
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@zendeskgarden/react-dropdowns.legacy
Advanced tools
Components relating to dropdowns in the Garden Design System
This package includes components relating to legacy dropdowns in the Garden Design System.
| ⚠️ DEPRECATED |
|---|
Use @zendeskgarden/react-dropdowns@^9.0.0 to continue using the latest Garden Dropdowns. |
npm install @zendeskgarden/react-dropdowns.legacy
# Peer Dependencies - Also Required
npm install react react-dom styled-components @zendeskgarden/react-theming
import { ThemeProvider } from '@zendeskgarden/react-theming';
import { Dropdown, Menu, Item, Trigger } from '@zendeskgarden/react-dropdowns.legacy';
/**
* Place a `ThemeProvider` at the root of your React application
*/
<ThemeProvider>
<Dropdown onSelect={value => console.log(`Selected: ${value}`)}>
<Trigger>
<button>This triggers a menu</button>
</Trigger>
<Menu placement="end" hasArrow>
<Item value="option-1">Option 1</Item>
<Item value="option-2">Option 2</Item>
<Item value="option-3">Option 3</Item>
</Menu>
</Dropdown>
</ThemeProvider>;
For all components within the react-dropdowns.legacy package, the menu layouts and
implementations are interchangeable.
Whether you're making a Select, Autocomplete, or a traditional Menu the <Menu> implementation
will adapted to its consumer.
The react-dropdowns.legacy package abstracts the common concepts of Menus, Selects, and Autocompletes
into a common API. This includes consistent visuals, common keyboard interaction, and a fully accessible
experience for sighted and non-sighted users.
The customizations available within this can be broken into two groups: placement / positioning and dropdown state
Internally, the <Dropdown> component uses PopperJS
for its positioning calculations.
The <Menu> component accepts all customizations regarding placement, boundaries, overflows,
etc. via the popperModifiers prop.
/** Customize default overflow settings to position against the `viewport` */
<Menu popperModifiers={{ preventOverflow: { boundariesElement: 'viewport' } }}>
<Item value="item-1">Item 1</Item>
<Item value="item-2">Item 2</Item>
<Item value="item-3">Item 3</Item>
</Menu>
We use the Downshift render-prop library to handle our keyboard and accessibility logic.
The following states can be controlled directly from the <Dropdown> component:
AutocompleteAll other customizations may be provided directly to the Downshift provider
via the downshiftProps prop.
Downshift provides several advanced customization features that can be very helpful when customizing this component. The stateReducer pattern is a common customization strategy.
If you are using server side rendering you may need to configure specific Downshift settings.
This package re-exports the Downshift resetIdCounter utility. It allows resetting the internal id
counter which is used to generate unique ids for Downshift.
FAQs
Components relating to dropdowns in the Garden Design System
The npm package @zendeskgarden/react-dropdowns.legacy receives a total of 16,650 weekly downloads. As such, @zendeskgarden/react-dropdowns.legacy popularity was classified as popular.
We found that @zendeskgarden/react-dropdowns.legacy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.