implement support for React 19

[ndrezn]

We should start exploring React 19 support. React 19 has many changes which may affect how Dash works.

We know that component libraries will be affected as defaultProps is removed in React 19.

From @T4rk1n :

The defaultProps was mostly handled with the upgrade to react 18 and most components libs now. propTypes removal doesn't really affect us because we still have the runtime check on our own, we also have our own typescript prop type support altho that might be difficult to update in the future if typescript indeed goes with the go rewrite that been in the news recently. contextType removal is a new one I didn't see before, might have to update some components for it to work. string refs removals was also part of the 18 update along with ReactDOM.render -> ReactDOM.createRoot findDOMNode removal was part of react 18 upgrade. new one is JSX namespace is changed https://react.dev/blog/2024/04/25/react-19-upgrade-guide#the-jsx-namespace-in-typescript might need some adaptation to the types. The rest of the changes I don't think would affect us that much, I don't see anything that would prevent us to update. The initial fear with react 19 was with their new compiler but I think that was dropped.

[emran-niftyitsolution]

Any update on this?

[e-wallace]

got another request for this

[ndrezn]

Chatting with @T4rk1n and it's probably a small lift to get this over the line, but not something currently in our planning. Given React 19 has been available for about a year, it's worth bringing this back up.

Curious @emran-niftyitsolution what's your use case? Anything specific you're trying to accomplish that's blocked by lack of React 19 support?

[maurerle]

Given that plotly dash does not use react 19 and the CVE https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r affects React recent 19, I am right to assume that current plotly dash deployments are not affected from this CVE, right?

[T4rk1n]

Given that plotly dash does not use react 19 and the CVE GHSA-fv66-9v8q-g76r affects React recent 19, I am right to assume that current plotly dash deployments are not affected from this CVE, right?

Not affected

[T4rk1n]

React 19 dropped UMD support in favor of cjs, this complicate the support since our bundling relies on umd in case of external serving from unpkg.