After used fix-react2shell-next，nextjs‘s version upgraded to fixed version, but react is still in a vulnerability version. Do we need to updagrade react version manually ?
"next": "16.0.7", "next-intl": "^4.5.6", "next-themes": "^0.4.6", "react": "19.2.0",
Activity
5
ansidot11mo ago@sabbir-shuvo-ux I personally updated manually my react version from 19.2.0 to 19.2.1.
sabbir-shuvo-ux11mo ago@ansidot Thanks for sharing. I have also updated manually, upgraded my React from 19.0.0 to 19.0.1 to stay on a patched version.
allenzhou10111mo agoHi! Thanks for raising this.
Upgrading react and react-dom do not affect the vulnerability. The packages that must be on patched versions include:
nextreact-server-dom-parcelreact-server-dom-turbopackreact-server-dom-webpack
Read more in the advisory.
ansidot11mo ago@allenzhou101 Yes, at first I saw it here and they displayed the versions of React and Next, or it's fixed, which is why I updated react and react-dom. 😀
I’m also a bit confused here, after upgrading Next.js to the patched version, should we still manually upgrade react and react-dom as well, or is the Next.js patch enough?
I’m currently using
react@19.0.0,which is listed as vulnerable. Would love to know what others have done in this case.