react

About

React is a JavaScript library for building user interfaces.

What detecting react tells you about a site

Finding react in a bundle is the single strongest signal that you're looking at a component-driven single-page app or a hydrated server-rendered site. Because almost the entire modern front-end ecosystem assumes React as the substrate, its presence tells you the rest of the stack is likely React-flavoured: the router, the data layer, the form library and the UI kit will all be React-specific choices rather than framework-agnostic ones.

Why the exact react version matters

The major version is a hard fork in behaviour, so the exact number changes how you read the whole app. React 18 introduced concurrent rendering and automatic batching; React 19 added the `use` hook, Actions and built-in support for the compiler. A site on React 16/17 is a legacy or slow-to-upgrade codebase; a site on 19 is shipping the newest patterns. Regex-based detectors usually can't tell these apart — reading the bundled `react/package.json` version does.

react in a real-world stack

When you find react in a bundle, it rarely travels alone. react-dom (always, on the web), a router (react-router or the framework's own), and increasingly a state or data library such as @tanstack/react-query, zustand or redux.

Quick facts

This package powers React

The react package is the canonical implementation of React. Sourcemap Explorer uses this exact npm package as the framework-level fingerprint when it flags React on a page — both via the bundled node_modules/react/ source paths and via the embedded package.json inside the JavaScript sourcemap.

How Sourcemap Explorer detects react

react ships as v19.2.8, published 2026-07-21 and carries 0 direct dependencies, 2,898 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when react rides inside a deployed bundle — here is how the detection works.

We catch react from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/react/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

1. 1

   Confirm the site exposes sourcemaps

   In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `react` paths live.

2. 2

   Find the package in the bundle

   Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/react/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/react/package.json` gives you the exact installed version.

3. 3

   Read the version directly from package.json

   Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/react/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of react

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the react version a site actually ships against the ecosystem.

Recent security advisories for react

The 2 most recent advisories affecting some versions of react, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

1. MODERATECVE-2013-7035· 2020-09-04

   Cross-Site Scripting in react

2. HIGHGHSA-hg79-j56m-fxgv· 2020-09-04

   Cross-Site Scripting in react

Recent versions

react README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

import { useState } from 'react';
import { createRoot } from 'react-dom/client';

function Counter() {
  const [count, setCount] = useState(0);
  return (
    <>
      <h1>{count}</h1>
      <button onClick={() => setCount(count + 1)}>
        Increment
      </button>
    </>
  );
}

const root = createRoot(document.getElementById('root'));
root.render(<Counter />);

FAQ

Keep reading on Sourcemap Explorer