## Summary



## How did you test this change?

## Summary

- Added `Cloned` to `BeforeAndAfterMutationTransitionMask` (gated behind `enableViewTransitionForPersistenceMode`) so the before-mutation phase traverses into subtrees where persistence-mode clones occurred, allowing `shouldStartViewTransition` to be set and `flushAfterMutationEffects` to run
- Introduced `commitHostCloned()` in `ReactFiberCommitHostEffects` to call `trackHostMutation()` for persistence-mode clones, so `viewTransitionMutationContext` is set and the `Update` flag gets applied to parent `ViewTransition` fibers during commit

## Root Cause

In persistence mode (Fabric), host component updates happen via `cloneInstance` during the render phase (`completeWork`), not via `commitUpdate` during commit. The view transition system relied on two mutation-mode-only mechanisms:

1. `BeforeAndAfterMutationTransitionMask` didn't include `Cloned`, so the before-mutation traversal skipped subtrees with only persistence-mode changes — `startViewTransition` was never called and `flushAfterMutationEffects` never ran
2. `trackHostMutation()` was only called from mutation-mode commit paths (`commitHostUpdate`, `commitHostTextUpdate`), so `viewTransitionMutationContext` stayed `false` and the `Update` flag was never set on `ViewTransition` fibers

## Test plan

- [ ] Verify `onUpdate` fires on `ViewTransition` components in React Native Fabric when child host components update
- [ ] Verify no impact on DOM renderer (changes are gated behind `enableViewTransitionForPersistenceMode` and `supportsPersistence`)
- [ ] Verify enter/exit (share) transitions continue to work in Fabric

CLA Signed

Enable ViewTransition onUpdate for persistence mode (Fabric)

## Summary

The dev-mode `console.warn` messages for `useEffect`, `useInsertionEffect`, and `useLayoutEffect` in `packages/react/src/ReactHooks.js` are currently vague when the `create` callback is `null` or `undefined`.

## Current Behavior

All three hooks produce this generic message:

```
React Hook useEffect requires an effect callback. Did you forget to pass a callback to the hook?
```

This message:
- Does **not** distinguish between `null` and `undefined` being passed
- Does **not** explain what the callback signature should look like
- Leaves beginners confused about what the correct fix is

## Expected Behavior

The warning should:
1. Say explicitly whether `null` or `undefined` was received
2. Explain that the hook expects a function that optionally returns a cleanup function
3. Be consistent across all three effect hooks

**Example improved message:**
```
React Hook useEffect received a null effect callback. useEffect must be passed a function that optionally returns a cleanup function. Did you accidentally pass nothing or the result of a function call instead of the function itself?
```

## Motivation

This is a very common beginner mistake — for example, passing `useEffect(someAsyncFn(), [])` (calling the function) instead of `useEffect(someAsyncFn, [])` (passing the function). A clearer error message would surface the root cause faster.

## Fix

A fix has been submitted in PR #36361.

## Affected Files

- `packages/react/src/ReactHooks.js`

Improvement: useEffect/useInsertionEffect/useLayoutEffect null-check warning messages are vague and don't distinguish null vs undefined

## Summary

The existing dev-mode `console.warn` messages in `useEffect`, `useInsertionEffect`, and `useLayoutEffect` (in `packages/react/src/ReactHooks.js`) are vague when the `create` callback is `null` or `undefined`.

**Before (all three hooks had this):**
```
React Hook useEffect requires an effect callback. Did you forget to pass a callback to the hook?
```

This message doesn't distinguish between `null` and `undefined`, and doesn't explain what the callback should look like, which is a common source of confusion for beginners.

**After:**
```
React Hook useEffect received a null effect callback. useEffect must be passed a function that optionally returns a cleanup function. Did you accidentally pass nothing or the result of a function call instead of the function itself?
```

## Changes

- `useEffect` — improved warning to mention `null` or `undefined` explicitly and explain the expected signature
- `useInsertionEffect` — same improvement, consistent phrasing
- `useLayoutEffect` — same improvement, consistent phrasing

All three hooks now use template literals to dynamically include whether the value was `null` or `undefined`, making it easier for developers to quickly understand and fix the issue.

## Test Plan

No new tests required — this is a dev-mode warning message improvement only. Existing tests for null callback behaviour remain unchanged.

## Related

Addresses common confusion reported by beginners around vague hook error messages.

fix: improve null/undefined warning messages for useEffect, useInsertionEffect, and useLayoutEffect

## Summary
Upgrade basic-ftp from 5.0.5 to 5.2.0 to fix CVE-2026-27699.

## Vulnerability
| Field | Value |
|-------|-------|
| **ID** | CVE-2026-27699 |
| **Severity** | CRITICAL |
| **Scanner** | trivy |
| **Rule** | `CVE-2026-27699` |
| **File** | `compiler/yarn.lock` |

**Description**: basic-ftp: basic-ftp: File overwrite due to path traversal

## Changes
- `compiler/package.json`
- `compiler/yarn.lock`

## Verification
- [x] Build passes
- [x] Scanner re-scan confirms fix
- [x] LLM code review passed

---
*Automated security fix by [OrbisAI Security](https://orbisappsec.com)*


fix: upgrade basic-ftp to 5.2.0 (CVE-2026-27699)

> Draft / WIP. Filing this as a draft to start a conversation; happy to add a regression test or refactor based on feedback.

