Skip to content

Bump fastify from 5.8.1 to 5.8.3 in the npm-security group across 1 directory#2846

Merged
justin808 merged 5 commits intomainfrom
dependabot/npm_and_yarn/npm-security-371a9f96ec
Mar 28, 2026
Merged

Bump fastify from 5.8.1 to 5.8.3 in the npm-security group across 1 directory#2846
justin808 merged 5 commits intomainfrom
dependabot/npm_and_yarn/npm-security-371a9f96ec

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 25, 2026

Bumps the npm-security group with 1 update in the / directory: fastify.

Updates fastify from 5.8.1 to 5.8.3

Release notes

Sourced from fastify's releases.

v5.8.3

⚠️ Security Release

This fixes CVE CVE-2026-3635 GHSA-444r-cwp2-x5xf.

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.8.2...v5.8.3

v5.8.2

What's Changed

New Contributors

... (truncated)

Commits
  • a3e77ce Bumped v5.8.3
  • 4e1db5b fix: gate host and protocol getters on proxy trust function
  • a22217f ci(lock-threads): use shared lock-threads workflow (#6592)
  • 1851f20 docs: update links (#6593)
  • 9cc5187 types: Allow port to be null in request type definition (#6589)
  • 722d83b docs: replace redirected npm.im http-errors link (#6588)
  • a1413de docs: fix incorrect code examples in Reply and Request reference (#6582)
  • d7f01b6 docs: clarify content-type parser/schema mismatch is outside threat model (#6...
  • a0649e9 docs: update syntax markdown, absolute paths and links (#6569)
  • d477915 ci(link-checker): fix root-relative links resolution (#6535)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm-security group with 1 update in the / directory: [fastify](https://github.com/fastify/fastify).


Updates `fastify` from 5.8.1 to 5.8.3
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.1...v5.8.3)

---
updated-dependencies:
- dependency-name: fastify
  dependency-version: 5.8.3
  dependency-type: direct:production
  dependency-group: npm-security
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file full-ci javascript Pull requests that update Javascript code labels Mar 25, 2026
@chatgpt-codex-connector
Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 25, 2026

size-limit report 📦

Path Size
react-on-rails/client bundled (gzip) 62.63 KB (0%)
react-on-rails/client bundled (gzip) (time) 62.63 KB (0%)
react-on-rails/client bundled (brotli) 53.7 KB (0%)
react-on-rails/client bundled (brotli) (time) 53.7 KB (0%)
react-on-rails-pro/client bundled (gzip) 63.65 KB (0%)
react-on-rails-pro/client bundled (gzip) (time) 63.65 KB (0%)
react-on-rails-pro/client bundled (brotli) 54.67 KB (0%)
react-on-rails-pro/client bundled (brotli) (time) 54.67 KB (0%)
registerServerComponent/client bundled (gzip) 127.46 KB (0%)
registerServerComponent/client bundled (gzip) (time) 127.46 KB (0%)
registerServerComponent/client bundled (brotli) 61.65 KB (0%)
registerServerComponent/client bundled (brotli) (time) 61.55 KB (-0.17% 🔽)
wrapServerComponentRenderer/client bundled (gzip) 122.02 KB (0%)
wrapServerComponentRenderer/client bundled (gzip) (time) 122.02 KB (0%)
wrapServerComponentRenderer/client bundled (brotli) 56.77 KB (0%)
wrapServerComponentRenderer/client bundled (brotli) (time) 56.77 KB (0%)

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented Mar 27, 2026

PR Review: Bump fastify 5.8.1 → 5.8.3

Verdict: Approve and merge

Security Fix (Primary Reason)

This is a security release fixing CVE-2026-3635 (GHSA-444r-cwp2-x5xf). The fix gates host and protocol request getters on the proxy trust function — without this, an attacker who can control the X-Forwarded-Host header could spoof the host/protocol values used by application logic (e.g., URL generation, redirect targets, CORS checks). This affects deployments of the Node Renderer that sit behind a proxy.

Scope of Changes

File Change
packages/react-on-rails-pro-node-renderer/package.json Version specifier bumped to ^5.8.3
pnpm-lock.yaml Fastify pinned at 5.8.3; transitive bumps to [email protected], [email protected], [email protected], [email protected]
docs (3 files) Minor Markdown formatting only (blank lines before fenced code blocks, table alignment)

Assessment

  • The transitive dependency bumps (safe-regex2, terser, tapable, acorn) are all patch/minor updates pulled in by fastify's new dependency tree — no concerns.
  • No application logic changes; purely a dependency pin update.
  • Documentation changes are cosmetic and correct.

This should be merged promptly given the security nature of the fix.

