dinou 3.0.3 → 3.0.4

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [3.0.4]
+
+### Security
+
+- Fix CVE-2025-55182 (React2Shell) – Remote Code Execution in React Server Components
+  - Updated internal react-server-dom-esm to custom build from React main (includes upstream security patch)
+  - All Dinou apps using Server Components / Server Actions are now protected
+
 ## [3.0.3]
 
 ### Fixed

package/dinou/core/client-error.jsx

@@ -1,5 +1,5 @@
 import { use } from "react";
-import { createFromFetch } from "@matthamlin/react-server-dom-esm/client";
+import { createFromFetch } from "@roggc/react-server-dom-esm/client";
 import { hydrateRoot } from "react-dom/client";
 
 const cache = new Map();

package/dinou/core/client.jsx

@@ -1,5 +1,5 @@
 import { use } from "react";
-import { createFromFetch } from "@matthamlin/react-server-dom-esm/client";
+import { createFromFetch } from "@roggc/react-server-dom-esm/client";
 import { hydrateRoot } from "react-dom/client";
 
 const cache = new Map();

package/dinou/core/server-function-proxy.js

@@ -1,5 +1,5 @@
 // public/server-function-proxy.js
-import { createFromFetch } from "@matthamlin/react-server-dom-esm/client";
+import { createFromFetch } from "@roggc/react-server-dom-esm/client";
 
 export function createServerFunctionProxy(id) {
   return new Proxy(() => {}, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "description": "Dinou is a modern React 19 framework with React Server Components, Server Functions, and streaming SSR.",
   "main": "index.js",
   "bin": {
@@ -40,8 +40,8 @@
     "@babel/register": "^7.27.1",
     "@babel/traverse": "^7.28.3",
     "@esbuild-plugins/tsconfig-paths": "^0.1.2",
-    "@matthamlin/react-server-dom-esm": "file:packages/vendor/react-server-dom-esm",
     "@pmmmwh/react-refresh-webpack-plugin": "^0.6.2",
+    "@roggc/react-server-dom-esm": "^0.0.0-380778d2-20251207",
     "@rollup/plugin-babel": "^6.0.4",
     "@rollup/plugin-commonjs": "^28.0.6",
     "@rollup/plugin-json": "^6.1.0",
@@ -85,7 +85,7 @@
     "ws": "^8.18.3"
   },
   "peerDependencies": {
-    "react": ">=19.1.0",
-    "react-dom": ">=19.1.0"
+    "react": ">=19.2.1",
+    "react-dom": ">=19.2.1"
   }
 }

package/packages/vendor/react-server-dom-esm/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) Meta Platforms, Inc. and affiliates.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/packages/vendor/react-server-dom-esm/README.md

@@ -1,5 +0,0 @@
-# react-server-dom-esm
-
-Experimental React Flight bindings for DOM using ESM.
-
-**Use it at your own risk.**