## Summary

When `ReactDOM.preload(href, { as: 'style' })` runs before a fresh `<link rel=\"stylesheet\" href={href} precedence>` mounts inside a new `<Suspense>` boundary, `getResource` short-circuits on `preloadPropsMap.has(key)`, skips the `preloadStylesheet` call, and leaves `state.loading` at `NotLoaded`. `completeWork` then throws `SuspenseyCommitException` and the boundary paints its fallback even though the preload bytes are already in the browser's cache.

## Trace

In `packages/react-dom-bindings/src/client/ReactFiberConfigDOM.js`, the stylesheet branch of `getResource` looked like this before the fix:

```js
if (!preloadPropsMap.has(key)) {
  const preloadProps = preloadPropsFromStylesheet(qualifiedProps);
  preloadPropsMap.set(key, preloadProps);
  if (!instance) {
    preloadStylesheet(ownerDocument, key, preloadProps, resource.state);
  }
}
```

The `preloadStylesheet` call is the only path that queries the existing `<link rel=\"preload\" as=\"style\">` and flips `state.loading` to `Loaded`. It is gated behind `!preloadPropsMap.has(key)`, but `preloadPropsMap` is populated unconditionally by `ReactDOM.preload(...)` (the `L` handler). So the sequence

1. `ReactDOM.preload(href, { as: 'style' })` — populates `preloadPropsMap`, inserts `<link rel=\"preload\" as=\"style\">`
2. Render reaches `<link rel=\"stylesheet\" href={href} precedence>` inside a fresh `<Suspense>` (= `shellBoundary`)
3. `getResource` creates a fresh resource with `state.loading = NotLoaded`
4. Stylesheet `querySelector` misses (no `<link rel=\"stylesheet\">` in the document yet)
5. `preloadPropsMap.has(key) === true` → `preloadStylesheet` not called → `state.loading` stays at `NotLoaded`
6. `completeWork` → `preloadResourceAndSuspendIfNeeded` → throws `SuspenseyCommitException`
7. The Suspense fallback paints (visible empty shell)

## Fix

Decouple the `preloadStylesheet` call from the `preloadPropsMap.has(key)` gate. Reuse the stored props when the map already has an entry so we still query for the matching `<link rel=\"preload\">` and update `state.loading` accordingly:

```js
let preloadProps: PreloadProps;
const existingPreloadProps = preloadPropsMap.get(key);
if (existingPreloadProps) {
  preloadProps = (existingPreloadProps: any);
} else {
  preloadProps = preloadPropsFromStylesheet(qualifiedProps);
  preloadPropsMap.set(key, preloadProps);
}
if (!instance) {
  preloadStylesheet(ownerDocument, key, preloadProps, resource.state);
}
```

## Repro

A minimal Next.js repro lives at https://github.com/vercel/next.js/pull/93296. The fixture:

- `'use client'` page that calls `ReactDOM.preload(href, { as: 'style' })` for 3 hrefs in `useEffect`
- A `<Link>` to `/logs` whose layout has `<Suspense>` and whose page is a client component rendering `<link rel=\"stylesheet\" href={href} precedence>` for the same hrefs

The Playwright test asserts the fallback IS painted (bug fires) and a SuspenseComponent fiber catches `SuspenseyCommitException` (`flags & 16384` set, `updateQueue` empty). With this fix applied, the boundary commits with content instead.

## Notes / open questions

- I haven't added a unit test in `ReactDOMFloat-test.js` — the existing tests for this path are SSR + hydrate flows, and reproducing the client-only \"preload-before-mount\" sequence cleanly looks invasive. Happy to add one if there's a preferred shape.
- The cast `(existingPreloadProps: any)` is because `preloadPropsMap` stores `PreloadProps | PreloadModuleProps`. Open to a narrower type if preferred.

Fix getResource short-circuit leaving stylesheet state.loading=NotLoaded after ReactDOM.preload

Adds a `enableInfiniteRenderLoopDetectionForceThrow` flag, which changes the detection mechanism behaviour to start throwing, when the loop is observed. By default, the value is set to `false`, also made dynamic from the start for `www`.



