chore(deps): bump react from 19.2.7 to 19.2.8

[dependabot]

Bumps react from 19.2.7 to 19.2.8.

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 34e9d18e84

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep react-dom on the exact React version

With a fresh install from this lockfile, react resolves to 19.2.8 while react-dom remains pinned to 19.2.7. React 19's renderer compatibility check requires these packages to have exactly matching versions, so importing react-dom/client in src/main.tsx throws an incompatible-version error before either frontend renders. Upgrade react-dom and its lockfile entry to 19.2.8 alongside React.

Useful? React with 👍 / 👎.

[helebest]

Automated Dependabot review

Step 1 — Code review

• Consistency: Version-only bump of react 19.2.7 → 19.2.8 in package.json + package-lock.json, matching the description.
• Correctness / effectiveness: Patch release; the single documented change is a React Server Components decoding performance improvement (#37087) — not a code path this app uses. Low risk.
• Security: No advisory against this package in the bump.
• Test coverage: No functional source change; regression is covered by the existing suite.

Steps 2 & 3 — Regression / CI

• ❌ Verify (typecheck + coverage + build + e2e) failed on this run. A React patch bump is an unlikely cause; this is most plausibly the known intermittent graph e2e flake and would want a single rerun to confirm — but see below, it is moot for the merge decision.
• Gate integrity ✓, Secret scan ✓, CodeQL ✓.
• ❌ Also blocked by two required checks: Dependency audit (prod, high+) and Container scan (trivy).

The audit/trivy failures are pre-existing on the base branch and unrelated to this bump. They reproduce across every open PR re-run today: the audit flags the @google-cloud/storage → gaxios / googleapis / teeny-request / uuid transitive tree; trivy flags newly-published CVEs in tar (CVE-2026-59873, CRITICAL), js-yaml (CVE-2026-59869) and fast-uri (CVE-2026-16221). main last passed CI on 2026-07-18, before these advisories were published.

Step 4 — Decision: not merged. Per fail-fast, I am not merging while required checks are red (mergeable_state: blocked). Unblocking requires (a) triaging the base-branch vulnerabilities on main, and (b) a Verify rerun to clear the flake. The bump itself is low-risk.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ❌ not merging

Step 1 (code review) / Step 2 (regression): this bump introduces a real break, reproduced locally.

React requires react and react-dom to be the exact same version. This PR bumps react to 19.2.8 but leaves react-dom at 19.2.7, so React throws at initialization:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version.

On this branch, npm run typecheck and npm run lint pass (the mismatch is a runtime invariant, not a type error), but the entire Vitest suite fails to run — 74/74 test files error with the message above. This is the cause of the failing Verify check on this PR.

Step 3 (CI): additionally, the required Dependency audit (prod, high+) and Container scan (trivy) checks are red repo-wide (pre-existing, unrelated to this bump).

Decision: not merged. react and react-dom must be bumped together. Recommend adding a react group to dependabot.yml covering both packages, or ·@·d·ependabot r·ecreate once react-dom@19.2.8 is available, otherwise this PR should be closed.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — not merged (fail-fast) ❌

Scope: react 19.2.7 → 19.2.8.

Blocking finding (Step 2 — regression): the required Verify check fails — this PR bumps only react and leaves react-dom at 19.2.7. React requires react and react-dom at the exact same version:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:
  - react:      19.2.8
  - react-dom:  19.2.7

All 74 test files error at import of react-dom, so the suite cannot run. Per fail-fast, the PR was not merged.

Recommended resolution: bump react and react-dom together to 19.2.8 (React ships them in lockstep). Grouping the two in the Dependabot config would prevent this split going forward. ·@·d·ependabot r·ecreate after grouping should produce a mergeable PR.

---

Generated by Claude Code

[helebest]

Dependabot PR review — blocked by a react/react-dom version mismatch ⛔ (not merged)

Step 1 — Code review
Bumps react 19.2.7 → 19.2.8 (patch) in package.json/package-lock.json. However, it bumps only react and leaves react-dom pinned at 19.2.7. React requires react and react-dom to be the exact same version, so this PR on its own produces an inconsistent pair.

