web-forms-react-hook-form-66068b — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited web-forms-react-hook-form-66068b (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick Guide: Useregisterfor native inputs,Controllerfor controlled components,useFieldArrayfor dynamic fields. Always provideuseForm<FormData>()generics. Setmode: "onBlur"for optimal UX. Use resolver pattern for schema validation. UseuseWatchinstead ofwatch()in render to avoid re-rendering the whole form. Usefield.idas key in useFieldArray -- never array index.
<critical_requirements>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)(You MUST provide generic types to `useForm<FormData>()` for type-safe form handling)
(You MUST use `field.id` as key prop in useFieldArray - NEVER use array index)
(You MUST use Controller for controlled components that don't expose a ref)
(You MUST use resolver pattern for schema validation - keep schemas separate from form logic)
(You MUST set `mode: "onBlur"` or `mode: "onTouched"` for optimal UX - avoid `mode: "onChange"` unless needed)
</critical_requirements>
Auto-detection: React Hook Form, useForm, register, handleSubmit, formState, Controller, useFieldArray, useWatch, useFormContext, resolver, zodResolver, FormProvider, useFormState, FormStateSubscribe
When to use:
When NOT to use:
Key patterns covered:
values prop<philosophy>
React Hook Form prioritizes performance through uncontrolled inputs and subscription-based updates. Only fields that change re-render, not the entire form. The library isolates form state from component state, minimizing re-renders and keeping forms responsive even with many fields.
Core Principles:
register for native inputs to avoid re-rendersController for UI library components that don't expose a refuseWatch, useFormState)</philosophy>
<patterns>
Always provide a type parameter, mode, and defaultValues. These three prevent the most common issues (no type safety, validation noise, undefined warnings).
const {
register,
handleSubmit,
formState: { errors, isSubmitting },
} = useForm<ContactFormData>({
mode: "onBlur",
defaultValues: { name: "", email: "", message: "" },
});Why this matters: Without generics, field names are any. Without defaultValues, values are undefined and cause hydration mismatches. Without mode: "onBlur", the default "onSubmit" gives no feedback until first submit.
See examples/core.md for complete form with accessibility attributes and error display.
Use Controller when a component doesn't expose a native ref (custom selects, date pickers, rich text editors). Use register for standard HTML inputs.
<Controller
name="service"
control={control}
rules={{ required: "Service is required" }}
render={({ field, fieldState: { error } }) => (
<>
<Select {...field} options={serviceOptions} />
{error && <span role="alert">{error.message}</span>}
</>
)}
/>Key decision: If the component accepts a ref prop that forwards to a native input, register works. Otherwise, use Controller.
See examples/controlled-components.md for single select, date picker, and multi-select checkbox patterns.
Use useFieldArray for repeatable field groups. Always use `field.id` as the React key -- array index causes state corruption on add/remove.
const { fields, append, remove } = useFieldArray({ control, name: "items" });
{fields.map((field, index) => (
<div key={field.id}> {/* CRITICAL: field.id, never index */}
<input {...register(`items.${index}.name`)} />
<button type="button" onClick={() => remove(index)}>Remove</button>
</div>
))}Gotcha: append/prepend/insert require complete objects (not partial). Use rules.minLength on useFieldArray for minimum item validation. Array-level errors live at errors.items.root.
See examples/arrays.md for a complete invoice form with calculated totals.
Use resolver to integrate validation schemas. The resolver handles validation; you wire it to the form. Keep schema definition separate from form code.
import { zodResolver } from "@hookform/resolvers/zod";
const { register, handleSubmit } = useForm<FormData>({
resolver: zodResolver(schema),
mode: "onBlur",
defaultValues: { username: "", email: "" },
});Why resolver over inline rules: Schemas are testable independently, reusable across forms, support cross-field validation (e.g. confirmPassword), and generate TypeScript types via z.infer.
See examples/validation.md for resolver integration with a registration form.
