Skip to content

[FlightReply] Type hardening and performance improvements#36425

Merged
eps1lon merged 1 commit into
facebook:mainfrom
eps1lon:sebbie/of-types-and-perf
May 6, 2026
Merged

[FlightReply] Type hardening and performance improvements#36425
eps1lon merged 1 commit into
facebook:mainfrom
eps1lon:sebbie/of-types-and-perf

Conversation

@eps1lon
Copy link
Copy Markdown
Collaborator

@eps1lon eps1lon commented May 6, 2026

This fixes security vulnerabilities in Server Functions.

Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>
@meta-cla meta-cla Bot added the CLA Signed label May 6, 2026
@github-actions github-actions Bot added the React Core Team Opened by a member of the React Core Team label May 6, 2026
@eps1lon eps1lon marked this pull request as ready for review May 6, 2026 17:34
@react-sizebot
Copy link
Copy Markdown

Comparing: 9635257...e0cd2b1

Critical size changes

Includes critical production bundles, as well as any change greater than 2%:

Name +/- Base Current +/- gzip Base gzip Current gzip
oss-stable/react-dom/cjs/react-dom.production.js = 6.84 kB 6.84 kB = 1.88 kB 1.88 kB
oss-stable/react-dom/cjs/react-dom-client.production.js = 612.85 kB 612.85 kB = 108.29 kB 108.29 kB
oss-experimental/react-dom/cjs/react-dom.production.js = 6.84 kB 6.84 kB = 1.88 kB 1.88 kB
oss-experimental/react-dom/cjs/react-dom-client.production.js = 678.78 kB 678.78 kB = 119.26 kB 119.26 kB
facebook-www/ReactDOM-prod.classic.js = 699.20 kB 699.20 kB = 122.82 kB 122.82 kB
facebook-www/ReactDOM-prod.modern.js = 689.51 kB 689.51 kB = 121.21 kB 121.21 kB

Significant size changes

Includes any change greater than 0.2%:

