Bump frontend and component library dependencies by masenf · Pull Request #6678 · reflex-dev/reflex

masenf · 2026-06-25T00:32:13Z

All Submissions:

Have you followed the guidelines stated in CONTRIBUTING.md file?
Have you checked to ensure there aren't any other open Pull Requests for the desired changed?

Type of change

New feature (non-breaking change which adds functionality)

Description

This PR bumps frontend and component library dependencies to their current releases (stable versions aged ≥ 7 days) across multiple packages.

Core frontend dependencies (reflex-base):

react / react-dom: 19.2.6 → 19.2.8
react-router, react-router-dom, @react-router/node, @react-router/dev, @react-router/fs-routes: 7.15.0 → 7.18.2 (includes a security fix; staying within 7.x)
isbot: 5.1.40 → 5.2.1
universal-cookie: 7.2.2 → 8.1.2
postcss: 8.5.14 → 8.5.22
autoprefixer: 10.5.0 → 10.5.4
@tailwindcss/typography: 0.5.19 → 0.5.20
Bun: 1.3.13 → 1.3.14
rich upper bound: <15 → <16 (adopting rich 15)

Component library updates:

reflex-components-plotly: react-plotly.js 2.6.0 → 4.0.0; plotly.js and its dist-min / locale variants 3.5.x → 3.7.0
reflex-components-code: shiki / @shikijs/transformers 3.3.0 → 4.3.1
reflex-components-core: react-error-boundary 6.1.1 → 6.1.2
reflex-components-lucide: lucide-react 1.14.0 → 1.26.0 (adds 46 new icons to the wrapper)
reflex-components-radix:
- @radix-ui/react-accordion: 1.2.12 → 1.2.18
- @radix-ui/react-dialog: 1.1.15 → 1.1.21 (also the react-dialog dep behind drawer)
- @radix-ui/react-form: 0.1.8 → 0.1.14
- @radix-ui/react-progress: 1.1.8 → 1.1.14
- @radix-ui/react-slider: 1.3.6 → 1.4.5
reflex-components-internal: @hugeicons/react 1.1.6 → 1.1.9, @hugeicons/core-free-icons 4.2.0 → 4.2.3, @icons-pack/react-simple-icons 13.8.0 → 13.13.0
reflex-site-shared: react-medium-image-zoom 5.4.2 → 5.4.8, @inkeep/cxkit-react 0.5.115 → 0.5.119

Other changes:

Replaced the now-redundant cookie package.json override with a postcss override pinning transitive resolutions to 8.5.22, keeping them on a patched release (≥ 8.5.18) for a security advisory. universal-cookie 8 and react-router both resolve cookie to 1.x on their own.
Updated reflex-hosting-cli to support rich 15.
Regenerated .pyi stubs for affected components.

Intentionally held back:

tailwindcss / @tailwindcss/postcss — kept at 4.3.0. 4.3.1 reworked @source/content file scanning (tailwindlabs/tailwindcss#20214 scan git-ignored referenced dirs, #20217 glob traversal, #20203 symlink preservation). reflex points tailwind's content globs at directories inside the git-ignored .web/, so 4.3.1+ began walking that tree; at the docs site's ~950-page scale (plus the build/ prerender output under .web/) the scan explodes, turning the prod export from under a minute into 900s+ (CI timeout). Adopting 4.3.1+ later will require teaching reflex to exclude the git-ignored/build trees from tailwind's scan. @tailwindcss/typography 0.5.20 is a separate plugin and is unaffected.
vite kept at 8.0.16, because 8.2.0 seemed to make the test_memo.py suite more adverse to timing issues.

All changes are non-breaking and maintain backward compatibility.

Test Plan

Existing unit tests pass. The dependency updates are configuration-only changes with no public API modifications; .pyi stub regeneration is automated and validated by the build system. The full dependency set is exercised by the reflex-docs prod-build CI job; the only held-back package (tailwindcss) is pinned to the version main builds green with.

https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

codspeed-hq · 2026-06-25T00:35:59Z

Merging this PR will degrade performance by 5.55%

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 1 regressed benchmark
✅ 25 untouched benchmarks
⏩ 8 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
❌	Simulation	`test_collect_imports[_complicated_page]`	1.5 ms	1.6 ms	-5.55%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing claude/gallant-lovelace-w3c4dp (c9aaeae) with main (35c03b5)}

8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

greptile-apps · 2026-06-25T00:36:51Z

Greptile Summary

This PR bumps a broad set of frontend and component library dependencies across the reflex monorepo to their current stable releases, while intentionally holding back Vite (regression with memoized components) and Tailwind CSS (source-file scanning regression at docs-site scale). The cookie override is replaced with a postcss override to pin transitive resolutions to the patched 8.5.23 release.

Core dependencies updated: React 19.2.8, react-router 7.18.2 (security fix), Bun 1.3.14, postcss 8.5.23, universal-cookie 7 → 8, isbot, autoprefixer, @tailwindcss/typography.
Component library bumps: react-plotly.js 2 → 4 (major), shiki / @shikijs/transformers 3 → 4 (major), 46 new lucide-react icons, Radix UI primitives, @hugeicons, simple-icons, site-shared packages.
rich upper bound relaxed to <16 in both reflex-base and reflex-hosting-cli; .pyi stubs regenerated accordingly.

Confidence Score: 5/5

Safe to merge — all dependency upgrades are backward-compatible, both major-version jumps (react-plotly.js 4, shiki 4) were verified against the APIs in use, and the two intentional holdbacks are documented with root-cause comments.

The changes are purely version bumps and lock-file updates. The react-plotly.js 2→4 major bump changes ref semantics (class to functional component), but Reflex never touches the class instance through a ref, so no runtime impact. The shiki 3→4 major bump dropped Node 18 but Reflex's frontend runs under Bun. The universal-cookie 7→8 bump is API-compatible for the three methods used in state.js.

Files Needing Attention: No files require special attention. All changed files correctly reflect the intended version pin or upgrade.

Important Files Changed

Filename	Overview
packages/reflex-base/src/reflex_base/constants/installer.py	Version bumps for react-router (7.18.2, security fix), React (19.2.8), isbot, universal-cookie (7→8), autoprefixer, postcss (8.5.23); vite held at 8.0.16 with documented regression comment; cookie override replaced with postcss override.
packages/reflex-components-plotly/src/reflex_components_plotly/plotly.py	react-plotly.js 2.6.0 → 4.0.0 (major) and plotly.js 3.5.x → 3.7.0; 4.0.0 changed ref handling (class→functional) but Reflex never accesses the class instance via ref, so the upgrade is compatible; factory subpath import still valid via package exports.
packages/reflex-components-code/src/reflex_components_code/shiki_code_block.py	shiki and @shikijs/transformers bumped from 3.3.0 to 4.3.1; shiki 4.x dropped Node 18 support (irrelevant — Reflex uses Bun), removed misspelled deprecated APIs not used here.
packages/reflex-components-lucide/src/reflex_components_lucide/icon.py	lucide-react bumped to 1.26.0; 46 new icon names added to LUCIDE_ICON_LIST; codespell:ignore suppression for 'astroid' is still present at line 242.
packages/reflex-base/src/reflex_base/plugins/tailwind_v4.py	Adds detailed inline comment explaining why tailwindcss is held at 4.3.0; no functional change.
packages/reflex-base/src/reflex_base/plugins/shared_tailwind.py	@tailwindcss/typography bumped from 0.5.19 to 0.5.20.
packages/reflex-components-radix/src/reflex_components_radix/primitives/drawer.py	@radix-ui/react-dialog lib_dependency updated 1.1.15 → 1.1.21 to match dialog.py.
packages/reflex-base/pyproject.toml	rich upper bound relaxed from <15 to <16 to adopt rich 15.
packages/reflex-hosting-cli/pyproject.toml	rich upper bound relaxed from <15 to <16, matching reflex-base.

_{Reviews (21): Last reviewed commit: "relock deps for docs/app" | Re-trigger Greptile}

Re-analyzed all bundled frontend npm pins and backend Python caps to their latest stable releases on top of latest main: - reflex-base: react/react-dom 19.2.8, react-router 7.18.1 (kept on 7.x rather than the new 8.x major), isbot 5.2.1, universal-cookie 8.1.2, postcss 8.5.21, tailwindcss/@tailwindcss/postcss 4.3.3, @tailwindcss/typography 0.5.20, Bun 1.3.14; removed the now-redundant cookie override; rich cap -> <16 (uv.lock resolves rich 15.0.0) - react-plotly.js 4.0.0 + plotly.js 3.7.0; shiki/@shikijs/transformers 4.3.1; react-error-boundary 6.1.2; lucide-react 1.25.0 (45 new icons added to the wrapper); Radix primitives (accordion/dialog/form/progress/slider); @hugeicons/react 1.1.9; @icons-pack/react-simple-icons 13.13.0; react-medium-image-zoom 5.4.8; @inkeep/cxkit-react 0.5.119 docs/app/reflex.lock is regenerated separately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

