From a850973c6f1168b6971ea7c6b6134d1751208f3a Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Wed, 3 Dec 2025 10:03:09 -0800 Subject: [PATCH 1/7] Backport conflicts for PR #10833 to release-v5.0 --- .changeset/old-bulldogs-relate.md | 6 ++++++ packages/react/package.json | 8 ++++++++ packages/rsc/package.json | 2 +- pnpm-lock.yaml | 17 +++++++++++++++++ 4 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 .changeset/old-bulldogs-relate.md diff --git a/.changeset/old-bulldogs-relate.md b/.changeset/old-bulldogs-relate.md new file mode 100644 index 000000000000..22ee75bb77ff --- /dev/null +++ b/.changeset/old-bulldogs-relate.md @@ -0,0 +1,6 @@ +--- +'@ai-sdk/react': patch +'@ai-sdk/rsc': patch +--- + +drop react 19-rc support. Require minimal versions for RSC to address CVE-2025-55182 diff --git a/packages/react/package.json b/packages/react/package.json index f018e0778569..573b30c18ff7 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -47,12 +47,17 @@ "eslint-config-vercel-ai": "workspace:*", "jsdom": "^24.0.0", "msw": "2.6.4", +<<<<<<< HEAD "react-dom": "^18", +======= + "react-dom": "^18 || ^19", +>>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) "tsup": "^7.2.0", "typescript": "5.8.3", "zod": "3.25.76" }, "peerDependencies": { +<<<<<<< HEAD "react": "^18 || ^19 || ^19.0.0-rc", "zod": "^3.25.76 || ^4.1.8" }, @@ -60,6 +65,9 @@ "zod": { "optional": true } +======= + "react": "^18 || ^19" +>>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) }, "engines": { "node": ">=18" diff --git a/packages/rsc/package.json b/packages/rsc/package.json index e213cd6ef8ea..d404884d4446 100644 --- a/packages/rsc/package.json +++ b/packages/rsc/package.json @@ -64,7 +64,7 @@ "zod": "3.25.76" }, "peerDependencies": { - "react": "^18 || ^19 || ^19.0.0-rc", + "react": "^18 || ~19.0.1 || ~19.1.2 || ^19.2.1", "zod": "^3.25.76 || ^4.1.8" }, "peerDependenciesMeta": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 18ad9d0961dd..17ea299ebd77 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -2440,7 +2440,11 @@ importers: specifier: workspace:* version: link:../ai react: +<<<<<<< HEAD specifier: ^18 || ^19 || ^19.0.0-rc +======= + specifier: ^18 || ^19 +>>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) version: 18.3.1 swr: specifier: ^2.2.5 @@ -2454,7 +2458,11 @@ importers: version: 6.6.3 '@testing-library/react': specifier: ^16.0.1 +<<<<<<< HEAD version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.2.0(react@18.3.1))(react@18.3.1) +======= + version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.3.0)(@types/react@18.3.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) +>>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) '@testing-library/user-event': specifier: ^14.5.2 version: 14.5.2(@testing-library/dom@10.4.0) @@ -2483,8 +2491,13 @@ importers: specifier: 2.6.4 version: 2.6.4(@types/node@20.17.24)(typescript@5.8.3) react-dom: +<<<<<<< HEAD specifier: ^18 version: 18.2.0(react@18.3.1) +======= + specifier: ^18 || ^19 + version: 18.3.1(react@18.3.1) +>>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) tsup: specifier: ^7.2.0 version: 7.2.0(postcss@8.5.6)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.8.3))(typescript@5.8.3) @@ -26951,7 +26964,11 @@ snapshots: '@types/react': 18.3.3 '@types/react-dom': 18.3.0 +<<<<<<< HEAD '@testing-library/svelte@5.2.7(svelte@5.32.1)(vite@6.2.7(@types/node@20.17.24)(jiti@2.4.0)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(tsx@4.19.2)(yaml@2.7.0))(vitest@3.0.7(@edge-runtime/vm@5.0.0)(@types/debug@4.1.12)(@types/node@20.17.24)(jiti@2.4.0)(jsdom@26.0.0)(less@4.4.0)(msw@2.7.0(@types/node@20.17.24)(typescript@5.6.3))(sass@1.90.0)(terser@5.43.1)(tsx@4.19.2)(yaml@2.7.0))': +======= + '@testing-library/svelte@5.2.7(svelte@5.32.1)(vite@6.2.7(@types/node@20.17.24)(jiti@2.4.0)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(tsx@4.19.2)(yaml@2.7.0))(vitest@3.0.7(@edge-runtime/vm@5.0.0)(@types/debug@4.1.12)(@types/node@20.17.24)(jiti@2.4.0)(jsdom@26.0.0)(less@4.4.0)(msw@2.7.0(@types/node@20.17.24)(typescript@5.8.3))(sass@1.90.0)(terser@5.43.1)(tsx@4.19.2)(yaml@2.7.0))': +>>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) dependencies: '@testing-library/dom': 10.4.0 svelte: 5.32.1 From ff8ea731e2b692dd9b56bebeff0a95f1eed5187c Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Wed, 3 Dec 2025 10:08:48 -0800 Subject: [PATCH 2/7] resolve conflicts --- packages/react/package.json | 8 ------ packages/rsc/package.json | 2 +- pnpm-lock.yaml | 49 ++++++++++++------------------------- 3 files changed, 17 insertions(+), 42 deletions(-) diff --git a/packages/react/package.json b/packages/react/package.json index 573b30c18ff7..f018e0778569 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -47,17 +47,12 @@ "eslint-config-vercel-ai": "workspace:*", "jsdom": "^24.0.0", "msw": "2.6.4", -<<<<<<< HEAD "react-dom": "^18", -======= - "react-dom": "^18 || ^19", ->>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) "tsup": "^7.2.0", "typescript": "5.8.3", "zod": "3.25.76" }, "peerDependencies": { -<<<<<<< HEAD "react": "^18 || ^19 || ^19.0.0-rc", "zod": "^3.25.76 || ^4.1.8" }, @@ -65,9 +60,6 @@ "zod": { "optional": true } -======= - "react": "^18 || ^19" ->>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) }, "engines": { "node": ">=18" diff --git a/packages/rsc/package.json b/packages/rsc/package.json index d404884d4446..85086ad70ff7 100644 --- a/packages/rsc/package.json +++ b/packages/rsc/package.json @@ -64,7 +64,7 @@ "zod": "3.25.76" }, "peerDependencies": { - "react": "^18 || ~19.0.1 || ~19.1.2 || ^19.2.1", + "react": "^18 || ^19.0.0-rc || ~19.0.1 || ~19.1.2 || ^19.2.1", "zod": "^3.25.76 || ^4.1.8" }, "peerDependenciesMeta": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 17ea299ebd77..5fa00537a2f2 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -2440,15 +2440,11 @@ importers: specifier: workspace:* version: link:../ai react: -<<<<<<< HEAD specifier: ^18 || ^19 || ^19.0.0-rc -======= - specifier: ^18 || ^19 ->>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) - version: 18.3.1 + version: 19.0.0-rc.1 swr: specifier: ^2.2.5 - version: 2.2.5(react@18.3.1) + version: 2.2.5(react@19.0.0-rc.1) throttleit: specifier: 2.1.0 version: 2.1.0 @@ -2458,11 +2454,7 @@ importers: version: 6.6.3 '@testing-library/react': specifier: ^16.0.1 -<<<<<<< HEAD - version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.2.0(react@18.3.1))(react@18.3.1) -======= - version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.3.0)(@types/react@18.3.