reflex-hosting-cli@0.1.69

Features

• deploy() accepts min_instances and max_instances, which are applied to the app before the deployment is submitted so it picks the new autoscaling bounds up. Only the bounds explicitly passed are sent, so apps keep their platform defaults otherwise. (#6884)

Bug Fixes

• --vmtype is no longer dropped when deploying to Google Cloud. The server maps VM types onto Cloud Run CPU/memory limits, so the flag is now passed through; only --region is still ignored for that target, since the region comes from the connected GCP account. (#6884)

reflex-release@0.1.0a1

Features

• New package: reflex-release extracts Reflex's changelog-driven release pipeline — the towncrier news-fragment workflow, the changelog-as-source-of-truth publish detection, and the human-gated PyPI upload — into a reusable tool other repositories can adopt with uvx reflex-release init. It scaffolds the GitHub Actions workflows into the consuming repository (required for PyPI trusted publishing, which validates the workflow's own repository) and keeps them in step with reflex-release sync --check. Repository shape lives in a [tool.reflex-release] table: single package or monorepo, branch policy, lockstep groups that release together at one version, and internal packages that release without a changelog. Every upload waits on an approval from the pypi environment's required reviewers, and the artifacts it covers are named by SHA-256 in the run summary and in a manifest attached to the GitHub release. See packages/reflex-release/README.md for setup, configuration and the security model. (#6868)

v0.9.8

reflex v0.9.8 ships alongside reflex-base 0.9.8, reflex-components-code 0.9.3, reflex-components-core 0.9.8, reflex-components-lucide 1.0.3, reflex-components-moment 0.9.3, reflex-components-plotly 0.9.4, reflex-components-radix 0.9.7, reflex-components-recharts 0.9.2, and reflex-docgen 0.9.4.

Features

• New preview run mode (reflex run --env preview) hot reloads like dev, but serves a freshly built frontend bundle mounted into the backend instead of running the Vite dev server. Minification, CSS minification, autoprefixer, and sourcemaps are all off by default for faster rebuilds and readable output, each overridable via VITE_MINIFY, REFLEX_NO_AUTOPREFIXER, and VITE_SOURCEMAP. (#6663)
• rx.asset URLs now carry a short content hash (rx.asset("logo.svg") → /logo.svg?v=a1b2c3d4), so browsers refetch an asset only when its contents actually change. (#6550)
• Mutable state values can be used as async context managers, so a helper that receives only the value can refresh it from its owning state and hold the same exclusive lock as async with self. Root mutable fields and nested values reached through stable dict keys or object attributes are supported; values taken from list indexes, slices, iteration, or a missing dict.get() default can't be re-identified after concurrent state changes and raise RuntimeError. (#6689)
• Plugins can contribute pages through a new staged Plugin.register_route hook, which runs once per app before page evaluation — with add_page and has_app_page capabilities — so a plugin's pages land atomically, and the cached route resolver is invalidated when a page is added after it was first built. rx.plugins.get_plugin() looks up a configured plugin instance by type, raising ConfigError on ambiguous matches. (#6728)
• reflex deploy gained --provider (deploy to Reflex Cloud or a GCP account connected to your organization) and --description (record an optional changelog note on the deployment, shown in reflex cloud apps history). (#6810)
• rx.recharts.layer and rx.recharts.rectangle wrap the Recharts Layer and Rectangle components, used for constructing custom node elements. (#6729)
• reflex-docgen gained typed description and image frontmatter fields on FrontMatter, parsed from docs and preserved by the markdown writer, for per-page SEO metadata. (#6464)

Bug Fixes

• Two Windows-only frontend failures are fixed — nested/subfolder stylesheets failed to load because the generated CSS @import used backslash path separators (which CSS treats as escape sequences), so the import URL is now always POSIX-normalized (#6762); and production frontend hydration broke when the system MIME registry maps JavaScript files to text/plain (#6831).
• Fixed reflex run failing with error: lockfile had changes, but lockfile is frozen after upgrading to a Reflex version that adds a package.json override. A persisted reflex.lock/package.json is now restored as-is and the framework-owned overrides are merged into .web/package.json after the frozen install, so the restored package.json/lockfile pair is no longer treated as out of date (#6844). Persisted package.json files are also processed before being mirrored into the web directory (#6765).
• reflex rename no longer corrupts or fails on source files under non-UTF-8 platform locales, while preserving declared Python source encodings and line endings. (#6761)
• Fixed reflex component build crashing with AttributeError on Python 3.10 and 3.11, by delegating recursive stub generation to the Python 3.10-compatible PyiGenerator scanner. (#6760)
• Event processor shutdown is cleaner — queued same-token events are drained during a graceful shutdown (#6791), and on Python 3.13+ the loop catches the native asyncio.QueueShutDown instead of surfacing uncaught exceptions while stopping (#6773).
• Editing a route that hasn't been loaded yet no longer poisons React Router's browser-side HMR queue, which previously blocked every later hot update until a full page reload. (#6774)
• Unannotated @rx.memo component parameters keep their runtime value types. (#6659)
• Timezone-aware datetime Vars compare by their instants instead of by their serialized UTC offsets. (#6767)
• Custom attributes on a Field are now carried onto the rebuilt field by reference instead of deep-copied, so stateful callable markers keep their identity and markers holding non-copyable values (locks, clients) no longer crash state class creation. (#6809)
• rx.moment is now a MemoizationLeaf, so a stateful date child is no longer memo-wrapped — react-moment parsed the wrapped value like moment({}) and rendered today at midnight. (#6784)

Miscellaneous

• Bundled frontend and component-library dependency pins were bumped to their current releases (#6678):

  • react / react-dom: 19.2.6 → 19.2.8
  • react-router, react-router-dom, @react-router/node, @react-router/dev, @react-router/fs-routes: 7.15.0 → 7.18.2
  • vite: 8.0.16 → 8.2.0, postcss: 8.5.14 → 8.5.23, autoprefixer: 10.5.0 → 10.5.4
  • isbot: 5.1.40 → 5.2.1, universal-cookie: 7.2.2 → 8.1.2, @tailwindcss/typography: 0.5.19 → 0.5.20
  • Bun: 1.3.13 → 1.3.14
  • lucide-react: 1.14.0 → 1.26.0, adding 46 new icons
  • react-plotly.js: 2.6.0 → 4.0.0, with plotly.js (and its dist-min / locale variants) 3.5.x → 3.7.0
  • shiki / @shikijs/transformers: 3.3.0 → 4.3.1
  • react-error-boundary: 6.1.1 → 6.1.2
  • Radix primitives — @radix-ui/react-accordion: 1.2.12 → 1.2.18, @radix-ui/react-dialog: 1.1.15 → 1.1.21, @radix-ui/react-form: 0.1.8 → 0.1.14, @radix-ui/react-progress: 1.1.8 → 1.1.14, @radix-ui/react-slider: 1.3.6 → 1.4.5

  The rich upper bound also rose to <16 (adopting rich 15). The now-redundant cookie package.json override (universal-cookie 8 and react-router resolve cookie to 1.x on their own) was replaced with a postcss override pinning 8.5.23 — which also satisfies vite 8.2.0's ^8.5.23 — so transitive resolutions stay on a release patched for a security advisory (>= 8.5.18).

• Development-only dependency pins were updated to clear CVE reports: Pillow==12.3.0 (#6836), and locked aiohttp==3.14.3 / cryptography==50.0.0, clearing CVE-2026-59881, CVE-2026-69243, CVE-2026-69244 and CVE-2026-69247 (#6837). The latter two are transitive development dependencies of the docs app and are not installed with Reflex.

• The unused REFLEX_USE_TURBOPACK environment variable was removed. Turbopack is a Next.js bundler; the flag has had no effect since Reflex moved to React Router and Vite in 0.8. (#6803)

Full Changelog: v0.9.7...v0.9.8

reflex@0.9.8a3

Bug Fixes

• Fixed reflex run failing with error: lockfile had changes, but lockfile is frozen after upgrading to a Reflex version that adds a package.json override. Overrides are now applied after the lockfile saved in reflex.lock/ has been installed, so it is no longer treated as out of date. (#6844)

reflex@0.9.8a2

Miscellaneous

• Update dev pin Pillow==12.3.0 to avoid various CVE reports (#6836)
• Update locked aiohttp==3.14.3 and cryptography==50.0.0, clearing CVE-2026-59881, CVE-2026-69243, CVE-2026-69244 and CVE-2026-69247. Both are transitive development dependencies of the docs app and are not installed with Reflex. (#6837)

reflex-docgen@0.9.4

Features

• Added typed description and image frontmatter fields to FrontMatter, parsed from docs and preserved by the markdown writer, for per-page SEO metadata. (#6464)

reflex-components-recharts@0.9.2

Features

• Added rx.recharts.layer and rx.recharts.rectangle, wrapping the Recharts Layer and Rectangle components used for constructing custom node elements.

reflex-components-radix@0.9.7

Miscellaneous

• Bumped Radix UI primitive pins:

  • @radix-ui/react-accordion: 1.2.12 → 1.2.18
  • @radix-ui/react-dialog: 1.1.15 → 1.1.21
  • @radix-ui/react-form: 0.1.8 → 0.1.14
  • @radix-ui/react-progress: 1.1.8 → 1.1.14
  • @radix-ui/react-slider: 1.3.6 → 1.4.5

  (#6678)

reflex-components-plotly@0.9.4

Miscellaneous

• Bumped react-plotly.js 2.6.0 → 4.0.0, with plotly.js (and its dist-min / locale variants) 3.5.x → 3.7.0. (#6678)

reflex-components-moment@0.9.3

Bug Fixes

• Make rx.moment a MemoizationLeaf so a stateful date child is not memo-wrapped, which react-moment parsed like moment({}) (today at midnight).