chore(deps): update react to ^19.3.0

[thomhurst]

This PR contains the following updates:

Package	Type	Update	Change
react (source)	dependencies	minor	^19.2.8 → ^19.3.0
react-dom (source)	dependencies	minor	^19.2.8 → ^19.3.0

---

Release Notes

react/react (react)

v19.3.0

Compare Source

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #​31975, #​31987, #​31996, #​31999, #​32001, #​32002, #​32028, #​32029, #​32031, #​32034, #​32038, #​32041, #​32050, #​32090, #​32105, #​32254, #​32379, #​32422, #​32462, #​32540, #​32545, #​32585, #​32599, #​32611, #​32612, #​32617, #​32651, #​32653, #​32656, #​32664, #​32699, #​32723, #​32734, #​32751, #​32752, #​32760, #​32761, #​32764, #​32772, #​32790, #​32819, #​32820, #​32822, #​32833, #​32849, #​33094, #​33191, #​33200, #​33206, #​33293, #​33330, #​33331, #​33332, #​33357, #​33362, #​33433, #​33576, #​34374, #​34450, #​34481, #​34500, #​34502, #​34510, #​34511, #​34539, #​35567, #​35564, #​35485, #​35380, #​35063, #​35060, #​34676, #​36917, #​35337, #​35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #​32465, #​32613, #​32619, #​32654, #​32660, #​32682, #​32722, #​32813, #​32814, #​33056, #​33058, #​33093, #​34069, #​34103, #​34544, #​34545, #​37062, #​37061, #​37060, #​36047, #​36010, #​35642, #​35641, #​35637, #​35630, #​34935, #​37457, #​37408, #​37326, #​37251, #​37171, #​37169, #​37168, #​37167, #​37166, #​37165, #​37164, #​37163, #​37162, #​37161, #​37160, #​37125, #​37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #​37143, #​37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #​37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #​35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #​37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #​36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #​36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #​36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #​36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #​36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #​35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #​35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #​35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #​35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #​35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #​36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #​34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #​34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #​34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #​36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #​35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #​34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #​35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #​34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #​35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #​37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #​37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #​37113)
• Only remove properties from Host Singletons on release (@​gnoff #​37112)
• Don't invoke effects on moved children in StrictMode (@​sophiebits #​36948)
• Throw a clearer error when a rejected Promise is incorrectly instrumented (@​eps1lon #​36328)
• Fix context propagation into Suspense fallbacks (@​acdlite #​36160)
• Fix context propagation through suspended Suspense boundaries (@​acdlite #​35839)
• Fix useDeferredValue getting stuck (@​gaearon #​36134)
• Update useActionState error message to say "action state" instead of "form state" (@​rickhanlonii #​35790)
• Don't warn when rendering data block scripts (@​eps1lon #​35953)
• Treat fibers with alternates as mounted in getNearestMountedFiber (@​sebmarkbage #​35578)
• Always instrument the lazy initializer thenable (@​gnoff #​35521)
• Annotate cascading updates for DevTools performance tracks in DEV (@​huntie #​34961)
• Resolve the .default export of a React.lazy as the canonical value (@​sebmarkbage #​34906)
• Limit owner stacks to 10 frames (@​eps1lon #​34864)
• Ensure useEffectEvent reads latest values in forwardRef and memo() components (@​eps1lon #​34831)

React DOM

• Copy source onto the synthetic toggle event (@​lazerg #​37389)
• Update HTML parser rules for the new <select> parser (@​josepharhar #​34804)
• Update defaultValue for type="number" inputs to match other input types (@​sophiebits #​36980)
• Avoid setting innerHTML when it hasn't changed (@​sophiebits #​36949)
• Forward the nonce option in ReactDOM.preloadModule() (@​UditDewan #​36851)
• Support fetchPriority for module resources (@​TheAlexLichter #​36835)
• Track stylesheet preloads when explicitly preloaded to avoid unnecessary suspension (@​gnoff #​36386)
• Suggest correct casing for the misspelled credentialless iframe attribute (@​vmx906 #​36322)
• Add credentialless as a recognized boolean attribute for iframes (@​vmx906 #​36148)
• Prevent reentrant finishedTask from calling completeAll multiple times (@​gnoff #​36287)
• Update the CSS shorthand property list (@​kidonng #​35636)
• Support the maskType SVG prop (@​sleitor #​35921)
• Add support for onFullscreenChange and onFullscreenError events (@​chirokas #​34621)
• Include submitter in submit events (@​eps1lon #​35590)
• Fire onReset when automatically resetting forms (@​eps1lon #​35176)
• Use the FormData submitter parameter (@​jenseng #​29028)
• Fix form status reset when component state is updated (@​eps1lon #​34075)
• Batch updates from resize events until the next frame (@​eps1lon #​35117)

React Server

• Add nonce to rendered import maps (@​mattcosta7 #​37339)
• Add an onBrowserBailout option to observe subtrees that defer to the browser (@​gnoff #​37193)
• Stop the caller's signal from retaining a finished render (@​unstubbable #​37315)
• Construct the render lifetime controller only when it is needed (@​unstubbable #​37357)
• Fix react-dom/server hanging on Deno (@​fraidev #​35235)
• Extend stack overflow recovery to retries in SSR (@​jackpope #​36977)
• Fix false-positive hydration mismatch on nonce attributes (@​MaxwellCohen #​37030)
• Guard shell-error callbacks instead of nulling them out on the request (@​eps1lon #​36916)
• Stop firing onAllReady after the shell errored (@​eps1lon #​36903)
• Treat an incomplete tree as an error during error recovery (@​acdlite #​36911)
• Fix non-script modulepreload tracking (@​fallintoplace #​36564)
• Finalize postponed nextSegmentId after the prelude flush (@​gaojude #​36779)
• Preserve referrerPolicy in image preload headers (@​ulises-jeremias #​36803)
• Allow pending work to specialize abort reasons (@​gnoff #​36586)
• Abort tasks that suspend after aborting during render (@​gnoff #​36585)
• Finish abort in a scheduled task (@​gnoff #​36580)
• Fix aborts during resumed rendering (@​gnoff #​36584)
• Track abort state on the request (@​gnoff #​36583)
• Model external work scheduling explicitly in the fb bundle (@​gnoff #​36576)
• Continue reporting aborted task errors after a fatal abort (@​gnoff #​36575)
• Disallow abort reentrancy (@​gnoff #​36574)
• Stop transpiling computed property names (@​eps1lon #​36542)
• Fix crash when capturing the callsite of a stalled use() of a rejected Flight chunk (@​lubieowoce #​36544)
• Double invoke effects in Strict Mode during hydration (@​eps1lon #​35961)
• Add additional task reentrancy protections in Fizz (@​gnoff #​36291)
• Don't outline Suspense boundaries with suspensey CSS during shell flush (@​gnoff #​35824)
• Push a stalled use() to the owner stack and debug task (@​eps1lon #​35226)
• Fix useId tracking on replay (@​gnoff #​35518)
• Correctly handle replaying when hydrating (@​gnoff #​35494)
• Simplify the createSuspenseBoundary path (@​sebmarkbage #​35087)
• Unify preamble-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35068)
• Unify prerender-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35067)
• Push halted awaits to the owner stack for late-arriving I/O info (@​unstubbable #​35019)
• Include all Node.js APIs in the Bun entrypoint for react-dom/server (@​RiskyMH #​34193)
• Detach a Suspense boundary after flushing its segment (@​gnoff #​34694)

React Server Components

• Keep an element pending while a referenced row is resolving (@​unstubbable #​37542)
• Fix RangeError from exponential debug info growth (@​unstubbable #​37481)
• Abort the cache signal when debug objects are retained (@​unstubbable #​37342)
• Transfer key validation of lazy nodes when they are unwrapped (@​unstubbable #​37258)
• Add pending_weak to the Flight thenable protocol (@​acdlite #​37154)
• Outline and dedupe repeated strings (@​gaearon #​37147)
• Port Reply Server traversal guards to the Flight Client (@​eps1lon #​37144)
• Define Flight chunk .then with Object.defineProperty (@​eps1lon #​37109)
• Support Turbopack's experimental array format for chunks (@​sampoder #​37095)
• Limit fake JSX call site stacks to 10 frames (@​timneutkens #​37086)
• Improve performance when decoding Flight replies (@​gnoff #​37090)
• Recognize Node 22+ V8 frames for Promise statics in debug info (@​gaearon #​36969)
• Tailor the warning for binary data serialized through toJSON (Node Buffer) (@​unstubbable #​36873)
• Resolve models before JSON.stringify for faster serialization (@​mhart #​36795)
• Prune debug info when chunks error (@​gnoff #​36782)
• Avoid main-thread stalls from large debug strings (@​unstubbable #​36570)
• Fix stranded row content under Node stream backpressure (@​unstubbable #​36516)
• Fix dropped FormData entries in decodeReplyFromBusboy (@​unstubbable #​36468)
• Harden types and improve performance of Flight replies (@​eps1lon #​36425)
• Add more cycle protections to Flight replies (@​eps1lon #​36236)
• Transport AggregateError.errors (@​eps1lon #​36156)
• Bail out early when a backing entry for Blob deserialization is not a Blob (@​eps1lon #​36055)
• Clear chunk reason after successful module initialization (@​unstubbable #​36024)
• Add support for transporting Error.cause (@​eps1lon #​35810)
• Walk parsed JSON instead of using a reviver for faster RSC payload parsing (@​timneutkens #​35776)
• Skip transferReferencedDebugInfo during debug info resolution (@​unstubbable #​35795)
• Add unstable_allowPartialStream option to Flight Client (@​unstubbable #​35731)
• Fix encodeReply for JSX with temporary references (@​unstubbable #​35730)
• Fix debug channel flag in Node.js renderToPipeableStream (@​feedthejim #​35724)
• Fix stack overflow in visitAsyncNode with deep async chains (@​unstubbable #​35612)
• Allow Server Components to render context providers from client modules (@​rickhanlonii #​35675)
• Allow overriding request.timeOrigin via options.startTime (@​lubieowoce #​35598)
• Warn once if eval is disabled in the dev environment (@​eps1lon #​35661)
• Restore original function name in dev server callstacks served with unsafe-eval (@​eps1lon #​35650)
• Fix react-markup types for server references (@​eps1lon #​35634)
• Add more DoS mitigations to Flight replies and harden Flight (@​unstubbable #​35632)
• Allow cyclic references to be serialized when unwrapping lazy elements (@​unstubbable #​35471)
• Improve cyclic thenable detection in Flight reply server (@​cvan20191 #​35369)
• Add extra loop protection to Flight reply server (@​sebmarkbage #​35351)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage #​35345)
• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Never parse then functions in Flight replies (@​sebmarkbage #​35289)
• Patch Flight reply server with fixes from Flight Client (@​sebmarkbage #​35277)
• Complete the list of Node.js internal Promise awaits (@​eps1lon #​35161)
• Reduce risk of maximum call stack exceeded when emitting async sequences (@​eps1lon #​35159)
• Fix pending chunks count for streams and async iterables in DEV (@​unstubbable #​35143)
• Fix broken byte stream parsing caused by buffer detachment (@​unstubbable #​35127)
• Fix hasReadable flag in Node.js clients' debug channel (@​unstubbable #​35039)
• Fix debug info filtering to include later resolved I/O (@​unstubbable #​35036)
• Cache the value when visiting the same I/O or Promise along different paths (@​sebmarkbage #​35005)
• Clone subsequent I/O nodes when resolved more than once (@​sebmarkbage #​35003)
• Fix hang after resolving cyclic references (@​unstubbable #​34988)
• Allow passing DEV-only startTime as an option (@​sebmarkbage #​34912)
• Ignore bound-anonymous-fn resources as they're not considered I/O (@​sebmarkbage #​34911)
• Fix detached ArrayBuffer error when streaming typed arrays (@​unstubbable #​34849)
• Exclude RSC stream if the stream resolves in a task (@​sebmarkbage #​34838)
• Forward the current environment when forwarding I/O entries (@​sebmarkbage #​34836)
• Look for moved debug info when logging component performance track (@​sebmarkbage #​34839)
• Respect displayName of Promise instances on the server (@​sebmarkbage #​34825)
• Avoid unnecessary indirection when serializing debug info (@​unstubbable #​34797)
• Fix preload as attribute for stylesheets (@​unstubbable #​34760)
• Don't serialize toJSON in debug path and omit wide arrays (@​sebmarkbage #​34759)
• Add support for <Activity> (@​eps1lon #​34697)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-09T17:37:16.747567Z	1c17757	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 10f35633-2b1c-43b8-add9-3fbf55df119c

📥 Commits

Reviewing files that changed from the base of the PR and between 5701f53 and 1c17757.

⛔ Files ignored due to path filters (1)

• docs/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• docs/package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The documentation package updates react and react-dom from ^19.2.8 to ^19.3.0.

Changes

Documentation dependencies

Layer / File(s)	Summary
Update React dependency versions docs/package.json	Updates react and react-dom to ^19.3.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 288c2

The documentation package now uses React 19.3.0, with matching locked React and React DOM resolutions. No concrete merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the React dependency update from the changeset.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/react

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the package gate
React hops to version three-oh straight
Two dependencies cross the line
The docs grow fresh and fine
Carrots celebrate the change tonight}

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Updates the documentation site’s React runtime dependencies while keeping the manifest and lockfile synchronized.

• Upgrades React and React DOM from 19.2.8 to 19.3.0.
• Updates the transitive Scheduler package from 0.27.0 to 0.28.0.

Confidence Score: 5/5

The PR appears safe to merge, with the dependency manifest and lockfile consistently updated and no actionable issues identified.

The React and React DOM upgrades are reflected consistently in the Yarn lockfile, including React DOM’s updated Scheduler dependency, and no blocking failure remains.

Important Files Changed

Filename	Overview
docs/package.json	Updates the React and React DOM dependency ranges to 19.3.0.
docs/yarn.lock	Locks React 19.3.0, React DOM 19.3.0, and Scheduler 0.28.0 with matching registry metadata.

_{Reviews (2): Last reviewed commit: "chore(deps): update react to ^19.3.0" | Re-trigger Greptile}