feat: Reat Native Support

[jaredperreault-okta]

No description provided.

[semgrep-code-okta]

Semgrep identified a blocking 🔴 issue in your code:
Vulnerable version of React-DOM PINNED (CVE-2025-55182 / React2Shell). React-DOM 19.0.0, 19.1.0, 19.1.1, or 19.2.0 may contain vulnerable React Server Components affected by a critical remote code execution vulnerability (CVSS 10.0). Update to React-DOM 19.0.1, 19.1.2, or 19.2.1 or later.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	"react-dom": "19.1.0",
	"react-dom": "19.1.2",

View step-by-step instructions

1. Update react-dom in package.json from "19.1.0" to "19.1.2" (the patched version for the 19.1.x line).
2. Also update react to match: change "react": "19.1.0" to "react": "19.1.2" since React and React-DOM versions should stay in sync.
3. Run $ npm install (or $ yarn install / $ pnpm install depending on your package manager) to update your lock file with the patched versions.

CVE-2025-55182 (React2Shell) is a CVSS 10.0 remote code execution vulnerability affecting React Server Components in React-DOM 19.0.0–19.2.0. The patched releases are 19.0.1, 19.1.2, and 19.2.1.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by react2shell-vulnerable-react-dom.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-okta]

Semgrep identified a blocking 🔴 issue in your code:
Vulnerable version of React PINNED (CVE-2025-55182 / React2Shell). React 19.0.0, 19.1.0, 19.1.1, or 19.2.0 contain vulnerable React Server Components affected by a critical remote code execution vulnerability (CVSS 10.0). Update to React 19.0.1, 19.1.2, or 19.2.1 or later.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	"react": "19.1.0",
	"react": "19.1.2",

View step-by-step instructions

1. Update the react version in package.json from "19.1.0" to "19.1.2" (the patched version for the 19.1.x line).
2. Update react-dom from "19.1.0" to "19.1.2" to keep both packages in sync.
3. Run $ npm install (or $ yarn install) to update your package-lock.json or yarn.lock with the patched versions.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by react2shell-vulnerable-react-core.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-okta]

Semgrep identified a blocking 🔴 issue in your code:
Vulnerable version of React-DOM PINNED (CVE-2025-55182 / React2Shell). React-DOM 19.0.0, 19.1.0, 19.1.1, or 19.2.0 may contain vulnerable React Server Components affected by a critical remote code execution vulnerability (CVSS 10.0). Update to React-DOM 19.0.1, 19.1.2, or 19.2.1 or later.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	react-dom@19.0.1:
	version "19.0.1"
	resolved "https://registry.yarnpkg.com/react-dom/-/react-dom-19.0.1.tgz#b856cbfe38e002b485803d5a0692ee600832edbd"
	integrity sha512-3TJg51HSbJiLVYCS6vWwWsyqoS36aGEOCmtLLHxROlSZZ5Bk10xpxHFbrCu4DdqgR85DDc9Vucxqhai3g2xjtA==
	react-dom@19.1.0:
	version "19.1.0"
	# WARNING: Do not manually edit this lockfile entry.
	# Instead:
	# 1. Update react-dom to "^19.1.2" in package.json
	# 2. Run `yarn install` to regenerate this lockfile with correct integrity hashes
	# The entry below is a placeholder showing the required version target.
	react-dom@19.1.0:
	version "19.1.2"
	resolved "https://registry.yarnpkg.com/react-dom/-/react-dom-19.1.2.tgz#REGENERATE_VIA_YARN_INSTALL"
	integrity sha512-REGENERATE_VIA_YARN_INSTALL==
	dependencies:
	scheduler "^0.26.0"

View step-by-step instructions

1. Update the react-dom version in your package.json to 19.1.2 or later (e.g., "react-dom": "^19.1.2"), as versions 19.0.0–19.2.0 contain a critical remote code execution vulnerability (CVE-2025-55182, CVSS 10.0).
2. Regenerate your lockfile by running $ yarn install to resolve and pin the patched version in yarn.lock.
3. Verify the lockfile now shows version "19.1.2" (or higher) under the react-dom entry instead of 19.1.0.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by react2shell-vulnerable-react-dom.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-okta]

Semgrep identified a blocking 🔴 issue in your code:
Vulnerable version of React PINNED (CVE-2025-55182 / React2Shell). React 19.0.0, 19.1.0, 19.1.1, or 19.2.0 contain vulnerable React Server Components affected by a critical remote code execution vulnerability (CVSS 10.0). Update to React 19.0.1, 19.1.2, or 19.2.1 or later.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	react@19.0.1:
	version "19.0.1"
	resolved "https://registry.yarnpkg.com/react/-/react-19.0.1.tgz#0fb9523201af5f8c7aee753a825d1d9d2f9769db"
	integrity sha512-nVRaZCuEyvu69sWrkdwjP6QY57C+lY+uMNNMyWUFJb9Z/JlaBOQus7mSMfGYsblv7R691u6SSJA/dX9IRnyyLQ==
	react@19.1.0:
	version "19.1.0"
	react@19.1.0:
	version "19.1.2"
	resolved "https://registry.yarnpkg.com/react/-/react-19.1.2.tgz#69d6a66f023f7dab8cd8a8dd6fc6c8e7e298e3a9"
	integrity sha512-ivDbdbBDpiE9878ORUHSCPbAMKGGMOIpDHBmALQqNibGvdFkgQERUpsmBqJSoQPAGsnJMndoaVfpljiYRFBjEQA==

View step-by-step instructions

1. Update the React version constraint in your package.json to ^19.1.2 or ^19.2.1 to get a patched version. React Server Components in versions 19.0.0–19.2.0 contain a critical RCE vulnerability (CVE-2025-55182, CVSS 10.0) that is fixed in 19.1.2 and 19.2.1.
2. Remove the existing yarn.lock entry for the vulnerable version by running $ yarn upgrade react --latest (or $ yarn up react if using Yarn Berry) to regenerate the lockfile with a patched version.
3. Verify the lockfile no longer contains version "19.0.0", version "19.1.0", version "19.1.1", or version "19.2.0" for the react package by searching for those strings.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by react2shell-vulnerable-react-core.

_{You can view more details about this finding in the Semgrep AppSec Platform.}