The plotly (react-plotly.js 4.0.0 / plotly.js 3.7.0) and shiki 4.3.1 bumps hang the reflex-docs production vite bundle at full docs scale (simple example apps build fine with them). Restore both to their previous pins — react-plotly.js 2.6.0 / plotly.js 3.5.x and shiki / @shikijs/transformers 3.3.0 — and drop their changelog fragments. The rest of the dependency bumps are unaffected. docs/app/reflex.lock still needs regenerating so its frozen plotly/shiki entries return to these previous pins. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

cubic-dev-ai

All reported issues were addressed across 26 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

postcss < 8.5.18 carries a security advisory. The direct pin is already 8.5.21, but transitive deps can still resolve an older 8.5.x (the docs frozen lock had postcss 8.5.15). Add a `postcss` entry to installer.py OVERRIDES so every resolution is forced to 8.5.21 (>= 8.5.18) once locks are regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

Rename the per-package +dependency-pin-bumps.misc.md fragments to 6678.misc.md so the changelog entries link to PR #6678. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

react-router 7.18.1's @react-router/dev vite plugin emits chunking options (advancedChunks/jsx) that vite 8.0.16's bundled rolldown rejects, collapsing route code-splitting into a near-monolithic bundle. At the docs site's ~950-page scale this turns the prod export from under a minute into 8+ minutes (>900s in CI, hitting the port timeout). vite is unchanged from main and every other bumped dep is runtime-only, so react-router is the sole build-time regression. Revert its pin to 7.15.0 (the version main builds green with); all other bumps in this PR stand. Drop the now net-zero react-router line from the changelog. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

tailwindcss 4.3.1 reworked @source/content file scanning (tailwindlabs/ tailwindcss#20214 scan git-ignored referenced dirs, #20217 glob traversal, #20203 symlink preservation). reflex points tailwind's content globs at directories inside the git-ignored .web/, so 4.3.1+ began walking that tree; at the docs site's ~950-page scale (plus the build/ prerender output living under .web/) the scan explodes, turning the prod export from under a minute into >900s and hitting the CI port timeout. Pin tailwindcss and @tailwindcss/postcss back to 4.3.0 (main's version). @tailwindcss/typography 0.5.20 is a separate plugin, unaffected, and stands. Drop the now net-zero tailwindcss line from the changelog. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

cubic-dev-ai

All reported issues were addressed across 2 files (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

Now that the docs prod-build regression is confirmed to be tailwindcss 4.3.1+ (not plotly, shiki, or react-router), un-hold the pins reverted while chasing it: - react-plotly.js 2.6.0 -> 4.0.0; plotly.js (+ dist-min/locale variants) 3.5.x -> 3.7.0 - shiki / @shikijs/transformers 3.3.0 -> 4.3.1 - react-router and related packages 7.15.0 -> 7.18.2 (7.18.2 carries a security fix; staying within 7.x) Simple apps build fine with the plotly/shiki majors; the docs hang was tailwind's source scanner, addressed separately by holding tailwind at 4.3.0. Restore the plotly and code changelog fragments and re-add the react-router line to the reflex-base fragment. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

cubic-dev-ai

All reported issues were addressed across 6 files (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

Re-checked the batch against npm for stable versions aged >=7 days: - vite 8.0.16 -> 8.2.0 - postcss 8.5.21 -> 8.5.22 (dep + security override) - autoprefixer 10.5.0 -> 10.5.4 - lucide-react 1.25.0 -> 1.26.0 (adds shield_keyhole; 46 new vs 1.14.0) - @radix-ui: accordion 1.2.18, dialog 1.1.21 (+ drawer), form 0.1.14, progress 1.1.14, slider 1.4.5 - @hugeicons/core-free-icons 4.2.0 -> 4.2.3 tailwindcss stays at 4.3.0 (4.3.1+ scanner regression); react-router stays at 7.18.2 (already ahead of the aged 7.x line for its security fix). Regenerated pyi_hashes.json for the lucide icon-list change and updated the changelog fragments. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

cubic-dev-ai

All reported issues were addressed across 13 files (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 2 files (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

vite 8.2.0 declares postcss `^8.5.23`; the security override was forcing postcss to 8.5.22 for every consumer (including vite), one patch below that floor. Raise the postcss dep and override to 8.5.23 (published 2026-07-24, ~7 days aged, still >= 8.5.18 for the advisory) so vite resolves within its declared range. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

…ce-w3c4dp

…-148 memo regression TEMPORARY diagnostic commit (unmerged branch). Reverts react-router 7.18.2->7.15.0 and vite 8.2.0->8.0.16 (main's known-green pair) while keeping react 19.2.8 and all component-lib bumps, to test whether a browser-interacting frontend dep is responsible for the memoized-component re-render failures seen only on CI's Chrome-for-Testing 148. The react-router security bump will be restored once the culprit is confirmed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

cubic-dev-ai

All reported issues were addressed across 1 file (changes from recent commits).

_{Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic}

Bisected the memoized-component re-render failures in the full playwright suite to vite: with all other bumps identical (react-router 7.18.2, react 19.2.8), a full-suite run is green on vite 8.0.16 and fails 7 memo tests on vite 8.2.0. The failure needs the full sequential suite (memo files pass in isolation) and is browser-independent (reproduced on Chromium 1194 locally, not just CI's Chrome 148). Restores the react-router 7.18.2 security pin (exonerated) and holds vite at 8.0.16 pending root-cause of the 8.2.0 regression. docs/app/reflex.lock still needs a relock to vite 8.0.16. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017VbHTc3JxgKUNBCrCMN2cp

masenf requested review from a team and Alek99 as code owners June 25, 2026 00:32

masenf force-pushed the claude/gallant-lovelace-w3c4dp branch from c87cb44 to 7c42ff5 Compare June 25, 2026 16:26

masenf force-pushed the claude/gallant-lovelace-w3c4dp branch from c3aefba to 367b496 Compare July 29, 2026 20:58

greptile-apps Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread packages/reflex-components-lucide/src/reflex_components_lucide/icon.py

masenf force-pushed the claude/gallant-lovelace-w3c4dp branch from 367b496 to 39b366a Compare July 29, 2026 21:07

masenf and others added 2 commits July 29, 2026 20:59

update reflex.lock for docs/app

e71b481

cubic-dev-ai Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread packages/reflex-base/src/reflex_base/constants/installer.py Outdated

Comment thread docs/app/reflex.lock/package.json

Comment thread docs/app/reflex.lock/package.json

claude and others added 5 commits July 31, 2026 19:28

revert plotly and shiki pins in docs/app

3a2c5dc

cubic-dev-ai Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread packages/reflex-base/src/reflex_base/plugins/tailwind_v4.py

cubic-dev-ai Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread packages/reflex-components-code/src/reflex_components_code/shiki_code_block.py

claude and others added 2 commits July 31, 2026 21:42

finalize docs/app reflex.lock pins

309d7ff

cubic-dev-ai Bot reviewed Jul 31, 2026

View reviewed changes

Comment thread docs/app/reflex.lock/package.json Outdated

claude and others added 4 commits July 31, 2026 22:15

relock deps for docs/app

55911d1

Merge remote-tracking branch 'origin/main' into claude/gallant-lovela…

020083a

…ce-w3c4dp

greptile-apps Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread packages/reflex-base/src/reflex_base/constants/installer.py Outdated

cubic-dev-ai Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread packages/reflex-base/src/reflex_base/constants/installer.py Outdated

Comment thread packages/reflex-base/src/reflex_base/constants/installer.py

claude and others added 2 commits August 3, 2026 18:08

relock deps for docs/app

c9aaeae

masenf enabled auto-merge (squash) August 3, 2026 18:46

FarhanAliRaza approved these changes Aug 3, 2026

View reviewed changes

masenf merged commit 9fcce60 into main Aug 3, 2026
131 of 133 checks passed

masenf deleted the claude/gallant-lovelace-w3c4dp branch August 3, 2026 18:48

Uh oh!

Conversation

masenf commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

All Submissions:

Type of change

Description

Test Plan

Uh oh!

codspeed-hq Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will degrade performance by 5.55%

Performance Changes

Footnotes

Uh oh!

greptile-apps Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

masenf commented Jun 25, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 25, 2026 •

edited

Loading

greptile-apps Bot commented Jun 25, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading