Skip to content

feat(security): update react monorepo to v19 (major) #899

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
renovate wants to merge 1 commit into from
Closed

feat(security): update react monorepo to v19 (major) #899

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions example/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@
"dotenv": "^17.4.1",
"express": "^4.22.1",
"jsonwebtoken": "^9.0.3",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"react": "^19.2.5",
"react-dom": "^19.2.5",
"react-flagpack": "^2.0.6",
"react-syntax-highlighter": "^16.1.1",
"typescript": "^6.0.0"
Expand Down
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,8 +83,8 @@
"dist"
],
"peerDependencies": {
"react": "^18.3.1",
"react-dom": "^18.3.1"
"react": "^19.2.5",
"react-dom": "^19.2.5"
Copy link
Copy Markdown

@cursor cursor Bot Apr 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incompatible react-day-picker v8 with React 19 upgrade

High Severity

The react and react-dom peer dependencies are bumped to ^19.2.5, but react-day-picker remains at ^8.10.1, which only supports React 16, 17, and 18. This will cause peer dependency errors at install time and likely runtime failures in the Calendar component used by DatePickerFieldDefault. The react-day-picker dependency needs to be upgraded to v9 for React 19 compatibility.

Additional Locations (1)
Fix in Cursor Fix in Web

Triggered by project rule: Code Review Guidelines

Reviewed by Cursor Bugbot for commit dd06d07. Configure here.

Copy link
Copy Markdown

@cursor cursor Bot Apr 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Peer dependency range drop breaks React 18 consumers

Medium Severity

The peerDependencies range for react and react-dom changed from ^18.3.1 to ^19.2.5, completely dropping support for React 18. This is a breaking change for all existing consumers of @remoteoss/remote-flows who are on React 18. Per the project rules, this requires a BREAKING CHANGE: conventional commit and a major version bump, but the PR title uses feat instead.

Fix in Cursor Fix in Web

Triggered by project rule: Code Review Guidelines

Reviewed by Cursor Bugbot for commit dd06d07. Configure here.

Copy link
Copy Markdown

@cursor cursor Bot Apr 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incompatible react-flagpack v2 with React 19 upgrade

Medium Severity

react-flagpack@^2.0.6 in dependencies does not declare React 19 in its peer dependencies (only React 16–18). Bumping the library's peerDependencies to ^19.2.5 means consumers installing @remoteoss/remote-flows with React 19 will encounter ERESOLVE peer-dependency conflicts during npm install. The Flag component is used in EstimationResults.tsx within the CostCalculator flow.

Additional Locations (1)
Fix in Cursor Fix in Web

Triggered by project rule: Code Review Guidelines

Reviewed by Cursor Bugbot for commit dd06d07. Configure here.

},
"dependencies": {
"@hookform/resolvers": "^4.1.3",
Expand Down
Loading