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) ->>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) + version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@19.0.0-rc.1))(react@19.0.0-rc.1) '@testing-library/user-event': specifier: ^14.5.2 version: 14.5.2(@testing-library/dom@10.4.0) @@ -2491,13 +2483,8 @@ importers: specifier: 2.6.4 version: 2.6.4(@types/node@20.17.24)(typescript@5.8.3) react-dom: -<<<<<<< HEAD specifier: ^18 - version: 18.2.0(react@18.3.1) -======= - specifier: ^18 || ^19 - version: 18.3.1(react@18.3.1) ->>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) + version: 18.3.1(react@19.0.0-rc.1) tsup: specifier: ^7.2.0 version: 7.2.0(postcss@8.5.6)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.8.3))(typescript@5.8.3) @@ -26944,12 +26931,12 @@ snapshots: lodash: 4.17.21 redent: 3.0.0 - '@testing-library/react@16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.2.0(react@18.3.1))(react@18.3.1)': + '@testing-library/react@16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@19.0.0-rc.1))(react@19.0.0-rc.1)': dependencies: '@babel/runtime': 7.25.7 '@testing-library/dom': 10.4.0 - react: 18.3.1 - react-dom: 18.2.0(react@18.3.1) + react: 19.0.0-rc.1 + react-dom: 18.3.1(react@19.0.0-rc.1) optionalDependencies: '@types/react': 18.3.3 '@types/react-dom': 18.2.4 @@ -26964,11 +26951,7 @@ snapshots: '@types/react': 18.3.3 '@types/react-dom': 18.3.0 -<<<<<<< HEAD '@testing-library/svelte@5.2.7(svelte@5.32.1)(vite@6.2.7(@types/node@20.17.24)(jiti@2.4.0)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(tsx@4.19.2)(yaml@2.7.0))(vitest@3.0.7(@edge-runtime/vm@5.0.0)(@types/debug@4.1.12)(@types/node@20.17.24)(jiti@2.4.0)(jsdom@26.0.0)(less@4.4.0)(msw@2.7.0(@types/node@20.17.24)(typescript@5.6.3))(sass@1.90.0)(terser@5.43.1)(tsx@4.19.2)(yaml@2.7.0))': -======= - '@testing-library/svelte@5.2.7(svelte@5.32.1)(vite@6.2.7(@types/node@20.17.24)(jiti@2.4.0)(less@4.4.0)(sass@1.90.0)(terser@5.43.1)(tsx@4.19.2)(yaml@2.7.0))(vitest@3.0.7(@edge-runtime/vm@5.0.0)(@types/debug@4.1.12)(@types/node@20.17.24)(jiti@2.4.0)(jsdom@26.0.0)(less@4.4.0)(msw@2.7.0(@types/node@20.17.24)(typescript@5.8.3))(sass@1.90.0)(terser@5.43.1)(tsx@4.19.2)(yaml@2.7.0))': ->>>>>>> af65ab6a9 (fix(rsc): require minimal versions for RSC to address CVE-2025-55182 (#10833)) dependencies: '@testing-library/dom': 10.4.0 svelte: 5.32.1 @@ -36524,16 +36507,16 @@ snapshots: react: 18.2.0 scheduler: 0.23.0 - react-dom@18.2.0(react@18.3.1): + react-dom@18.3.1(react@18.3.1): dependencies: loose-envify: 1.4.0 react: 18.3.1 - scheduler: 0.23.0 + scheduler: 0.23.2 - react-dom@18.3.1(react@18.3.1): + react-dom@18.3.1(react@19.0.0-rc.1): dependencies: loose-envify: 1.4.0 - react: 18.3.1 + react: 19.0.0-rc.1 scheduler: 0.23.2 react-dom@19.0.0-rc-cc1ec60d0d-20240607(react@19.0.0-rc-cc1ec60d0d-20240607): @@ -37877,11 +37860,11 @@ snapshots: csso: 5.0.5 picocolors: 1.1.1 - swr@2.2.5(react@18.3.1): + swr@2.2.5(react@19.0.0-rc.1): dependencies: client-only: 0.0.1 - react: 18.3.1 - use-sync-external-store: 1.2.0(react@18.3.1) + react: 19.0.0-rc.1 + use-sync-external-store: 1.2.0(react@19.0.0-rc.1) swrv@1.0.4(vue@3.3.8(typescript@5.8.3)): dependencies: @@ -38957,9 +38940,9 @@ snapshots: urlpattern-polyfill@8.0.2: {} - use-sync-external-store@1.2.0(react@18.3.1): + use-sync-external-store@1.2.0(react@19.0.0-rc.1): dependencies: - react: 18.3.1 + react: 19.0.0-rc.1 utif@2.0.1: dependencies: From 288668bb99cf7e9510813c1e9689d0a21dc2e1e5 Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Wed, 3 Dec 2025 10:10:24 -0800 Subject: [PATCH 3/7] Update old-bulldogs-relate.md --- .changeset/old-bulldogs-relate.