Upgrade to react 19

[RomanHotsiy]

I also upgraded the testing library as the @testing-library/react-hooks is deprecated.

Fixes #423

A few notable changes:

• useMemo typings in react changed so deps argument can't be undefined anymore (I updated in the code)
• one test was giving 2 instead of 3 renders. I didn't have time to dig, @avkonst maybe you would understand it faster but if you're busy let me know, I can dig
• updated test code in one place as the renderHook from @testing-library/react doesn't return error but throws instead

[phylum-io]

Phylum OSS Supply Chain Risk Analysis - FAILED

This repository analyzes the risk of new dependencies. An
administrator of this repository has set requirements via Phylum policy.

If you see this comment, one or more dependencies have failed Phylum's risk analysis.

Package: cjs-module-lexer@1.4.3 failed.

cjs-module-lexer@1.4.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js@3.42.0 failed.

core-js@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js-pure@3.42.0 failed.

core-js-pure@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: es-module-lexer@1.7.0 failed.

es-module-lexer@1.7.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: eta@1.14.2 failed.

Eta vulnerable to Code Injection via templates rendered with user-defined data

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

XSS Attack with Express API

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: jiti@1.21.7 failed.

jiti@1.21.7 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: postcss@8.5.3 failed.

postcss@8.5.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: prismjs@1.30.0 failed.

prismjs@1.30.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: psl@1.15.0 failed.

psl@1.15.0 references suspicious URLs.

Risk Domain: Malicious Code
Risk Level: medium

Reason: Suspicious URL reference

Package: registry-auth-token@5.1.0 failed.

registry-auth-token@5.1.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: tailwindcss@3.4.17 failed.

tailwindcss@3.4.17 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: terser@5.39.2 failed.

terser@5.39.2 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: undici@6.21.3 failed.

undici@6.21.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: webpack@5.99.9 failed.

webpack@5.99.9 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: yaml@2.8.0 failed.

yaml@2.8.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: @algolia/client-search@5.25.0 failed.

@algolia/client-search@5.25.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

View this project in the Phylum UI

[RomanHotsiy]

The lock file is generated using pnpm 7.30.0, not sure why it breaks builds.

[RomanHotsiy]

Hey @avkonst.

Would you be able to take a look at this PR this week?

[avkonst]

Hi, thank you for contribution. I am not able to look at this week but will try on weekend or next week. Could you please investigate what changed in the rerender from 2 to 3? That will help a lot

[RomanHotsiy]

@avkonst do you need any help maybe?

[phylum-io]

Phylum OSS Supply Chain Risk Analysis - FAILED

This repository analyzes the risk of new dependencies. An
administrator of this repository has set requirements via Phylum policy.

If you see this comment, one or more dependencies have failed Phylum's risk analysis.

Package: axios@1.9.0 failed.

Axios is vulnerable to DoS attack through lack of data size check

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: cjs-module-lexer@1.4.3 failed.

cjs-module-lexer@1.4.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js@3.42.0 failed.

core-js@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js-pure@3.42.0 failed.

core-js-pure@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: es-module-lexer@1.7.0 failed.

es-module-lexer@1.7.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: eta@1.14.2 failed.

Eta vulnerable to Code Injection via templates rendered with user-defined data

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

XSS Attack with Express API

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: form-data@3.0.3 failed.

form-data uses unsafe random function in form-data for choosing boundary

Risk Domain: Software Vulnerability
Risk Level: critical

Reason: Critical or High software vulnerability

Package: form-data@4.0.2 failed.

form-data uses unsafe random function in form-data for choosing boundary

Risk Domain: Software Vulnerability
Risk Level: critical

Reason: Critical or High software vulnerability

Package: glob@10.4.5 failed.

glob CLI: Command injection via -c/--cmd executes matches with shell:true

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: jiti@1.21.7 failed.

jiti@1.21.7 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: postcss@8.5.3 failed.

postcss@8.5.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: prismjs@1.30.0 failed.

prismjs@1.30.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: psl@1.15.0 failed.

psl@1.15.0 references suspicious URLs.

Risk Domain: Malicious Code
Risk Level: medium

Reason: Suspicious URL reference

Package: registry-auth-token@5.1.0 failed.

registry-auth-token@5.1.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: tailwindcss@3.4.17 failed.

tailwindcss@3.4.17 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: terser@5.39.2 failed.

terser@5.39.2 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: undici@6.21.3 failed.

undici@6.21.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: webpack@5.99.9 failed.

webpack@5.99.9 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: yaml@2.8.0 failed.

yaml@2.8.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: @algolia/client-search@5.25.0 failed.

@algolia/client-search@5.25.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

View this project in the Phylum UI

[avkonst]

Hi @RomanHotsiy . Sorry for dropping the ball here, life carried over with changes and I am overloaded over the board now. If you can help that would be great. If you could investigate the remaining two tests failing, suggest a fix in PR and I will merge. If you would like to take more active role in the project. I am happy to share as well.

[gdenchev]

Hi, I just cloned the repo with the PR, ran the tests (pnpm test) to see which tests fail.

I got only one test failing - the last one in Error.tsx in core, starting on line 46:
test('error: should not allow serialization of statelink', async () => {

But this is caused by recent commit 22bc57a, which does NOT throw 109 in dev mode.

If I revert to b271f18, all tests seem to pass.

Maybe I'm doing something odd, but I see no problem with the current tests and the PR?

If possible, can you direct me to the failing tests, I want to try and help :)

Disclaimer: I'm no Hookstate source code expert, just use it in projects, and will be glad to see it support React 19.

[avkonst]

Thanks for helping. I believe PR needs to be rebased to the latest mainline then run the tests. The expectation is the tests are passing. Sorry guys, I was extremely busy with a start up, relocated recently to a new city, all that makes it very difficult to give it time. Happy to merge and release if you complete the PR.

…

On Wed, Jan 21, 2026 at 5:15 AM gdenchev ***@***.***> wrote: *gdenchev* left a comment (avkonst/hookstate#425) <#425 (comment)> Hi, I just cloned the repo with the PR, ran the tests (pnpm test) to see which tests fail. I got only one test failing - the last one in Error.tsx in core, starting on line 46: test('error: should not allow serialization of statelink', async () => { But this is caused by recent commit 22bc57a <22bc57a>, which does NOT throw 109 in dev mode. If I revert to b271f18 <b271f18>, all tests seem to pass. Maybe I'm doing something odd, but I see no problem with the current tests and the PR? If possible, can you direct me to the failing tests, I want to try and help :) Disclaimer: I'm no Hookstate source code expert, just use it in projects, and will be glad to see it support React 19. — Reply to this email directly, view it on GitHub <#425 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA6JSVKBOVXQBP77EYUM5SL4HZICLAVCNFSM6AAAAAB55EYP4CVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTONZTG42TIMRSHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[phylum-io]

Phylum OSS Supply Chain Risk Analysis - FAILED

This repository analyzes the risk of new dependencies. An
administrator of this repository has set requirements via Phylum policy.

If you see this comment, one or more dependencies have failed Phylum's risk analysis.

Package: axios@1.9.0 failed.

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Axios is vulnerable to DoS attack through lack of data size check

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: cjs-module-lexer@1.4.3 failed.

cjs-module-lexer@1.4.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js@3.42.0 failed.

core-js@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: core-js-pure@3.42.0 failed.

core-js-pure@3.42.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: es-module-lexer@1.7.0 failed.

es-module-lexer@1.7.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: eta@1.14.2 failed.

Eta vulnerable to Code Injection via templates rendered with user-defined data

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

XSS Attack with Express API

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: flatted@3.3.3 failed.

flatted vulnerable to unbounded recursion DoS in parse() revive phase

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Prototype Pollution via parse() in NodeJS flatted

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: form-data@3.0.3 failed.

form-data uses unsafe random function in form-data for choosing boundary

Risk Domain: Software Vulnerability
Risk Level: critical

Reason: Critical or High software vulnerability

Package: form-data@4.0.2 failed.

form-data uses unsafe random function in form-data for choosing boundary

Risk Domain: Software Vulnerability
Risk Level: critical

Reason: Critical or High software vulnerability

Package: glob@10.4.5 failed.

glob CLI: Command injection via -c/--cmd executes matches with shell:true

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: handlebars@4.7.8 failed.

Handlebars.js has JavaScript Injection via AST Type Confusion

Risk Domain: Software Vulnerability
Risk Level: critical

Reason: Critical or High software vulnerability

Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: jiti@1.21.7 failed.

jiti@1.21.7 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: jsonpath@1.1.1 failed.

jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: minimatch@5.1.6 failed.

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: minimatch@9.0.5 failed.

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: node-forge@1.3.1 failed.

Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

node-forge has ASN.1 Unbounded Recursion

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Forge has signature forgery in Ed25519 due to missing S > L check

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: path-to-regexp@0.1.12 failed.

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: postcss@8.5.3 failed.

postcss@8.5.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: prismjs@1.30.0 failed.

prismjs@1.30.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: psl@1.15.0 failed.

psl@1.15.0 references suspicious URLs.

Risk Domain: Malicious Code
Risk Level: medium

Reason: Suspicious URL reference

Package: registry-auth-token@5.1.0 failed.

registry-auth-token@5.1.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: serialize-javascript@6.0.2 failed.

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: tailwindcss@3.4.17 failed.

tailwindcss@3.4.17 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: tar@6.2.1 failed.

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

node-tar Symlink Path Traversal via Drive-Relative Linkpath

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

tar has Hardlink Path Traversal via Drive-Relative Linkpath

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: terser@5.39.2 failed.

terser@5.39.2 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: underscore@1.12.1 failed.

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Package: undici@6.21.3 failed.

Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression

Risk Domain: Software Vulnerability
Risk Level: high

Reason: Critical or High software vulnerability

undici@6.21.3 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: webpack@5.99.9 failed.

webpack@5.99.9 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: yaml@2.8.0 failed.

yaml@2.8.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

Package: @algolia/client-search@5.25.0 failed.

@algolia/client-search@5.25.0 is decoding Base64 strings

Risk Domain: Malicious Code
Risk Level: low

Reason: Obfuscated code

View this project in the Phylum UI