browser() is a new API for components that depend on the browser.
Calling use(browser()) suspends during server rendering, so React can show the nearest Suspense fallback and continue rendering the component on the client.
react.dev/reference/react-do…
Fragment Refs are now stable.
Pass a ref to <Fragment> to work with its DOM children as a group, without adding a wrapper element. FragmentInstance includes APIs for events, focus, observers, measurement, and scrolling.
react.dev/reference/react/Fr…
<ViewTransition> is now stable.
It can animate UI as it enters, exits, or updates. Transitions, Suspense reveals, and deferred updates can trigger the animation.
react.dev/reference/react/Vi…
React 19.3 is now available!
This release makes View Transitions and Fragment Refs stable, and adds browser(), Trusted Types support, and Context in Server Components.
react.dev/blog/2026/09/09/re…
A huge thank you to React Conf 2025's sponsors. This event wouldn't be possible without the support of our incredible partners conf.react.dev/#sponsors
We found that the fix to address the DoS vulnerability in React Server Components (CVE-2025-55184) was incomplete and does not prevent an attack in a specific case.
This is disclosed as CVE-2025-67779. New patches are available now, please update immediately.
These vulnerabilities are present in the patches published last week for React2Shell.
Even though they do not allow for Remote Code Execution they are high severity and you should update (again) immediately.
react.dev/blog/2025/12/11/de…
This pattern shows up across the industry.
For example, after Log4Shell, additional CVEs were reported as the community examined the original fix.
Additional disclosures can be frustrating, but they are generally a sign of a healthy response cycle.