Bump react-refresh from 0.14.0 to 0.18.0

[dependabot]

Bumps react-refresh from 0.14.0 to 0.18.0.

Release notes

Sourced from react-refresh's releases.

0.14.10 (October 14, 2020)

React

• Backport support for the new JSX transform to 0.14.x. (@​lunaruan in #18299 and @​gaearon in #20024)

v0.14.8

React

• Fixed memory leak when rendering on the server

v0.14.7

React

• Fixed bug with <option> tags when using dangerouslySetInnerHTML
• Fixed memory leak in synthetic event system

React TestUtils Add-on

• Fixed bug with calling setState in componentWillMount when using shallow rendering

v0.14.6

React

• Updated fbjs dependency to pick up change affecting handling of undefined document.

v0.14.5

React

• More minor internal changes for better compatibility with React Native

Changelog

Sourced from react-refresh's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #35632)

19.2.3 (Dec 11, 2025)

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #35351)

19.2.2 (Dec 11, 2025)

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #35289, #35345)

19.2.1 (Dec 3, 2025)

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #35277)

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by react-bot, a new releaser for react-refresh since your current version.

---

Note

Low Risk
Dev-only dependency bump with no production or application code changes; risk is limited to local dev HMR behavior.

Overview
Updates the react-refresh dev dependency in packages/gui from 0.14.0 to 0.18.0, with matching package-lock.json entries.

This only affects the development React Fast Refresh stack (Babel plugin and @pmmmwh/react-refresh-webpack-plugin in the webpack React config). Production builds and runtime behavior are unchanged.

^{Reviewed by Cursor Bugbot for commit ea0f431. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react-refresh@​0.14.0 ⏵ 0.18.0	+1

View full report

[github-actions]

'This PR has been flagged as stale due to no activity for over 60
days. It will not be automatically closed, but it has been given
a stale-pr label and should be manually reviewed.'

[emlowe]

@dependabot rebase

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the react-refresh bump against the malware scan, lockfile, and upstream package for supply-chain compromise.Verdict: benign

This is a legitimate Meta react-refresh bump (0.14.0 → 0.18.0) used as a dev-only Fast Refresh Babel plugin with @pmmmwh/react-refresh-webpack-plugin. It is not the typosquat react-refresh-update.

Scanner vs interpretation: status warn, but both heuristics are expected false positives, not compromise:

• ghost_version_or_missing_tag for 0.18.0: React git tags follow React (v19.2.0, etc.). react-refresh is versioned independently (0.x in ReactVersions.js; current tree is 0.19.0). npm does publish react-refresh@0.18.0. Scan could not resolve a to ref (unresolved, 0 files scanned).
• maintainer_drift to react-bot: normal Facebook/React npm publisher, not a hijack.

Integrity: lockfile points at https://registry.npmjs.org/react-refresh/-/react-refresh-0.18.0.tgz with a normal SHA-512 integrity; 0 dependencies; no install lifecycle scripts. Dependabot notes/commits are wrong package history (React 0.14.x / packages/react), not a malware signal.

No obfuscation, unexpected network/FS/process behavior, Unicode/IOC findings, new transitives, or workflow changes. Safe to merge from a supply-chain malware standpoint (still a minor version jump for Fast Refresh; smoke-test HMR if you care about runtime compatibility).

Compatibility Analysis

I'll inspect how react-refresh is used in this repo and what changed upstream between 0.14.0 and 0.18.0.Next I’ll compare the react-refresh package surface between 0.14 and 0.18 and check how the webpack plugin consumes it.Recommendation: merge-with-caveats

Dependabot’s notes/changelog are for React 0.14 / React 19, not react-refresh. Treat them as unusable. This bump is dev-only Fast Refresh for webpack; production builds do not load it.

1) Usage in this repo

Only @chia-network/gui, and only the webpack React renderer:

• packages/gui/package.json — react-refresh 0.18.0 (dev) + @pmmmwh/react-refresh-webpack-plugin 0.6.0
• packages/gui/webpack.react.babel.ts
  • require.resolve('react-refresh/babel') when NODE_ENV !== 'production'
  • new ReactRefreshWebpackPlugin() in the same DEV path
• No app/runtime import of react-refresh/runtime (the webpack plugin injects it)
• Plugin peer: react-refresh: >=0.10.0 <1.0.0 — 0.18.0 fits
• App React is 18.3.1; webpack 5.105.1 / webpack-dev-server 5.2.6 — already in the plugin’s range

Production (build:react) never adds the Babel plugin or the webpack plugin.

2) API overlap with 0.14.0 → 0.18.0

This repo only needs the stable bundler surface:

• react-refresh/babel (still in exports)
• runtime hooks consumed by the webpack plugin (injectIntoGlobalHook, performReactRefresh, register, signature helpers)

You do not pass plugin options (skipEnvCheck, refreshReg, refreshSig, emitFullSignatures). Those still exist on HEAD of .upstream-dependency (packages/react-refresh, currently 0.19.0 source).

No usage of React 19 / RSC APIs from the bogus changelog.

3) Risks / unknowns

Risk	Severity	Why
No real react-refresh changelog for 0.15–0.18	Low	0.x minors can still change Fast Refresh behavior; CI likely does not exercise HMR
Babel env !== 'development' throw	Low	Plugin is gated on DEV, and dev:react sets NODE_ENV=development. Odd BABEL_ENV could fail the transform
React 18.3 + refresh 0.18	Low	Runtime still talks to the renderer via the DevTools hook; not tied to React 19
Production/runtime	None	Not in the shipped renderer bundle

4) What to do

Merge after a short local smoke test (not a production concern):

1. npm run dev (or dev:react)
2. Edit a simple component and confirm Fast Refresh keeps state
3. Confirm a production build:react still does not pull react-refresh

If HMR misbehaves, pin back to 0.14.0 or try 0.17.x first; no app code changes are required for this bump.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 0
• Resolution strategy: unresolved
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved refs: from=3603d45157e6c1b21cda7ed96683408b319ae619 to=n/a
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 2

Top findings

• react-refresh:0 ghost_version_or_missing_tag :: 0.18.0
• react-refresh:0 maintainer_drift :: 0.14.0->0.18.0