Preact 10

Apply the JavaScript ES2026 prompt first. These rules cover Preact 10, its bundled hooks, compat and JSX APIs, and optional SSR integration, and were checked against 10.29.8 and preact-render-to-string 6.7.0. Browser compatibility depends on the application build and host APIs; Preact 10's legacy-browser compatibility does not supply ES2026 features or browser security controls.

Package and renderer boundaries

• Resolve preact, preact/hooks, preact/compat, and preact/jsx-runtime to the reviewed core package in client builds, SSR builds, aliases, and import maps. Use preact/compat for React compatibility; the old standalone preact-compat package belongs to Preact 8. Check bundled copies so an older dependency cannot reintroduce the JSON VNode injection regression fixed before 10.29.8.
• Review and lock the SSR renderer separately, including when accessed through preact/compat/server: preact-render-to-string has its own releases, and Preact's optional peer range >=5 is a compatibility declaration, not a security floor. Refresh it with npm update preact-render-to-string and check every copy with npm ls preact-render-to-string. Never let request data choose prop or attribute names, because the renderer writes them into markup. Check the deployed server runtime and streaming APIs separately; core Preact declares no Node.js engines requirement.

VNodes, props, and DOM sinks

• Validate external display fields as the expected string or number before placing them in JSX children; ordinary text children use text nodes in the browser and escaping in