Update react dependencies (major)

[renovate]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@testing-library/react	13.4.0 -> 16.3.1
eslint-plugin-react-hooks (source)	4.6.2 -> 7.0.1
qrcode.react (source)	3.2.0 -> 4.2.0
react (source)	18.3.1 -> 19.2.3
react-dom (source)	18.3.1 -> 19.2.3
react-helmet-async	1.3.0 -> 2.0.5
react-router-dom (source)	6.30.0 -> 7.11.0
react-test-renderer (source)	18.3.1 -> 19.2.3

---

Release Notes

testing-library/react-testing-library (@​testing-library/react)

v16.3.1

Compare Source

v16.3.0

Compare Source

Features

• add bernardobelchior as a contributor for code, and doc (#​1391) (9fc6a75)

v16.2.0

Compare Source

Features

• Add support for React error handlers (#​1354) (9618c51)

v16.1.0

Compare Source

Features

• Add support for React 19 (#​1367) (85ac253)

v16.0.1

Compare Source

Bug Fixes

• Add support for exactOptionalPropertyTypes in TypeScript (#​1351) (3dcd8a9)

v16.0.0

Compare Source

Features

• Move @testing-library/dom and @types/react-dom to peer dependencies (#​1305) (a4744fa)

BREAKING CHANGES

• @testing-library/dom was moved to a peer dependency and needs to be explicitly installed. This reduces the chance of having conflicting versions of @testing-library/dom installed that frequently caused bugs when used with @testing-library/user-event. We will also be able to allow new versions of @testing-library/dom being used without a SemVer major release of @testing-library/react by just widening the peer dependency.
  @types/react-dom needs to be installed if you're typechecking files using @testing-library/react.

v15.0.7

Compare Source

Bug Fixes

• Ensure act is not any when React.act is not declared (#​1323) (c1f2957)

v15.0.6

Compare Source

Bug Fixes

• export new act when available (#​1319) (b6e59f7)

v15.0.5

Compare Source

Bug Fixes

• Stop restricting container option based on hydrate (#​1313) (d143f46)

v15.0.4

Compare Source

Bug Fixes

• Ensure renderHook options extend options for render (#​1308) (48282c2)

v15.0.3

Compare Source

Bug Fixes

• Don't raise TypeScript errors when hydating document (#​1304) (067d0c6)

v15.0.2

Compare Source

Bug Fixes

• Improve legacyRoot error message (#​1301) (c63b873)

v15.0.1

Compare Source

Bug Fixes

• Stop using nullish coalescing (#​1299) (1645d21)

v15.0.0

Compare Source

Release

• 15.0.0 (#​1295) (787cb85)

BREAKING CHANGES

• Minimum supported Node.js version is 18.0
• New version of @testing-library/dom changes various roles. Check out the changed tests in testing-library/dom-testing-library@2c57055 to get an overview about what changed.

v14.3.1

Compare Source

Bug Fixes

• Stop using nullish coalescing (#​1300) (8434a24)

v14.3.0

Compare Source

Features

• Add support for React 19 Canary (#​1294) (9c4a46d)

v14.2.2

Compare Source

Bug Fixes

• Remove unused types (#​1287) (3da62fd)

v14.2.1

Compare Source

Bug Fixes

• Update types to support all possible react component return values (#​1272) (55e79c2)

v14.2.0

Compare Source

Features

• add reactStrictMode option to enable strict mode render (#​1241) (0880eba)

v14.1.2

Compare Source

Bug Fixes

• revert missing hooks warnings (#​1255) (1c67477)

v14.1.1

Compare Source

Bug Fixes

• log globals warning only once (#​1252) (fd52a59), closes #​1249

v14.1.0

Compare Source

Features

• add warnings when globals are missing (#​1244) (d80319f)

v14.0.0

Compare Source

Bug Fixes

• Prevent "missing act" warning for queued microtasks (#​1137) (f78839b)

Features

• Bump @testing-library/dom to 9.0.0 (#​1177) (6653c23)
• Drop support for Node.js 12.x (#​1169) (9b7a1e2)

BREAKING CHANGES

• See https://github.com/testing-library/dom-testing-library/releases/tag/v9.0.0
• Minimum supported Node.js version is now 14.x

facebook/react (eslint-plugin-react-hooks)

v7.0.1

Compare Source

• Disallowed passing inline useEffectEvent values as JSX props to guard against accidental propagation. (#​34820 by @​jf-eirinha)
• Switch to export = so eslint-plugin-react-hooks emits correct types for consumers in Node16 ESM projects. (#​34949 by @​karlhorky)
• Tightened the typing of configs.flat so the configs export is always defined. (#​34950 by @​poteto)
• Fix named import runtime errors. (#​34951, #​34953 by @​karlhorky)

v7.0.0

Compare Source

This release slims down presets to just 2 configurations (recommended and recommended-latest), and all compiler rules are enabled by default.

• Breaking: Removed recommended-latest-legacy and flat/recommended configs. The plugin now provides recommended (legacy and flat configs with all recommended rules), and recommended-latest (legacy and flat configs with all recommended rules plus new bleeding edge experimental compiler rules). (@​poteto in #​34757)

v6.1.1

Compare Source

Note: 6.1.0 accidentally allowed use of recommended without flat config, causing errors when used with ESLint v9's defineConfig() helper. This has been fixed in 6.1.1.

• Fix recommended config for flat config compatibility. The recommended config has been converted to flat config format. Non-flat config users should use recommended-legacy instead. (@​poteto in #​34700)
• Add recommended-latest and recommended-latest-legacy configs that include React Compiler rules. (@​poteto in #​34675)
• Remove unused NoUnusedOptOutDirectives rule. (@​poteto in #​34703)
• Remove hermes-parser and dependency. (@​poteto in #​34719)
• Remove @babel/plugin-proposal-private-methods dependency. (@​ArnaudBarre and @​josephsavona in #​34715)
• Update for Zod v3/v4 compatibility. (@​kolian and @​josephsavona in #​34717)

v6.1.0

Compare Source

Note: Version 6.0.0 was mistakenly released and immediately deprecated and untagged on npm. This is the first official 6.x major release and includes breaking changes.

• Breaking: Require Node.js 18 or newer. (@​michaelfaith in #​32458)
• Breaking: Flat config is now the default recommended preset. Legacy config moved to recommended-legacy. (@​michaelfaith in #​32457)
• New Violations: Disallow calling use within try/catch blocks. (@​poteto in #​34040)
• New Violations: Disallow calling useEffectEvent functions in arbitrary closures. (@​jbrown215 in #​33544)
• Handle React.useEffect in addition to useEffect in rules-of-hooks. (@​Ayc0 in #​34076)
• Added react-hooks settings config option that to accept additionalEffectHooks that are used across exhaustive-deps and rules-of-hooks rules. (@​jbrown215) in #​34497

v6.0.0

Compare Source

Accidentally released. See 6.1.0 for the actual changes.

v5.2.0

Compare Source

• Support flat config (@​michaelfaith in #​30774)
• Convert the plugin to TypeScript and provide package type declarations (@​michaelfaith in #​32279, #​32283, #​32240, #​32400 and @​poteto in #​32420)
• Fix false positive error in components with do/while loops (@​tyxla in #​31720)
• Detect issues in class properties (@​mjesun & @​ecraig12345 in #​31823)

v5.1.0

Compare Source

• Add support for do/while loops (@​tyxla in #​28714)
• Fix error when callback argument is an identifier with an as expression (@​mskelton in #​31119)

v5.0.0

Compare Source

• New Violations: Component names now need to start with an uppercase letter instead of a non-lowercase letter. This means _Button or _component are no longer valid. (@​kassens) in #​25162

• Consider dispatch from useActionState stable. (@​eps1lon in #​29665)
• Add support for ESLint v9. (@​eps1lon in #​28773)
• Accept as expression in callback. (@​StyleShit in #​28202)
• Accept as expressions in deps array. (@​StyleShit in #​28189)
• Treat React.use() the same as use(). (@​kassens in #​27769)
• Move use() lint to non-experimental. (@​kassens in #​27768)
• Support Flow as expressions. (@​cpojer in #​27590)
• Allow useEffect(fn, undefined). (@​kassens in #​27525)
• Disallow hooks in async functions. (@​acdlite in #​27045)
• Rename experimental useEvent to useEffectEvent. (@​sebmarkbage in #​25881)
• Lint for presence of useEvent functions in dependency lists. (@​poteto in #​25512)
• Check useEvent references instead. (@​poteto in #​25319)
• Update RulesOfHooks with useEvent rules. (@​poteto in #​25285)

zpao/qrcode.react (qrcode.react)

