[Flight] Add more DoS mitigations to Flight Reply, and harden Flight#35632
Merged
Conversation
This fixes security vulnerabilities in Server Functions. Co-authored-by: Josh Story <josh.c.story@gmail.com> Co-authored-by: Janka Uryga <lolzatu2@gmail.com> Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>
github-actions
Bot
added
the
React Core Team
eps1lon
approved these changes
Jan 26, 2026
github-actions Bot
pushed a commit
that referenced
this pull request
Jan 26, 2026
…35632) This fixes security vulnerabilities in Server Functions. --------- Co-authored-by: Sebastian Markbåge <sebastian@calyptus.eu> Co-authored-by: Josh Story <josh.c.story@gmail.com> Co-authored-by: Janka Uryga <lolzatu2@gmail.com> Co-authored-by: Sebastian Sebbie Silbermann <sebastian.silbermann@vercel.com> DiffTrain build for [1068027](1068027)
This was referenced Jan 26, 2026
2 tasks
This was referenced Feb 5, 2026
This was referenced Feb 19, 2026
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This was referenced Feb 25, 2026
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This was referenced Feb 26, 2026
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
This comment was marked as spam.
This comment was marked as spam.
1 task
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This was referenced Mar 25, 2026
1 task
This comment was marked as spam.
This comment was marked as spam.
vytick
added a commit
to trezor/trezor-suite
that referenced
this pull request
Jun 17, 2026
The previous commit bumped react-native 0.83.2 -> 0.85.3 (required by
Expo SDK 56) but left the react resolution at 19.2.4. React Native
bundles its own copy of the React reconciler and asserts at runtime that
the installed `react` version exactly equals that bundled renderer:
Error: Incompatible React versions: The "react" and
"react-native-renderer" packages must have the exact same version.
- react: 19.2.4
- react-native-renderer: 19.2.3
RN 0.85.3 syncs React 19.2.3 (confirmed in the bundled
ReactFabric-prod.js), so react must be 19.2.3, not 19.2.4. React 19.2.4
is pinned by Expo SDK 56's RN version; there is no 0.85.x release built
against 19.2.4.
19.2.4's only change over 19.2.3 is server-side hardening of React
Server Components / Flight Reply against DoS (react/react#35632).
Trezor Suite is client-only (Electron, web SPA, React Native) with no
React server runtime, so nothing functional is lost by the downgrade.
Aligns the resolution and all workspace declarations to 19.2.3
(react, react-dom, react-test-renderer).
Also bumps react-native-svg 15.15.3 -> 15.15.5: 15.15.4+ adds the
RN-version-guarded ImageResponseObserverCoordinator call (shared_ptr
instead of dereferenced ref) required for the iOS build on RN 0.85.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This fixes security vulnerabilities in Server Functions.