nextjs - 💡(How to fix) Fix Bug: React DevTools shows different versions (Stable vs. Canary) for Page/App Router in Next.js, potentially indicating an unpatched security risk (19.2.0-canary vs 19.2.1) [1 comments, 2 participants]

Link to the code that reproduces this issue

//

To Reproduce

1. Set up a Next.js project with both App Router and Page Router enabled.
2. Set react and react-dom versions to 19.1.2 in package.json and run pnpm install
3. Create a page based on the Page Router
4. Create a page based on the App Router
5. Open React DevTools.

Current vs. Expected behavior

React version: react 19.1.2 / next 15.3.6

Steps To Reproduce

1. Set up a Next.js project with both App Router and Page Router enabled.
2. Set react and react-dom versions to 19.1.2 in package.json and run pnpm install
3. Create a page based on the Page Router
4. Create a page based on the App Router
5. Open React DevTools.

Link to code example:

The current behavior

React DevTools displays 19.2.0-canary on App Router pages.

The expected behavior

React DevTools should display 19.1.2 on App Router pages, consistent with the Page Router and the stable React version specified in the project's package.json.

Furthermore, since version 19.2.0 (or its corresponding Canary build) is known to potentially have security vulnerabilities that were patched in 19.2.1, it is crucial that the App Router's internal RSC runtime dependencies are updated to reflect the 19.2.1 patch level.

Provide environment information

React version: react 19.1.2 / next 15.3.6

Which area(s) are affected? (Select all that apply)

React

Which stage(s) are affected? (Select all that apply)

Other (Deployed)

Additional context

No response