Skip to content

[Snyk] Upgrade react-dom from 18.2.0 to 18.3.1 #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RemyLoveLogicAI wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade react-dom from 18.2.0 to 18.3.1 #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 15 additions & 12 deletions skyvern-frontend/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion skyvern-frontend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@
"open": "^10.1.0",
"posthog-js": "^1.138.0",
"react": "^18.2.0",
"react-dom": "^18.2.0",
"react-dom": "^18.3.1",
Comment on lines 58 to +59

@gemini-code-assist gemini-code-assist Bot Dec 2, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

To ensure compatibility and avoid potential runtime errors, the react package version should be aligned with the react-dom version. It's best practice to keep them in sync. Since react-dom is being upgraded to 18.3.1, react should also be upgraded to ^18.3.1.

Suggested change
"react": "^18.2.0",
"react-dom": "^18.2.0",
"react-dom": "^18.3.1",
"react": "^18.3.1",
"react-dom": "^18.3.1",

@vercel vercel Bot Dec 2, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The react version in package.json is still pinned to ^18.2.0 while react-dom has been upgraded to ^18.3.1. This creates a version mismatch since react-dom@18.3.1 requires react@^18.3.1.

View Details
📝 Patch Details 
diff --git a/skyvern-frontend/package.json b/skyvern-frontend/package.json
index 88e63d7..887d4e4 100644
--- a/skyvern-frontend/package.json
+++ b/skyvern-frontend/package.json
@@ -55,7 +55,7 @@
     "nanoid": "^5.0.7",
     "open": "^10.1.0",
     "posthog-js": "^1.138.0",
-    "react": "^18.2.0",
+    "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-github-btn": "^1.4.0",
     "react-hook-form": "^7.51.1",

Analysis

Incomplete React version upgrade in package.json

What fails: The react package version constraint does not match the requirement declared by react-dom@18.3.1. While react-dom@18.3.1 declares a peerDependency of react@^18.3.1, the package.json specifies react@^18.2.0, allowing versions incompatible with react-dom@18.3.1.

How to reproduce:

# Verify the peerDependency requirement
npm view react-dom@18.3.1 peerDependencies
# Returns: { react: '^18.3.1' }

# Check package.json (before fix)
grep "\"react\":" skyvern-frontend/package.json
# Shows: "react": "^18.2.0"

Result: The version ranges don't properly align - ^18.2.0 includes version 18.2.0 which does not satisfy react-dom's requirement of ^18.3.1 (which requires 18.3.1 or higher). While npm v7+ intelligently resolves this to 18.3.1 in practice, the package.json constraint is semantically incorrect and could cause issues in other dependency resolution scenarios.

Expected: Both packages should specify compatible version constraints. According to the git history, commit 0f77681 upgraded react-dom from 18.2.0 to 18.3.1 but forgot to upgrade react to match.

Fix applied: Updated line 58 from "react": "^18.2.0" to "react": "^18.3.1" to match the version requirement of react-dom@18.3.1.

@cubic-dev-ai cubic-dev-ai Bot Dec 2, 2025 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: react-dom was bumped to 18.3.1 without upgrading react, violating react-dom’s ^18.3.1 peer dependency and risking install/runtime issues. Upgrade the react dependency to the same 18.3.1 range when bumping react-dom.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At skyvern-frontend/package.json, line 59:

<comment>react-dom was bumped to 18.3.1 without upgrading react, violating react-dom’s ^18.3.1 peer dependency and risking install/runtime issues. Upgrade the react dependency to the same 18.3.1 range when bumping react-dom.</comment>

<file context>
@@ -56,7 +56,7 @@
     &quot;posthog-js&quot;: &quot;^1.138.0&quot;,
     &quot;react&quot;: &quot;^18.2.0&quot;,
-    &quot;react-dom&quot;: &quot;^18.2.0&quot;,
+    &quot;react-dom&quot;: &quot;^18.3.1&quot;,
     &quot;react-github-btn&quot;: &quot;^1.4.0&quot;,
     &quot;react-hook-form&quot;: &quot;^7.51.1&quot;,
</file context>
Fix with Cubic

"react-github-btn": "^1.4.0",
"react-hook-form": "^7.51.1",
"react-router-dom": "^6.22.3",
Expand Down