Step 2 — Regression verification — FAILED (fresh run against current main)
After updating the branch onto the latest main, the CI Verify job fails the entire unit suite — 74/74 test files error at setup:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:
  - react:      19.2.8
  - react-dom:  19.2.7
Learn more: https://react.dev/warnings/version-mismatch

This is a real, blocking regression, not a flake or stale base.

Decision (fail-fast): Not merging. react-dom must be bumped to 19.2.8 in the same change (react and react-dom always move together). Recommended maintainer action: either add a matching react-dom 19.2.8 bump to this PR, or configure Dependabot to group react + react-dom so they always update as a pair, then ·@·d·ependabot r·ecreate. (Verify was green on main before this PR, confirming the failure is introduced here.)

---

Generated by Claude Code

[helebest]

·@·d·ependabot r·ebase

---

Automated dependency review — react 19.2.7 → 19.2.8 (patch)

Step 1 · Code review: Patch bump; release notes describe only a React Server Components decoding performance improvement (#37087). No API surface change; low risk for this browser app. package.json + package-lock.json only.

Step 2 · Regression verification: The prior CI Verify run (July 25) failed, but its logs show npm ci, build and typecheck all completed and the failure occurred later in the suite — consistent with the repo's known-flaky graph e2e on a now-outdated base, not a react-related regression (contrast #167/#169, which fail at install/typecheck). That run also predates #168 and several other merges to main.

Next: requested a rebase onto current main to get a clean, authoritative CI run. Will squash-merge once the required checks are green.

---

Generated by Claude Code

[helebest]

Automated dependency review — react 19.2.7 → 19.2.8 ⚠️ Not merging

Step 1 — Code review

The bump raises react to 19.2.8 but leaves react-dom pinned at 19.2.7 (react-dom stays ^19.2.7 and resolves to 19.2.7 in the lockfile). React requires react and react-dom to be the exact same version, so bumping one without the other is not a safe standalone change.

Step 2 — Regression verification: FAILED ❌

On a fresh CI run rebased onto current main, the required Verify job fails immediately — all 74 unit/component test suites error at import:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:
  - react:      19.2.8
  - react-dom:  19.2.7
Learn more: https://react.dev/warnings/version-mismatch

This is a genuine regression introduced by the bump, not a flake.

Steps 3–4 — Decision

Per fail-fast, stopping — not merging. react and react-dom must move together. This will resolve once the companion react-dom → 19.2.8 bump lands; the cleanest path is for Dependabot to update both in a single PR (·@·d·ependabot r·ecreate once the react-dom update is available, or group react + react-dom in .github/dependabot.yml). Leaving this open.

---

Generated by Claude Code

[helebest]

Step 2/3 · Regression verification on the rebased head — ❌ FAILED

After rebasing onto current main (53254d6), a fresh CI run completed and Verify fails. This is not the flaky-e2e case I anticipated — it's a real incompatibility caused by the bump itself. All 74 vitest suites fail at setup:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:
  - react:      19.2.8
  - react-dom:  19.2.7
Learn more: https://react.dev/warnings/version-mismatch

react and react-dom must be locked to the exact same version, but this PR bumps only react (19.2.7 → 19.2.8) and leaves react-dom at 19.2.7. (Gate integrity ✅, CodeQL ✅, Analyze ✅, gitleaks ✅ all pass; audit/trivy are the pre-existing environmental reds.)

Decision — not merging. This bump must include a matching react-dom 19.2.8. Recommend ·@·d·ependabot r·ecreate once react-dom 19.2.8 is available (ideally grouping react/react-dom so they always move together), or a manual combined bump. I've corrected my earlier assessment above — the prior stale failure masked this real mismatch.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — react 19.2.7 → 19.2.8

1. Code review. The diff is limited to package.json + package-lock.json. React 19.2.8 is a patch (React Server Components decode perf improvement) with no public API changes. However, this PR bumps react without bumping react-dom — and React requires react and react-dom to be the exact same version.

2. Regression verification (CI Verify job). ❌ Failed. The unit/component suite aborts at module load and all 74 test files fail:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:
  - react:      19.2.8
  - react-dom:  19.2.7

Gate integrity, CodeQL, and gitleaks pass. Container scan (trivy) and Dependency audit fail, but with pre-existing issues on main that are unrelated to this bump.

