fix(deps): update react monorepo

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/react (source)	19.1.6 → 19.2.14
@types/react-dom (source)	19.1.6 → 19.2.3
react (source)	19.1.0 → 19.2.4
react-dom (source)	19.1.0 → 19.2.4

---

Release Notes

facebook/react (react)

v19.2.4: 19.2.4 (January 26th, 2026)

Compare Source

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#​35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

v19.2.3: 19.2.3 (December 11th, 2025)

Compare Source

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #​35351)

v19.2.2: 19.2.2 (December 11th, 2025)

Compare Source

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #​35289)

v19.2.1: 19.2.1 (December 3rd, 2025)

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

v19.2.0

Compare Source

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

• <Activity>: A new API to hide and restore the UI and internal state of its children.
• useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
• cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
• React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

• Added resume APIs for partial pre-rendering with Web Streams:
  • resume: to resume a prerender to a stream.
  • resumeAndPrerender: to resume a prerender to HTML.
• Added resume APIs for partial pre-rendering with Node Streams:
  • resumeToPipeableStream: to resume a prerender to a stream.
  • resumeAndPrerenderToNodeStream: to resume a prerender to HTML.
• Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

• React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
• Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
• Use underscore instead of : IDs generated by useId

All Changes

React

• <Activity /> was developed over many years, starting before ClassComponent.setState (@​acdlite @​sebmarkbage and many others)
• Stringify context as "SomeContext" instead of "SomeContext.Provider" (@​kassens #​33507)
• Include stack of cause of React instrumentation errors with %o placeholder (@​eps1lon #​34198)
• Fix infinite useDeferredValue loop in popstate event (@​acdlite #​32821)
• Fix a bug when an initial value was passed to useDeferredValue (@​acdlite #​34376)
• Fix a crash when submitting forms with Client Actions (@​sebmarkbage #​33055)
• Hide/unhide the content of dehydrated suspense boundaries if they resuspend (@​sebmarkbage #​32900)
• Avoid stack overflow on wide trees during Hot Reload (@​sophiebits #​34145)
• Improve Owner and Component stacks in various places (@​sebmarkbage, @​eps1lon: #​33629, #​33724, #​32735, #​33723)
• Add cacheSignal (@​sebmarkbage #​33557)

React DOM

• Block on Suspensey Fonts during reveal of server-side-rendered content (@​sebmarkbage #​33342)
• Use underscore instead of : for IDs generated by useId (@​sebmarkbage, @​eps1lon: #​32001, #​33342#​33099, #​33422)
• Stop warning when ARIA 1.3 attributes are used (@​Abdul-Omira #​34264)
• Allow nonce to be used on hoistable styles (@​Andarist #​32461)
• Warn for using a React owned node as a Container if it also has text content (@​sebmarkbage #​32774)
• s/HTML/text for for error messages if text hydration mismatches (@​rickhanlonii #​32763)
• Fix a bug with React.use inside React.lazy-ed Component (@​hi-ogawa #​33941)
• Enable the progressiveChunkSize option for server-side-rendering APIs (@​sebmarkbage #​33027)
• Fix a bug with deeply nested Suspense inside Suspense fallback when server-side-rendering (@​gnoff #​33467)
• Avoid hanging when suspending after aborting while rendering (@​gnoff #​34192)
• Add Node Web Streams to server-side-rendering APIs for Node.js (@​sebmarkbage #​33475)

React Server Components

• Preload <img> and <link> using hints before they're rendered (@​sebmarkbage #​34604)
• Log error if production elements are rendered during development (@​eps1lon #​34189)
• Fix a bug when returning a Temporary reference (e.g. a Client Reference) from Server Functions (@​sebmarkbage #​34084, @​denk0403 #​33761)
• Pass line/column to filterStackFrame (@​eps1lon #​33707)
• Support Async Modules in Turbopack Server References (@​lubieowoce #​34531)
• Add support for .mjs file extension in Webpack (@​jennyscript #​33028)
• Fix a wrong missing key warning (@​unstubbable #​34350)
• Make console log resolve in predictable order (@​sebmarkbage #​33665)