Expand to show
Name +/- Base Current +/- gzip Base gzip Current gzip
oss-stable-semver/react-server-dom-parcel/cjs/react-server-dom-parcel-server.node.production.js +0.98% 118.37 kB 119.53 kB +1.19% 23.65 kB 23.93 kB
oss-stable/react-server-dom-parcel/cjs/react-server-dom-parcel-server.node.production.js +0.98% 118.37 kB 119.53 kB +1.19% 23.65 kB 23.93 kB
oss-experimental/react-server-dom-parcel/cjs/react-server-dom-parcel-server.node.production.js +0.96% 120.17 kB 121.32 kB +1.20% 24.01 kB 24.30 kB
oss-stable-semver/react-server-dom-esm/cjs/react-server-dom-esm-server.node.production.js +0.94% 114.38 kB 115.46 kB +0.98% 23.12 kB 23.35 kB
oss-stable/react-server-dom-esm/cjs/react-server-dom-esm-server.node.production.js +0.94% 114.38 kB 115.46 kB +0.98% 23.12 kB 23.35 kB
oss-stable-semver/react-server-dom-unbundled/cjs/react-server-dom-unbundled-server.node.production.js +0.93% 124.24 kB 125.40 kB +1.10% 24.59 kB 24.86 kB
oss-stable/react-server-dom-unbundled/cjs/react-server-dom-unbundled-server.node.production.js +0.93% 124.24 kB 125.40 kB +1.10% 24.59 kB 24.86 kB
oss-experimental/react-server-dom-esm/cjs/react-server-dom-esm-server.node.production.js +0.93% 116.18 kB 117.26 kB +0.97% 23.49 kB 23.71 kB
oss-stable-semver/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.production.js +0.92% 125.29 kB 126.44 kB +1.11% 24.82 kB 25.10 kB
oss-stable/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.production.js +0.92% 125.29 kB 126.44 kB +1.11% 24.82 kB 25.10 kB
oss-stable-semver/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.node.production.js +0.92% 125.30 kB 126.46 kB +1.09% 24.82 kB 25.09 kB
oss-stable/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.node.production.js +0.92% 125.30 kB 126.46 kB +1.09% 24.82 kB 25.09 kB
oss-experimental/react-server-dom-unbundled/cjs/react-server-dom-unbundled-server.node.production.js +0.92% 126.03 kB 127.19 kB +1.10% 24.96 kB 25.24 kB
oss-experimental/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.production.js +0.91% 127.08 kB 128.24 kB +1.10% 25.19 kB 25.47 kB
oss-experimental/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.node.production.js +0.91% 127.09 kB 128.25 kB +1.08% 25.19 kB 25.46 kB
oss-stable-semver/react-server-dom-parcel/cjs/react-server-dom-parcel-server.edge.production.js +0.80% 111.59 kB 112.48 kB +0.98% 22.58 kB 22.80 kB
oss-stable/react-server-dom-parcel/cjs/react-server-dom-parcel-server.edge.production.js +0.80% 111.59 kB 112.48 kB +0.98% 22.58 kB 22.80 kB
oss-experimental/react-server-dom-parcel/cjs/react-server-dom-parcel-server.edge.production.js +0.78% 113.39 kB 114.28 kB +0.96% 22.97 kB 23.19 kB
oss-stable-semver/react-server-dom-webpack/cjs/react-server-dom-webpack-server.edge.production.js +0.75% 118.53 kB 119.42 kB +0.95% 23.74 kB 23.97 kB
oss-stable/react-server-dom-webpack/cjs/react-server-dom-webpack-server.edge.production.js +0.75% 118.53 kB 119.42 kB +0.95% 23.74 kB 23.97 kB
oss-stable-semver/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.edge.production.js +0.75% 118.53 kB 119.42 kB +0.95% 23.74 kB 23.96 kB
oss-stable/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.edge.production.js +0.75% 118.53 kB 119.42 kB +0.95% 23.74 kB 23.96 kB
oss-experimental/react-server-dom-webpack/cjs/react-server-dom-webpack-server.edge.production.js +0.74% 120.32 kB 121.21 kB +0.92% 24.11 kB 24.34 kB
oss-experimental/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.edge.production.js +0.74% 120.32 kB 121.21 kB +0.90% 24.11 kB 24.33 kB
facebook-www/ReactFlightServer-prod.classic.js +0.58% 102.72 kB 103.32 kB +0.66% 20.81 kB 20.95 kB
facebook-www/ReactFlightServer-prod.modern.js +0.58% 102.72 kB 103.32 kB +0.66% 20.81 kB 20.95 kB
oss-stable-semver/react-server-dom-parcel/cjs/react-server-dom-parcel-server.node.development.js +0.55% 241.51 kB 242.84 kB +0.73% 43.19 kB 43.51 kB
oss-stable/react-server-dom-parcel/cjs/react-server-dom-parcel-server.node.development.js +0.55% 241.51 kB 242.84 kB +0.73% 43.19 kB 43.51 kB
oss-experimental/react-server-dom-parcel/cjs/react-server-dom-parcel-server.node.development.js +0.55% 243.60 kB 244.93 kB +0.76% 43.62 kB 43.95 kB
oss-stable-semver/react-server-dom-unbundled/cjs/react-server-dom-unbundled-server.node.development.js +0.54% 248.03 kB 249.36 kB +0.79% 44.26 kB 44.60 kB
oss-stable/react-server-dom-unbundled/cjs/react-server-dom-unbundled-server.node.development.js +0.54% 248.03 kB 249.36 kB +0.79% 44.26 kB 44.60 kB
oss-stable-semver/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js +0.53% 249.23 kB 250.56 kB +0.76% 44.58 kB 44.92 kB
oss-stable/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js +0.53% 249.23 kB 250.56 kB +0.76% 44.58 kB 44.92 kB
oss-stable-semver/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.node.development.js +0.53% 249.24 kB 250.57 kB +0.74% 44.59 kB 44.92 kB
oss-stable/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.node.development.js +0.53% 249.24 kB 250.57 kB +0.74% 44.59 kB 44.92 kB
