From 3ee1fe4a8ead714cee51be09f64ecd3a81df1acb Mon Sep 17 00:00:00 2001
From: Jack Pope <jackpope1@gmail.com>
Date: Mon, 20 Apr 2026 11:40:34 -0400
Subject: [PATCH 1/2] Fix contributor attribution for ESLint v10 support

Updated the changelog to reflect the correct contributor for the ESLint v10 support addition.
---
 packages/eslint-plugin-react-hooks/CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/eslint-plugin-react-hooks/CHANGELOG.md b/packages/eslint-plugin-react-hooks/CHANGELOG.md
index fde29f763089..9ae0b7c65462 100644
--- a/packages/eslint-plugin-react-hooks/CHANGELOG.md
+++ b/packages/eslint-plugin-react-hooks/CHANGELOG.md
@@ -8,7 +8,7 @@
 
 This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better `set-state-in-effect` detection, improved ref validation, and more helpful error reporting.
 
-- Add ESLint v10 support. ([@nicolo-ribaudo](https://github.com/nicolo-ribaudo) in [#35720](https://github.com/facebook/react/pull/35720))
+- Add ESLint v10 support. ([@azat-io](https://github.com/azat-io) in [#35720](https://github.com/facebook/react/pull/35720))
 - Skip compilation for non-React files to improve performance. ([@josephsavona](https://github.com/josephsavona) in [#35589](https://github.com/facebook/react/pull/35589))
 - Fix exhaustive deps bug with Flow type casting. ([@jorge-cab](https://github.com/jorge-cab) in [#35691](https://github.com/facebook/react/pull/35691))
 - Fix `useEffectEvent` checks in component syntax. ([@jbrown215](https://github.com/jbrown215) in [#35041](https://github.com/facebook/react/pull/35041))

From 306a01b4e0242e9379ba971c8925670651f16818 Mon Sep 17 00:00:00 2001
From: vmx906 <vmx@meta.com>
Date: Mon, 20 Apr 2026 18:37:33 +0100
Subject: [PATCH 2/2] Add credentialless as a recognized boolean attribute for
 iframes (#36148)

## Summary

The `credentialless` attribute is a boolean HTML attribute for
`<iframe>` elements that loads the iframe in a new, ephemeral context
without access to the parent's credentials (cookies, client
certificates, etc.). This change adds it to all boolean attribute
switch/case lists in React DOM so it is properly handled as a boolean
(set when true, removed when false) rather than being treated as an
unknown string attribute.

Per the [Anonymous iframe spec
(WICG)](https://wicg.github.io/anonymous-iframe/):

> The credentialless attribute enables loading documents hosted by the
iframe with a new and ephemeral storage partition. It is a boolean
value. The default is false.

```
partial interface HTMLIFrameElement {
  attribute boolean credentialless;
};
```

Changes:
- ReactDOMComponent.js: Added to both `setProp` and
`diffHydratedGenericElement`
- ReactFizzConfigDOM.js: Added to `pushAttribute` for server-side
rendering
- ReactDOMUnknownPropertyHook.js: Added to both validation switch/case
lists

## Test plan

- Added unit test in DOMPropertyOperations-test.js verifying
`credentialless={true}` sets the attribute to `''` and
`credentialless={false}` removes it
- All tests pass in source and www channels (590 tests each)
- Flow type checking passes (dom-node renderer)
- Prettier and lint pass
---
 .../src/client/ReactDOMComponent.js           |  2 ++
 .../src/server/ReactFizzConfigDOM.js          |  1 +
 .../src/shared/ReactDOMUnknownPropertyHook.js |  2 ++
 .../__tests__/DOMPropertyOperations-test.js   | 28 +++++++++++++++++++
 ...eactDOMServerIntegrationAttributes-test.js | 12 ++++++++
 5 files changed, 45 insertions(+)