[enableInfiniteRenderLoopDetection] Add a flag to force throwing

- Add comprehensive comments to validAriaProperties.js explaining each ARIA attribute
- Organize ARIA attributes by category (Global, Widget, Live Region, Drag-and-Drop, Relationship)
- Add ARIA 1.3 specification reference link
- Clarify which attributes are new in ARIA 1.3 (aria-braillelabel, aria-brailleroledescription, aria-colindextext, aria-rowindextext)
- Add documentation note explaining React's ARIA validation approach
- Improve error messages in ReactDOMInvalidARIAHook to include helpful reference link
- Each attribute includes a descriptive comment explaining its purpose

This makes it easier for developers to:
1. Understand what ARIA attributes are supported
2. Find the correct attribute name when they make typos
3. Learn about ARIA 1.3 features
4. Understand why certain attributes are validated

Addresses Issue #7 from BUGS_ANALYSIS.md: Remove false positive warnings for ARIA 1.3 attributes



## Summary



## How did you test this change?

improve: enhance ARIA attributes documentation and error messages

…and guidance

- Add component name to hydration error messages for better debugging context
- Reorganize error message structure with clear sections: causes, debug steps, learning resources
- Include specific guidance based on mismatch type (text vs HTML)
- Improve attribute mismatch warning with actionable suggestions
- Add suppressHydrationWarning tip to help developers manage intentional mismatches
- Import getComponentNameFromFiber for extracting component context

This change improves the developer experience when debugging hydration issues by providing:
1. Component name context (which component had the mismatch)
2. Clearer categorization of common causes
3. Specific debugging steps to follow
4. Better formatting for readability

Addresses Issue #3 from BUGS_ANALYSIS.md: Make hydration warnings clearer



## Summary



## How did you test this change?

improve: enhance hydration mismatch error messages with more context …

- Fix spelling error in ReactDOMFloat-test.js line 157
- Fix spelling error in ReactDOMFizzServer-test.js line 237
- Both messages read 'Received <html> without <!DOCTYPE html>'



## Summary



## How did you test this change?

fix: correct typo 'Recieved' to 'Received' in error messages

- SUMMARY.md: High-level project overview and analysis
- SETUP_GUIDE.md: Development environment setup and workflow
- BUGS_ANALYSIS.md: 9 identified issues with detailed analysis and solutions
- CONTRIBUTION_PLAN.md: Step-by-step pull request workflow
- README_DOCUMENTATION.md: Guide to using the documentation
- README_DOCUMENTATION_INDEX.md: Index of all documentation

This documentation provides new contributors with:
* Understanding of React monorepo structure (30+ packages)
* Identified issues ranked by difficulty
* Complete setup and development workflow
* Best practices for creating pull requests

Helps reduce barriers to entry for open source contributions.



## Summary



## How did you test this change?

docs: Add comprehensive React contribution and development guide

## Summary

Fixes #35722

PR has been created with the help of Claude Code

`packages/eslint-plugin-react-hooks/src/index.ts` has a hardcoded `version: '7.0.0'` in `plugin.meta`. The rollup build for this package does **not** inject the package version at bundle time (unlike `__DEV__` / `__EXPERIMENTAL__`), so `plugin.meta.version` can become stale after a release if `src/index.ts` is not updated alongside `package.json`.

The root cause is in `scripts/release/utils.js`: `updateVersionsForNext` updates every `package.json` but never touches `src/index.ts`.

**Fix:** in `updateVersionsForNext`, after writing `package.json` for `eslint-plugin-react-hooks`, also patch the `version: '...'` literal in `src/index.ts` using the same `readFileSync` / `writeFileSync` / regex-replace pattern already used to keep `packages/shared/ReactVersion.js` in sync.

```js
// after: await writeJson(packageJSONPath, packageJSON, {spaces: 2});
if (packageName === 'eslint-plugin-react-hooks') {
  const pluginSrcPath = join(packagePath, 'src', 'index.ts');
  const pluginSrc = readFileSync(pluginSrcPath, 'utf8');
  writeFileSync(
    pluginSrcPath,
    pluginSrc.replace(/version: '[^']+'/, `version: '${version}'`),
  );
}
```

This keeps `plugin.meta.version` permanently in sync with the published package version without requiring any build system changes or a JSON import.

**File changed:** `scripts/release/utils.js` (+12 lines)

## How did you test this change?

- Verified that `readFileSync` and `writeFileSync` are already imported in `utils.js` (line 6) — no new imports needed.
- Verified the regex `/version: '[^']+'/ ` correctly matches and replaces the single `version: '7.0.0'` in `src/index.ts` without touching unrelated strings.
- Ran `yarn prettier` on the changed file — no formatting changes needed.
- Ran `yarn linc` — **Lint passed for changed files.**

fix: keep eslint-plugin-react-hooks meta.version in sync during releases

## Summary

Fixes #35656

PR has been raised with the help of Claude Code

The `autofocus` attribute is a [global HTML attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/autofocus) applicable to any focusable element per the HTML spec. React's `autoFocus` prop was only handled for `button`, `input`, `select`, and `textarea` elements. Anchor tags (`<a>`) were silently ignored.

