4 ms·
They shouldn't be loaded in a React SPA at least, e.g. `react-dom` and `react` packages should be unaffected.
by silverwind 10mo ago
They shouldn't be loaded in a React SPA at least, e.g. `react-dom` and `react` packages should be unaffected.
- TZubiri 10mo agoSo they are part of the standard distribution (like through npm install react), but are unused by default? Something like that?
- danabramov 10mo agoThis code doesn’t exist in `react` or `react-dom`, no. Packages are released in lockstep to avoid confusion which is why everything got a version bump. The vulnerable packages are the ones starting with `react-server-` (like `react-server-dom-webpack') or anything that vendors their code (like `next` does).