v4.2.0

Compare Source

Added

• Added React v19 to peerDependencies (#​381)

v4.1.0

Compare Source

Added

• Added support for new boostLevel prop, allowing the disabling of the underlying encoder's default of automatically boosting the ECL. (#​374)
• Added support for accepting an array of strings for value, which enables encoding of each part into independent segments. (#​374)

v4.0.1

Compare Source

Fixed

• Corrected issue with loading types in Typescript when configured with "moduleResolution": "Bundler" or "module": "ESNext". (#​368)

v4.0.0

Compare Source

Added

• Added proper support for ref, enabling direct access for underlying canvas or svg nodes. This also resulted in much more accurate type defitions. (#​202)
• Added support for marginSize prop, replacing the now deprecated includeMargin. This enables margins of any value, not just 0 or 4. (#​281)
• Added Support for Setting Image Opacity via imageSettings.opacity (#​292)
• Added minVersion prop to give better control over QR Code generated (#​323)
• Added support for specifying cross-origin for embedded images via imageSettings.crossOrigin. (#​324)

Changed

• Improved accessibility for QRCodeSVG by rendering a <title> node instead of setting a title attribute. (#​284)
• Improved accessibility with explicit role set on rendered SVG and Canvas. (#​321)
• Improved documentation (#​358)
• Used better types in TypeScript for ErrorCorrectionLevel, resulting in better developer experience. (#​291)

Deprecated

• The includeMargin prop has been deprecated in favor of marginSize. (#​281)

Removed

• Removed default export which was deprecated in v3. (#​208)
• Remove explicit style prop. This still works identically as it was passed through and the type definitions are unaffected as they were improved via the ref changes (#​357)

Fixed

• Improved support for dual publishing of ESM/CJS modules for better compatibility with tools. (#​301)
• Set explicit display names for improved debugging experience. (#​304)
• Improved SVG compatibility by using href in place of xlink:href for embedded images. (#​336)
• Mitigated warnings when using QRCodeSVG in server components (#​352)

facebook/react (react)

v19.2.3: 19.2.3 (December 11th, 2025)

Compare Source

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #​35351)

v19.2.2: 19.2.2 (December 11th, 2025)

Compare Source

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #​35289)

v19.2.1: 19.2.1 (December 3rd, 2025)

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

v19.2.0

Compare Source

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

• <Activity>: A new API to hide and restore the UI and internal state of its children.
• useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
• cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
• React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

• Added resume APIs for partial pre-rendering with Web Streams:
  • resume: to resume a prerender to a stream.
  • resumeAndPrerender: to resume a prerender to HTML.
• Added resume APIs for partial pre-rendering with Node Streams:
  • resumeToPipeableStream: to resume a prerender to a stream.
  • resumeAndPrerenderToNodeStream: to resume a prerender to HTML.
• Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

• React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
• Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
• Use underscore instead of : IDs generated by useId

All Changes

React

• <Activity /> was developed over many years, starting before ClassComponent.setState (@​acdlite @​sebmarkbage and many others)
• Stringify context as "SomeContext" instead of "SomeContext.Provider" (@​kassens #​33507)
• Include stack of cause of React instrumentation errors with %o placeholder (@​eps1lon #​34198)
• Fix infinite useDeferredValue loop in popstate event (@​acdlite #​32821)
• Fix a bug when an initial value was passed to useDeferredValue (@​acdlite #​34376)
• Fix a crash when submitting forms with Client Actions (@​sebmarkbage #​33055)
• Hide/unhide the content of dehydrated suspense boundaries if they resuspend (@​sebmarkbage #​32900)
• Avoid stack overflow on wide trees during Hot Reload (@​sophiebits #​34145)
• Improve Owner and Component stacks in various places (@​sebmarkbage, @​eps1lon: #​33629, #​33724, #​32735, #​33723)
• Add cacheSignal (@​sebmarkbage #​33557)

React DOM

• Block on Suspensey Fonts during reveal of server-side-rendered content (@​sebmarkbage #​33342)
• Use underscore instead of : for IDs generated by useId (@​sebmarkbage, @​eps1lon: #​32001, #​33342#​33099, #​33422)
• Stop warning when ARIA 1.3 attributes are used (@​Abdul-Omira #​34264)
• Allow nonce to be used on hoistable styles (@​Andarist #​32461)
• Warn for using a React owned node as a Container if it also has text content (@​sebmarkbage #​32774)
• s/HTML/text for for error messages if text hydration mismatches (@​rickhanlonii #​32763)
• Fix a bug with React.use inside React.lazy-ed Component (@​hi-ogawa #​33941)
• Enable the progressiveChunkSize option for server-side-rendering APIs (@​sebmarkbage #​33027)
• Fix a bug with deeply nested Suspense inside Suspense fallback when server-side-rendering (@​gnoff #​33467)
• Avoid hanging when suspending after aborting while rendering (@​gnoff #​34192)
• Add Node Web Streams to server-side-rendering APIs for Node.js (@​sebmarkbage #​33475)

React Server Components

• Preload <img> and <link> using hints before they're rendered (@​sebmarkbage #​34604)
• Log error if production elements are rendered during development (@​eps1lon #​34189)
• Fix a bug when returning a Temporary reference (e.g. a Client Reference) from Server Functions (@​sebmarkbage #​34084, @​denk0403 #​33761)
• Pass line/column to filterStackFrame (@​eps1lon #​33707)
• Support Async Modules in Turbopack Server References (@​lubieowoce #​34531)
• Add support for .mjs file extension in Webpack (@​jennyscript #​33028)
• Fix a wrong missing key warning (@​unstubbable #​34350)
• Make console log resolve in predictable order (@​sebmarkbage #​33665)

React Reconciler

• createContainer and createHydrationContainer had their parameter order adjusted after on* handlers to account for upcoming experimental APIs

v19.1.4: 19.1.4 (December 11th, 2025)

Compare Source

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #​35351)

v19.1.3: 19.1.3 (December 11th, 2025)

Compare Source

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #​35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #​35289, #​35345)

v19.1.2: 19.1.2 (December 3rd, 2025)

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

v19.1.1

Compare Source

React

• Fixed Owner Stacks to work with ES2015 function.name semantics (#​33680 by @​hoxyq)

v19.1.0

Compare Source

Owner Stack

An Owner Stack is a string representing the components that are directly responsible for rendering a particular component. You can log Owner Stacks when debugging or use Owner Stacks to enhance error overlays or other development tools. Owner Stacks are only available in development builds. Component Stacks in production are unchanged.

• An Owner Stack is a development-only stack trace that helps identify which components are responsible for rendering a particular component. An Owner Stack is distinct from a Component Stacks, which shows the hierarchy of components leading to an error.
• The captureOwnerStack API is only available in development mode and returns a Owner Stack, if available. The API can be used to enhance error overlays or log component relationships when debugging. #​29923, #​32353, #​30306,
  #​32538, #​32529, #​32538

React

• Enhanced support for Suspense boundaries to be used anywhere, including the client, server, and during hydration. #​32069, #​32163, #​32224, #​32252
• Reduced unnecessary client rendering through improved hydration scheduling #​31751
• Increased priority of client rendered Suspense boundaries #​31776
• Fixed frozen fallback states by rendering unfinished Suspense boundaries on the client. #​31620
• Reduced garbage collection pressure by improving Suspense boundary retries. #​31667
• Fixed erroneous “Waiting for Paint” log when the passive effect phase was not delayed #​31526
• Fixed a regression causing key warnings for flattened positional children in development mode. #​32117
• Updated useId to use valid CSS selectors, changing format from :r123: to «r123». #​32001
• Added a dev-only warning for null/undefined created in useEffect, useInsertionEffect, and useLayoutEffect. #​32355
• Fixed a bug where dev-only methods were exported in production builds. React.act is no longer available in production builds. #​32200
• Improved consistency across prod and dev to improve compatibility with Google Closure Compiler and bindings #​31808
• Improve passive effect scheduling for consistent task yielding. #​31785
• Fixed asserts in React Native when passChildrenWhenCloningPersistedNodes is enabled for OffscreenComponent rendering. #​32528
• Fixed component name resolution for Portal #​32640
• Added support for beforetoggle and toggle events on the dialog element. #​32479

React DOM

• Fixed double warning when the href attribute is an empty string #​31783
• Fixed an edge case where getHoistableRoot() didn’t work properly when the container was a Document #​32321
• Removed support for using HTML comments (e.g. <!-- -->) as a DOM container. #​32250
• Added support for <script> and <template> tags to be nested within <select> tags. #​31837
• Fixed responsive images to be preloaded as HTML instead of headers #​32445

use-sync-external-store

• Added exports field to package.json for use-sync-external-store to support various entrypoints. #​25231