3. Decision. ⛔ Not merging. The bump is incomplete on its own and breaks the app and the test suite. To land it, react-dom must be raised to 19.2.8 in the same change. Recommend grouping react + react-dom in the Dependabot config so they always move together.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — react 19.2.7 → 19.2.8 — ❌ blocked

1. Code review

The diff bumps react only (^19.2.6 → ^19.2.8) and leaves react-dom at ^19.2.7. React requires react and react-dom to be the exact same version, so this bump is internally inconsistent.

2. Regression verification — FAILED

The required Verify job fails during test-environment setup, taking down all 74 test suites:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:
  - react:      19.2.8
  - react-dom:  19.2.7
Learn more: https://react.dev/warnings/version-mismatch

This is not transient and not a base-branch issue — it is caused directly by the version skew in this PR, and it would also break the app at runtime, not just the tests.

3. Decision

Not merging (fail-fast on a failed required check). react and react-dom must be upgraded together.

Suggested remediation: bump react-dom to 19.2.8 in lockstep (a combined PR), or add a Dependabot groups entry so react + react-dom are always updated together, e.g.:

# .github/dependabot.yml
groups:
  react:
    patterns:
      - "react"
      - "react-dom"

This PR is left open for that follow-up.

---

Generated by Claude Code

[helebest]

Automated review — ❌ blocked at regression verification (fail-fast)

Step 1 · Code review — The diff bumps react 19.2.7 → 19.2.8 in package.json + package-lock.json, but does not bump react-dom, which stays at 19.2.7. React requires that the react and react-dom packages resolve to the exact same version — a skew is not a supported configuration.

Step 2 · Regression verification — FAILED. The required Verify job fails, and the failure signature is exactly what a react/react-dom skew produces — every test file errors during collection:

 Test Files  74 failed (74)
      Tests  no tests

All 74 test files fail to import (React DOM throws "Incompatible React versions" / the testing-library render environment can't initialize) rather than any individual assertion failing. This is a genuine, deterministic breakage of the whole test + build surface, not flakiness.

Decision: Per fail-fast, processing stops here and this PR is not merged.

Recommended remediation: bump react-dom to 19.2.8 in the same change so React and React-DOM stay in lockstep. (Dependabot usually pairs them; if it split them, a combined react + react-dom bump — or a Dependabot group covering both — resolves it.) Once both are on 19.2.8, Verify should pass.

The Dependency audit / Container scan (trivy) jobs are red on the pre-existing main baseline and are unrelated to this finding.

---

Generated by Claude Code

[helebest]

Automated review — Step 1 (Code review)

Dimension	Finding
Consistency	✅ Description matches: react 19.2.7 → 19.2.8 in package.json + package-lock.json.
Correctness	✅ Patch release; the only change is a React Server Components flight-reply decode performance improvement (react/react#37087). This app does not use RSC, so it is effectively a no-op runtime-wise.
Conventions / Security / Effectiveness	✅ Standard patch bump, no advisory, no API surface change.
Test coverage	✅ N/A — no functional source change.

The branch was behind main after #175 merged; I've updated it to re-run CI against current main. Proceeding to Step 3 (CI) — will squash-merge once the required checks (Verify, CodeQL, gitleaks, gate-integrity) are green.

---

Generated by Claude Code

[helebest]

Step 3 (CI) — ❌ FAILED, not merging

After updating the branch onto current main and running CI, the required Verify check failed — and this is a real defect in the PR, not a flake or a pre-existing base failure:

Error: Incompatible React versions: The "react" and "react-dom" packages
must have the exact same version. Instead got:
  - react:      19.2.8
  - react-dom:  19.2.7

This PR bumps only react to 19.2.8 and leaves react-dom pinned at 19.2.7. React requires react and react-dom to be the exact same version, so every component test fails at render (74 failed (74)).

Fail-fast: stopping here, not merging.

Fix required: bump react-dom to 19.2.8 alongside react (they must move together). Either add the react-dom bump to this PR, or close it and let Dependabot recreate the two as a grouped update.

Steps 1–2 (review + regression on the react patch itself) were otherwise clean; the blocker is purely the missing companion react-dom bump.

---

Generated by Claude Code