
index a07b2f280..a1ce77d11 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1225,10 +1225,10 @@
unist-util-visit "^4.0.0"
vfile "^5.0.0"
-"@next/env@15.1.9":
- version "15.1.9"
- resolved "https://registry.yarnpkg.com/@next/env/-/env-15.1.9.tgz#3569b6dd6a9b0af998fc6e4902da6b9ed2fc36c9"
- integrity sha512-Te1wbiJ//I40T7UePOUG8QBwh+VVMCc0OTuqesOcD3849TVOVOyX4Hdrkx7wcpLpy/LOABIcGyLX5P/SzzXhFA==
+"@next/env@15.1.11":
+ version "15.1.11"
+ resolved "https://registry.yarnpkg.com/@next/env/-/env-15.1.11.tgz#599a126f7ce56decc39cea46668cb60d96b66bc6"
+ integrity sha512-yp++FVldfLglEG5LoS2rXhGypPyoSOyY0kxZQJ2vnlYJeP8o318t5DrDu5Tqzr03qAhDWllAID/kOCsXNLcwKw==
"@next/eslint-plugin-next@12.0.3":
version "12.0.3"
@@ -5797,12 +5797,12 @@ next-tick@^1.1.0:
resolved "https://registry.npmjs.org/next-tick/-/next-tick-1.1.0.tgz"
integrity sha512-CXdUiJembsNjuToQvxayPZF9Vqht7hewsvy2sOWafLvi2awflj9mOC6bHIg50orX8IJvWKY9wYQ/zB2kogPslQ==
-next@15.1.9:
- version "15.1.9"
- resolved "https://registry.yarnpkg.com/next/-/next-15.1.9.tgz#eaab46d7a57c881fadf748d8ba2a8c65ec27ad8f"
- integrity sha512-OoQpDPV2i3o5Hnn46nz2x6fzdFxFO+JsU4ZES12z65/feMjPHKKHLDVQ2NuEvTaXTRisix/G5+6hyTkwK329kA==
+next@15.1.11:
+ version "15.1.11"
+ resolved "https://registry.yarnpkg.com/next/-/next-15.1.11.tgz#8a70a236e02d8dd62fb0569bedfd5e4290e7af55"
+ integrity sha512-UiVJaOGhKST58AadwbFUZThlNBmYhKqaCs8bVtm4plTxsgKq0mJ0zTsp7t7j/rzsbAEj9WcAMdZCztjByi4EoQ==
dependencies:
- "@next/env" "15.1.9"
+ "@next/env" "15.1.11"
"@swc/counter" "0.1.3"
"@swc/helpers" "0.5.15"
busboy "1.6.0"
From a1ddcf51a08cc161182b90a24b409ba11289f73e Mon Sep 17 00:00:00 2001
From: Ricky
Date: Fri, 16 Jan 2026 13:27:58 -0500
Subject: [PATCH 20/35] Add caveat to useId for cache keys (#8242)
---
src/content/reference/react/useId.md | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/content/reference/react/useId.md b/src/content/reference/react/useId.md
index a77cf7a72..44a11b20d 100644
--- a/src/content/reference/react/useId.md
+++ b/src/content/reference/react/useId.md
@@ -44,6 +44,8 @@ function PasswordField() {
* `useId` is a Hook, so you can only call it **at the top level of your component** or your own Hooks. You can't call it inside loops or conditions. If you need that, extract a new component and move the state into it.
+* `useId` **should not be used to generate cache keys** for [use()](/reference/react/use). The ID is stable when a component is mounted but may change during rendering. Cache keys should be generated from your data.
+
* `useId` **should not be used to generate keys** in a list. [Keys should be generated from your data.](/learn/rendering-lists#where-to-get-your-key)
* `useId` currently cannot be used in [async Server Components](/reference/rsc/server-components#async-components-with-server-components).
From ed876185c3ec4a0d9e9180b1727b256c94625664 Mon Sep 17 00:00:00 2001
From: Ricky
Date: Mon, 26 Jan 2026 14:10:27 -0500
Subject: [PATCH 21/35] Update DoS blog post with additional CVE (#8263)
---
...ulnerability-in-react-server-components.md | 25 +++++----
...ode-exposure-in-react-server-components.md | 56 +++++++++++++------
2 files changed, 55 insertions(+), 26 deletions(-)
diff --git a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
index ffef6119d..310a84116 100644
--- a/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
+++ b/src/content/blog/2025/12/03/critical-security-vulnerability-in-react-server-components.md
@@ -62,13 +62,15 @@ An unauthenticated attacker could craft a malicious HTTP request to any Server F
These instructions have been updated to include the new vulnerabilities:
-- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) (CVSS 7.5)
+- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) and [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779) (CVSS 7.5)
- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
-
-They also include the additional case found, patched, and disclosed as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).
