refactor: drop json5 dep, handle non-finite floats in socket parse fallback

[FarhanAliRaza]

…

Happy path uses native JSON.parse; the catch rewrites Python"s bare Infinity/-Infinity/NaN tokens outside string literals before retrying, so only payloads that actually contain specials pay the extra cost. NaN has no JSON literal and becomes null (matches JSON.stringify).

All Submissions:

• Have you followed the guidelines stated in CONTRIBUTING.md file?
• Have you checked to ensure there aren't any other open Pull Requests for the desired changed?

Type of change

Please delete options that are not relevant.

• New feature (non-breaking change which adds functionality)

New Feature Submission:

• Does your submission pass the tests?
• Have you linted your code locally prior to submission?

Changes To Core Features:

• Have you successfully ran tests with your changes locally?

claoses #5820

Will also help with the lighthouse score, I think.

[codspeed-hq]

Merging this PR will not alter performance

✅ 9 untouched benchmarks

---

_{Comparing FarhanAliRaza:remove-json5-dep (24b214c) with main (d6db9c9)}

[greptile-apps]

Greptile Summary

This PR removes the json5 npm dependency and replaces it with native JSON.parse plus a regex-based fallback that rewrites Python's non-standard bare float tokens (Infinity, -Infinity, NaN) before retrying. The happy path pays no extra cost; only payloads that contain specials go through the rewrite step.

• NaN → null (not NaN) is an intentional behavior change: state values of float('nan') now render as empty strings in the UI rather than "NaN". The test reflects this, but downstream users who relied on the NaN display will see a silent difference with no deprecation notice.

Confidence Score: 5/5

Safe to merge; all findings are P2 style/documentation suggestions with no runtime correctness issues.

The regex implementation correctly handles Python's non-finite float tokens and the string-literal-first alternation prevents false positives inside quoted values. Removing json5 is a clean, well-scoped change. Both open findings are P2: one asks for word-boundary guards that are not required for real payloads, and one notes the intentional NaN→null behavior change lacks a deprecation/changelog entry.

No files require special attention.

Important Files Changed

Filename	Overview
packages/reflex-base/src/reflex_base/.templates/web/utils/state.js	Replaces JSON5.parse with native JSON.parse + a regex fallback for non-finite floats; regex correctly prioritizes string-literal matching to avoid touching values inside quotes.
packages/reflex-base/src/reflex_base/constants/installer.py	Removes the json5 npm dependency entry; clean single-line removal with no other side effects.
tests/integration/test_computed_vars.py	Updates the special-floats assertion to expect an empty slot for NaN (now null), reflecting the intentional behavior change; all other float expectations are unchanged.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["Socket.io packet received (str)"] --> B["JSON.parse(str)"]
    B -->|success| C["Return parsed object"]
    B -->|throws| D["rewriteBareNonFiniteFloats(str)"]
    D --> E["Regex: match string literals first\n(pass through unchanged)"]
    E --> F["Replace bare Infinity → 1e999\n-Infinity → -1e999\nNaN → null"]
    F --> G["JSON.parse(rewritten str)"]
    G -->|success| H["Return parsed object\n(NaN becomes null, ±Inf preserved)"]
    G -->|throws| I["Return false\n(malformed payload)"]

Loading

_{Reviews (1): Last reviewed commit: "refactor: drop json5 dep, handle non-fin..." | Re-trigger Greptile}