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/old-bulldogs-relate.md b/.changeset/old-bulldogs-relate.md index 22ee75bb77ff..ea7127beea0d 100644 --- a/.changeset/old-bulldogs-relate.md +++ b/.changeset/old-bulldogs-relate.md @@ -3,4 +3,4 @@ '@ai-sdk/rsc': patch --- -drop react 19-rc support. Require minimal versions for RSC to address CVE-2025-55182 +Require minimal versions for RSC to address CVE-2025-55182 From 2a6d9dd1ed5fe78ed6b3d924a15a2921e479e843 Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Wed, 3 Dec 2025 10:20:26 -0800 Subject: [PATCH 4/7] minimize changes --- packages/react/package.json | 2 +- pnpm-lock.yaml | 32 +++++++++++++------------------- 2 files changed, 14 insertions(+), 20 deletions(-) diff --git a/packages/react/package.json b/packages/react/package.json index f018e0778569..6b630321d730 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -53,7 +53,7 @@ "zod": "3.25.76" }, "peerDependencies": { - "react": "^18 || ^19 || ^19.0.0-rc", + "react": "^18 || ^19.0.0-rc || ^19", "zod": "^3.25.76 || ^4.1.8" }, "peerDependenciesMeta": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5fa00537a2f2..d00cf7998de9 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -2440,11 +2440,11 @@ importers: specifier: workspace:* version: link:../ai react: - specifier: ^18 || ^19 || ^19.0.0-rc - version: 19.0.0-rc.1 + specifier: ^18 || ^19 + version: 18.3.1 swr: specifier: ^2.2.5 - version: 2.2.5(react@19.0.0-rc.1) + version: 2.2.5(react@18.3.1) throttleit: specifier: 2.1.0 version: 2.1.0 @@ -2454,7 +2454,7 @@ importers: version: 6.6.3 '@testing-library/react': specifier: ^16.0.1 - version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@19.0.0-rc.1))(react@19.0.0-rc.1) + version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) '@testing-library/user-event': specifier: ^14.5.2 version: 14.5.2(@testing-library/dom@10.4.0) @@ -2484,7 +2484,7 @@ importers: version: 2.6.4(@types/node@20.17.24)(typescript@5.8.3) react-dom: specifier: ^18 - version: 18.3.1(react@19.0.0-rc.1) + version: 18.3.1(react@18.3.1) tsup: specifier: ^7.2.0 version: 7.2.0(postcss@8.5.6)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.8.3))(typescript@5.8.3) @@ -26931,12 +26931,12 @@ snapshots: lodash: 4.17.21 redent: 3.0.0 - '@testing-library/react@16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@19.0.0-rc.1))(react@19.0.0-rc.1)': + '@testing-library/react@16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)': dependencies: '@babel/runtime': 7.25.7 '@testing-library/dom': 10.4.0 - react: 19.0.0-rc.1 - react-dom: 18.3.1(react@19.0.0-rc.1) + react: 18.3.1 + react-dom: 18.3.1(react@18.3.1) optionalDependencies: '@types/react': 18.3.3 '@types/react-dom': 18.2.4 @@ -36513,12 +36513,6 @@ snapshots: react: 18.3.1 scheduler: 0.23.2 - react-dom@18.3.1(react@19.0.0-rc.1): - dependencies: - loose-envify: 1.4.0 - react: 19.0.0-rc.1 - scheduler: 0.23.2 - react-dom@19.0.0-rc-cc1ec60d0d-20240607(react@19.0.0-rc-cc1ec60d0d-20240607): dependencies: react: 19.0.0-rc-cc1ec60d0d-20240607 @@ -37860,11 +37854,11 @@ snapshots: csso: 5.0.5 picocolors: 1.1.1 - swr@2.2.5(react@19.0.0-rc.1): + swr@2.2.5(react@18.3.1): dependencies: client-only: 0.0.1 - react: 19.0.0-rc.1 - use-sync-external-store: 1.2.0(react@19.0.0-rc.1) + react: 18.3.1 + use-sync-external-store: 1.2.0(react@18.3.1) swrv@1.0.4(vue@3.3.8(typescript@5.8.3)): dependencies: @@ -38940,9 +38934,9 @@ snapshots: urlpattern-polyfill@8.0.2: {} - use-sync-external-store@1.2.0(react@19.0.0-rc.1): + use-sync-external-store@1.2.0(react@18.3.1): dependencies: - react: 19.0.0-rc.1 + react: 18.3.1 utif@2.0.1: dependencies: From 5317f64965e8d4dcc215e0011a2bdc21d508922a Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Wed, 10 Dec 2025 14:54:02 -0800 Subject: [PATCH 5/7] update lockfile --- pnpm-lock.yaml | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f2fccf02d392..3885a58b7bf8 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -2440,11 +2440,11 @@ importers: specifier: workspace:* version: link:../ai react: - specifier: ^18 || ^19 - version: 18.3.1 + specifier: ^18 || ^19.0.0-rc || ^19 + version: 19.0.0-rc.1 swr: specifier: ^2.2.5 - version: 2.2.5(react@18.3.1) + version: 2.2.5(react@19.0.0-rc.1) throttleit: specifier: 2.1.0 version: 2.1.0 @@ -2454,7 +2454,7 @@ importers: version: 6.6.3 '@testing-library/react': specifier: ^16.0.1 - version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) + version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@19.0.0-rc.1))(react@19.0.0-rc.1) '@testing-library/user-event': specifier: ^14.5.2 version: 14.5.2(@testing-library/dom@10.4.0) @@ -2484,7 +2484,7 @@ importers: version: 2.6.4(@types/node@20.17.24)(typescript@5.8.3) react-dom: specifier: ^18 - version: 18.3.1(react@18.3.1) + version: 18.3.1(react@19.0.0-rc.1) tsup: specifier: ^7.2.0 version: 7.2.0(postcss@8.5.6)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.8.3))(typescript@5.8.3) @@ -26921,12 +26921,12 @@ snapshots: lodash: 4.17.21 redent: 3.0.0 - '@testing-library/react@16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)': + '@testing-library/react@16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@19.0.0-rc.1))(react@19.0.0-rc.1)': dependencies: '@babel/runtime': 7.25.7 '@testing-library/dom': 10.4.0 - react: 18.3.1 - react-dom: 18.3.1(react@18.3.1) + react: 19.0.0-rc.1 + react-dom: 18.3.1(react@19.0.0-rc.1) optionalDependencies: '@types/react': 18.3.3 '@types/react-dom': 18.2.4 @@ -36498,6 +36498,12 @@ snapshots: react: 18.3.1 scheduler: 0.23.2 + react-dom@18.3.1(react@19.0.0-rc.1): + dependencies: + loose-envify: 1.4.0 + react: 19.0.0-rc.1 + scheduler: 0.23.2 + react-dom@19.0.0-rc-cc1ec60d0d-20240607(react@19.0.0-rc-cc1ec60d0d-20240607): dependencies: react: 19.0.0-rc-cc1ec60d0d-20240607 @@ -37839,11 +37845,11 @@ snapshots: csso: 5.0.5 picocolors: 1.1.1 - swr@2.2.5(react@18.3.1): + swr@2.2.5(react@19.0.0-rc.1): dependencies: client-only: 0.0.1 - react: 18.3.1 - use-sync-external-store: 1.2.0(react@18.3.1) + react: 19.0.0-rc.1 + use-sync-external-store: 1.2.0(react@19.0.0-rc.1) swrv@1.0.4(vue@3.3.8(typescript@5.8.3)): dependencies: @@ -38919,9 +38925,9 @@ snapshots: urlpattern-polyfill@8.0.2: {} - use-sync-external-store@1.2.0(react@18.3.1): + use-sync-external-store@1.2.0(react@19.0.0-rc.1): dependencies: - react: 18.3.1 + react: 19.0.0-rc.1 utif@2.0.1: dependencies: From c7f35353d599bc859265c131a66be2d0a9802dbd Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Wed, 10 Dec 2025 14:56:59 -0800 Subject: [PATCH 6/7] rc is giving trouble and we need to ship this --- packages/react/package.json | 2 +- packages/rsc/package.json | 2 +- pnpm-lock.yaml | 61 +++++++++++-------------------------- 3 files changed, 19 insertions(+), 46 deletions(-) diff --git a/packages/react/package.json b/packages/react/package.json index 225a066f7709..33c75a1da659 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -53,7 +53,7 @@ "zod": "3.25.76" }, "peerDependencies": { - "react": "^18 || ^19.0.0-rc || ^19", + "react": "^18 || ^19", "zod": "^3.25.76 || ^4.1.8" }, "peerDependenciesMeta": { diff --git a/packages/rsc/package.json b/packages/rsc/package.json index c2e4c26fc4ea..48244d0c1e78 100644 --- a/packages/rsc/package.json +++ b/packages/rsc/package.json @@ -64,7 +64,7 @@ "zod": "3.25.76" }, "peerDependencies": { - "react": "^18 || ^19.0.0-rc || ~19.0.1 || ~19.1.2 || ^19.2.1", + "react": "^18 || ~19.0.1 || ~19.1.2 || ^19.2.1", "zod": "^3.25.76 || ^4.1.8" }, "peerDependenciesMeta": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3885a58b7bf8..c57b491baf4d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -482,7 +482,7 @@ importers: version: 7.0.0 ts-jest: specifier: ^29.1.0 - version: 29.2.5(@babel/core@7.28.3)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.28.3))(jest@29.7.0(@types/node@20.17.24)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.5.4)))(typescript@5.5.4) + version: 29.2.5(@babel/core@7.26.10)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.26.10))(jest@29.7.0(@types/node@20.17.24)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.5.4)))(typescript@5.5.4) ts-loader: specifier: ^9.4.3 version: 9.5.1(typescript@5.5.4)(webpack@5.96.1) @@ -2440,11 +2440,11 @@ importers: specifier: workspace:* version: link:../ai react: - specifier: ^18 || ^19.0.0-rc || ^19 - version: 19.0.0-rc.1 + specifier: ^18 || ^19 + version: 18.3.1 swr: specifier: ^2.2.5 - version: 2.2.5(react@19.0.0-rc.1) + version: 2.2.5(react@18.3.1) throttleit: specifier: 2.1.0 version: 2.1.0 @@ -2454,7 +2454,7 @@ importers: version: 6.6.3 '@testing-library/react': specifier: ^16.0.1 - version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@19.0.0-rc.1))(react@19.0.0-rc.1) + version: 16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1) '@testing-library/user-event': specifier: ^14.5.2 version: 14.5.2(@testing-library/dom@10.4.0) @@ -2484,7 +2484,7 @@ importers: version: 2.6.4(@types/node@20.17.24)(typescript@5.8.3) react-dom: specifier: ^18 - version: 18.3.1(react@19.0.0-rc.1) + version: 18.3.1(react@18.3.1) tsup: specifier: ^7.2.0 version: 7.2.0(postcss@8.5.6)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.8.3))(typescript@5.8.3) @@ -26921,12 +26921,12 @@ snapshots: lodash: 4.17.21 redent: 3.0.0 - '@testing-library/react@16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@19.0.0-rc.1))(react@19.0.0-rc.1)': + '@testing-library/react@16.0.1(@testing-library/dom@10.4.0)(@types/react-dom@18.2.4)(@types/react@18.3.