+- **Denial of Service - High Severity**: January 26, 2026 [CVE-2026-23864](https://www.cve.org/CVERecord?id=CVE-2026-23864) (CVSS 7.5)
See the [follow-up blog post](/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) for more info.
+-----
+
+_Updated January 26, 2026._
### Next.js {/*update-next-js*/}
@@ -77,18 +79,21 @@ All users should upgrade to the latest patched version in their release line:
```bash
npm install next@14.2.35 // for 13.3.x, 13.4.x, 13.5.x, 14.x
-npm install next@15.0.7 // for 15.0.x
-npm install next@15.1.11 // for 15.1.x
-npm install next@15.2.8 // for 15.2.x
-npm install next@15.3.8 // for 15.3.x
-npm install next@15.4.10 // for 15.4.x
-npm install next@15.5.9 // for 15.5.x
-npm install next@16.0.10 // for 16.0.x
+npm install next@15.0.8 // for 15.0.x
+npm install next@15.1.12 // for 15.1.x
+npm install next@15.2.9 // for 15.2.x
+npm install next@15.3.9 // for 15.3.x
+npm install next@15.4.11 // for 15.4.x
+npm install next@15.5.10 // for 15.5.x
+npm install next@16.0.11 // for 16.0.x
+npm install next@16.1.5 // for 16.1.x
npm install next@15.6.0-canary.60 // for 15.x canary releases
npm install next@16.1.0-canary.19 // for 16.x canary releases
```
+15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.10, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5
+
If you are on version `13.3` or later version of Next.js 13 (`13.3.x`, `13.4.x`, or `13.5.x`) please upgrade to version `14.2.35`.
If you are on `next@14.3.0-canary.77` or a later canary release, downgrade to the latest stable 14.x release:
diff --git a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
index 119317edc..6845e2f2f 100644
--- a/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
+++ b/src/content/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components.md
@@ -9,6 +9,8 @@ description: Security researchers have found and disclosed two additional vulner
December 11, 2025 by [The React Team](/community/team)
+_Updated January 26, 2026._
+
---
@@ -23,7 +25,7 @@ Security researchers have found and disclosed two additional vulnerabilities in
The new vulnerabilities are disclosed as:
-- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) and [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779) (CVSS 7.5)
+- **Denial of Service - High Severity**: [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184), [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779), and [CVE-2026-23864](https://www.cve.org/CVERecord?id=CVE-2026-23864) (CVSS 7.5)
- **Source Code Exposure - Medium Severity**: [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) (CVSS 5.3)
We recommend upgrading immediately due to the severity of the newly disclosed vulnerabilities.
@@ -32,12 +34,16 @@ We recommend upgrading immediately due to the severity of the newly disclosed vu
#### The patches published earlier are vulnerable. {/*the-patches-published-earlier-are-vulnerable*/}
-If you already updated for the Critical Security Vulnerability last week, you will need to update again.
+If you already updated for the previous vulnerabilities, you will need to update again.
-If you updated to 19.0.2, 19.1.3, and 19.2.2, [these are incomplete](#additional-fix-published) and you will need to update again.
+If you updated to 19.0.3, 19.1.4, and 19.2.3, [these are incomplete](#additional-fix-published), and you will need to update again.
Please see [the instructions in the previous post](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps.
+-----
+
+_Updated January 26, 2026._
+
Further details of these vulnerabilities will be provided after the rollout of the fixes are complete.
@@ -46,13 +52,13 @@ Further details of these vulnerabilities will be provided after the rollout of t
These vulnerabilities are present in the same packages and versions as [CVE-2025-55182](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components).
-This includes versions 19.0.0, 19.0.1, 19.0.2, 19.1.0, 19.1.1, 19.1.2, 19.1.2, 19.2.0, 19.2.1 and 19.2.2 of:
+This includes 19.0.0, 19.0.1, 19.0.2, 19.0.3, 19.1.0, 19.1.1, 19.1.2, 19.1.3, 19.2.0, 19.2.1, 19.2.2, and 19.2.3 of:
* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)
* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)
* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)
-Fixes were backported to versions 19.0.3, 19.1.4, and 19.2.3. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
+Fixes were backported to versions 19.0.4, 19.1.5, and 19.2.4. If you are using any of the above packages please upgrade to any of the fixed versions immediately.
As before, if your app’s React code does not use a server, your app is not affected by these vulnerabilities. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by these vulnerabilities.
@@ -72,7 +78,7 @@ Additional disclosures can be frustrating, but they are generally a sign of a he
Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: [next](https://www.npmjs.com/package/next), [react-router](https://www.npmjs.com/package/react-router), [waku](https://www.npmjs.com/package/waku), [@parcel/rsc](https://www.npmjs.com/package/@parcel/rsc), [@vite/rsc-plugin](https://www.npmjs.com/package/@vitejs/plugin-rsc), and [rwsdk](https://www.npmjs.com/package/rwsdk).
-Please see [the instructions in the previous post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps.
+Please see [the instructions in the previous post](/blog/2025/12/03/critical-security-vulnerability-in-react-server-components#update-instructions) for upgrade steps.
### Hosting Provider Mitigations {/*hosting-provider-mitigations*/}
@@ -94,29 +100,47 @@ This is required to mitigate the security advisories, but you do not need to upd
See [this issue](https://github.com/facebook/react-native/issues/54772#issuecomment-3617929832) for more information.
-## High Severity: Denial of Service {/*high-severity-denial-of-service*/}
+---
-**CVEs:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) and [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779)
+## High Severity: Multiple Denial of Service {/*high-severity-multiple-denial-of-service*/}
+
+**CVEs:** [CVE-2026-23864](https://www.cve.org/CVERecord?id=CVE-2026-23864)
**Base Score:** 7.5 (High)
+**Date**: January 26, 2025
-Security researchers have discovered that a malicious HTTP request can be crafted and sent to any Server Functions endpoint that, when deserialized by React, can cause an infinite loop that hangs the server process and consumes CPU. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
+Security researchers discovered additional DoS vulnerabilities still exist in React Server Components.
-This creates a vulnerability vector where an attacker may be able to deny users from accessing the product, and potentially have a performance impact on the server environment.
+The vulnerabilities are triggered by sending specially crafted HTTP requests to Server Function endpoints, and could lead to server crashes, out-of-memory exceptions or excessive CPU usage; depending on the vulnerable code path being exercised, the application configuration and application code.
-The patches published today mitigate by preventing the infinite loop.
+The patches published January 26th mitigate these DoS vulnerabilities.
-#### Additional fix published {/*additional-fix-published*/}
+#### Additional fixes published {/*additional-fix-published*/}
The original fix addressing the DoS in [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) was incomplete.
-This left versions 19.0.2, 19.1.3, 19.2.2 vulnerable. Versions 19.0.3, 19.1.4, 19.2.3 are safe.
+This left previous versions vulnerable. Versions 19.0.4, 19.1.5, 19.2.4 are safe.
+
+-----
-We've fixed the additional cases and filed [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779) for the vulnerable versions.
+_Updated January 26, 2026._
+---
+
+## High Severity: Denial of Service {/*high-severity-denial-of-service*/}
+
+**CVEs:** [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184) and [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779)
+**Base Score:** 7.5 (High)
+
+Security researchers have discovered that a malicious HTTP request can be crafted and sent to any Server Functions endpoint that, when deserialized by React, can cause an infinite loop that hangs the server process and consumes CPU. Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
+
+This creates a vulnerability vector where an attacker may be able to deny users from accessing the product, and potentially have a performance impact on the server environment.
+
+The patches published today mitigate by preventing the infinite loop.
+
## Medium Severity: Source Code Exposure {/*low-severity-source-code-exposure*/}
**CVE:** [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183)
@@ -170,9 +194,9 @@ Always verify against production bundles.
* **December 11th**: Additional DoS reported to [Meta Bug Bounty](https://bugbounty.meta.com/) by Shinsaku Nomura.
* **December 11th**: Patches published and publicly disclosed as [CVE-2025-55183](https://www.cve.org/CVERecord?id=CVE-2025-55183) and [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).
* **December 11th**: Missing DoS case found internally, patched and publicly disclosed as [CVE-2025-67779](https://www.cve.org/CVERecord?id=CVE-2025-67779).
-
+* **January 26th**: Additional DoS cases found, patched, and publicly disclosed as [CVE-2026-23864](https://www.cve.org/CVERecord?id=CVE-2026-23864).
---
## Attribution {/*attribution*/}
-Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc and Shinsaku Nomura of Bitforest Co., Ltd. for reporting the Denial of Service vulnerabilities.
+Thank you to [Andrew MacPherson (AndrewMohawk)](https://github.com/AndrewMohawk) for reporting the Source Code Exposure, [RyotaK](https://ryotak.net) from GMO Flatt Security Inc and Shinsaku Nomura of Bitforest Co., Ltd. for reporting the Denial of Service vulnerabilities. Thank you to [Mufeed VH](https://x.com/mufeedvh) from [Winfunc Research](https://winfunc.com), [Joachim Viide](https://jviide.iki.fi), [RyotaK](https://ryotak.net) from [GMO Flatt Security Inc](https://flatt.tech/en/) and Xiangwei Zhang of Tencent Security YUNDING LAB for reporting the additional DoS vulnerabilities.
