Update dependency react-dom [SECURITY]

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
react-dom (source)	^15.3.1 → ^19.0.0
react-dom (source)	^15.3.2 → ^19.0.0
react-dom (source)	16.2.0 → 16.2.1
react-dom (source)	^15.6.1 → ^16.0.0
react-dom (source)	^15.5.4 → ^16.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Cross-Site Scripting in react-dom

CVE-2018-6341 / GHSA-mvjj-gqq2-p4hw

More information

Details

Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:

• be a server-side React app
• be rendered to HTML using ReactDOMServer
• include an attribute name from user input in an HTML tag

Recommendation

If you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.

Severity

• CVSS Score: 6.1 / 10 (Medium)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-6341
• https://github.com/advisories/GHSA-mvjj-gqq2-p4hw
• https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html
• https://snyk.io/vuln/npm:react-dom:20180802
• https://www.npmjs.com/advisories/1421
• https://twitter.com/reactjs/status/1024745321987887104

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

react/react (react-dom)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37845 by @​unstubbable and @​eps1lon)

v19.3.0

Compare Source

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #​31975, #​31987, #​31996, #​31999, #​32001, #​32002, #​32028, #​32029, #​32031, #​32034, #​32038, #​32041, #​32050, #​32090, #​32105, #​32254, #​32379, #​32422, #​32462, #​32540, #​32545, #​32585, #​32599, #​32611, #​32612, #​32617, #​32651, #​32653, #​32656, #​32664, #​32699, #​32723, #​32734, #​32751, #​32752, #​32760, #​32761, #​32764, #​32772, #​32790, #​32819, #​32820, #​32822, #​32833, #​32849, #​33094, #​33191, #​33200, #​33206, #​33293, #​33330, #​33331, #​33332, #​33357, #​33362, #​33433, #​33576, #​34374, #​34450, #​34481, #​34500, #​34502, #​34510, #​34511, #​34539, #​35567, #​35564, #​35485, #​35380, #​35063, #​35060, #​34676, #​36917, #​35337, #​35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #​32465, #​32613, #​32619, #​32654, #​32660, #​32682, #​32722, #​32813, #​32814, #​33056, #​33058, #​33093, #​34069, #​34103, #​34544, #​34545, #​37062, #​37061, #​37060, #​36047, #​36010, #​35642, #​35641, #​35637, #​35630, #​34935, #​37457, #​37408, #​37326, #​37251, #​37171, #​37169, #​37168, #​37167, #​37166, #​37165, #​37164, #​37163, #​37162, #​37161, #​37160, #​37125, #​37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #​37143, #​37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #​37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #​35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #​37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #​36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #​36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #​36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #​36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #​36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #​35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #​35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #​35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #​35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #​35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #​36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #​34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #​34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #​34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #​36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #​35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #​34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #​35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #​34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #​35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #​37104, #​37203, #​37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #​37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #​37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #​37113)
• Only remove properties from Host Singletons on release (@​gnoff #​37112)
• Don't invoke effects on moved children in StrictMode (@​sophiebits #​36948)
• Throw a clearer error when a rejected Promise is incorrectly instrumented (@​eps1lon #​36328)
• Fix context propagation into Suspense fallbacks (@​acdlite #​36160)
• Fix context propagation through suspended Suspense boundaries (@​acdlite #​35839)
• Fix useDeferredValue getting stuck (@​gaearon #​36134)
• Update useActionState error message to say "action state" instead of "form state" (@​rickhanlonii #​35790)
• Don't warn when rendering data block scripts (@​eps1lon #​35953)
• Treat fibers with alternates as mounted in getNearestMountedFiber (@​sebmarkbage #​35578)
• Always instrument the lazy initializer thenable (@​gnoff #​35521)
• Annotate cascading updates for DevTools performance tracks in DEV (@​huntie #​34961)
• Resolve the .default export of a React.lazy as the canonical value (@​sebmarkbage #​34906)
• Limit owner stacks to 10 frames (@​eps1lon #​34864)
• Ensure useEffectEvent reads latest values in forwardRef and memo() components (@​eps1lon #​34831)