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented Mar 27, 2026

Security dependency update review: fastify 5.8.1 to 5.8.3. Changes look correct and safe to merge.

Security Fix: CVE-2026-3635 - fastify host and protocol request getters were not properly gated on the proxy trust function, potentially allowing request forgery via manipulated X-Forwarded-Host / X-Forwarded-Proto headers.

Changes in this PR:

  1. packages/react-on-rails-pro-node-renderer/package.json - bumps fastify from ^5.8.1 to ^5.8.3
  2. pnpm-lock.yaml - updated with fastify 5.8.3 and minor transitive bumps: safe-regex2 5.0.0 to 5.1.0, acorn 8.15.0 to 8.16.0, tapable 2.3.0 to 2.3.2, terser 5.46.0 to 5.46.1
  3. Documentation - cosmetic Markdown formatting improvements and a broken link fix (shakacode.gitbooks.io to reactonrails.com/docs/)
  4. .lychee.toml - adds a diva-portal.org PDF URL to link-checker exclusions to avoid intermittent CI timeouts

Assessment: All changes are appropriate for a security patch. No logic changes, no API surface changes, no new top-level dependencies. The fastify security fix is relevant to any deployment of the node renderer behind a reverse proxy.

Recommendation: approve and merge.

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented Mar 27, 2026

Security Dependency Bump: fastify 5.8.1 to 5.8.3

This is a clean security-motivated dependency update.

Security Fix (Primary Reason for This PR)

CVE-2026-3635 (GHSA-444r-cwp2-x5xf): Fixed in v5.8.3 by gating the host and protocol request getters on the proxy trust function. Without this fix, a malicious client behind an untrusted proxy could forge X-Forwarded-Host / X-Forwarded-Proto headers and influence URL construction inside the application. This is worth patching promptly.

Transitive Dependency Changes

The lock file also picks up minor bumps:

  • safe-regex2 5.0.0 to 5.1.0 (fastify transitive dep, adds hasBin, otherwise cosmetic)
  • acorn 8.15.0 to 8.16.0, tapable 2.3.0 to 2.3.2, terser 5.46.0 to 5.46.1 (both old and new snapshots retained for different consumers, no regressions expected)

Unrelated Changes Bundled In

Several documentation/link fixes are also included:

  • .lychee.toml: Adds a CI link-checker exclusion for an intermittently timing-out PDF URL (reasonable housekeeping)
  • NEWS.md: Updates two stale Gitbook links to reactonrails.com/docs/
  • docs/: Formatting improvements (blank lines before code blocks, Markdown table alignment, minor JSX style fix)

These doc changes are harmless and correct, but worth noting since they were not generated by dependabot.

Verdict

LGTM - recommend merging. The CVE fix is important for any deployment using the Node renderer behind a reverse proxy. No regressions are expected from the transitive bumps.

@justin808 justin808 merged commit 9407924 into main Mar 28, 2026
40 checks passed
@justin808 justin808 deleted the dependabot/npm_and_yarn/npm-security-371a9f96ec branch March 28, 2026 09:52
justin808 added a commit that referenced this pull request Mar 28, 2026
…irectory (#2846)

Bumps the npm-security group with 1 update in the / directory:
[fastify](https://github.com/fastify/fastify).