From 303e6b4c6dd835c83583410e04e5613f560004bc Mon Sep 17 00:00:00 2001
From: Ricky
Date: Tue, 27 Jan 2026 10:22:10 -0500
Subject: [PATCH 22/35] Init claude config (#8265)
---
.claude/agents/docs-reviewer.md | 77 +++
.claude/docs/react-docs-patterns.md | 637 ++++++++++++++++++
.claude/settings.json | 26 +
.claude/skills/docs-components/SKILL.md | 142 ++++
.claude/skills/docs-sandpack/SKILL.md | 315 +++++++++
.claude/skills/docs-writer-learn/SKILL.md | 66 ++
.claude/skills/docs-writer-reference/SKILL.md | 117 ++++
.gitignore | 3 +
CLAUDE.md | 52 ++
9 files changed, 1435 insertions(+)
create mode 100644 .claude/agents/docs-reviewer.md
create mode 100644 .claude/docs/react-docs-patterns.md
create mode 100644 .claude/settings.json
create mode 100644 .claude/skills/docs-components/SKILL.md
create mode 100644 .claude/skills/docs-sandpack/SKILL.md
create mode 100644 .claude/skills/docs-writer-learn/SKILL.md
create mode 100644 .claude/skills/docs-writer-reference/SKILL.md
create mode 100644 CLAUDE.md
diff --git a/.claude/agents/docs-reviewer.md b/.claude/agents/docs-reviewer.md
new file mode 100644
index 000000000..6d769cb6f
--- /dev/null
+++ b/.claude/agents/docs-reviewer.md
@@ -0,0 +1,77 @@
+---
+name: docs-reviewer
+description: "Use after editing docs to review changes. Orchestrates docs-writer-learn, docs-writer-reference, docs-components, and docs-sandpack skills to validate structure, components, and style"
+model: opus
+color: cyan
+---
+
+# React Documentation Reviewer Agent
+
+You are an expert reviewer for React documentation. Your role is to validate documentation changes for consistency, correctness, and adherence to established patterns.
+
+## Available Skills
+
+You have access to specialized skills that define the authoritative patterns for React docs. **Always invoke the relevant skills** to get the current patterns:
+
+| Skill | When to Use |
+|-------|-------------|
+| `docs-writer-learn` | Reviewing files in `src/content/learn/` |
+| `docs-writer-reference` | Reviewing files in `src/content/reference/` |
+| `docs-components` | Validating MDX components (DeepDive, Pitfall, Note, Recipes, Challenges) |
+| `docs-sandpack` | Validating interactive code examples |
+
+## Review Process
+
+1. **Identify changed files** - Check git status or read the files to review
+2. **Determine document type** based on path:
+ - `src/content/learn/**` → Invoke `docs-writer-learn`
+ - `src/content/reference/**` → Invoke `docs-writer-reference`
+3. **Invoke component skills** for any MDX components or Sandpack examples in the file
+4. **Read the patterns reference** at `.claude/docs/react-docs-patterns.md` for comprehensive details
+5. **Validate against each skill's requirements**
+6. **Run verification commands**
+7. **Report issues with specific line numbers and fixes**
+
+## Verification Commands
+
+These commands can help identify issues (user may run manually):
+
+```bash
+yarn lint-heading-ids # Check heading ID format
+yarn lint # Check for ESLint issues
+yarn deadlinks # Check for broken links
+```
+
+## Issue Reporting Format
+
+```
+## Documentation Review Results
+
+### Errors (must fix)
+- **Line 45**: Missing heading ID. Change `## Events` to `## Events {/*events*/}`
+- **Line 78**: `` missing `####` heading as first child
+
+### Warnings (recommended)
+- **Line 23**: Capitalize "effect" to "Effect" when referring to the React concept
+
+### Summary
+- Errors: X
+- Warnings: Y
+- Status: PASS | BLOCKED (fix errors before committing)
+```
+
+## Key Validation Points
+
+These are quick checks - see the skills for full details:
+
+### All Documents
+- All `##`, `###`, `####` headings have explicit IDs: `{/*lowercase-with-hyphens*/}`
+- React terms capitalized: Hook, Effect, State, Context, Ref, Component
+- Uses "you" to address the reader
+- No time estimates ("quick", "simple", "easy")
+- Internal links use relative paths (`/learn/...`, `/reference/...`)
+
+### Invoke Skills For
+- **Structure validation** → `docs-writer-learn` or `docs-writer-reference`
+- **Component usage** → `docs-components`
+- **Code examples** → `docs-sandpack`
diff --git a/.claude/docs/react-docs-patterns.md b/.claude/docs/react-docs-patterns.md
new file mode 100644
index 000000000..f8df03d0b
--- /dev/null
+++ b/.claude/docs/react-docs-patterns.md
@@ -0,0 +1,637 @@
+# React Documentation Patterns Reference
+
+Comprehensive reference for React documentation patterns. Use this when writing or reviewing docs.
+
+---
+
+## Document Templates
+
+### Learn Page Template (`src/content/learn/`)
+
+```mdx
+---
+title: Your Page Title
+---
+
+
+
+Opening paragraph introducing the topic. Use *italics* for new terms being defined. Keep it to 1-2 sentences that hook the reader.
+
+
+
+
+
+* Bullet point of what reader will learn
+* Another learning outcome
+* Keep to 3-5 items
+
+
+
+## First Section {/*first-section*/}
+
+Content with examples...
+
+
+
+* Summary bullet of key point
+* Another summary point
+
+
+
+
+
+#### Challenge Title {/*challenge-id*/}
+
+Challenge description...
+
+
+{/* problem code */}
+
+
+
+
+Explanation and solution...
+
+
+{/* solution code */}
+
+
+
+
+
+```
+
+### Reference Page Template (`src/content/reference/`)
+
+```mdx
+---
+title: hookName
+---
+
+
+
+`hookName` is a React Hook that lets you [brief description].
+
+\`\`\`js
+const result = hookName(arg)
+\`\`\`
+
+
+
+
+
+---
+
+## Reference {/*reference*/}
+
+### `hookName(arg)` {/*hookname*/}
+
+Call `hookName` at the top level of your component to...
+
+\`\`\`js
+import { hookName } from 'react';
+
+function MyComponent() {
+ const result = hookName(initialValue);
+ // ...
+\`\`\`
+
+[See more examples below.](#usage)
+
+#### Parameters {/*parameters*/}
+
+* `arg`: Description of the parameter.
+
+#### Returns {/*returns*/}
+
+Description of return value.
+
+#### Caveats {/*caveats*/}
+
+* Caveat about usage.
+* Another important caveat.
+
+---
+
+## Usage {/*usage*/}
+
+### Common Use Case {/*common-use-case*/}
+
+Explanation with examples...
+
+---
+
+## Troubleshooting {/*troubleshooting*/}
+
+### Common Problem {/*common-problem*/}
+
+How to solve it...
+```
+
+---
+
+## Tone & Voice Guidelines
+
+### Learn Pages
+- Conversational, friendly
+- Address the reader as "you"
+- "Here's what that looks like..."
+- "You might be wondering..."
+- "Let's see how this works..."
+
+### Reference Pages
+- Precise, technical
+- Still use "you" but more direct
+- "Call `useState` at the top level..."
+- "This Hook returns..."
+
+### Universal Rules
+- **Capitalize React terms:** Hook, Effect, State, Context, Ref, Component, Transition
+- **Capitalize:** Server Component, Client Component, Server Action, Error Boundary, Suspense
+- **Use proper product names:** ESLint, TypeScript, JavaScript (not lowercase)
+- **Use bold** for key concepts: **state variable**, **event handler**
+- **Use italics** for new terms being defined: *event handlers*
+- Avoid "simple", "easy", "just" - these can be dismissive
+- Prefer concrete examples over abstract explanations
+- No time estimates ("quick", "takes X minutes")
+- Frame feature differences as "capabilities" not "advantages/disadvantages"
+- Avoid passive voice and jargon
+
+### Avoiding Jargon
+
+React docs explain technical concepts in plain language. Follow these patterns:
+
+**Don't use CS jargon without explanation:**
+- ❌ "State updates are atomic"
+- ✅ "React waits until all state updates are done before re-rendering"
+
+- ❌ "Components must be idempotent"
+- ✅ "Given the same inputs, a component always returns the same output"
+
+- ❌ "Rendering must be deterministic"
+- ✅ "React expects the same inputs to produce the same result"
+
+**Terms to avoid or always explain:**
+- "atomic" → describe what actually happens (all-or-nothing, batched together)
+- "idempotent" → "same inputs, same output"
+- "deterministic" → "predictable", "same result every time"
+- "memoize/memoization" → "remember the result", "skip recalculating"
+- "referentially transparent" → avoid entirely, explain the behavior
+- "invariant" → "rule that must always be true", "requirement"
+- "reify" → avoid entirely, describe what's being created
+
+**Use analogies the docs already establish:**
+- Rendering = preparing food in a kitchen
+- Committing = placing the order on the table
+- Batching = waiter collecting the full order before going to kitchen
+- State = snapshot/photograph at a moment in time
+- Pure functions = math formulas (y = 2x always gives same result)
+
+**Pattern: Explain behavior, then name it**
+```markdown
+React waits until all code in the event handlers has run before
+processing your state updates. This is called *batching*.
+```
+
+Not:
+```markdown
+React uses batching to process state updates atomically.
+```
+
+---
+
+## Code Style Rules (Enforced in PR Review)
+
+These rules are strictly enforced during PR review:
+
+### Component Definitions
+```js
+// ✅ Correct - function declaration
+function MyInput({ value, onChange, ref }) {
+ return ;
+}
+export default MyInput;
+
+// 🚫 Wrong - arrow function for component
+const MyInput = ({ value, onChange, ref }) => {
+ return ;
+};
+```
+
+### Event Handlers
+```js
+// ✅ Correct - use 'e' for event parameter
+
diff --git a/src/components/Layout/TopNav/TopNav.tsx b/src/components/Layout/TopNav/TopNav.tsx
index 148098933..efc90ed2c 100644
--- a/src/components/Layout/TopNav/TopNav.tsx
+++ b/src/components/Layout/TopNav/TopNav.tsx
@@ -29,7 +29,6 @@ import {IconHamburger} from 'components/Icon/IconHamburger';
import {IconSearch} from 'components/Icon/IconSearch';
import {Search} from 'components/Search';
import {Logo} from '../../Logo';
-import {Feedback} from '../Feedback';
import {SidebarRouteTree} from '../Sidebar';
import type {RouteItem} from '../getRouteMeta';
import {siteConfig} from 'siteConfig';
@@ -448,9 +447,6 @@ export default function TopNav({
-
-
-
)}
diff --git a/src/styles/index.css b/src/styles/index.css
index 6b2915be4..7bdf4c765 100644
--- a/src/styles/index.css
+++ b/src/styles/index.css
@@ -741,13 +741,6 @@ ol.mdx-illustration-block {
}
}
-.exit {
- opacity: 0;
- transition: opacity 500ms ease-out;
- transition-delay: 1s;
- pointer-events: none;
-}
-
.uwu-visible {
display: none;
}
From a2a19bae5f3ea54496915979fcfd01a9738d07c3 Mon Sep 17 00:00:00 2001
From: Joseph
Date: Wed, 28 Jan 2026 21:48:01 +0100
Subject: [PATCH 27/35] feat: Add Accept header content negotiation for
markdown (#8272)
---
next.config.js | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/next.config.js b/next.config.js
index c9dc3ead8..7580eb944 100644
--- a/next.config.js
+++ b/next.config.js
@@ -21,6 +21,20 @@ const nextConfig = {
},
async rewrites() {
return [
+ // Serve markdown when Accept header prefers text/markdown
+ // Useful for LLM agents - https://www.skeptrune.com/posts/use-the-accept-header-to-serve-markdown-instead-of-html-to-llms/
+ {
+ source: '/:path*',
+ has: [
+ {
+ type: 'header',
+ key: 'accept',
+ value: '(.*text/markdown.*)',
+ },
+ ],
+ destination: '/api/md/:path*',
+ },
+ // Explicit .md extension also serves markdown
{
source: '/:path*.md',
destination: '/api/md/:path*',
From ec13a90a368d7eb64fca34b96bd595f7e9c4c595 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yadiel=20V=C3=A9lez?=
<16180439+hernan-yadiel@users.noreply.github.com>
Date: Thu, 29 Jan 2026 11:23:10 -0500
Subject: [PATCH 28/35] remove outdated note about streaming ssr (#8277)
---
src/content/reference/react/ViewTransition.md | 2 --
1 file changed, 2 deletions(-)
diff --git a/src/content/reference/react/ViewTransition.md b/src/content/reference/react/ViewTransition.md
index acf59ac38..9f451eddc 100644
--- a/src/content/reference/react/ViewTransition.md
+++ b/src/content/reference/react/ViewTransition.md
@@ -1052,8 +1052,6 @@ Just like any Transition, React waits for data and new CSS (`
@@ -18,24 +18,18 @@ title: useOptimistic
## Reference {/*reference*/}
-### `useOptimistic(state, updateFn)` {/*use*/}
+### `useOptimistic(value, reducer?)` {/*useoptimistic*/}
-`useOptimistic` is a React Hook that lets you show a different state while an async action is underway. It accepts some state as an argument and returns a copy of that state that can be different during the duration of an async action such as a network request. You provide a function that takes the current state and the input to the action, and returns the optimistic state to be used while the action is pending.
