![\"Warning:](\"https://i.imgur.com/sngxSML.png\")
Today we are releasing React 16.9. It contains several new features, bugfixes, and new deprecation warnings to help prepare for a future major release.
\nOver a year ago, we announced that unsafe lifecycle methods are getting renamed:
\ncomponentWillMount → UNSAFE_componentWillMountcomponentWillReceiveProps → UNSAFE_componentWillReceivePropscomponentWillUpdate → UNSAFE_componentWillUpdateReact 16.9 does not contain breaking changes, and the old names continue to work in this release. But you will now see a warning when using any of the old names:
\n
As the warning suggests, there are usually better approaches for each of the unsafe methods. However, maybe you don’t have the time to migrate or test these components. In that case, we recommend running a «codemod» script that renames them automatically:
\ncd your_project\nnpx react-codemod rename-unsafe-lifecycles(Note that it says npx, not npm. npx is a utility that comes with Node 6+ by default.)
Running this codemod will replace the old names like componentWillMount with the new names like UNSAFE_componentWillMount:
![\"Codemod](\"https://i.imgur.com/Heyvcyi.gif\")
The new names like UNSAFE_componentWillMount will keep working in both React 16.9 and in React 17.x. However, the new UNSAFE_ prefix will help components with problematic patterns stand out during the code review and debugging sessions. (If you’d like, you can further discourage their use inside your app with the opt-in Strict Mode.)
\n\nNote
\nLearn more about our versioning policy and commitment to stability.
\n
javascript: URLs URLs starting with javascript: are a dangerous attack surface because it’s easy to accidentally include unsanitized output in a tag like <a href> and create a security hole:
const userProfile = {\n website: \"javascript: alert('you got hacked')\",\n};\n// This will now warn:\n<a href={userProfile.website}>Profile</a>In React 16.9, this pattern continues to work, but it will log a warning. If you use javascript: URLs for logic, try to use React event handlers instead. (As a last resort, you can circumvent the protection with dangerouslySetInnerHTML, but it is highly discouraged and often leads to security holes.)
In a future major release, React will throw an error if it encounters a javascript: URL.
Before compiling JavaScript classes with Babel became popular, React had support for a «factory» component that returns an object with a render method:
function FactoryComponent() {\n return { render() { return <div />; } }\n}This pattern is confusing because it looks too much like a function component — but it isn’t one. (A function component would just return the <div /> in the above example.)
This pattern was almost never used in the wild, and supporting it causes React to be slightly larger and slower than necessary. So we are deprecating this pattern in 16.9 and logging a warning if it’s encountered. If you rely on it, adding FactoryComponent.prototype = React.Component.prototype can serve as a workaround. Alternatively, you can convert it to either a class or a function component.
We don’t expect most codebases to be affected by this.
\nact() for Testing React 16.8 introduced a new testing utility called act() to help you write tests that better match the browser behavior. For example, multiple state updates inside a single act() get batched. This matches how React already works when handling real browser events, and helps prepare your components for the future in which React will batch updates more often.
However, in 16.8 act() only supported synchronous functions. Sometimes, you might have seen a warning like this in a test but could not easily fix it:
An update to SomeComponent inside a test was not wrapped in act(...).In React 16.9, act() also accepts asynchronous functions, and you can await its call:
await act(async () => {\n // ...\n});This solves the remaining cases where you couldn’t use act() before, such as when the state update was inside an asynchronous function. As a result, you should be able to fix all the remaining act() warnings in your tests now.
We’ve heard there wasn’t enough information about how to write tests with act(). The new Testing Recipes guide describes common scenarios, and how act() can help you write good tests. These examples use vanilla DOM APIs, but you can also use React Testing Library to reduce the boilerplate code. Many of its methods already use act() internally.
Please let us know on the issue tracker if you bump into any other scenarios where act() doesn’t work well for you, and we’ll try to help.
<React.Profiler> In React 16.5, we introduced a new React Profiler for DevTools that helps find performance bottlenecks in your application. In React 16.9, we are also adding a programmatic way to gather measurements called <React.Profiler>. We expect that most smaller apps won’t use it, but it can be handy to track performance regressions over time in larger apps.
The <Profiler> measures how often a React application renders and what the «cost» of rendering is. Its purpose is to help identify parts of an application that are slow and may benefit from optimizations such as memoization.
A <Profiler> can be added anywhere in a React tree to measure the cost of rendering that part of the tree.\nIt requires two props: an id (string) and an onRender callback (function) which React calls any time a component within the tree «commits» an update.
render(\n <Profiler id=\"application\" onRender={onRenderCallback}> <App>\n <Navigation {...props} />\n <Main {...props} />\n </App>\n </Profiler>); To learn more about the Profiler and the parameters passed to the onRender callback, check out the Profiler docs.
\n\nNote:
\nProfiling adds some additional overhead, so it is disabled in the production build.
\nTo opt into production profiling, React provides a special production build with profiling enabled.\nRead more about how to use this build at fb.me/react-profiling.
\n
This release contains a few other notable improvements:
\nfindDOMNode() inside a <Suspense> tree has been fixed.setState in useEffect now logs an error. (This is similar to the error you see when you call setState in componentDidUpdate in a class.)We’re thankful to all the contributors who helped surface and fix these and other issues. You can find the full changelog below.
\nIn November 2018, we have posted this roadmap for the 16.x releases:
\nThese estimates were too optimistic, and we’ve needed to adjust them.
\ntldr: We shipped Hooks on time, but we’re regrouping Concurrent Mode and Suspense for Data Fetching into a single release that we intend to release later this year.
\nIn February, we shipped a stable 16.8 release including React Hooks, with React Native support coming a month later. However, we underestimated the follow-up work for this release, including the lint rules, developer tools, examples, and more documentation. This shifted the timeline by a few months.
\nNow that React Hooks are rolled out, the work on Concurrent Mode and Suspense for Data Fetching is in full swing. The new Facebook website that’s currently in active development is built on top of these features. Testing them with real code helped discover and address many issues before they can affect the open source users. Some of these fixes involved an internal redesign of these features, which has also caused the timeline to slip.
\nWith this new understanding, here’s what we plan to do next.
\nConcurrent Mode and Suspense power the new Facebook website that’s in active development, so we are confident that they’re close to a stable state technically. We also now better understand the concrete steps before they are ready for open source adoption.
\nOriginally we thought we would split Concurrent Mode and Suspense for Data Fetching into two releases. We’ve found that this sequencing is confusing to explain because these features are more related than we thought at first. So we plan to release support for both Concurrent Mode and Suspense for Data Fetching in a single combined release instead.
\nWe don’t want to overpromise the release date again. Given that we rely on both of them in production code, we expect to provide a 16.x release with opt-in support for them this year.
\nWhile React is not opinionated about how you fetch data, the first release of Suspense for Data Fetching will likely focus on integrating with opinionated data fetching libraries. For example, at Facebook we are using upcoming Relay APIs that integrate with Suspense. We will document how other opinionated libraries like Apollo can support a similar integration.
\nIn the first release, we don’t intend to focus on the ad-hoc «fire an HTTP request» solution we used in earlier demos (also known as «React Cache»). However, we expect that both we and the React community will be exploring that space in the months after the initial release.
\nWe have started the work on the new Suspense-capable server renderer, but we don’t expect it to be ready for the initial release of Concurrent Mode. This release will, however, provide a temporary solution that lets the existing server renderer emit HTML for Suspense fallbacks immediately, and then render their real content on the client. This is the solution we are currently using at Facebook ourselves until the streaming renderer is ready.
\nWe’ve shipped the individual pieces leading up to Concurrent Mode as they became stable, including new context API, lazy loading with Suspense, and Hooks. We are also eager to release the other missing parts, but trying them at scale is an important part of the process. The honest answer is that it just took more work than we expected when we started. As always, we appreciate your questions and feedback on Twitter and in our issue tracker.
\nReact v16.9.0 is available on the npm registry.
\nTo install React 16 with Yarn, run:
\nyarn add react@^16.9.0 react-dom@^16.9.0To install React 16 with npm, run:
\nnpm install --save react@^16.9.0 react-dom@^16.9.0We also provide UMD builds of React via a CDN:
\n<script crossorigin src=\"https://unpkg.com/react@16/umd/react.production.min.js\"></script>\n<script crossorigin src=\"https://unpkg.com/react-dom@16/umd/react-dom.production.min.js\"></script>Refer to the documentation for detailed installation instructions.
\n<React.Profiler> API for gathering performance measurements programmatically. (@bvaughn in #15172)unstable_ConcurrentMode in favor of unstable_createRoot. (@acdlite in #15532)UNSAFE_* lifecycle methods. (@bvaughn in #15186 and @threepointone in #16103)javascript: URLs as a common attack surface. (@sebmarkbage in #15047)disablePictureInPicture attribute on <video>. (@eek in #15334)onLoad event for <embed>. (@cherniavskii in #15614)useState state from DevTools. (@bvaughn in #14906)setState is called from useEffect, creating a loop. (@gaearon in #15180)findDOMNode for components wrapped in <Suspense>. (@acdlite in #15312)!important style. (@acdlite in #15861 and #15882)act(async () => ...) for testing asynchronous state updates. (@threepointone in #14853)act from different renderers. (@threepointone in #16039 and #16042)act() call. (@threepointone in #15763 and #16041)act from the wrong renderer. (@threepointone in #15756)