Do we need to updagrade react version manually ?

[healyxiang]

After used fix-react2shell-next，nextjs‘s version upgraded to fixed version, but react is still in a vulnerability version. Do we need to updagrade react version manually ?

"next": "16.0.7",
"next-intl": "^4.5.6",
"next-themes": "^0.4.6",
"react": "19.2.0",

[sabbir-shuvo-ux]

I’m also a bit confused here, after upgrading Next.js to the patched version, should we still manually upgrade react and react-dom as well, or is the Next.js patch enough?

I’m currently using react@19.0.0, which is listed as vulnerable.
Would love to know what others have done in this case.

[ansidot]

@sabbir-shuvo-ux I personally updated manually my react version from 19.2.0 to 19.2.1.

[sabbir-shuvo-ux]

@ansidot Thanks for sharing. I have also updated manually, upgraded my React from 19.0.0 to 19.0.1 to stay on a patched version.

[allenzhou101]

Hi! Thanks for raising this.

Upgrading react and react-dom do not affect the vulnerability. The packages that must be on patched versions include:

• next
• react-server-dom-parcel
• react-server-dom-turbopack
• react-server-dom-webpack

Read more in the advisory.

[ansidot]

@allenzhou101 Yes, at first I saw it here and they displayed the versions of React and Next, or it's fixed, which is why I updated react and react-dom. 😀