-
-This state is called the "optimistic" state because it is usually used to immediately present the user with the result of performing an action, even though the action actually takes time to complete.
+Call `useOptimistic` at the top level of your component to create optimistic state for a value.
```js
import { useOptimistic } from 'react';
-function AppContainer() {
- const [optimisticState, addOptimistic] = useOptimistic(
- state,
- // updateFn
- (currentState, optimisticValue) => {
- // merge and return new state
- // with optimistic value
- }
- );
+function MyComponent({name, todos}) {
+ const [optimisticAge, setOptimisticAge] = useOptimistic(28);
+ const [optimisticName, setOptimisticName] = useOptimistic(name);
+ const [optimisticTodos, setOptimisticTodos] = useOptimistic(todos, todoReducer);
+ // ...
}
```
@@ -43,89 +37,1047 @@ function AppContainer() {
#### Parameters {/*parameters*/}
-* `state`: the value to be returned initially and whenever no action is pending.
-* `updateFn(currentState, optimisticValue)`: a function that takes the current state and the optimistic value passed to `addOptimistic` and returns the resulting optimistic state. It must be a pure function. `updateFn` takes in two parameters. The `currentState` and the `optimisticValue`. The return value will be the merged value of the `currentState` and `optimisticValue`.
-
+* `value`: The value returned when there are no pending Actions.
+* **optional** `reducer(currentState, action)`: The reducer function that specifies how the optimistic state gets updated. It must be pure, should take the current state and reducer action arguments, and should return the next optimistic state.
#### Returns {/*returns*/}
-* `optimisticState`: The resulting optimistic state. It is equal to `state` unless an action is pending, in which case it is equal to the value returned by `updateFn`.
-* `addOptimistic`: `addOptimistic` is the dispatching function to call when you have an optimistic update. It takes one argument, `optimisticValue`, of any type and will call the `updateFn` with `state` and `optimisticValue`.
+`useOptimistic` returns an array with exactly two values:
+
+1. `optimisticState`: The current optimistic state. It is equal to `value` unless an Action is pending, in which case it is equal to the state returned by `reducer` (or the value passed to the set function if no `reducer` was provided).
+2. The [`set` function](#setoptimistic) that lets you update the optimistic state to a different value inside an Action.
+
+---
+
+### `set` functions, like `setOptimistic(optimisticState)` {/*setoptimistic*/}
+
+The `set` function returned by `useOptimistic` lets you update the state for the duration of an [Action](reference/react/useTransition#functions-called-in-starttransition-are-called-actions). You can pass the next state directly, or a function that calculates it from the previous state:
+
+```js
+const [optimisticLike, setOptimisticLike] = useOptimistic(false);
+const [optimisticSubs, setOptimisticSubs] = useOptimistic(subs);
+
+function handleClick() {
+ startTransition(async () => {
+ setOptimisticLike(true);
+ setOptimisticSubs(a => a + 1);
+ await saveChanges();
+ });
+}
+```
+
+#### Parameters {/*setoptimistic-parameters*/}
+
+* `optimisticState`: The value that you want the optimistic state to be during an [Action](reference/react/useTransition#functions-called-in-starttransition-are-called-actions). If you provided a `reducer` to `useOptimistic`, this value will be passed as the second argument to your reducer. It can be a value of any type.
+ * If you pass a function as `optimisticState`, it will be treated as an _updater function_. It must be pure, should take the pending state as its only argument, and should return the next optimistic state. React will put your updater function in a queue and re-render your component. During the next render, React will calculate the next state by applying the queued updaters to the previous state similar to [`useState` updaters](/reference/react/useState#setstate-parameters).
+
+#### Returns {/*setoptimistic-returns*/}
+
+`set` functions do not have a return value.
+
+#### Caveats {/*setoptimistic-caveats*/}
+
+* The `set` function must be called inside an [Action](reference/react/useTransition#functions-called-in-starttransition-are-called-actions). If you call the setter outside an Action, [React will show a warning](#an-optimistic-state-update-occurred-outside-a-transition-or-action) and the optimistic state will briefly render.
+
+
+
+#### How optimistic state works {/*how-optimistic-state-works*/}
+
+`useOptimistic` lets you show a temporary value while a Action is in progress:
+
+```js
+const [value, setValue] = useState('a');
+const [optimistic, setOptimistic] = useOptimistic(value);
+
+startTransition(async () => {
+ setOptimistic('b');
+ const newValue = await saveChanges('b');
+ setValue(newValue);
+});
+```
+
+When the setter is called inside an Action, `useOptimistic` will trigger a re-render to show that state while the Action is in progress. Otherwise, the `value` passed to `useOptimistic` is returned.
+
+This state is called the "optimistic" because it is used to immediately present the user with the result of performing an Action, even though the Action actually takes time to complete.
+
+**How the update flows**
+
+1. **Update immediately**: When `setOptimistic('b')` is called, React immediately renders with `'b'`.
+
+2. **(Optional) await in Action**: If you await in the Action, React continues showing `'b'`.
+
+3. **Transition scheduled**: `setValue(newValue)` schedules an update to the real state.
+
+4. **(Optional) wait for Suspense**: If `newValue` suspends, React continues showing `'b'`.
+
+5. **Single render commit**: Finally, the `newValue` is commits for `value` and `optimistic`.
+
+There's no extra render to "clear" the optimistic state. The optimistic and real state converge in the same render when the Transition completes.
+
+
+
+#### Optimistic state is temporary {/*optimistic-state-is-temporary*/}
+
+Optimistic state is only renders while an Action is in progress, otherwise `value` is rendered.
+
+If `saveChanges` returned `'c'`, then both `value` and `optimistic` will be `'c'`, not `'b'`.
+
+
+
+**How the final state is determined**
+
+The `value` argument to `useOptimistic` determines what displays after the Action finishes. How this works depends on the pattern you use:
+
+- **Hardcoded values** like `useOptimistic(false)`: After the Action, `state` is still `false`, so the UI shows `false`. This is useful for pending states where you always start from `false`.
+
+- **Props or state passed in** like `useOptimistic(isLiked)`: If the parent updates `isLiked` during the Action, the new value is used after the Action completes. This is how the UI reflects the result of the Action.
+
+- **Reducer pattern** like `useOptimistic(items, fn)`: If `items` changes while the Action is pending, React re-runs your `reducer` with the new `items` to recalculate the state. This keeps your optimistic additions on top of the latest data.
+
+**What happens when the Action fails**
+
+If the Action throws an error, the Transition still ends, and React renders with whatever `value` currently is. Since the parent typically only updates `value` on success, a failure means `value` hasn't changed, so the UI shows what it showed before the optimistic update. You can catch the error to show a message to the user.
+
+
---
## Usage {/*usage*/}
-### Optimistically updating forms {/*optimistically-updating-with-forms*/}
+### Adding optimistic state to a component {/*adding-optimistic-state-to-a-component*/}
+
+Call `useOptimistic` at the top level of your component to declare one or more optimistic states.
+
+```js [[1, 4, "age"], [1, 5, "name"], [1, 6, "todos"], [2, 4, "optimisticAge"], [2, 5, "optimisticName"], [2, 6, "optimisticTodos"], [3, 4, "setOptimisticAge"], [3, 5, "setOptimisticName"], [3, 6, "setOptimisticTodos"], [4, 6, "reducer"]]
+import { useOptimistic } from 'react';
+
+function MyComponent({age, name, todos}) {
+ const [optimisticAge, setOptimisticAge] = useOptimistic(age);
+ const [optimisticName, setOptimisticName] = useOptimistic(name);
+ const [optimisticTodos, setOptimisticTodos] = useOptimistic(todos, reducer);
+ // ...
+```
+
+`useOptimistic` returns an array with exactly two items:
+
+1. The optimistic state, initially set to the value provided.
+2. The set function that lets you temporarily change the state during an [Action](reference/react/useTransition#functions-called-in-starttransition-are-called-actions).
+ * If a reducer is provided, it will run before returning the optimistic state.
+
+To use the optimistic state, call the `set` function inside an Action.
+
+Actions are functions called inside `startTransition`:
+
+```js {3}
+function onAgeChange(e) {
+ startTransition(async () => {
+ setOptimisticAge(42);
+ const newAge = await postAge(42);
+ setAge(newAge);
+ });
+}
+```
+
+React will render the optimistic state `42` first while the `age` remains the current age. The Action waits for POST, and then renders the `newAge` for both `age` and `optimisticAge`.
+
+See [How optimistic state works](#how-optimistic-state-works) for a deep dive.
+
+
+
+When using [Action props](/reference/react/useTransition#exposing-action-props-from-components), you can call the set function without `startTransition`:
+
+```js [[3, 2, "setOptimisticName"]]
+async function submitAction() {
+ setOptimisticName('Taylor');
+ await updateName('Taylor');
+}
+```
+
+This works because Action props are already called inside `startTransition`.
+
+For an example, see: [Using optimistic state in Action props](#using-optimistic-state-in-action-props).
+
+
+
+---
+
+### Using optimistic state in Action props {/*using-optimistic-state-in-action-props*/}
+
+In an [Action prop](/reference/react/useTransition#exposing-action-props-from-components), you can call the optimistic setter directly without `startTransition`.
+
+This example sets optimistic state inside a `