Updates `fastify` from 5.8.1 to 5.8.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/fastify/fastify/releases">fastify's
releases</a>.</em></p>
<blockquote>
<h2>v5.8.3</h2>
<h2>⚠️ Security Release</h2>
<p>This fixes CVE CVE-2026-3635 <a
href="https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf">https://github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf</a>.</p>
<h2>What's Changed</h2>
<ul>
<li>docs(readme): add <a
href="https://github.com/Tony133"><code>@​Tony133</code></a> to plugin
team by <a href="https://github.com/Tony133"><code>@​Tony133</code></a>
in <a
href="https://redirect.github.com/fastify/fastify/pull/6565">fastify/fastify#6565</a></li>
<li>Updated Plugins-Guide.md; Changed &quot;fastify&quot; to
&quot;instance&quot; during plugin registration to showcase that it's
added as a child by <a
href="https://github.com/kyrylchenko"><code>@​kyrylchenko</code></a> in
<a
href="https://redirect.github.com/fastify/fastify/pull/6566">fastify/fastify#6566</a></li>
<li>test: use fastify.test in test case by <a
href="https://github.com/climba03003"><code>@​climba03003</code></a> in
<a
href="https://redirect.github.com/fastify/fastify/pull/6568">fastify/fastify#6568</a></li>
<li>docs: use fastify.example in documentation by <a
href="https://github.com/climba03003"><code>@​climba03003</code></a> in
<a
href="https://redirect.github.com/fastify/fastify/pull/6567">fastify/fastify#6567</a></li>
<li>docs: add common performance degradation guidance by <a
href="https://github.com/maxpetrusenko"><code>@​maxpetrusenko</code></a>
in <a
href="https://redirect.github.com/fastify/fastify/pull/6520">fastify/fastify#6520</a></li>
<li>docs(server): fix camelCase anchor links in TOC by <a
href="https://github.com/Deepvamja"><code>@​Deepvamja</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6530">fastify/fastify#6530</a></li>
<li>ci(link-checker): fix root-relative links resolution by <a
href="https://github.com/barba-rossa"><code>@​barba-rossa</code></a> in
<a
href="https://redirect.github.com/fastify/fastify/pull/6535">fastify/fastify#6535</a></li>
<li>docs: update syntax markdown, absolute paths and links by <a
href="https://github.com/Tony133"><code>@​Tony133</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6569">fastify/fastify#6569</a></li>
<li>docs: clarify content-type parser/schema mismatch is outside threat
model by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6537">fastify/fastify#6537</a></li>
<li>docs: fix incorrect code examples in Reply and Request reference by
<a
href="https://github.com/mahmoodhamdi"><code>@​mahmoodhamdi</code></a>
in <a
href="https://redirect.github.com/fastify/fastify/pull/6582">fastify/fastify#6582</a></li>
<li>docs: replace redirected npm.im http-errors link by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6588">fastify/fastify#6588</a></li>
<li>types: Allow port to be null in request type definition by <a
href="https://github.com/TristanBarlow"><code>@​TristanBarlow</code></a>
in <a
href="https://redirect.github.com/fastify/fastify/pull/6589">fastify/fastify#6589</a></li>
<li>docs: update links by <a
href="https://github.com/Tony133"><code>@​Tony133</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6593">fastify/fastify#6593</a></li>
<li>ci(lock-threads): use shared lock-threads workflow by <a
href="https://github.com/Fdawgs"><code>@​Fdawgs</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6592">fastify/fastify#6592</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/kyrylchenko"><code>@​kyrylchenko</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6566">fastify/fastify#6566</a></li>
<li><a
href="https://github.com/maxpetrusenko"><code>@​maxpetrusenko</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6520">fastify/fastify#6520</a></li>
<li><a href="https://github.com/Deepvamja"><code>@​Deepvamja</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6530">fastify/fastify#6530</a></li>
<li><a
href="https://github.com/barba-rossa"><code>@​barba-rossa</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6535">fastify/fastify#6535</a></li>
<li><a
href="https://github.com/mahmoodhamdi"><code>@​mahmoodhamdi</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6582">fastify/fastify#6582</a></li>
<li><a
href="https://github.com/TristanBarlow"><code>@​TristanBarlow</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6589">fastify/fastify#6589</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/fastify/fastify/compare/v5.8.2...v5.8.3">https://github.com/fastify/fastify/compare/v5.8.2...v5.8.3</a></p>
<h2>v5.8.2</h2>
<h2>What's Changed</h2>
<ul>
<li>docs(ecosystem): add <code>@​yeliex/fastify-problem-details</code>
by <a href="https://github.com/yeliex"><code>@​yeliex</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6546">fastify/fastify#6546</a></li>
<li>Revert &quot;chore: upgrade borp to v1.0.0&quot; by <a
href="https://github.com/climba03003"><code>@​climba03003</code></a> in
<a
href="https://redirect.github.com/fastify/fastify/pull/6564">fastify/fastify#6564</a></li>
<li>docs: document body validation with custom content type parsers by
<a href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6556">fastify/fastify#6556</a></li>
<li>docs(ecosystem): add fastify-file-router by <a
href="https://github.com/bhouston"><code>@​bhouston</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6441">fastify/fastify#6441</a></li>
<li>docs: add fastify-svelte-view to Ecosystem list by <a