Use useWatch in a separate component to subscribe to specific fields without re-rendering the entire form. Prefer useWatch over watch() in render.
function PriceDisplay({ control }: { control: Control<PricingFormData> }) {
const [plan, seats] = useWatch({ control, name: ["plan", "seats"] });
return <div>Total: ${PLAN_PRICES[plan] * seats}</div>;
}v7.61+ `compute` option: Transform watched values before subscription -- component only re-renders when the computed result changes.
const total = useWatch({
control,
compute: ({ plan, seats, billingCycle }) => {
const base = PLAN_PRICES[plan] * seats;
return billingCycle === "annual" ? base * 12 * (1 - ANNUAL_DISCOUNT) : base;
},
});See examples/v7-advanced.md Pattern 6 for complete compute example.
Use FormProvider + useFormContext to share form methods across deeply nested components without prop drilling. Ideal for multi-section forms and wizard steps.
// Parent
<FormProvider {...methods}>
<form onSubmit={methods.handleSubmit(onSubmit)}>
<AddressFields prefix="shippingAddress" />
<AddressFields prefix="billingAddress" />
</form>
</FormProvider>
// Child - no props needed
function AddressFields({ prefix }) {
const { register } = useFormContext<CheckoutFormData>();
return <input {...register(`${prefix}.street`)} />;
}When to use: 3+ levels of nesting or reusable form sections. For 1-2 levels, passing control/register as props is simpler.
See examples/wizard.md for a complete multi-step wizard using FormProvider with per-step validation via trigger().
Two approaches for loading external data into a form:
resetOptions: { keepDirtyValues: true } to preserve user edits.reset(data) which updates both values AND defaultValues for proper isDirty tracking.// Modern: values prop (reactive, auto-updates)
useForm<FormData>({
values: userData,
resetOptions: { keepDirtyValues: true },
});
// Legacy: manual reset
useEffect(() => {
if (data) reset(data);
}, [data, reset]);Cancel/save pattern: reset() without args reverts to defaultValues. After save, call reset(data) to update defaultValues and clear isDirty.
See examples/v7-advanced.md Pattern 1 for values prop with async data.
Use useFormState with name to create error components that only re-render when their specific field's error changes. For v7.68+, FormStateSubscribe provides the same isolation as a component.
function FieldError<T extends FieldValues>({ control, name }: Props<T>) {
const { errors } = useFormState({ control, name });
const error = errors[name];
if (!error) return null;
return <span role="alert">{error.message as string}</span>;
}See examples/performance.md for a complete large form with isolated subscriptions, and examples/v7-advanced.md Pattern 4 for FormStateSubscribe.
</patterns>
Detailed Resources:
<red_flags>
High Priority Issues:
useForm -- loses type safety for field names and valuesregister for components that don't expose ref -- use Controller insteaddefaultValues -- causes hydration mismatches and undefined warningsMedium Priority Issues:
mode: "onChange" without reason -- validates on every keystroke, noisy UXformState properties -- subscribes to all, causes unnecessary re-renderswatch() in render body -- triggers re-render on every field change; use useWatch insteadsetValue without shouldValidate: true -- may leave form in invalid statetrigger(fieldNames) for step validation in wizard formsGotchas & Edge Cases:
reset() reverts to defaultValues; reset(newData) updates both values AND defaultValueshandleSubmit does not catch errors thrown in your onSubmit callback -- handle errors yourself with try/catchappend/prepend/insert require complete objects, not partial dataerrors.arrayName.root, item errors at errors.arrayName[index].fieldNameshouldUnregister: true removes unmounted field values -- keep false (default) for wizard formsuseWatch returns defaultValue on first render before subscription kicks insetValue does not directly update useFieldArray -- use replace() API insteadFormStateSubscribe works with control prop directly or via FormProvider (both are valid)values prop (reactive external data) vs defaultValues (static initial values) -- do not mix their use cases</red_flags>
<critical_reminders>
All code must follow project conventions in CLAUDE.md
(You MUST provide generic types to `useForm<FormData>()` for type-safe form handling)
(You MUST use `field.id` as key prop in useFieldArray - NEVER use array index)
(You MUST use Controller for controlled components that don't expose a ref)
(You MUST use resolver pattern for schema validation - keep schemas separate from form logic)
(You MUST set `mode: "onBlur"` or `mode: "onTouched"` for optimal UX - avoid `mode: "onChange"` unless needed)
Failure to follow these rules will break form validation, cause re-render issues, and reduce type safety.
</critical_reminders>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.