diff --git a/packages/react-dom-bindings/src/client/ReactDOMComponent.js b/packages/react-dom-bindings/src/client/ReactDOMComponent.js
index 1b25e3727023..80ee96a87a8f 100644
--- a/packages/react-dom-bindings/src/client/ReactDOMComponent.js
+++ b/packages/react-dom-bindings/src/client/ReactDOMComponent.js
@@ -756,6 +756,7 @@ function setProp(
     case 'async':
     case 'autoPlay':
     case 'controls':
+    case 'credentialless':
     case 'default':
     case 'defer':
     case 'disabled':
@@ -2849,6 +2850,7 @@ function diffHydratedGenericElement(
       case 'async':
       case 'autoPlay':
       case 'controls':
+      case 'credentialless':
       case 'default':
       case 'defer':
       case 'disabled':
diff --git a/packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js b/packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js
index 73ce8d3dd29f..691e49e563fd 100644
--- a/packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js
+++ b/packages/react-dom-bindings/src/server/ReactFizzConfigDOM.js
@@ -1695,6 +1695,7 @@ function pushAttribute(
     case 'async':
     case 'autoPlay':
     case 'controls':
+    case 'credentialless':
     case 'default':
     case 'defer':
     case 'disabled':
diff --git a/packages/react-dom-bindings/src/shared/ReactDOMUnknownPropertyHook.js b/packages/react-dom-bindings/src/shared/ReactDOMUnknownPropertyHook.js
index f45e477d876f..aee7d9adb7df 100644
--- a/packages/react-dom-bindings/src/shared/ReactDOMUnknownPropertyHook.js
+++ b/packages/react-dom-bindings/src/shared/ReactDOMUnknownPropertyHook.js
@@ -208,6 +208,7 @@ function validateProperty(tagName, name, value, eventRegistry) {
           case 'async':
           case 'autoPlay':
           case 'controls':
+          case 'credentialless':
           case 'default':
           case 'defer':
           case 'disabled':
@@ -287,6 +288,7 @@ function validateProperty(tagName, name, value, eventRegistry) {
             case 'async':
             case 'autoPlay':
             case 'controls':
+            case 'credentialless':
             case 'default':
             case 'defer':
             case 'disabled':
diff --git a/packages/react-dom/src/__tests__/DOMPropertyOperations-test.js b/packages/react-dom/src/__tests__/DOMPropertyOperations-test.js
index ef09e49bf36c..5bbc2c8dbac8 100644
--- a/packages/react-dom/src/__tests__/DOMPropertyOperations-test.js
+++ b/packages/react-dom/src/__tests__/DOMPropertyOperations-test.js
@@ -160,6 +160,34 @@ describe('DOMPropertyOperations', () => {
       expect(container.firstChild.hasAttribute('allowFullScreen')).toBe(false);
     });
 
+    it('should set credentialless boolean attribute on iframes', async () => {
+      const container = document.createElement('div');
+      const root = ReactDOMClient.createRoot(container);
+      await act(() => {
+        root.render(<iframe credentialless={true} />);
+      });
+      expect(container.firstChild.getAttribute('credentialless')).toBe('');
+      await act(() => {
+        root.render(<iframe credentialless={false} />);
+      });
+      expect(container.firstChild.hasAttribute('credentialless')).toBe(false);
+    });
+
+    it('should set credentialless attribute when passed a string and warn', async () => {
+      const container = document.createElement('div');
+      const root = ReactDOMClient.createRoot(container);
+      await act(() => {
+        root.render(<iframe credentialless="true" />);
+      });
+      assertConsoleErrorDev([
+        'Received the string `true` for the boolean attribute `credentialless`. ' +
+          'Although this works, it will not work as expected if you pass the string "false". ' +
+          'Did you mean credentialless={true}?\n' +
+          '    in iframe (at **)',
+      ]);
+      expect(container.firstChild.getAttribute('credentialless')).toBe('');
+    });
+
     it('should remove when setting custom attr to null', async () => {
       const container = document.createElement('div');
       const root = ReactDOMClient.createRoot(container);
diff --git a/packages/react-dom/src/__tests__/ReactDOMServerIntegrationAttributes-test.js b/packages/react-dom/src/__tests__/ReactDOMServerIntegrationAttributes-test.js
index be5ff44b8cd1..9857718c35b7 100644
--- a/packages/react-dom/src/__tests__/ReactDOMServerIntegrationAttributes-test.js
+++ b/packages/react-dom/src/__tests__/ReactDOMServerIntegrationAttributes-test.js
@@ -187,6 +187,18 @@ describe('ReactDOMServerIntegration', () => {
       });
     });
 
+    describe('credentialless property', function () {
+      itRenders('credentialless prop with true value', async render => {
+        const e = await render(<iframe credentialless={true} />);
+        expect(e.getAttribute('credentialless')).toBe('');
+      });
+
+      itRenders('credentialless prop with false value', async render => {
+        const e = await render(<iframe credentialless={false} />);
+        expect(e.hasAttribute('credentialless')).toBe(false);
+      });
+    });
+
     describe('download property (combined boolean/string attribute)', function () {
       itRenders('download prop with true value', async render => {
         const e = await render(<a download={true} />);