React DOM

• Copy source onto the synthetic toggle event (@​lazerg #​37389)
• Update HTML parser rules for the new <select> parser (@​josepharhar #​34804)
• Update defaultValue for type="number" inputs to match other input types (@​sophiebits #​36980)
• Avoid setting innerHTML when it hasn't changed (@​sophiebits #​36949)
• Forward the nonce option in ReactDOM.preloadModule() (@​UditDewan #​36851)
• Support fetchPriority for module resources (@​TheAlexLichter #​36835)
• Track stylesheet preloads when explicitly preloaded to avoid unnecessary suspension (@​gnoff #​36386)
• Suggest correct casing for the misspelled credentialless iframe attribute (@​vmx906 #​36322)
• Add credentialless as a recognized boolean attribute for iframes (@​vmx906 #​36148)
• Prevent reentrant finishedTask from calling completeAll multiple times (@​gnoff #​36287)
• Update the CSS shorthand property list (@​kidonng #​35636)
• Support the maskType SVG prop (@​sleitor #​35921)
• Add support for onFullscreenChange and onFullscreenError events (@​chirokas #​34621)
• Include submitter in submit events (@​eps1lon #​35590)
• Fire onReset when automatically resetting forms (@​eps1lon #​35176)
• Use the FormData submitter parameter (@​jenseng #​29028)
• Fix form status reset when component state is updated (@​eps1lon #​34075)
• Batch updates from resize events until the next frame (@​eps1lon #​35117)

React Server

• Add nonce to rendered import maps (@​mattcosta7 #​37339)
• Add an onBrowserBailout option to observe subtrees that defer to the browser (@​gnoff #​37193)
• Stop the caller's signal from retaining a finished render (@​unstubbable #​37315)
• Construct the render lifetime controller only when it is needed (@​unstubbable #​37357)
• Fix react-dom/server hanging on Deno (@​fraidev #​35235)
• Extend stack overflow recovery to retries in SSR (@​jackpope #​36977)
• Fix false-positive hydration mismatch on nonce attributes (@​MaxwellCohen #​37030)
• Guard shell-error callbacks instead of nulling them out on the request (@​eps1lon #​36916)
• Stop firing onAllReady after the shell errored (@​eps1lon #​36903)
• Treat an incomplete tree as an error during error recovery (@​acdlite #​36911)
• Fix non-script modulepreload tracking (@​fallintoplace #​36564)
• Finalize postponed nextSegmentId after the prelude flush (@​gaojude #​36779)
• Preserve referrerPolicy in image preload headers (@​ulises-jeremias #​36803)
• Allow pending work to specialize abort reasons (@​gnoff #​36586)
• Abort tasks that suspend after aborting during render (@​gnoff #​36585)
• Finish abort in a scheduled task (@​gnoff #​36580)
• Fix aborts during resumed rendering (@​gnoff #​36584)
• Track abort state on the request (@​gnoff #​36583)
• Model external work scheduling explicitly in the fb bundle (@​gnoff #​36576)
• Continue reporting aborted task errors after a fatal abort (@​gnoff #​36575)
• Disallow abort reentrancy (@​gnoff #​36574)
• Stop transpiling computed property names (@​eps1lon #​36542)
• Fix crash when capturing the callsite of a stalled use() of a rejected Flight chunk (@​lubieowoce #​36544)
• Double invoke effects in Strict Mode during hydration (@​eps1lon #​35961)
• Add additional task reentrancy protections in Fizz (@​gnoff #​36291)
• Don't outline Suspense boundaries with suspensey CSS during shell flush (@​gnoff #​35824)
• Push a stalled use() to the owner stack and debug task (@​eps1lon #​35226)
• Fix useId tracking on replay (@​gnoff #​35518)
• Correctly handle replaying when hydrating (@​gnoff #​35494)
• Simplify the createSuspenseBoundary path (@​sebmarkbage #​35087)
• Unify preamble-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35068)
• Unify prerender-only fields to save a field on Suspense boundaries (@​sebmarkbage #​35067)
• Push halted awaits to the owner stack for late-arriving I/O info (@​unstubbable #​35019)
• Include all Node.js APIs in the Bun entrypoint for react-dom/server (@​RiskyMH #​34193)
• Detach a Suspense boundary after flushing its segment (@​gnoff #​34694)

React Server Components

• Keep an element pending while a referenced row is resolving (@​unstubbable #​37542)
• Fix RangeError from exponential debug info growth (@​unstubbable #​37481)
• Abort the cache signal when debug objects are retained (@​unstubbable #​37342)
• Transfer key validation of lazy nodes when they are unwrapped (@​unstubbable #​37258)
• Add pending_weak to the Flight thenable protocol (@​acdlite #​37154)
• Outline and dedupe repeated strings (@​gaearon #​37147)
• Port Reply Server traversal guards to the Flight Client (@​eps1lon #​37144)
• Define Flight chunk .then with Object.defineProperty (@​eps1lon #​37109)
• Support Turbopack's experimental array format for chunks (@​sampoder #​37095)
• Limit fake JSX call site stacks to 10 frames (@​timneutkens #​37086)
• Improve performance when decoding Flight replies (@​gnoff #​37090)
• Recognize Node 22+ V8 frames for Promise statics in debug info (@​gaearon #​36969)
• Tailor the warning for binary data serialized through toJSON (Node Buffer) (@​unstubbable #​36873)
• Resolve models before JSON.stringify for faster serialization (@​mhart #​36795)
• Prune debug info when chunks error (@​gnoff #​36782)
• Avoid main-thread stalls from large debug strings (@​unstubbable #​36570)
• Fix stranded row content under Node stream backpressure (@​unstubbable #​36516)
• Fix dropped FormData entries in decodeReplyFromBusboy (@​unstubbable #​36468)
• Harden types and improve performance of Flight replies (@​eps1lon #​36425)
• Add more cycle protections to Flight replies (@​eps1lon #​36236)
• Transport AggregateError.errors (@​eps1lon #​36156)
• Bail out early when a backing entry for Blob deserialization is not a Blob (@​eps1lon #​36055)
• Clear chunk reason after successful module initialization (@​unstubbable #​36024)
• Add support for transporting Error.cause (@​eps1lon #​35810)
• Walk parsed JSON instead of using a reviver for faster RSC payload parsing (@​timneutkens #​35776)
• Skip transferReferencedDebugInfo during debug info resolution (@​unstubbable #​35795)
• Add unstable_allowPartialStream option to Flight Client (@​unstubbable #​35731)
• Fix encodeReply for JSX with temporary references (@​unstubbable #​35730)
• Fix debug channel flag in Node.js renderToPipeableStream (@​feedthejim #​35724)
• Fix stack overflow in visitAsyncNode with deep async chains (@​unstubbable #​35612)
• Allow Server Components to render context providers from client modules (@​rickhanlonii #​35675)
• Allow overriding request.timeOrigin via options.startTime (@​lubieowoce #​35598)
• Warn once if eval is disabled in the dev environment (@​eps1lon #​35661)
• Restore original function name in dev server callstacks served with unsafe-eval (@​eps1lon #​35650)
• Fix react-markup types for server references (@​eps1lon #​35634)
• Add more DoS mitigations to Flight replies and harden Flight (@​unstubbable #​35632)
• Allow cyclic references to be serialized when unwrapping lazy elements (@​unstubbable #​35471)
• Improve cyclic thenable detection in Flight reply server (@​cvan20191 #​35369)
• Add extra loop protection to Flight reply server (@​sebmarkbage #​35351)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage #​35345)
• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Never parse then functions in Flight replies (@​sebmarkbage #​35289)
• Patch Flight reply server with fixes from Flight Client (@​sebmarkbage #​35277)
• Complete the list of Node.js internal Promise awaits (@​eps1lon #​35161)
• Reduce risk of maximum call stack exceeded when emitting async sequences (@​eps1lon #​35159)
• Fix pending chunks count for streams and async iterables in DEV (@​unstubbable #​35143)
• Fix broken byte stream parsing caused by buffer detachment (@​unstubbable #​35127)
• Fix hasReadable flag in Node.js clients' debug channel (@​unstubbable #​35039)
• Fix debug info filtering to include later resolved I/O (@​unstubbable #​35036)
• Cache the value when visiting the same I/O or Promise along different paths (@​sebmarkbage #​35005)
• Clone subsequent I/O nodes when resolved more than once (@​sebmarkbage #​35003)
• Fix hang after resolving cyclic references (@​unstubbable #​34988)
• Allow passing DEV-only startTime as an option (@​sebmarkbage #​34912)
• Ignore bound-anonymous-fn resources as they're not considered I/O (@​sebmarkbage #​34911)
• Fix detached ArrayBuffer error when streaming typed arrays (@​unstubbable #​34849)
• Exclude RSC stream if the stream resolves in a task (@​sebmarkbage #​34838)
• Forward the current environment when forwarding I/O entries (@​sebmarkbage #​34836)
• Look for moved debug info when logging component performance track (@​sebmarkbage #​34839)
• Respect displayName of Promise instances on the server (@​sebmarkbage #​34825)
• Avoid unnecessary indirection when serializing debug info (@​unstubbable #​34797)
• Fix preload as attribute for stylesheets (@​unstubbable #​34760)
• Don't serialize toJSON in debug path and omit wide arrays (@​sebmarkbage #​34759)
• Add support for <Activity> (@​eps1lon #​34697)

v19.2.9: 19.2.9 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37844 by @​unstubbable and @​eps1lon)

v19.2.8: 19.2.8 (July 21st, 2026)

Compare Source

React Server Components

• Performance improvements when decoding
  (#​37087 by @​eps1lon)

v19.2.7

Compare Source

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #​36566)

v19.2.6

Compare Source

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #​36425)

v19.2.5

Compare Source

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #​36236)

v19.2.4

Compare Source

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #​35632)

v19.2.3

Compare Source

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #​35351)

v19.2.2

Compare Source

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #​35289, #​35345)

v19.2.1

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

v19.2.0

Compare Source

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

• <Activity>: A new API to hide and restore the UI and internal state of its children.
• useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
• cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
• React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

• Added resume APIs for partial pre-rendering with Web Streams:
  • resume: to resume a prerender to a stream.
  • resumeAndPrerender: to resume a prerender to HTML.
• Added resume APIs for partial pre-rendering with Node Streams:
  • resumeToPipeableStream: to resume a prerender to a stream.
  • resumeAndPrerenderToNodeStream: to resume a prerender to HTML.
• Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

• React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
• Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
• Use underscore instead of : IDs generated by useId

All Changes

React

• <Activity /> was developed over many years, starting before ClassComponent.setState (@​acdlite @​sebmarkbage and many others)
• Stringify context as "SomeContext" instead of "SomeContext.Provider" (@​kassens #​33507)
• Include stack of cause of React instrumentation errors with %o placeholder (@​eps1lon #​34198)
• Fix infinite useDeferredValue loop in popstate event (@​acdlite #​32821)
• Fix a bug when an initial value was passed to useDeferredValue (@​acdlite #​34376)
• Fix a crash when submitting forms with Client Actions (@​sebmarkbage #​33055)
• Hide/unhide the content of dehydrated suspense boundaries if they resuspend (@​sebmarkbage #​32900)
• Avoid stack overflow on wide trees during Hot Reload (@​sophiebits #​34145)
• Improve Owner and Component stacks in various places (@​sebmarkbage, @​eps1lon: #​33629, #​33724, #​32735, #​33723)
• Add cacheSignal (@​sebmarkbage #​33557)

React DOM

• Block on Suspensey Fonts during reveal of server-side-rendered content (@​sebmarkbage #​33342)
• Use underscore instead of : for IDs generated by useId (@​sebmarkbage, @​eps1lon: #​32001, #​33342#​33099, #​33422)
• Stop warning when ARIA 1.3 attributes are used (@​Abdul-Omira #​34264)
• Allow nonce to be used on hoistable styles (@​Andarist #​32461)
• Warn for using a React owned node as a Container if it also has text content (@​sebmarkbage #​32774)
• s/HTML/text for for error messages if text hydration mismatches (@​rickhanlonii #​32763)
• Fix a bug with React.use inside React.lazy-ed Component (@​hi-ogawa #​33941)
• Enable the progressiveChunkSize option for server-side-rendering APIs (@​sebmarkbage #​33027)
• Fix a bug with deeply nested Suspense inside Suspense fallback when server-side-rendering (@​gnoff #​33467)
• Avoid hanging when suspending after aborting while rendering (@​gnoff #​34192)
• Add Node Web Streams to server-side-rendering APIs for Node.js (@​sebmarkbage #​33475)

React Server Components

• Preload <img> and <link> using hints before they're rendered (@​sebmarkbage #​34604)
• Log error if production elements are rendered during development (@​eps1lon #​34189)
• Fix a bug when returning a Temporary reference (e.g. a Client Reference) from Server Functions ([@​sebmarkbage](htt

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: 2-resources/Client-Auth-Solution-master/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn old lockfile
npm warn old lockfile The package-lock.json file was created with an old version of npm,
npm warn old lockfile so supplemental metadata must be fetched from the registry.
npm warn old lockfile
npm warn old lockfile This is a one-time fix-up, please be patient...
npm warn old lockfile
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: auth-client@0.1.0
npm error Found: react@15.7.0
npm error node_modules/react
npm error   react@"^15.5.4" from the root project
npm error
npm error Could not resolve dependency:
npm error peer react@"^16.14.0" from react-dom@16.14.0
npm error node_modules/react-dom
npm error   react-dom@"^16.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-16T21_34_23_410Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-16T21_34_23_410Z-debug-0.log

File name: 1-projects/Client-Auth-Solution-master/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn old lockfile
npm warn old lockfile The package-lock.json file was created with an old version of npm,
npm warn old lockfile so supplemental metadata must be fetched from the registry.
npm warn old lockfile
npm warn old lockfile This is a one-time fix-up, please be patient...
npm warn old lockfile
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: auth-client@0.1.0
npm error Found: react@15.7.0
npm error node_modules/react
npm error   react@"^15.5.4" from the root project
npm error
npm error Could not resolve dependency:
npm error peer react@"^16.14.0" from react-dom@16.14.0
npm error node_modules/react-dom
npm error   react-dom@"^16.0.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-16T21_34_28_577Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-16T21_34_28_577Z-debug-0.log