React Server Components

• Added unstable_prerender, a new experimental API for prerendering React Server Components on the server #​31724
• Fixed an issue where streams would hang when receiving new chunks after a global error #​31840, #​31851
• Fixed an issue where pending chunks were counted twice. #​31833
• Added support for streaming in edge environments #​31852
• Added support for sending custom error names from a server so that they are available in the client for console replaying. #​32116
• Updated the server component wire format to remove IDs for hints and console.log because they have no return value #​31671
• Exposed registerServerReference in client builds to handle server references in different environments. #​32534
• Added react-server-dom-parcel package which integrates Server Components with the Parcel bundler #​31725, #​32132, #​31799, #​32294, #​31741

v19.0.3: 19.0.3 (December 11th, 2025)

Compare Source

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #​35351)

v19.0.2: 19.0.2 (December 11th, 2025)

Compare Source

React Server Components

• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #​35289, #​35345)

v19.0.1: 19.0.1 (December 3rd, 2025)

Compare Source

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #​35277)

v19.0.0

Compare Source

Below is a list of all new features, APIs, deprecations, and breaking changes. Read React 19 release post and React 19 upgrade guide for more information.

Note: To help make the upgrade to React 19 easier, we’ve published a react@​18.3 release that is identical to 18.2 but adds warnings for deprecated APIs and other changes that are needed for React 19. We recommend upgrading to React 18.3.1 first to help identify any issues before upgrading to React 19.

New Features

React

• Actions: startTransition can now accept async functions. Functions passed to startTransition are called “Actions”. A given Transition can include one or more Actions which update state in the background and update the UI with one commit. In addition to updating state, Actions can now perform side effects including async requests, and the Action will wait for the work to finish before finishing the Transition. This feature allows Transitions to include side effects like fetch() in the pending state, and provides support for error handling, and optimistic updates.
• useActionState: is a new hook to order Actions inside of a Transition with access to the state of the action, and the pending state. It accepts a reducer that can call Actions, and the initial state used for first render. It also accepts an optional string that is used if the action is passed to a form action prop to support progressive enhancement in forms.
• useOptimistic: is a new hook to update state while a Transition is in progress. It returns the state, and a set function that can be called inside a transition to “optimistically” update the state to expected final value immediately while the Transition completes in the background. When the transition finishes, the state is updated to the new value.
• use: is a new API that allows reading resources in render. In React 19, use accepts a promise or Context. If provided a promise, use will suspend until a value is resolved. use can only be used in render but can be called conditionally.
• ref as a prop: Refs can now be used as props, removing the need for forwardRef.
• Suspense sibling pre-warming: When a component suspends, React will immediately commit the fallback of the nearest Suspense boundary, without waiting for the entire sibling tree to render. After the fallback commits, React will schedule another render for the suspended siblings to “pre-warm” lazy requests.

React DOM Client

• <form> action prop: Form Actions allow you to manage forms automatically and integrate with useFormStatus. When a <form> action succeeds, React will automatically reset the form for uncontrolled components. The form can be reset manually with the new requestFormReset API.
• <button> and <input> formAction prop: Actions can be passed to the formAction prop to configure form submission behavior. This allows using different Actions depending on the input.
• useFormStatus: is a new hook that provides the status of the parent <form> action, as if the form was a Context provider. The hook returns the values: pending, data, method, and action.
• Support for Document Metadata: We’ve added support for rendering document metadata tags in components natively. React will automatically hoist them into the <head> section of the document.
• Support for Stylesheets: React 19 will ensure stylesheets are inserted into the <head> on the client before revealing the content of a Suspense boundary that depends on that stylesheet.
• Support for async scr

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ EDITORCONFIG	editorconfig-checker	2		0	0.01s
✅ JSON	eslint-plugin-jsonc	1	0	0	0.92s
✅ JSON	jsonlint	1		0	0.26s
✅ JSON	npm-package-json-lint	yes		no	0.65s
✅ JSON	prettier	1	0	0	0.34s
✅ JSON	v8r	1		0	5.37s
✅ REPOSITORY	checkov	yes		no	40.62s
✅ REPOSITORY	git_diff	yes		no	0.02s
✅ REPOSITORY	grype	yes		no	12.51s
✅ REPOSITORY	trivy-sbom	yes		no	3.12s
✅ REPOSITORY	trufflehog	yes		no	134.58s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by