[Perf Tracks] Prevent crash when accessing $$typeof#35679
Merged
eps1lon merged 4 commits intoFeb 3, 2026
Merged
Conversation
github-actions
Bot
added
the
React Core Team
eps1lon
commented
Feb 3, 2026
eps1lon
force-pushed
the
sebbie/02-03-_perf_tracks_skip_diffing_html-like_objects
branch
3 times, most recently
from
February 3, 2026 10:58
9f43236 to
f435c5c
Compare
eps1lon
force-pushed
the
sebbie/02-03-_perf_tracks_skip_diffing_html-like_objects
branch
from
February 3, 2026 10:59
f435c5c to
736819e
Compare
eps1lon
force-pushed
the
sebbie/02-03-_perf_tracks_skip_diffing_html-like_objects
branch
from
February 3, 2026 11:00
736819e to
45ac560
Compare
eps1lon
marked this pull request as ready for review
February 3, 2026 11:07
hoxyq
approved these changes
Feb 3, 2026
eps1lon
deleted the
sebbie/02-03-_perf_tracks_skip_diffing_html-like_objects
branch
February 3, 2026 16:54
This was referenced Feb 5, 2026
github-actions Bot
pushed a commit
to code/lib-react
that referenced
this pull request
Feb 9, 2026
DiffTrain build for [6853d7a](react@6853d7a)
github-actions Bot
pushed a commit
to code/lib-react
that referenced
this pull request
Feb 9, 2026
DiffTrain build for [6853d7a](react@6853d7a)
mbret
added a commit
to mbret/oboku
that referenced
this pull request
Jul 25, 2026
…n frames React 19.2's dev-only performance track deep-walks changed props and throws a SecurityError when it reaches the reader iframe's cross-origin window, crashing the commit (react/react#34840). Guard the prop walkers so unreadable values log as [inaccessible] instead of throwing. Fixed upstream by react/react#35679 (19.3 canary only); remove with `pnpm patch-remove react-dom@19.2.8` once on a release containing it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mbret
added a commit
to mbret/oboku
that referenced
this pull request
Jul 25, 2026
* feat: upgrade @prose-reader/* to 1.332.0 (#503) * feat: upgrade @prose-reader/* to 1.332.0 Bump every @prose-reader/* dependency from 1.324.0 to 1.332.0 across web, api and archive-metadata, and migrate the web reader to the breaking API changes shipped in that range. Reader lifecycle (prose #229/#230/#231): - createReader() now takes the manifest (and optional cfi) at construction and mount(containerElement) is a one-shot DOM attachment; reader.load() is gone. useCreateReader now creates + mounts + destroys the reader in a single effect (destroy() is the true inverse of create + mount, so the effect is strict-mode safe), and useLoadReader is removed. - The restored reading location (cfi) is read through a live ref so later progress writes flowing back into the book query never destroy/recreate the reader. - reader.state$ ("idle"|"ready") is replaced by reader.mounted$; the book loading overlay now keys off !mounted. Pin react/react-dom to 19.1.8 in the web app only: - react-dom 19.2 dev builds recursively read component props and access $$typeof on every object, throwing SecurityError on our gapi cross-origin iframe (react/react#34840). The uncaught throw aborts passive-effect mounts (dead reader quick-menu) and corrupts the work loop (crash on back navigation). Prod is unaffected; dev is unusable. - 19.1.x predates the offending logger and the web app uses no 19.2-only APIs. admin/landing stay on 19.2.x (@Mantine 9.4 needs useEffectEvent), so the pin is web-only, held together by resolve.dedupe in vite.config. - Documented in AGENTS.md with removal steps for when the react bug is fixed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(reader): read book once via enabled gate instead of useLiveRef The enabled predicate already stops observing after the first result, so progress-sync writes to the same book document never change the value. Drop the redundant useLiveRef, read bookOnce directly, and name the enabled predicate to state the intent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: unpin apps/web react and bump react to 19.2.7 project-wide apps/web was pinned to react 19.1.8 to dodge a dev-only React 19.2 logger crash with the gapi iframe. The pin diverged web from the rest of the repo and left @types on 19.2.x, creating a runtime/types skew. Align everything to the latest 19.2.7 (react/react-dom) and 19.2.17 (@types/react) across web, admin and landing. Remove the now-unneeded scaffolding: the vite resolve.dedupe entry and the AGENTS.md "React version pin" section. The dev-only reader crash returns at parity with develop/master; production is unaffected (logger is dev-only). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> * chore(deps): bump @nestjs/platform-express to 11.1.28 to fix multer DoS (#507) Updates @nestjs/platform-express 11.1.27 -> 11.1.28, which pulls multer 2.1.1 -> 2.2.0 (multer is consumed only by platform-express). Resolves the two multer denial-of-service advisories on the API file-upload path: - GHSA-72gw-mp4g-v24j (high): DoS via deeply nested field names - GHSA-3p4h-7m6x-2hcm (moderate): DoS via incomplete cleanup of aborted uploads Claude-Session: https://claude.ai/code/session_01WKoPAepDc2xhSFFDhHTHe5 Co-authored-by: Claude <noreply@anthropic.com> * fix: lock * fix: biome * fix: types * feat: migrate to pnpm * fix: dedupe * fix(deps): patch react-dom 19.2.8 dev perf-track crash on cross-origin frames React 19.2's dev-only performance track deep-walks changed props and throws a SecurityError when it reaches the reader iframe's cross-origin window, crashing the commit (react/react#34840). Guard the prop walkers so unreadable values log as [inaccessible] instead of throwing. Fixed upstream by react/react#35679 (19.3 canary only); remove with `pnpm patch-remove react-dom@19.2.8` once on a release containing it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(dev-proxy): stop 502 bursts from unreachable IPv6 host.docker.internal peer Docker Desktop writes both IPv4 and IPv6 host-gateway entries, so nginx expands host.docker.internal into two peers; the IPv6 one is unreachable from the IPv4-only compose network and its failure accounting could mark the whole implicit upstream down (no live upstreams -> 502 bursts during replication). An explicit upstream with max_fails=0 lets a failed connect fall through to the reachable address instead of disabling the group. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(vercel): bootstrap pnpm 11 in install command to match lockfile Vercel's lockfile heuristic picks pnpm 9, which can't read patchedDependencies from pnpm-workspace.yaml and fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. The bootstrapped pnpm 11 defers to the packageManager pin in package.json. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(vercel): invoke bootstrapped pnpm by absolute path Vercel prepends its detected pnpm 9 to PATH, shadowing the npm-installed pnpm 11, so the install still hit ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Alternate to #34840
Fixes #34840
Closes #34840
Summary
Guards dotting into
$$typeofunconditionally. The try-catch proposed in #34840 feels too heavy.Original plan was to skip diffing DOM nodes entirely since they're mutable boxes anyway. That felt like too much of a stretch unless we move the check to the host config. However, that wouldn't fix the linked issue. The linked issue is caused by having a cross-origin window in props not the iframe. Perf tracks wouldn't diff
contentWindowsince it's not enumerable.The proposed implementation is host agnostic and feels like a better fit overall. And it guards against cases where accessing an unknown
$$typeofproperty would also throw.Test plan