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)': dependencies: '@babel/runtime': 7.25.7 '@testing-library/dom': 10.4.0 - react: 19.0.0-rc.1 - react-dom: 18.3.1(react@19.0.0-rc.1) + react: 18.3.1 + react-dom: 18.3.1(react@18.3.1) optionalDependencies: '@types/react': 18.3.3 '@types/react-dom': 18.2.4 @@ -28838,20 +28838,6 @@ snapshots: transitivePeerDependencies: - supports-color - babel-jest@29.7.0(@babel/core@7.28.3): - dependencies: - '@babel/core': 7.28.3 - '@jest/transform': 29.7.0 - '@types/babel__core': 7.20.5 - babel-plugin-istanbul: 6.1.1 - babel-preset-jest: 29.6.3(@babel/core@7.28.3) - chalk: 4.1.2 - graceful-fs: 4.2.11 - slash: 3.0.0 - transitivePeerDependencies: - - supports-color - optional: true - babel-loader@10.0.0(@babel/core@7.28.3)(webpack@5.101.2(esbuild@0.25.9)): dependencies: '@babel/core': 7.28.3 @@ -28970,13 +28956,6 @@ snapshots: babel-plugin-jest-hoist: 29.6.3 babel-preset-current-node-syntax: 1.1.0(@babel/core@7.26.10) - babel-preset-jest@29.6.3(@babel/core@7.28.3): - dependencies: - '@babel/core': 7.28.3 - babel-plugin-jest-hoist: 29.6.3 - babel-preset-current-node-syntax: 1.1.0(@babel/core@7.28.3) - optional: true - bail@2.0.2: {} balanced-match@1.0.2: {} @@ -36498,12 +36477,6 @@ snapshots: react: 18.3.1 scheduler: 0.23.2 - react-dom@18.3.1(react@19.0.0-rc.1): - dependencies: - loose-envify: 1.4.0 - react: 19.0.0-rc.1 - scheduler: 0.23.2 - react-dom@19.0.0-rc-cc1ec60d0d-20240607(react@19.0.0-rc-cc1ec60d0d-20240607): dependencies: react: 19.0.0-rc-cc1ec60d0d-20240607 @@ -37845,11 +37818,11 @@ snapshots: csso: 5.0.5 picocolors: 1.1.1 - swr@2.2.5(react@19.0.0-rc.1): + swr@2.2.5(react@18.3.1): dependencies: client-only: 0.0.1 - react: 19.0.0-rc.1 - use-sync-external-store: 1.2.0(react@19.0.0-rc.1) + react: 18.3.1 + use-sync-external-store: 1.2.0(react@18.3.1) swrv@1.0.4(vue@3.3.8(typescript@5.8.3)): dependencies: @@ -38276,7 +38249,7 @@ snapshots: ts-interface-checker@0.1.13: {} - ts-jest@29.2.5(@babel/core@7.28.3)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.28.3))(jest@29.7.0(@types/node@20.17.24)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.5.4)))(typescript@5.5.4): + ts-jest@29.2.5(@babel/core@7.26.10)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.26.10))(jest@29.7.0(@types/node@20.17.24)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.5.4)))(typescript@5.5.4): dependencies: bs-logger: 0.2.6 ejs: 3.1.10 @@ -38290,10 +38263,10 @@ snapshots: typescript: 5.5.4 yargs-parser: 21.1.1 optionalDependencies: - '@babel/core': 7.28.3 + '@babel/core': 7.26.10 '@jest/transform': 29.7.0 '@jest/types': 29.6.3 - babel-jest: 29.7.0(@babel/core@7.28.3) + babel-jest: 29.7.0(@babel/core@7.26.10) ts-loader@9.5.1(typescript@5.5.4)(webpack@5.96.1): dependencies: @@ -38925,9 +38898,9 @@ snapshots: urlpattern-polyfill@8.0.2: {} - use-sync-external-store@1.2.0(react@19.0.0-rc.1): + use-sync-external-store@1.2.0(react@18.3.1): dependencies: - react: 19.0.0-rc.1 + react: 18.3.1 utif@2.0.1: dependencies: From c7070c7c6e8caee1cd9f0d7cdf8f8ecc7d6c487c Mon Sep 17 00:00:00 2001 From: Gregor Martynus <39992+gr2m@users.noreply.github.com> Date: Wed, 10 Dec 2025 14:58:57 -0800 Subject: [PATCH 7/7] prevent install of vulnerable react versions through peer dependency range --- packages/react/package.json | 2 +- pnpm-lock.yaml | 31 ++++++++++++++++++++++++++----- 2 files changed, 27 insertions(+), 6 deletions(-) diff --git a/packages/react/package.json b/packages/react/package.json index 33c75a1da659..10a384d7ab8b 100644 --- a/packages/react/package.json +++ b/packages/react/package.json @@ -53,7 +53,7 @@ "zod": "3.25.76" }, "peerDependencies": { - "react": "^18 || ^19", + "react": "^18 || ~19.0.1 || ~19.1.2 || ^19.2.1", "zod": "^3.25.76 || ^4.1.8" }, "peerDependenciesMeta": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c57b491baf4d..1ff2da0b00ef 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -482,7 +482,7 @@ importers: version: 7.0.0 ts-jest: specifier: ^29.1.0 - version: 29.2.5(@babel/core@7.26.10)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.26.10))(jest@29.7.0(@types/node@20.17.24)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.5.4)))(typescript@5.5.4) + version: 29.2.5(@babel/core@7.28.3)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.28.3))(jest@29.7.0(@types/node@20.17.24)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.5.4)))(typescript@5.5.4) ts-loader: specifier: ^9.4.3 version: 9.5.1(typescript@5.5.4)(webpack@5.96.1) @@ -2440,7 +2440,7 @@ importers: specifier: workspace:* version: link:../ai react: - specifier: ^18 || ^19 + specifier: ^18 || ~19.0.1 || ~19.1.2 || ^19.2.1 version: 18.3.1 swr: specifier: ^2.2.5 @@ -28838,6 +28838,20 @@ snapshots: transitivePeerDependencies: - supports-color + babel-jest@29.7.0(@babel/core@7.28.3): + dependencies: + '@babel/core': 7.28.3 + '@jest/transform': 29.7.0 + '@types/babel__core': 7.20.5 + babel-plugin-istanbul: 6.1.1 + babel-preset-jest: 29.6.3(@babel/core@7.28.3) + chalk: 4.1.2 + graceful-fs: 4.2.11 + slash: 3.0.0 + transitivePeerDependencies: + - supports-color + optional: true + babel-loader@10.0.0(@babel/core@7.28.3)(webpack@5.101.2(esbuild@0.25.9)): dependencies: '@babel/core': 7.28.3 @@ -28956,6 +28970,13 @@ snapshots: babel-plugin-jest-hoist: 29.6.3 babel-preset-current-node-syntax: 1.1.0(@babel/core@7.26.10) + babel-preset-jest@29.6.3(@babel/core@7.28.3): + dependencies: + '@babel/core': 7.28.3 + babel-plugin-jest-hoist: 29.6.3 + babel-preset-current-node-syntax: 1.1.0(@babel/core@7.28.3) + optional: true + bail@2.0.2: {} balanced-match@1.0.2: {} @@ -38249,7 +38270,7 @@ snapshots: ts-interface-checker@0.1.13: {} - ts-jest@29.2.5(@babel/core@7.26.10)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.26.10))(jest@29.7.0(@types/node@20.17.24)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.5.4)))(typescript@5.5.4): + ts-jest@29.2.5(@babel/core@7.28.3)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.28.3))(jest@29.7.0(@types/node@20.17.24)(ts-node@10.9.2(@types/node@20.17.24)(typescript@5.5.4)))(typescript@5.5.4): dependencies: bs-logger: 0.2.6 ejs: 3.1.10 @@ -38263,10 +38284,10 @@ snapshots: typescript: 5.5.4 yargs-parser: 21.1.1 optionalDependencies: - '@babel/core': 7.26.10 + '@babel/core': 7.28.3 '@jest/transform': 29.7.0 '@jest/types': 29.6.3 - babel-jest: 29.7.0(@babel/core@7.26.10) + babel-jest: 29.7.0(@babel/core@7.28.3) ts-loader@9.5.1(typescript@5.5.4)(webpack@5.96.1): dependencies: