reactjs/react.dev dependency check
The React documentation website
reactjs/react.dev: 1 critical finding, fixed by upgrading next to 15.5.27. Plus 11 warnings.
Last checked against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, npm and endoflife.date.
12 things your coding agent doesn’t know about this repo
reactjs/react.dev on GitHub (opens in a new tab)
1 critical11 warnings44 low priority
One task with every fix, most urgent first, the file to change and why. Paste it into Claude Code, Cursor or Codex.
- CriticalVulnerabilitypackage.json
30 known vulnerabilities in next 15.1.12
EPSS: top 1%11 rated high or critical. Most serious: CVE-2025-29927, Authorization Bypass in Next.js Middleware. Upgrading to 15.5.27 fixes all of them.
- WarningVulnerabilitypackage.json
CVE-2021-39199 in remark-html 12.0.0
EPSS: top 36%Dev onlyUnsafe defaults in `remark-html`. Fixed in 13.0.2.
- WarningVulnerabilitypackage.json
5 known vulnerabilities in postcss 8.4.6
EPSS: top 39%Dev onlyMost serious: CVE-2026-45623, PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments. Upgrading to 8.5.23 fixes all of them.
- WarningEnd of lifepackage.json
Next.js 15 reaches end-of-life in 4 days
Support ends 2026-10-21. Plan an upgrade to Next.js 16 LTS.
- WarningMaintenancepackage.json
@types/classnames is deprecated on npm
The maintainers' deprecation notice: "This is a stub types definition. classnames provides its own type definitions, so you do not need this installed."
- WarningMaintenancepackage.json
@types/github-slugger is deprecated on npm
The maintainers' deprecation notice: "This is a stub types definition. github-slugger provides its own type definitions, so you do not need this installed."
- WarningMaintenancepackage.json
@types/mdx-js__react is deprecated on npm
The maintainers' deprecation notice: "This is a stub types definition. @mdx-js/react provides its own type definitions, so you do not need this installed."
- WarningMaintenancepackage.json
@types/parse-numeric-range is deprecated on npm
The maintainers' deprecation notice: "This is a stub types definition. parse-numeric-range provides its own type definitions, so you do not need this installed."
- WarningMaintenancepackage.json
babel-eslint is deprecated on npm
The maintainers' deprecation notice: "babel-eslint is now @babel/eslint-parser. This package will no longer receive updates."
- WarningOutdatedpackage.json
@docsearch/css 3.8.3 is 2 major versions behind
Latest release is 5.1.2.
- WarningOutdatedpackage.json
@docsearch/react 3.8.3 is 2 major versions behind
Latest release is 5.1.2.
- WarningOutdatedpackage.json
debounce 1.2.1 is 2 major versions behind
Latest release is 3.0.0.
Checked 79 packages from package.json and yarn.lock against:
Add this badge to your README
It shows today’s result and links to this report, so anyone opening the repo sees what needs fixing.
[](https://stackprism.ai/check/github/reactjs/react.dev)What next
Want your agent to check before it adds a package? Connect Claude Code, Cursor or Codex to StackPrism. Setup steps
Ask Prism Agent about reactjs/react.dev
Map the repo (free) and ask what to fix first, whether an upgrade is safe, or what breaks if a service goes down. Prism Agent checks live sources before it answers.
How this report works
StackPrism read package.json and yarn.lock from the default branch of reactjs/react.dev and checked its 79 packages against GitHub, OSV.dev, deps.dev, CISA KEV, FIRST EPSS, npm and endoflife.date. Nothing was installed or run, and there’s no AI in the findings: each one comes from a source you can open.
Vulnerabilities come from OSV.dev, with known-exploited ones from CISA marked and listed first. Runtimes, frameworks and base images are checked against endoflife.date, and packages against their registry for deprecations and major versions you’ve fallen behind. The fix task above lists every change with the file to edit.
This page refreshes every few hours; after you push a fix, “Check again” runs it now. Only the repo’s root is read. For an app in a sub-folder, paste the folder’s link into the dependency check, and for a private repo, connect GitHub.