[Snyk] Upgrade react-dom from 19.2.8 to 19.3.0 by magic-peach · Pull Request #1805 · reframe-oss/reframe

magic-peach · 2026-10-03T10:44:50Z

Snyk has created this PR to upgrade react-dom from 19.2.8 to 19.3.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 205 versions ahead of your current version.
The recommended version was released 24 days ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: react-dom

19.3.0 - 2026-09-09
Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features
- <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@ sebmarkbage, @ jackpope, @ gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
- Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@ jackpope, @ sebmarkbage, @ eps1lon, @ Dhakshin2007, @ chirokas, @ teamleaderleo, @ fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)
New React DOM Features
- browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@ gnoff: #37143, #37241)
  - Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@ gnoff #37193)
Notable changes
- Enable Trusted Types API integration (@ rickhanlonii #35816)
- Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@ acdlite #37290)
- Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@ hoxyq, @ eps1lon: #37104, #37203, #37491)
All Changes

React
- Fast Refresh Fixes
  - Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@ sophiebits #36965)
  - Fix Fast Refresh so edits to a memo() comparison function take effect (@ sophiebits #36964)
  - Fix Fast Refresh crash when an edit changes the kind of a component's type (@ sophiebits #36963)
  - Unify hot reload type resolution for Fast Refresh (@ sophiebits #36962)
  - Fix Fast Refresh to remount correctly when an edit changes the component kind (@ sophiebits #36950)
  - Double invoke effects in StrictMode after Fast Refresh (@ eps1lon #35962)
- Performance Track Fixes
  - Prevent crash when accessing $$typeof in Performance Tracks (@ eps1lon #35679)
  - Handle non-string function names in Performance Tracks (@ eps1lon #35659)
  - Use minus (-) instead of en dash for removed props in Performance Tracks (@ eps1lon #35649)
  - Handle arrays with bigints in deep objects in Performance Tracks (@ eps1lon #35648)
  - Don't enumerate typed array props in Performance Tracks in DEV (@ UditDewan #36913)
  - Bail out of diffing wide objects and arrays in Performance Tracks (@ eps1lon #34742)
  - Clear potentially large performance measures in DEV (@ hoxyq #34803)
  - Fix missing else branch for renders with no props change in Performance Tracks (@ hoxyq #34837)
- Activity Fixes
  - Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@ sophiebits #36947)
  - Hide portal contents when an Activity is hidden (@ acdlite #35091)
  - Prevent metadata hoisting in hidden <Activity> trees (@ ronnakamoto #34983)
  - Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@ acdlite #35074)
  - Don't unhide a node if a direct parent Offscreen is still hidden (@ sebmarkbage #34821)
  - Don't show internal <Offscreen> component in error messages (@ rickhanlonii #35763)
- Warn in DEV when a component appears to have been unblocked by a conditional use() (@ hoxyq, @ eps1lon: #37104, #37203, #37491)
- Render transitions independently instead of entangling them into a single render (@ acdlite #37290)
- Fix hang when updating a dehydrated boundary inside a hidden tree (@ gaearon #37135)
- Don't reacquire Host Singletons during dev effect validation (@ gnoff #37113)
- Only remove properties from Host Singletons on release (@ gnoff #37112)
- Don't invoke effects on moved children in StrictMode (@ sophiebits #36948)
- Throw a clearer error when a rejected Promise is incorrectly instrumented (@ eps1lon #36328)
- Fix context propagation into Suspense fallbacks (@ acdlite #36160)
- Fix context propagation through suspended Suspense boundaries (@ acdlite #35839)
- Fix useDeferredValue getting stuck (@ gaearon #36134)
- Update useActionState error message to say "action state" instead of "form state" (@ rickhanlonii #35790)
- Don't warn when rendering data block scripts (@ eps1lon #35953)
- Treat fibers with alternates as mounted in getNearestMountedFiber (@ sebmarkbage #35578)
- Always instrument the lazy initializer thenable (@ gnoff #35521)
- Annotate cascading updates for DevTools performance tracks in DEV (@ huntie #34961)
- Resolve the .default export of a React.lazy as the canonical value (@ sebmarkbage #34906)
- Limit owner stacks to 10 frames (@ eps1lon #34864)
- Ensure useEffectEvent reads latest values in forwardRef and memo() components (@ eps1lon #34831)
React DOM
- Copy source onto the synthetic toggle event (@ lazerg #37389)
- Update HTML parser rules for the new <select> parser (@ josepharhar #34804)
- Update defaultValue for type="number" inputs to match other input types (@ sophiebits #36980)
- Avoid setting innerHTML when it hasn't changed (@ sophiebits #36949)
- Forward the nonce option in ReactDOM.preloadModule() (@ UditDewan #36851)
- Support fetchPriority for module resources (@ TheAlexLichter #36835)
- Track stylesheet preloads when explicitly preloaded to avoid unnecessary suspension (@ gnoff #36386)
- Suggest correct casing for the misspelled credentialless iframe attribute (@ vmx906 #36322)
- Add credentialless as a recognized boolean attribute for iframes (@ vmx906 #36148)
- Prevent reentrant finishedTask from calling completeAll multiple times (@ gnoff #36287)
- Update the CSS shorthand property list (@ kidonng #35636)
- Support the maskType SVG prop (@ sleitor #35921)
- Add support for onFullscreenChange and onFullscreenError events (@ chirokas #34621)
- Include submitter in submit events (@ eps1lon #35590)
- Fire onReset when automatically resetting forms (@ eps1lon #35176)
- Use the FormData submitter parameter (@ jenseng #29028)
- Fix form status reset when component state is updated (@ eps1lon #34075)
- Batch updates from resize events until the next frame (@ eps1lon #35117)
React Server
- Add nonce to rendered import maps (@ mattcosta7 #37339)
- Add an onBrowserBailout option to observe subtrees that defer to the browser (@ gnoff #37193)
- Stop the caller's signal from retaining a finished render (@ unstubbable #37315)
- Construct the render lifetime controller only when it is needed (@ unstubbable #37357)
- Fix react-dom/server hanging on Deno (@ fraidev #35235)
- Extend stack overflow recovery to retries in SSR (@ jackpope #36977)
- Fix false-positive hydration mismatch on nonce attributes (@ MaxwellCohen #37030)
- Guard shell-error callbacks instead of nulling them out on the request (@ eps1lon #36916)
- Stop firing onAllReady after the shell errored (@ eps1lon #36903)
- Treat an incomplete tree as an error during error recovery (@ acdlite #36911)
- Fix non-script modulepreload tracking (@ fallintoplace #36564)
- Finalize postponed nextSegmentId after the prelude flush (@ gaojude #36779)
- Preserve referrerPolicy in image preload headers (@ ulises-jeremias #36803)
- Allow pending work to specialize abort reasons (@ gnoff #36586)
- Abort tasks that suspend after aborting during render (@ gnoff #36585)
- Finish abort in a scheduled task (@ gnoff #36580)
- Fix aborts during resumed rendering (@ gnoff #36584)
- Track abort state on the request (@ gnoff #36583)
- Model external work scheduling explicitly in the fb bundle (@ gnoff #36576)
- Continue reporting aborted task errors after a fatal abort (@ gnoff #36575)
- Disallow abort reentrancy (@ gnoff

Snyk has created this PR to upgrade react-dom from 19.2.8 to 19.3.0. See this package in npm: react-dom See this project in Snyk: https://app.snyk.io/org/akankshatrehun/project/c7be4db0-e651-4c17-8863-f50a9a61eaca?utm_source=github&utm_medium=referral&page=upgrade-pr

magic-peach · 2026-10-03T10:44:51Z

This is a minor version upgrade that introduces new features and bug fixes without any documented breaking changes. According to React's semantic versioning, breaking changes are reserved for major releases.

Key Additions:

Stable Features: Two previously experimental APIs, <ViewTransition> and Fragment Refs, are now stable and ready for production use.
New React DOM Features: The release adds support for the browser's Trusted Types API to enhance security and introduces a use(browser()) hook to opt components out of server-side rendering.
Bug Fixes: Includes several bug fixes, such as for useDeferredValue, context propagation with Suspense, and a crash related to View Transitions on Mobile Safari.

No migration is required, as all new features are additive.

Source: React 19.3 Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

netlify · 2026-10-03T10:44:55Z

✅ Deploy Preview for reframe-os ready!

Name	Link
🔨 Latest commit	`dfbe08b`
🔍 Latest deploy log	https://app.netlify.com/projects/reframe-os/deploys/6adb2ec94f3479823e4b7706
😎 Deploy Preview	https://deploy-preview-1805--reframe-os.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2026-10-03T10:44:59Z

⚠️ PR Format Issues — @magic-peach

Please fix the following before your PR can be reviewed:

⚠️ Use a conventional PR title. Examples:
- feat: add dark mode support
- fix: resolve aria label missing on slider
- docs: add deployment guide to README
⚠️ No linked issue found. Add Closes #<issue-number> to your PR description.

Push new commits after fixing — this comment will update automatically.

📖 CONTRIBUTING.md

github-actions · 2026-10-03T10:45:01Z

👋 Thanks for your PR, @magic-peach!

Welcome to Reframe — a browser-based video editor built for everyone 🎬

What happens next

🤖 Automated checks — build & TypeScript typecheck will run automatically
✅ Vercel preview — a preview deployment will be created (requires maintainer authorization for fork PRs)
👀 Code review — a maintainer will review your changes
🚀 Merge — once approved, your PR will be merged!

Quick checklist

PR title follows Conventional Commits (e.g. feat: add dark mode)
Linked the issue this PR closes (e.g. Closes #123)
Tested the changes locally (bun run dev)
Build passes (bun run build)