The current React 19 release line receives active security and compatibility fixes. Older React-major lines remain available and are assessed case by case.

Use GitHub private vulnerability reporting. Do not disclose a suspected vulnerability in a public issue before a fix is available.

Include the affected package and React versions, a minimal reproduction, the data trust boundary, and the expected impact. The published package has no runtime dependencies; development-only audit findings are still treated as release blockers for the maintained line.