href="https://github.com/matths"><code>@​matths</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6453">fastify/fastify#6453</a></li>
<li>fix: anchor keyValuePairsReg to prevent quadratic backtracking by <a
href="https://github.com/mcollina"><code>@​mcollina</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6558">fastify/fastify#6558</a></li>
<li>docs: added note on handling of invalid URLs in setNotFoundHandler
by <a
href="https://github.com/leftieFriele"><code>@​leftieFriele</code></a>
in <a
href="https://redirect.github.com/fastify/fastify/pull/5661">fastify/fastify#5661</a></li>
<li>docs(guides): update codemod links by <a
href="https://github.com/OluchiEzeifedikwa"><code>@​OluchiEzeifedikwa</code></a>
in <a
href="https://redirect.github.com/fastify/fastify/pull/6479">fastify/fastify#6479</a></li>
<li>docs: add <code>@​glidemq/fastify</code> to community plugins by <a
href="https://github.com/avifenesh"><code>@​avifenesh</code></a> in <a
href="https://redirect.github.com/fastify/fastify/pull/6560">fastify/fastify#6560</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/yeliex"><code>@​yeliex</code></a> made
their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6546">fastify/fastify#6546</a></li>
<li><a href="https://github.com/matths"><code>@​matths</code></a> made
their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6453">fastify/fastify#6453</a></li>
<li><a
href="https://github.com/leftieFriele"><code>@​leftieFriele</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/5661">fastify/fastify#5661</a></li>
<li><a
href="https://github.com/OluchiEzeifedikwa"><code>@​OluchiEzeifedikwa</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6479">fastify/fastify#6479</a></li>
<li><a href="https://github.com/avifenesh"><code>@​avifenesh</code></a>
made their first contribution in <a
href="https://redirect.github.com/fastify/fastify/pull/6560">fastify/fastify#6560</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/fastify/fastify/commit/a3e77ce171516e95f0c28ce60b9e5228a4c42fe4"><code>a3e77ce</code></a>
Bumped v5.8.3</li>
<li><a
href="https://github.com/fastify/fastify/commit/4e1db5bd0012ccf63a49ff105a63e25981b9a747"><code>4e1db5b</code></a>
fix: gate host and protocol getters on proxy trust function</li>
<li><a
href="https://github.com/fastify/fastify/commit/a22217f9420f70017a419d8e18b2a3141ab27989"><code>a22217f</code></a>
ci(lock-threads): use shared lock-threads workflow (<a
href="https://redirect.github.com/fastify/fastify/issues/6592">#6592</a>)</li>
<li><a
href="https://github.com/fastify/fastify/commit/1851f208e72be06ca419f2000dea63e540ff1ab0"><code>1851f20</code></a>
docs: update links (<a
href="https://redirect.github.com/fastify/fastify/issues/6593">#6593</a>)</li>
<li><a
href="https://github.com/fastify/fastify/commit/9cc5187be2dc7c38fd68d0d43541f16ed6d1e1ad"><code>9cc5187</code></a>
types: Allow port to be null in request type definition (<a
href="https://redirect.github.com/fastify/fastify/issues/6589">#6589</a>)</li>
<li><a
href="https://github.com/fastify/fastify/commit/722d83b0632387b853b218ae3a7da40cc46e2677"><code>722d83b</code></a>
docs: replace redirected npm.im http-errors link (<a
href="https://redirect.github.com/fastify/fastify/issues/6588">#6588</a>)</li>
<li><a
href="https://github.com/fastify/fastify/commit/a1413de2033b2b00dc1d3563d4f00a7e15ceab2d"><code>a1413de</code></a>
docs: fix incorrect code examples in Reply and Request reference (<a
href="https://redirect.github.com/fastify/fastify/issues/6582">#6582</a>)</li>
<li><a
href="https://github.com/fastify/fastify/commit/d7f01b600811172d7f7023bccc5e96583159202b"><code>d7f01b6</code></a>
docs: clarify content-type parser/schema mismatch is outside threat
model (<a
href="https://redirect.github.com/fastify/fastify/issues/6">#6</a>...</li>
<li><a
href="https://github.com/fastify/fastify/commit/a0649e92e93c1ad8b164020f61be5d5fa287d506"><code>a0649e9</code></a>
docs: update syntax markdown, absolute paths and links (<a
href="https://redirect.github.com/fastify/fastify/issues/6569">#6569</a>)</li>
<li><a
href="https://github.com/fastify/fastify/commit/d4779155286ea1d31c24dba1e90d7d478909382b"><code>d477915</code></a>
ci(link-checker): fix root-relative links resolution (<a
href="https://redirect.github.com/fastify/fastify/issues/6535">#6535</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/fastify/fastify/compare/v5.8.1...v5.8.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fastify&package-manager=npm_and_yarn&previous-version=5.8.1&new-version=5.8.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/shakacode/react_on_rails/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Justin Gordon <[email protected]>
justin808 added a commit that referenced this pull request Mar 28, 2026
…ew-fixes

* origin/main:
  Remove dependency on internal TanStack Router router.ssr flag (#2833)
  Revert "Eliminate double JSON.stringify in RSC payload embedding (#2835)" (#2878)
  Eliminate double JSON.stringify in RSC payload embedding (#2835)
  docs: align Pro references with canonical docs routes (#2866)
  docs: make Pro route entry points explicit (#2867)
  Bump fastify from 5.8.1 to 5.8.3 in the npm-security group across 1 directory (#2846)
  docs: add RoR-specific competitive landscape and template refs (#2869)
  Clarify streaming narrative in RSC docs (#2813) (#2814)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file full-ci javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant