[v5] Add support for React 16 and 17

.pipelines/3p-e2e.yml

@@ -123,20 +123,12 @@ extends:
                             - "react-router-sample"
                             - "typescript-sample"
                             - "b2c-sample"
+                            - "react16-sample"
+                            - "react17-sample"
+                            - "react18-sample"
                         debug: ${{ parameters.debug }}
                         npmInstallTimeout: ${{ parameters.npmInstallTimeout }}
                         enableScreenshots: ${{ parameters.enableScreenshots }}
-                  - template: .pipelines/templates/msal-react-react18-e2e.yml@self
-                    parameters:
-                        poolType: ${{ parameters.poolType }}
-                        sourceBranch: ${{ variables.sourceBranch }}
-                        debug: ${{ parameters.debug }}
-                        npmInstallTimeout: ${{ parameters.npmInstallTimeout }}
-                        enableScreenshots: ${{ parameters.enableScreenshots }}
-                        samples:
-                            - "react-router-sample"
-                            - "typescript-sample"
-                            - "b2c-sample"
                 - ${{ if eq(parameters.runAngularTests, true) }}:
                   - template: .pipelines/templates/e2e-tests.yml@1P
                     parameters:

change/@azure-msal-react-fc1bd3a1-c1c1-43f6-b654-5934d367b063.json

@@ -0,0 +1,7 @@
+{
+  "type": "minor",
+  "comment": "Extend peer dependency range to support React 16 (16.8+) and React 17 [#8461](https://github.com/AzureAD/microsoft-authentication-library-for-js/pull/8461)",
+  "packageName": "@azure/msal-react",
+  "email": "joarroyo@microsoft.com",
+  "dependentChangeType": "patch"
+}

lib/msal-react/AGENTS.md

@@ -3,6 +3,7 @@
 ## Supported Environments
 
 - msal-react supports all modern mainstream browsers (Chrome, Firefox, Safari, Edge)
-- msal-react supports React versions 18 and 19
+- msal-react supports React versions 16 (16.8+), 17, 18, and 19
 
-Never use or suggest APIs or features that are not supported by the environments listed above.
+Never use or suggest APIs or features that are not supported by the environments listed above.
+React hooks are required (available since React 16.8). Do not use React 18+ specific APIs (e.g., `useSyncExternalStore`, `useId`, `useTransition`, `startTransition`, `createRoot`) in the library source code.

lib/msal-react/README.md

@@ -40,7 +40,7 @@ The `@azure/msal-react` package described by the code in this folder uses the [`
 
 | MSAL React version    | MSAL support status | Supported React versions |
 | --------------------- | ------------------- | ------------------------ |
-| MSAL React v5         | Active development  | 18, 19                   |
+| MSAL React v5         | Active development  | 16 (16.8+), 17, 18, 19  |
 | MSAL React v3         | In maintenance      | 16, 17, 18, 19           |
 | MSAL React v1, v2     | In maintenance      | 16, 17, 18               |
 
@@ -134,6 +134,9 @@ Our [samples directory](https://github.com/AzureAD/microsoft-authentication-libr
 -   [Next.js Sample](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-react-samples/nextjs-sample)
 -   [Gatsby Sample](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-react-samples/gatsby-sample)
 -   [B2C Sample](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-react-samples/b2c-sample)
+-   [React 16 Compat Sample (MUI v4)](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-react-samples/react16-sample)
+-   [React 17 Compat Sample](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-react-samples/react17-sample)
+-   [React 18 Compat Sample](https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-react-samples/react18-sample)
 
 More advanced samples backed with a tutorial can be found in the [Azure Samples](https://github.com/Azure-Samples) space on GitHub:
 

lib/msal-react/docs/getting-started.md

@@ -10,7 +10,7 @@
 
 `@azure/msal-react` is built on the [React context API](https://reactjs.org/docs/context.html) and all parts of your app that require authentication must be wrapped in the `MsalProvider` component. You will first need to [initialize](https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/initialization.md) an instance of `PublicClientApplication` then pass this to `MsalProvider` as a prop.
 
-> **React version support:** `@azure/msal-react` v5 supports both React 18 and React 19. Choose the rendering API that matches your React version.
+> **React version support:** `@azure/msal-react` v5 supports React 16 (16.8+), 17, 18, and 19 (19.2.1+). React 19.0.0–19.2.0 are excluded due to [CVE-2025-55182](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55182). All React hooks are required (available since React 16.8). Choose the rendering API that matches your React version.
 
 ```javascript
 import React from "react";
@@ -42,6 +42,15 @@ const root = createRoot(document.getElementById("root"));
 root.render(<AppProvider />);
 ```
 
+For React 16 or 17, use `ReactDOM.render` instead:
+
+```javascript
+import React from "react";
+import ReactDOM from "react-dom";
+
+ReactDOM.render(<AppProvider />, document.getElementById("root"));
+```
+
 All components underneath `MsalProvider` will have access to the `PublicClientApplication` instance via context as well as all hooks and components provided by `@azure/msal-react`.
 
 ## Determining whether a user is authenticated

lib/msal-react/docs/migration-guide-v4-v5.md

@@ -16,21 +16,23 @@ MSAL Browser v5 requires a dedicated redirect page/bridge for authentication flo
 Please see the [COOP section in the MSAL Browser v4-v5 migration guide](https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/v4-migration.md#cross-origin-opener-policy-coop-support).
 
 ## Updated React version support
-MSAL React v5 supports React 18.0.0 or greater and React 19.2.1 or greater. It no longer supports React 16 or 17.
+MSAL React v5 supports React 16.8.0 or greater through React 19.x. This includes React 16 (16.8+), 17, 18, and 19.
 
 ## Peer dependency ranges
 
-MSAL React v5 declares its `react` peer dependency as `"^18.0.0 || ^19.2.1"`. This means:
+MSAL React v5 declares its `react` peer dependency as `">=16.8.0 <19.0.0 || >=19.2.1 <20.0.0"`. This means:
 
-- Applications using React 18.x will satisfy the peer dependency without errors or warnings.
-- Applications using React 19.2.1 or newer (within the React 19.x line) will satisfy the peer dependency without errors or warnings.
-- No `--legacy-peer-deps` flag is required for either version.
+- Applications using React 16.8 through 18.x, or React 19.2.1+, will satisfy the peer dependency without errors or warnings.
+- React 19.0.0, 19.1.0, 19.1.1, and 19.2.0 are **excluded** due to [CVE-2025-55182](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55182). Upgrade to React 19.2.1 or later.
+- No `--legacy-peer-deps` flag is required for any supported version.
 
 ### Known considerations
 
-- **`@types/react`**: If you use TypeScript, install the `@types/react` version matching your React major version (`@types/react@^18` for React 18, `@types/react@^19` for React 19). Both are compatible with the MSAL React v5 public API surface.
-- **`@testing-library/react`**: v14+ supports React 18; v16+ supports both React 18 and 19. Choose the version that matches your React version.
-- **`react-dom`**: Install the same major version of `react-dom` as `react` (e.g., `react-dom@^18` with `react@^18`).
+- **React 16/17 note**: React hooks are required. Minimum supported version is React 16.8.0.
+- **`@types/react`**: If you use TypeScript, install the `@types/react` version matching your React major version (`@types/react@^16` for React 16, `@types/react@^17` for React 17, `@types/react@^18` for React 18, `@types/react@^19` for React 19). All are compatible with the MSAL React v5 public API surface.
+- **`@testing-library/react`**: v12 supports React 16/17; v14+ supports React 18; v16+ supports both React 18 and 19. Choose the version that matches your React version.
+- **`react-dom`**: Install the same major version of `react-dom` as `react` (e.g., `react-dom@^16` with `react@^16`).
+- **Rendering API**: React 16 and 17 use `ReactDOM.render()`. React 18+ uses `createRoot()`. MSAL React itself does not call either API — your application chooses the rendering method.
 
 ## Migrating from Create React App (react-scripts)
 

lib/msal-react/package.json

@@ -57,7 +57,7 @@
   },
   "peerDependencies": {
     "@azure/msal-browser": "^5.6.0",
-    "react": "^18.0.0 || ^19.2.1"
+    "react": ">=16.8.0 <19.0.0 || >=19.2.1 <20.0.0"
   },
   "devDependencies": {
     "@azure/msal-browser": "^5.6.0",
@@ -83,4 +83,4 @@
     "tslib": "^2.0.0",
     "typescript": "^4.9.5"
   }
-}
+}