React Reconciler

• createContainer and createHydrationContainer had their parameter order adjusted after on* handlers to account for upcoming experimental APIs

v19.1.5: 19.1.5 (January 26th, 2026)

Compare Source

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#​35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

v19.1.4: 19.1.4 (December 11th, 2025)

Compare Source

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #​35351)

v19.1.3: 19.1.3 (December 11th, 2025)

Compare Source

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #​35289, #​35345)

v19.1.2: 19.1.2 (December 3rd, 2025)

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

v19.1.1

Compare Source

React

• Fixed Owner Stacks to work with ES2015 function.name semantics (#​33680 by @​hoxyq)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
exif-transfer	Ready	Preview, Comment	Feb 13, 2026 7:58am

[safedep]

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
react-router @ 7.6.2 npm pnpm-lock.yaml	✔️	⛔	✔️	🔗
@floating-ui/react @ 0.26.28 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@floating-ui/react-dom @ 2.1.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@headlessui/react @ 2.2.4 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@pivanov/utils @ 0.0.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-accordion @ 1.2.11 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-arrow @ 1.1.7 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-checkbox @ 1.3.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-collapsible @ 1.1.11 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-collection @ 1.1.7 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-compose-refs @ 1.1.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-context @ 1.1.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-context-menu @ 2.2.15 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-direction @ 1.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-dismissable-layer @ 1.1.10 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-focus-guards @ 1.1.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-focus-scope @ 1.1.7 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-hover-card @ 1.1.14 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-id @ 1.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-label @ 2.1.7 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-menu @ 2.1.15 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-popper @ 1.2.7 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-portal @ 1.1.9 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-presence @ 1.1.4 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-primitive @ 2.1.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-roving-focus @ 1.1.10 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-select @ 2.2.5 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-slider @ 1.3.5 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-slot @ 1.2.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-tooltip @ 1.2.7 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-use-callback-ref @ 1.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-use-controllable-state @ 1.2.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-use-effect-event @ 0.0.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-use-escape-keydown @ 1.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-use-layout-effect @ 1.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-use-previous @ 1.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-use-rect @ 1.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-use-size @ 1.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@radix-ui/react-visually-hidden @ 1.2.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@react-aria/focus @ 3.20.4 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@react-aria/interactions @ 3.25.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@react-aria/ssr @ 3.9.9 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@react-aria/utils @ 3.29.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@react-leaflet/core @ 3.0.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@react-stately/utils @ 3.10.7 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@react-types/shared @ 3.30.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@remixicon/react @ 4.6.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@tanstack/react-query @ 5.80.6 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@tanstack/react-virtual @ 3.13.9 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@types/react @ 19.2.14 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@types/react-dom @ 19.2.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
@types/react-reconciler @ 0.28.9 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
bippy @ 0.3.16 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
csstype @ 3.2.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
foxact @ 0.2.45 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
framer-motion @ 12.16.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
jotai @ 2.12.5 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
lucide-react @ 0.513.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
motion @ 12.16.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
prism-react-renderer @ 2.4.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
react @ 19.2.4 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
react-dom @ 19.2.4 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
react-leaflet @ 5.0.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
react-remove-scroll @ 2.7.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
react-remove-scroll-bar @ 2.3.8 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
react-router-dom @ 7.6.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
react-scan @ 0.3.4 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
react-style-singleton @ 2.2.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
scheduler @ 0.27.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
sonner @ 2.0.5 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
tailwind-scrollbar @ 4.0.2 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
use-callback-ref @ 1.3.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
use-sidecar @ 1.1.3 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
use-sync-external-store @ 1.5.0 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗
usehooks-ts @ 3.1.1 npm pnpm-lock.yaml	✔️	✔️	✔️	🔗

_{This report is generated by SafeDep Github App}