This PR adds `case 'a':` to the two switch statements in `ReactFiberConfigDOM.js` that control `autoFocus` behaviour:

1. **`finalizeInitialChildren`** (line ~701) — tells React whether `commitMount` needs to be called for this element. Adding `'a'` here ensures the mount phase is scheduled when `autoFocus` is set.
2. **`commitMount`** (line ~894) — calls `.focus()` on the DOM node. Adding `'a'` here (with `HTMLAnchorElement` in the Flow cast) performs the actual focus.

**File changed:** `packages/react-dom-bindings/src/client/ReactFiberConfigDOM.js`

**Before:**
```jsx
<a href="#main-content" autoFocus>Skip to main content</a>
// ↑ never focused on mount
```

**After:**
```jsx
<a href="#main-content" autoFocus>Skip to main content</a>
// ↑ correctly focused on mount, consistent with <button autoFocus>
```

## How did you test this change?

- Verified the two switch statement locations match the patch described in the issue.
- Confirmed `<a href="..." autoFocus>` now falls through to the `autoFocus` check in both `finalizeInitialChildren` and `commitMount`, matching the behaviour of `<button autoFocus>`.
- Ran `yarn prettier` — no formatting changes needed.
- Ran `yarn linc` — **Lint passed for changed files.**

fix: support autoFocus on anchor (<a>) elements

## Summary

Fixes #36341

PR has been raised with the help of Claude Code

`CONTRIBUTING.md` linked to `https://reactjs.org/docs/how-to-contribute.html` while `README.md` already used `https://legacy.reactjs.org/docs/how-to-contribute.html` in all four of its occurrences. The two different URLs both resolve to the same page (the former redirects to the latter), but having them differ is unnecessarily inconsistent and can cause confusion.

This PR updates the single link in `CONTRIBUTING.md` to use `https://legacy.reactjs.org/docs/how-to-contribute.html`, making all five contribution guide references across both files consistent.

**Files changed:**
- `CONTRIBUTING.md` — 1 URL updated

## How did you test this change?

- Verified with `grep -n "reactjs.org" CONTRIBUTING.md README.md` that all five contribution guide links now point to the same `legacy.reactjs.org` URL.
- Ran `yarn prettier` — no formatting changes needed.
- Ran `yarn linc` — **Lint passed for changed files.**
- Documentation-only change; no code or test logic affected.

docs: standardize contribution guide URL in CONTRIBUTING.md to match README.md

## Summary

Fixes #36320

PR has been raised with the help of Claude Code

Corrects four misspellings in DEV-only warning strings emitted by `react-dom-bindings`, along with their matching test expectations:

| Wrong | Correct | Location |
|-------|---------|----------|
| `ecountered` | `encountered` | `ReactFizzConfigDOM.js`, `ReactDOMResourceValidation.js`, tests |
| `ocurred` | `occurred` | `ReactFizzConfigDOM.js`, tests |
| `deduplciate` | `deduplicate` | `ReactFizzConfigDOM.js`, `ReactDOMResourceValidation.js`, tests |
| `Recieved` | `Received` | `ReactDOMFloat-test.js`, `ReactDOMFizzServer-test.js` |

**Files changed:**
- `packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js`
- `packages/react-dom-bindings/src/shared/ReactDOMResourceValidation.js`
- `packages/react-dom/src/__tests__/ReactDOMFloat-test.js`
- `packages/react-dom/src/__tests__/ReactDOMFizzServer-test.js`

No behavior change — DEV-only warning text and matching test expectations only.

## How did you test this change?

- Verified all occurrences of each misspelling with `grep -rn` across `packages/` — none remain after the fix.
- Ran `yarn prettier` on changed files — no formatting changes needed.
- Ran `yarn linc` — **Lint passed for changed files.**
- Source warning strings and test assertion strings are updated in lockstep so existing tests continue to pass.

Fix typos in react-dom dev warning messages (ecountered, ocurred, deduplciate, Recieved)

## Summary

`shallowEqual` is on the hot path for `React.memo` and `PureComponent.shouldComponentUpdate`. The current implementation calls `Object.keys(objB)` only to read `.length` from the resulting array and then discards it:

```js
const keysA = Object.keys(objA);
const keysB = Object.keys(objB); // ← throwaway array
if (keysA.length !== keysB.length) { … }
```

Replace `Object.keys(objB)` with an inline `for…in` + `hasOwnProperty` counter that:

1. avoids the heap allocation of `keysB`, and
2. bails as soon as B's own-key count exceeds A's, so we don't keep enumerating when sizes already differ.

The set of keys iterated is unchanged: `Object.keys` returns own enumerable string-keyed properties, and `for…in` filtered through `hasOwnProperty.call(objB, key)` returns the same set (excluding the prototype chain, symbols, and non-enumerable keys). The post-loop check `keysBCount !== keysA.length` plus the existing key-by-key compare still catches the case where the counts match but the keys differ.

## Tests

New file: `packages/shared/__tests__/shallowEqual-test.js`. Covers:

- reference equality
- `Object.is` semantics (NaN === NaN, +0 ≠ -0)
- null and non-object inputs on either side
- equal/different keys with same and different counts
- prototype-chain isolation (own-only)
- null-prototype objects (`Object.create(null)`)
- empty objects

## Test plan

- [x] `yarn prettier`, `yarn linc`
- [x] `yarn flow dom-node` — no errors
- [x] `yarn test --no-watchman shallowEqual-test` — 11/11 pass
- [x] `yarn test --no-watchman ReactMemo-test` — 28/28 pass (memo bailout uses shallowEqual)
- [x] `yarn test --no-watchman ReactPureComponent` — 4/4 pass
- [x] `yarn test-www --no-watchman ReactMemo ReactPureComponent shallowEqual-test` — pass on www-modern channel

Fixes #36283

[shared] shallowEqual: avoid Object.keys(objB) allocation

## Summary

`getDataType` collapsed both `Infinity` and `-Infinity` to the `'infinity'` data type, so a `-Infinity` value coming from inspected props/state/hooks was rehydrated on the frontend as `Infinity`.

This adds a `'-infinity'` `DataType`, routes it through `dehydrate`/`hydrate` alongside the existing `'infinity'` arm, and makes `smartParse`/`smartStringify` (used for editable hook values) symmetric.

## Files

- `packages/react-devtools-shared/src/utils.js` — extend `DataType`, split sign in `getDataType`, route `'-infinity'` through `formatDataForPreview`.
- `packages/react-devtools-shared/src/hydration.js` — `dehydrate` and `hydrate` cases for `'-infinity'`.
- `packages/react-devtools-shared/src/devtools/utils.js` — `smartParse` accepts `'-Infinity'`; `smartStringify` returns `'-Infinity'` for negative infinite values.
- `packages/react-devtools-shared/src/__tests__/inspectedElement-test.js` and `legacy/inspectElement-test.js` — added `minus_infinity={-Infinity}` to the simple-data-types tests + snapshots.
- `packages/react-devtools-shell/src/app/InspectableElements/SimpleValues.js` — added `minusInfinity` to the dev shell so the path is exercised manually.

## Test plan

- [x] `yarn prettier` / `yarn linc`
- [x] `yarn flow dom-node` — no errors
- [x] `yarn test --silent --no-watchman -t "should support simple data types"` (source channel)
- [x] `yarn test-www --silent --no-watchman -t "should support simple data types"` (www-modern)
- [ ] `yarn test-build-devtools` — relies on a built bundle; left to CI per repo policy.

Fixes #32552

[DevTools] Preserve -Infinity in inspected values

React version:

## Steps To Reproduce

1.
2.



Link to code example:



## The current behavior


## The expected behavior

A potential issue that we haven't yet confirmed as a bug

Status: Unconfirmed

Bug:

## Summary\n\nFixes crash in packages/shared/CheckStringCoercion.js:\n\n\	ypeName()\ accessed \alue.constructor.name\ without guarding against null-prototype objects (created via \Object.create(null)\), which have no \.constructor\ property. This prevented helpful error messages from printing.\n\nAdded guard with fallback to \Object.prototype.toString.call()\ and try-catch wrapper.\n\nAlso adds .gitattributes for consistent line endings.\n\nSigned-off-by: Srikanth Patchava <spatchava@meta.com>

fix: handle null-prototype objects in typeName helper

Bumps [postcss](https://github.com/postcss/postcss) from 8.4.47 to 8.5.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p>
<blockquote>
<h2>8.5.10</h2>
<ul>
<li>Fixed XSS via unescaped <code>&lt;/style&gt;</code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@​TharVid</code></a>).</li>
</ul>
<h2>8.5.9</h2>
<ul>
<li>Speed up source map encoding paring in case of the error.</li>
</ul>
<h2>8.5.8</h2>
<ul>
<li>Fixed <code>Processor#version</code>.</li>
</ul>
<h2>8.5.7</h2>
<ul>
<li>Improved source map annotation cleaning performance (by CodeAnt AI).</li>
</ul>
<h2>8.5.6</h2>
<ul>
<li>Fixed <code>ContainerWithChildren</code> type discriminating (by <a href="https://github.com/Goodwine"><code>@​Goodwine</code></a>).</li>
</ul>
<h2>8.5.5</h2>
<ul>
<li>Fixed <code>package.json</code>→<code>exports</code> compatibility with some tools (by <a href="https://github.com/JounQin"><code>@​JounQin</code></a>).</li>
</ul>
<h2>8.5.4</h2>
<ul>
<li>Fixed Parcel compatibility issue (by <a href="https://github.com/git-sumitchaudhary"><code>@​git-sumitchaudhary</code></a>).</li>
</ul>
<h2>8.5.3</h2>
<ul>
<li>Added more details to <code>Unknown word</code> error (by <a href="https://github.com/hiepxanh"><code>@​hiepxanh</code></a>).</li>
<li>Fixed types (by <a href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
<li>Fixed docs (by <a href="https://github.com/catnipan"><code>@​catnipan</code></a>).</li>
</ul>
<h2>8.5.2</h2>
<ul>
<li>Fixed end position of rules with semicolon (by <a href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
</ul>
<h2>8.5.1</h2>
<ul>
<li>Fixed backwards compatibility for complex cases (by <a href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
</ul>
<h2>8.5 “Duke Alloces”</h2>

<p>PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.</p>
<p><a href="https://github.com/romainmenke"><code>@​romainmenke</code></a> during <a href="https://redirect.github.com/postcss/postcss/issues/1995">his work</a> on <a href="https://stylelint.io">Stylelint</a> added <code>Input#document</code> in additional to <code>Input#css</code>.</p>
<pre lang="js"><code>root.source.input.document //=&gt; &quot;&lt;p&gt;Hello&lt;/p&gt;
                           //    &lt;style&gt;
                           //    p {
                           //      color: green;
                           //    }
                           //    &lt;/style&gt;&quot;
root.source.input.css      //=&gt; &quot;p {
                           //      color: green;
                           //    }&quot;
<p>&lt;/tr&gt;&lt;/table&gt;<br />
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p>
<blockquote>
<h2>8.5.10</h2>
<ul>
<li>Fixed XSS via unescaped <code>&lt;/style&gt;</code> in non-bundler cases (by <a href="https://github.com/TharVid"><code>@​TharVid</code></a>).</li>
</ul>
<h2>8.5.9</h2>
<ul>
<li>Speed up source map encoding paring in case of the error.</li>
</ul>
<h2>8.5.8</h2>
<ul>
<li>Fixed <code>Processor#version</code>.</li>
</ul>
<h2>8.5.7</h2>
<ul>
<li>Improved source map annotation cleaning performance (by CodeAnt AI).</li>
</ul>
<h2>8.5.6</h2>
<ul>
<li>Fixed <code>ContainerWithChildren</code> type discriminating (by <a href="https://github.com/Goodwine"><code>@​Goodwine</code></a>).</li>
</ul>
<h2>8.5.5</h2>
<ul>
<li>Fixed <code>package.json</code>→<code>exports</code> compatibility with some tools (by <a href="https://github.com/JounQin"><code>@​JounQin</code></a>).</li>
</ul>
<h2>8.5.4</h2>
<ul>
<li>Fixed Parcel compatibility issue (by <a href="https://github.com/git-sumitchaudhary"><code>@​git-sumitchaudhary</code></a>).</li>
</ul>
<h2>8.5.3</h2>
<ul>
<li>Added more details to <code>Unknown word</code> error (by <a href="https://github.com/hiepxanh"><code>@​hiepxanh</code></a>).</li>
<li>Fixed types (by <a href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
<li>Fixed docs (by <a href="https://github.com/catnipan"><code>@​catnipan</code></a>).</li>
</ul>
<h2>8.5.2</h2>
<ul>
<li>Fixed end position of rules with semicolon (by <a href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
</ul>
<h2>8.5.1</h2>
<ul>
<li>Fixed backwards compatibility for complex cases (by <a href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
</ul>
<h2>8.5 “Duke Alloces”</h2>
<ul>
<li>Added <code>Input#document</code> for sources like CSS-in-JS or HTML (by <a href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
</ul>
<h2>8.4.49</h2>
<ul>
<li>Fixed custom syntax without <code>source.offset</code> (by <a href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/postcss/postcss/commit/33b9790263dc1562a46ce45d9532bd63e95b7986"><code>33b9790</code></a> Release 8.5.10 version</li>
<li><a href="https://github.com/postcss/postcss/commit/536c79e4b01e58a3a56b09c3c0cf2323f4b9a28b"><code>536c79e</code></a> Escape &lt;/style&gt; in CSS output (<a href="https://redirect.github.com/postcss/postcss/issues/2074">#2074</a>)</li>
<li><a href="https://github.com/postcss/postcss/commit/afa96b2a139ce625c4d27973313479c7c85f39d4"><code>afa96b2</code></a> Update dependencies (<a href="https://redirect.github.com/postcss/postcss/issues/2073">#2073</a>)</li>
<li><a href="https://github.com/postcss/postcss/commit/effe88bb87cabdc1876e02adbdd30f392f19f40d"><code>effe88b</code></a> Typo (<a href="https://redirect.github.com/postcss/postcss/issues/2072">#2072</a>)</li>
<li><a href="https://github.com/postcss/postcss/commit/3ee79a2c4a11e41d52db50b444eebe38299495ad"><code>3ee79a2</code></a> Thread model (<a href="https://redirect.github.com/postcss/postcss/issues/2071">#2071</a>)</li>
<li><a href="https://github.com/postcss/postcss/commit/2e0683daca4dc2919211b03774f6b2d137136c01"><code>2e0683d</code></a> Create incident response docs (<a href="https://redirect.github.com/postcss/postcss/issues/2070">#2070</a>)</li>
<li><a href="https://github.com/postcss/postcss/commit/fe88ac29c06b7b218be32994cdc6ca1525bdf2c9"><code>fe88ac2</code></a> Release 8.5.9 version</li>
<li><a href="https://github.com/postcss/postcss/commit/c551632496b87ab3f1965bfda5dc386b6c71963e"><code>c551632</code></a> Avoid RegExp when we can use simple JS</li>
<li><a href="https://github.com/postcss/postcss/commit/89a6b744060eb8dee743351c785a9fbe37d4525a"><code>89a6b74</code></a> Move SECURITY.txt for docs folder to keep GitHub page cleaner</li>
<li><a href="https://github.com/postcss/postcss/commit/6ceb8a46af9f9de821faee98f861bdf84617347b"><code>6ceb8a4</code></a> Create SECURITY.md</li>
<li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.4.47...8.5.10">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.4.47&new-version=8.5.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts).

</details>

Pull requests that update a dependency file

dependencies

Pull requests that update Javascript code

javascript

Bump postcss from 8.4.47 to 8.5.10 in /compiler/apps/playground

I noticed a small docs consistency issue around contribution links in this repository.

Right now the repo points readers to two slightly different legacy contribution URLs:

- `README.md` links to `https://legacy.reactjs.org/docs/how-to-contribute.html`
- `CONTRIBUTING.md` links to `https://reactjs.org/docs/how-to-contribute.html`

These may both still resolve, but the repo currently uses two different legacy domains for what appears to be the same contribution guide.

It might help to standardize these links, or clarify the canonical contribution guide location if the current setup is intentional.

Where I found it:
- https://github.com/facebook/react/blob/main/README.md
- https://github.com/facebook/react/blob/main/CONTRIBUTING.md

This is just a small docs cleanup report.

README and CONTRIBUTING.md use inconsistent legacy contribution links

## Summary

aria-* attributes currently bypass the NaN check in `ReactDOMUnknownPropertyHook` because they return early (line 97-99 of that file) before the check is reached. When a `NaN` number flows through, the DOM stringifies it to the literal string `"NaN"`, which is invalid for **every** ARIA attribute type and silently breaks accessibility.

This is a common pitfall when a computed numeric value is derived from user data or state that can be undefined/null:

```jsx
// e.g. items.findIndex(...) returns -1 → some derived math → NaN
<div aria-valuenow={computedValue} />  // renders aria-valuenow="NaN" — silent bug
```

**Changes:**

- `ReactDOMInvalidARIAHook.js` — extend `validateProperty` to accept the prop `value` and add a `NaN` check for valid, correctly-cased aria-* attributes. Mirrors the warning message already used by `ReactDOMUnknownPropertyHook` for non-aria attributes.
- `ReactDOMInvalidARIAHook-test.js` — three new test cases: NaN on a numeric aria attribute (`aria-valuenow`), NaN on a string-type aria attribute (`aria-label`), and no false-positive for valid integers.

## Test plan

- [x] `yarn test ReactDOMInvalidARIAHook` — all tests pass (new + existing)
- [x] Existing tests unaffected — only the `validateProperty` signature changes (internal)

Warn when NaN is passed as an aria-* attribute value

## Summary

Fixes an invalid `private` field in `packages/react-devtools-fusebox/package.json`. Per the npm package.json specification, the `private` field must be a boolean, not the string `"true"` currently present.

## Fix

```diff
-  "private": "true",
+  "private": true,
```

## Testing

No behavioral code changes. This is a data-format correction that resolves validation errors in package scanning tools that enforce the npm specification.

## Related

Fixes #35793

---

*Note: this fix was previously merged to the fork main branch (Jah-yee/react#1) but the PR was closed without being pushed upstream. Resubmitting to facebook/react.*

fix(react-devtools-fusebox): change private field from string to boolean

**Test Environment:**
OS: Windows 11 Enterprise23H2 (Build 22631.4037)
Edge version: Version 137.0.3296.93 (Official build) dev (64-bit)
Chrome: Version 135.0.6422.112 (Official Build) (64-bit)
Screen readers: NVDA (2024.4.2), JAWS (Version 2025.2412.50) and Narrator.
Test URL: https://dpei4n.csb.app/

**User Impact:**
Visually challenged users who rely on screen readers are facing difficulty if slider control does not have an accessible name in windows.

**Pre-Requisite:**

Turn on Screen Readers:
Narrator: Win + Shift + Enter
NVDA: Ctrl + Alt + N
JAWS: Ctrl + Alt + J
Verbosity:
Narrator: Default
JAWS: Beginner, Highest
NVDA: Default

**Repro steps:**

1. Launch the application using URL: https://dpei4n.csb.app/ in windows.
2. Press tab key to move to the slider controls.
3. Verify whether slider control have an accessible name in windows or not.

**Actual Result:**
Slider control does not have an accessible name in windows.
Screen reader announces: Slider 3

**Refer Attachment:**
1.Slider control does not have an accessible name in windows..png
2.Slider control does not have an accessible name in windows..mp4

<img width="966" height="529" alt="Image" src="https://github.com/user-attachments/assets/5f073f1e-c7d7-4034-a55a-31c696082cc7" />

https://github.com/user-attachments/assets/bc0e99b7-f6a2-4942-a29e-56a435b63af0

**Expected Result:**
Slider control should have an accessible name in windows.

Slider control does not have an accessible name in windows.

Fixes #35576.

The immutability rule currently reports a TDZ-style error for a stable self-reference inside useCallback, such as removing the same callback from an event listener.

This updates hoisted context tracking to only record real reads that happen before initialization. Self-references introduced by the callback being memoized are ignored, while later captures that actually read a declaration before initialization still fail.

Tests:
- add a regression that allows a self-referential useCallback
- keep a regression that still rejects a later declaration capture
- run yarn workspace eslint-plugin-react-hooks test --runInBand

Fix false positive for self-referential useCallback

ixes #32339

React DevTools injects `installHook.js` into the page's **MAIN world** via
`chrome.scripting.registerContentScripts`. Because the script runs in the
page context, browsers resolve the `//# sourceMappingURL=installHook.js.map`
comment relative to the **page's origin** instead of the extension URL,
causing a failed network request and a console warning in every app that has
React DevTools installed:

GET https://myapp.com/installHook.js.map  net::ERR_NOT_FOUND



This confuses developers into thinking the warning originates from their own
code.

## Root Cause

`SourceMapDevToolPlugin` appends `//# sourceMappingURL=installHook.js.map`
to the built file. In an ISOLATED world content script this would resolve to
the extension URL correctly, but in MAIN world Chrome resolves it against
the page origin.

## Fix

Split `SourceMapDevToolPlugin` into two instances:

- **`installHook.js`** — adds `append: false` in production so the
  `sourceMappingURL` comment is never written to the file. The `.map` file
  is still generated for internal debugging.
- **`react_devtools_backend_compact.js`** — keeps existing behavior
  unchanged.

In development builds (`__DEV__ === true`) `append` stays `undefined` so
source maps continue to work normally for DevTools contributors.

## Test Plan

- [x] Build production Chrome extension: `yarn build:chrome`
- [x] Load unpacked extension in Chrome
- [x] Open any React app with DevTools installed
- [x] Confirm no `installHook.js.map` network request or console warning
- [x] Confirm DevTools panels still work correctly
- [x] Build development extension: `yarn build:chrome:local`
- [x] Confirm source maps still work in dev build (breakpoints in DevTools)


Fix DevTools installHook.js source map warning in browser console (#32339)

issue:#36320
ok

## Summary

 Solution  of this bug i got small probleam to solve this issue. motivation solution is good becouse facebook is big repogetory  

## How did you test this change?

 
<img width="1366" height="768" alt="Screenshot (920)" src="https://github.com/user-attachments/assets/ad2ed301-2907-4024-8880-79dc630ab681" />
<img width="1366" height="768" alt="Screenshot (921)" src="https://github.com/user-attachments/assets/dfc4b3be-0b05-42e4-8b88-1b7c118a78b4" />
<img width="1366" height="768" alt="Screenshot (922)" src="https://github.com/user-attachments/assets/88a64588-4254-47cd-a8b7-260779077d63" />
<img width="1366" height="768" alt="Screenshot (923)" src="https://github.com/user-attachments/assets/77e1d1a9-1909-40e3-8ef0-dc3d0a62fb65" />

fix/bug-tyop-error-message

Closes #29034

React 19 automatically calls `form.reset()` after every form action completes. This is intentional behavior, but there are legitimate cases where developers need to opt out:

- Multi-step forms where fields shouldn't be cleared between steps
- When a server action fails and the user's input should be preserved
- Forms with manually managed controlled state

This PR adds an `autoReset` prop to `<form>` elements. It defaults to `true` (preserving current behavior), and can be set to `false` to disable the automatic reset.

## Usage

```jsx
// Default behavior — form resets after action (unchanged)
<form action={myAction}>...</form>

// Opt out of automatic reset
<form action={myAction} autoReset={false}>...</form>