oss-experimental/react-server-dom-unbundled/cjs/react-server-dom-unbundled-server.node.development.js +0.53% 250.12 kB 251.45 kB +0.77% 44.69 kB 45.03 kB
oss-stable-semver/react-server-dom-esm/cjs/react-server-dom-esm-server.node.development.js +0.53% 234.83 kB 236.07 kB +0.71% 42.60 kB 42.90 kB
oss-stable/react-server-dom-esm/cjs/react-server-dom-esm-server.node.development.js +0.53% 234.83 kB 236.07 kB +0.71% 42.60 kB 42.90 kB
oss-experimental/react-server-dom-webpack/cjs/react-server-dom-webpack-server.node.development.js +0.53% 251.32 kB 252.65 kB +0.75% 45.00 kB 45.34 kB
oss-experimental/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.node.development.js +0.53% 251.33 kB 252.66 kB +0.75% 45.01 kB 45.35 kB
oss-experimental/react-server-dom-esm/cjs/react-server-dom-esm-server.node.development.js +0.52% 236.92 kB 238.16 kB +0.70% 43.03 kB 43.33 kB
oss-stable-semver/react-server-dom-parcel/cjs/react-server-dom-parcel-server.edge.development.js +0.49% 211.15 kB 212.19 kB +0.66% 38.07 kB 38.32 kB
oss-stable/react-server-dom-parcel/cjs/react-server-dom-parcel-server.edge.development.js +0.49% 211.15 kB 212.19 kB +0.66% 38.07 kB 38.32 kB
oss-experimental/react-server-dom-parcel/cjs/react-server-dom-parcel-server.edge.development.js +0.49% 213.24 kB 214.28 kB +0.64% 38.49 kB 38.73 kB
oss-stable-semver/react-server-dom-webpack/cjs/react-server-dom-webpack-server.edge.development.js +0.47% 218.87 kB 219.91 kB +0.66% 39.36 kB 39.62 kB
oss-stable/react-server-dom-webpack/cjs/react-server-dom-webpack-server.edge.development.js +0.47% 218.87 kB 219.91 kB +0.66% 39.36 kB 39.62 kB
oss-stable-semver/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.edge.development.js +0.47% 218.87 kB 219.91 kB +0.65% 39.37 kB 39.62 kB
oss-stable/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.edge.development.js +0.47% 218.87 kB 219.91 kB +0.65% 39.37 kB 39.62 kB
oss-experimental/react-server-dom-webpack/cjs/react-server-dom-webpack-server.edge.development.js +0.47% 220.96 kB 222.00 kB +0.63% 39.78 kB 40.04 kB
oss-experimental/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.edge.development.js +0.47% 220.96 kB 222.00 kB +0.63% 39.79 kB 40.04 kB
oss-stable-semver/react-server-dom-parcel/cjs/react-server-dom-parcel-server.browser.production.js +0.42% 107.84 kB 108.30 kB +0.40% 21.02 kB 21.10 kB
oss-stable/react-server-dom-parcel/cjs/react-server-dom-parcel-server.browser.production.js +0.42% 107.84 kB 108.30 kB +0.40% 21.02 kB 21.10 kB
oss-experimental/react-server-dom-parcel/cjs/react-server-dom-parcel-server.browser.production.js +0.42% 109.64 kB 110.09 kB +0.39% 21.38 kB 21.46 kB
oss-stable-semver/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.browser.production.js +0.40% 113.36 kB 113.81 kB +0.35% 21.94 kB 22.02 kB
oss-stable/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.browser.production.js +0.40% 113.36 kB 113.81 kB +0.35% 21.94 kB 22.02 kB
oss-stable-semver/react-server-dom-webpack/cjs/react-server-dom-webpack-server.browser.production.js +0.40% 113.71 kB 114.17 kB +0.36% 22.03 kB 22.11 kB
oss-stable/react-server-dom-webpack/cjs/react-server-dom-webpack-server.browser.production.js +0.40% 113.71 kB 114.17 kB +0.36% 22.03 kB 22.11 kB
oss-experimental/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.browser.production.js +0.40% 115.15 kB 115.61 kB +0.35% 22.30 kB 22.38 kB
oss-experimental/react-server-dom-webpack/cjs/react-server-dom-webpack-server.browser.production.js +0.40% 115.50 kB 115.96 kB +0.36% 22.40 kB 22.48 kB
facebook-www/ReactFlightServer-dev.classic.js +0.36% 198.74 kB 199.45 kB +0.50% 35.96 kB 36.14 kB
facebook-www/ReactFlightServer-dev.modern.js +0.36% 198.74 kB 199.45 kB +0.50% 35.96 kB 36.14 kB
oss-stable-semver/react-server-dom-parcel/cjs/react-server-dom-parcel-server.browser.development.js +0.34% 207.46 kB 208.17 kB +0.46% 37.55 kB 37.72 kB
oss-stable/react-server-dom-parcel/cjs/react-server-dom-parcel-server.browser.development.js +0.34% 207.46 kB 208.17 kB +0.46% 37.55 kB 37.72 kB
oss-experimental/react-server-dom-parcel/cjs/react-server-dom-parcel-server.browser.development.js +0.34% 209.56 kB 210.27 kB +0.45% 37.97 kB 38.14 kB
oss-stable-semver/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.browser.development.js +0.33% 215.07 kB 215.78 kB +0.44% 38.84 kB 39.01 kB
oss-stable/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.browser.development.js +0.33% 215.07 kB 215.78 kB +0.44% 38.84 kB 39.01 kB
oss-stable-semver/react-server-dom-webpack/cjs/react-server-dom-webpack-server.browser.development.js +0.33% 215.54 kB 216.25 kB +0.45% 38.94 kB 39.12 kB
oss-stable/react-server-dom-webpack/cjs/react-server-dom-webpack-server.browser.development.js +0.33% 215.54 kB 216.25 kB +0.45% 38.94 kB 39.12 kB
oss-experimental/react-server-dom-turbopack/cjs/react-server-dom-turbopack-server.browser.development.js +0.33% 217.17 kB 217.88 kB +0.44% 39.27 kB 39.44 kB
oss-experimental/react-server-dom-webpack/cjs/react-server-dom-webpack-server.browser.development.js +0.33% 217.65 kB 218.36 kB +0.43% 39.38 kB 39.55 kB

Generated by 🚫 dangerJS against e0cd2b1

@eps1lon eps1lon merged commit dd45307 into facebook:main May 6, 2026
246 checks passed
github-actions Bot pushed a commit that referenced this pull request May 6, 2026
Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>

DiffTrain build for [dd45307](dd45307)
github-actions Bot pushed a commit to code/lib-react that referenced this pull request May 10, 2026
…6425)

Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>

DiffTrain build for [dd45307](facebook@dd45307)
unstubbable added a commit to unstubbable/react that referenced this pull request May 13, 2026
Fixes a regression from facebook#36425 where referenced `FormData` entries can
be dropped by `decodeReplyFromBusboy` when files are interleaved with
text fields in the payload.

`decodeReplyFromBusboy` queues text fields that arrive while a file is
being streamed and flushes them after the last file's `'end'`, working
around busboy emitting `'end'` deferred relative to subsequent `'field'`
events. With multiple files interleaved with text, this loses the
relative order of the affected text entries. The reorder was a
long-standing but invisible issue — entries came back in the wrong order
but were all present — until facebook#36425 tightened how referenced FormData
entries are collected from the backing store to rely on them being
contiguous. With that assumption violated, referenced FormDatas can now
come back with some entries dropped. The pattern is most easily surfaced
through `useActionState` actions that return the submitted `FormData` as
part of their state.

This replaces the tail-flush with a positionally-tagged buffer drained
in arrival order. `flush()` walks from a monotonic index pointer,
resolving text immediately and files once their `'end'` has fired, and
holding later entries when the cursor lands on a still-streaming file.
The backing FormData now matches the payload's order, restoring the
contiguity assumption (and fixing the long-standing reorder as a side
effect). The same change is applied to all five copies in
`react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new
tests cover the multi-file interleave.

fixes vercel/next.js#93822
unstubbable added a commit to unstubbable/react that referenced this pull request May 13, 2026
Fixes a regression from facebook#36425 where referenced `FormData` entries can
be dropped by `decodeReplyFromBusboy` when files are interleaved with
text fields in the payload.

`decodeReplyFromBusboy` queues text fields that arrive while a file is
being streamed and flushes them after the last file's `'end'`, working
around busboy emitting `'end'` deferred relative to subsequent `'field'`
events. With multiple files interleaved with text, this loses the
relative order of the affected text entries. The reorder was a
long-standing but invisible issue — entries came back in the wrong order
but were all present — until facebook#36425 tightened how referenced FormData
entries are collected from the backing store to rely on them being
contiguous. With that assumption violated, referenced FormDatas can now
come back with some entries dropped. The pattern is most easily surfaced
through `useActionState` actions that return the submitted `FormData` as
part of their state.

This replaces the tail-flush with a positionally-tagged buffer drained
in arrival order. `flush()` walks from a monotonic index pointer,
resolving text immediately and files once their `'end'` has fired, and
holding later entries when the cursor lands on a still-streaming file.
The backing FormData now matches the payload's order, restoring the
contiguity assumption (and fixing the long-standing reorder as a side
effect). The same change is applied to all five copies in
`react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new
tests cover the multi-file interleave.

fixes vercel/next.js#93822
unstubbable added a commit to unstubbable/react that referenced this pull request May 13, 2026
Fixes a regression from facebook#36425 where referenced `FormData` entries can
be dropped by `decodeReplyFromBusboy` when files are interleaved with
text fields in the payload.

`decodeReplyFromBusboy` queues text fields that arrive while a file is
being streamed and flushes them after the last file's `'end'`, working
around busboy emitting `'end'` deferred relative to subsequent `'field'`
events. With multiple files interleaved with text, this loses the
relative order of the affected text entries. The reorder was a
long-standing but invisible issue — entries came back in the wrong order
but were all present — until facebook#36425 tightened how referenced FormData
entries are collected from the backing store to rely on them being
contiguous. With that assumption violated, referenced FormDatas can now
come back with some entries dropped. The pattern is most easily surfaced
through `useActionState` actions that return the submitted `FormData` as
part of their state.

This replaces the tail-flush with a positionally-tagged buffer drained
in arrival order. `flush()` walks from a monotonic index pointer,
resolving text immediately and files once their `'end'` has fired, and
holding later entries when the cursor lands on a still-streaming file.
The backing FormData now matches the payload's order, restoring the
contiguity assumption (and fixing the long-standing reorder as a side
effect). The same change is applied to all five copies in
`react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new
tests cover the multi-file interleave.

fixes vercel/next.js#93822
unstubbable added a commit to unstubbable/react that referenced this pull request May 13, 2026
Fixes a regression from facebook#36425 where referenced `FormData` entries can
be dropped by `decodeReplyFromBusboy` when files are interleaved with
text fields in the payload.

`decodeReplyFromBusboy` queues text fields that arrive while a file is
being streamed and flushes them after the last file's `'end'`, working
around busboy emitting `'end'` deferred relative to subsequent `'field'`
events. With multiple files interleaved with text, this loses the
relative order of the affected text entries. The reorder was a
long-standing but invisible issue — entries came back in the wrong order
but were all present — until facebook#36425 tightened how referenced FormData
entries are collected from the backing store to rely on them being
contiguous. With that assumption violated, referenced FormDatas can now
come back with some entries dropped. The pattern is most easily surfaced
through `useActionState` actions that return the submitted `FormData` as
part of their state.

This replaces the tail-flush with a positionally-tagged buffer drained
in arrival order. `flush()` walks from a monotonic index pointer,
resolving text immediately and files once their `'end'` has fired, and
holding later entries when the cursor lands on a still-streaming file.
The backing FormData now matches the payload's order, restoring the
contiguity assumption (and fixing the long-standing reorder as a side
effect). The same change is applied to all five copies in
`react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new
tests cover the multi-file interleave.

fixes vercel/next.js#93822
moshehbenavraham pushed a commit to moshehbenavraham/openclaw-board that referenced this pull request May 14, 2026
React 19.2.6 patch release: type hardening and performance improvements for React Server Components (facebook/react#36425). Pure patch, no API changes. Eligible for safe auto-merge under repo policy.

Validation: PR-level checks green; CI on main has been green since #43 (next 16.2.6) merged on 2026-05-13. Risk: low — patch-version bump on stable 19.2.x line.

Rollback: revert merge commit on main, then `npm install` to restore prior lockfile state.
unstubbable added a commit that referenced this pull request May 14, 2026
…36468)

Fixes a regression from #36425 where referenced `FormData` entries can
be dropped by `decodeReplyFromBusboy` when files are interleaved with
text fields in the payload.

`decodeReplyFromBusboy` queues text fields that arrive while a file is
being streamed and flushes them after the last file's `'end'`, working
around busboy emitting `'end'` deferred relative to subsequent `'field'`
events. With multiple files interleaved with text, this loses the
relative order of the affected text entries. The reorder was a
long-standing but invisible issue — entries came back in the wrong order
but were all present — until #36425 tightened how referenced FormData
entries are collected from the backing store to rely on them being
contiguous. With that assumption violated, referenced FormDatas can now
come back with some entries dropped. The pattern is most easily surfaced
through `useActionState` actions that return the submitted `FormData` as
part of their state.

This replaces the tail-flush with a linked list of pending files. Text
fields that arrive while a file is in flight are queued on the tail
file's `queuedFields`; fields that arrive when the list is empty resolve
immediately. `flush()` walks from the head, resolving each completed
file followed by its queued fields, and stops at the first file that
hasn't ended yet. The backing FormData now matches the payload's order,
restoring the contiguity assumption (and fixing the long-standing
reorder as a side effect). The same change is applied to all five copies
in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new
tests cover the multi-file interleave.

fixes vercel/next.js#93822
moshehbenavraham pushed a commit to moshehbenavraham/openclaw-board that referenced this pull request May 15, 2026
React 19.2.6 patch release: type hardening and performance improvements for React Server Components (facebook/react#36425). Pure patch, no API changes. Auto-merge per agent maintenance — eligible for safe auto-merge.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed React Core Team Opened by a member of the React Core Team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants