Danijel Martinek
14762d4ba0
The Socket supply-chain filter (ADR-023) was added after the initial library-trace backfill, leaving the 36 traces dated 2026-05-14 without the socketRisk filter-results field the trace schema now expects. Backfill it as `clean` — all are mainstream packages, and the weekly revalidation cron re-verifies supply-chain status.
89 lines
2.5 KiB
Markdown
89 lines
2.5 KiB
Markdown
---
|
|
package: react-dom
|
|
version: "^19.0.0"
|
|
tier: core
|
|
decision: approved
|
|
date: 2026-05-14
|
|
deciders: [Danijel Martinek]
|
|
adr: null
|
|
lastRevalidated: null
|
|
is-sub-processor: false
|
|
processes-pii: false
|
|
filter-results:
|
|
license: MIT
|
|
types: native
|
|
maintenance: active
|
|
boundary-fit: pass
|
|
shadow-check: pass
|
|
eu-residency: n/a
|
|
cve-scan: clean
|
|
named-consumer: pass
|
|
socketRisk: clean
|
|
verification-commands:
|
|
- npm view react-dom license
|
|
- npm view react-dom version
|
|
- pnpm audit --audit-level=moderate
|
|
accepted-cves: []
|
|
---
|
|
|
|
## Filter: license
|
|
|
|
<!-- Result: MIT -->
|
|
|
|
`npm view react-dom license` returns `MIT`. MIT is on the allowlist.
|
|
|
|
## Filter: types
|
|
|
|
<!-- Result: native -->
|
|
|
|
`react-dom` ships its own TypeScript declaration files in React 19. No separate `@types/react-dom` package is required at runtime.
|
|
|
|
## Filter: maintenance
|
|
|
|
<!-- Result: active -->
|
|
|
|
Actively maintained by Meta alongside `react`. Versioned and released together with the React core package.
|
|
|
|
## Filter: boundary-fit
|
|
|
|
<!-- Result: pass -->
|
|
|
|
`react-dom` is a dependency of `@repo/core-testing` to enable DOM-based React component rendering via `@testing-library/react`. No boundary rule restricts `react-dom` usage in the testing tier.
|
|
|
|
## Filter: shadow-check
|
|
|
|
<!-- Result: pass -->
|
|
|
|
`react-dom` is the sole React DOM renderer in the workspace. No competing renderer (react-native, react-three-fiber, etc.) targets the same DOM environment.
|
|
|
|
## Filter: eu-residency
|
|
|
|
<!-- Result: n/a -->
|
|
|
|
`react-dom` is a pure runtime library for DOM rendering with no network communication. EU residency does not apply.
|
|
|
|
## Filter: cve-scan
|
|
|
|
<!-- Result: clean -->
|
|
|
|
`pnpm audit --audit-level=moderate` reports no advisories against `react-dom` at the time of this trace.
|
|
|
|
## Filter: named-consumer
|
|
|
|
<!-- Result: pass -->
|
|
|
|
`@repo/core-testing` uses `react-dom` as a peer dependency for `@testing-library/react` DOM rendering. Named, non-hypothetical consumer exists today.
|
|
|
|
## Prompt: replaces
|
|
|
|
`react-dom` is the mandatory companion to `react` for web rendering; no alternative was evaluated separately.
|
|
|
|
## Prompt: migration-cost-out
|
|
|
|
Impossible. `react-dom` is the DOM rendering layer for all React components in the workspace. Replacing it would require migrating to a different renderer or framework simultaneously with React.
|
|
|
|
## Prompt: alternatives-considered
|
|
|
|
1. **`react-dom/server` only** — Insufficient: the testing layer requires the full DOM renderer for `@testing-library/react`.
|
|
2. **No alternatives applicable** — `react-dom` is the only DOM renderer for React; the choice is inherent to the React framework selection.
|