Wouldn't make more sense keeping React smaller and left those features to framew...

TZubiri · 2025-12-11T23:58:01 1765497481

But the react-components are a separate library, they are not installed by default

hollowturtle · 2025-12-12T00:04:58 1765497898

? afaik react server components made it to core

silverwind · 2025-12-12T00:45:05 1765500305

They shouldn't be loaded in a React SPA at least, e.g. `react-dom` and `react` packages should be unaffected.

TZubiri · 2025-12-12T04:58:00 1765515480

So they are part of the standard distribution (like through npm install react), but are unused by default? Something like that?

danabramov · 2025-12-12T09:16:51 1765531011

This code doesn’t exist in `react` or `react-dom`, no. Packages are released in lockstep to avoid confusion which is why everything got a version bump.

The vulnerable packages are the ones starting with `react-server-` (like `react-server-dom-webpack') or anything that vendors their code (like `next` does).

ivanjermakov · 2025-12-11T23:07:05 1765494425

git checkout v15.0.0

There we go.

hollowturtle · 2025-12-11T23:47:00 1765496820

Can I have v15 with the rendering optimizations of further versions?