Unable to install react 19 for 5 months now without security issues, anyone from MS still maintaining this?

[julesblancphin]

Core Library

MSAL.js (@azure/msal-browser)

Core Library Version

3.17

Wrapper Library

MSAL Angular (@azure/msal-angular)

Wrapper Library Version

2.0

Public or Confidential Client?

Public

Description

No React 19 support is forcing the community to use temporary workarounds which are far from ideal from a security point of view.

Read more about the issues here #7455 #7577 #7606 #7481

This PR #7548 has been opened for a long time now without any resolve.

Error Message

No response

MSAL Logs

No response

Network Trace (Preferrably Fiddler)

• Sent
• Pending

MSAL Configuration

{
	auth: {
		clientId: ''.
		authority: ''.
		knownAuthorities: [b2cPolicies.authorityDomain],
		redirectUri: '/',
		postLogoutRedirectUri: '/', 
		navigateToLoginRequestUrl: true
	},
	cache: {
		cacheLocation: 'sessionStorage',
		storeAuthStateInCookie: false 
	}
}

Relevant Code Snippets

Just look at the issues linked

Reproduction Steps

1. Create a react 19 project
2. Try to install @msal/react
3. You'll see an error message

Expected Behavior

Just support react 19

Identity Provider

Entra ID (formerly Azure AD) / MSA

Browsers Affected (Select all that apply)

Chrome, Firefox, Edge, Safari, Other

Regression

No response

[tnorling]

Sorry for the lack of progress on this. We are aware that there is a new version out and upgrading is on our backlog. The react wrapper is absolutely still supported, but to be completely transparent, we simply have had higher priorities than upgrading, especially given that workarounds exist in the meantime. I know it's not what folks want to hear but it's all I've got at the moment.

In order for us to declare support for a new version we need a couple things:

1. Peer dependencies need to be updated
2. Documentation needs to be updated to reflect the current supported versions
3. Samples need to be updated such that our E2E tests test against the new version, and ideally older still supported versions as well

The community PRs thus far have done the first item on this list, while the third is the most important. If someone feels compelled to open a PR that ticks all 3 boxes, we'll be happy to accept it. Otherwise we will pick it up once we have the bandwidth.

[Ben-CA]

See this pull request:
#7710

[rm-eth-a-n]

Sorry for the lack of progress on this. We are aware that there is a new version out and upgrading is on our backlog. The react wrapper is absolutely still supported, but to be completely transparent, we simply have had higher priorities than upgrading, especially given that workarounds exist in the meantime. I know it's not what folks want to hear but it's all I've got at the moment.

In order for us to declare support for a new version we need a couple things:

1. Peer dependencies need to be updated
2. Documentation needs to be updated to reflect the current supported versions
3. Samples need to be updated such that our E2E tests test against the new version, and ideally older still supported versions as well

The community PRs thus far have done the first item on this list, while the third is the most important. If someone feels compelled to open a PR that ticks all 3 boxes, we'll be happy to accept it. Otherwise we will pick it up once we have the bandwidth.

Thanks @tnorling, 1 and 2 are now complete, can you clarify what needs doing for 3, as there are no breaking changes between react 18 and 19 for anything this library uses, I also can't find where different versions of react are tested anywhere else in this repo ?

[julesblancphin]

@microsoft-github-policy-service not resolved yet