build(deps): Bump react from 19.2.7 to 19.2.8 by dependabot[bot] · Pull Request #1069 · Chia-Network/chia-docs

dependabot · 2026-07-28T22:32:52Z

Bumps react from 19.2.7 to 19.2.8.

Release notes

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Note

Low Risk
Lockfile-only dependency patch with no application code changes; minimal risk beyond normal React patch upgrade behavior.

Overview
Bumps the react dependency from 19.2.7 to 19.2.8 in package.json and updates the lockfile accordingly. react-dom stays at 19.2.7.

This is a patch release; upstream notes include React Server Components decoding performance improvements, which mainly matter if the site uses RSC—typical Docusaurus client rendering is unlikely to see a visible change.

^{Reviewed by Cursor Bugbot for commit 56a15f5. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-07-28T22:33:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react@19.2.7 ⏵ 19.2.8

View full report

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e9e5b6f. Configure here.}

cursor · 2026-07-28T22:34:22Z

    "prettier": "^3.9.5",
    "prism-react-renderer": "^2.4.1",
-    "react": "^19.2.6",
+    "react": "^19.2.8",


Mismatched React package versions

High Severity

This bump updates react to 19.2.8 while react-dom remains at 19.2.7. React 19 requires those packages to share the exact same version, so the mismatch can throw an incompatible-versions error and break the app at runtime.

Additional Locations (1)

package-lock.json#L15852-L15862

^{Reviewed by Cursor Bugbot for commit e9e5b6f. Configure here.}

github-actions · 2026-07-28T22:35:41Z

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream diff and scanner findings against the malware checklist.Checking whether the heuristic hits are real payload changes or repo-rename noise.Verdict: benign

Patch bump react 19.2.7 → 19.2.8 from the official package. Upstream changes match the release notes: Flight reply decoding performance/hardening plus facebook/react → react/react reference updates. No supply-chain compromise indicators.

Evidence

Scanner: warn with 0 unicode / confusable / IOC hits. All 25 heuristics are false positives (pre-existing charCodeAt protocol parsing; cross-spawn dep name; RegExp.exec / comment “spawn”; Danger token comment; compiler-only postinstalls not shipped in npm react; existing base64-rejection error text; workflow files touched only for org rename).
Diff intent: decodeAction/decodeFormState defer action loading; iterator abort uses noop; workflows/package.json/dangerfile only swap repo URLs. Published react has no install lifecycle scripts and no new transitive deps.
Integrity: Tags v19.2.7 / v19.2.8 resolve to the scanned range; lockfile points at registry.npmjs.org/react/-/react-19.2.8.tgz with a normal sha512 integrity hash.

Action: Safe to merge from a malware/supply-chain perspective.

Compatibility Analysis

I'll analyze local React usage against the 19.2.7→19.2.8 upstream changes and produce a concise compatibility recommendation.## Compatibility verdict: merge

Patch bump with no public API changes that this Docusaurus site can hit.

1) Local usage

Declared in package.json / lockfile as a direct dependency (react ^19.2.8; react-dom still ^19.2.7).
App imports (client React only):
- src/components/Runnable.tsx — useState / useEffect / useMemo
- src/utils/stringify.ts — Children, isValidElement, ReactNode
- src/pages/index.js, src/components/HomepageFeatures.js — default React import
Also consumed transitively via Docusaurus, @mdx-js/react, prism-react-renderer, react-icons, react-simple-code-editor.
No RSC / Flight / react-server-dom-* usage in this repo.

2) Intersection with upstream changes

In .upstream-dependency, packages/react only changes metadata (version 19.2.7→19.2.8, GitHub repo URLs).
Real code changes are RSC FlightReply decoding in react-server / react-server-dom-* — not used here and not part of the published react package surface this site imports.
Local APIs used (hooks, Children, JSX types) are untouched.

3) Risks / unknowns

Low: temporary react 19.2.8 vs react-dom 19.2.7 skew (peer allows react@^19.2.7); prefer bumping react-dom in a follow-up for lockstep.
No build/runtime API breakage expected for this docs site.

4) Recommendation

merge — safe patch for this consumer; optional follow-up to align react-dom to 19.2.8.

Malware Scan Summary

Status: warn
Warn only mode: true
Changed upstream files scanned: 61
Resolution strategy: tag_range
Changed node/vendor paths: 0
Changed lockfiles: 0
Resolved upstream range: 6117d7cca4906492c51fe6a03381e35adfd86e7d..1dd4ecbdabf826f527fc9a58c05ea70375b7d170
Resolved refs: from=6117d7cca4906492c51fe6a03381e35adfd86e7d to=1dd4ecbdabf826f527fc9a58c05ea70375b7d170
Unicode findings (post-allowlist): 0
Confusable findings (post-allowlist): 0
IOC findings (post-allowlist): 0
Heuristic findings (post-allowlist): 25

Top findings

packages/react-server/src/ReactFlightServer.js:6598 codepoint_decoder :: const command = message.charCodeAt(0);
packages/react-devtools/package.json:25 shell_process_spawn :: "cross-spawn": "^5.0.1",
.github/workflows/runtime_commit_artifacts.yml:374 shell_process_spawn :: const {execSync} = require('child_process');
.github/workflows/runtime_commit_artifacts.yml:397 shell_process_spawn :: return PATTERN.exec(data) != null;
packages/react-server/src/ReactFlightServer.js:5981 shell_process_spawn :: // We're now past rendering this task and future renders will spawn new tasks for their
dangerfile.js:28 credential_exfil_indicator :: // DANGER_GITHUB_API_TOKEN=[ENV_ABOVE] yarn danger pr https://github.com/facebook/react/pull/11865
compiler/packages/snap/package.json:12 lifecycle_script :: "postinstall": "./scripts/link-react-compiler-runtime.sh && perl -p -i -e 's/react\\.element/react.transitional.element/' ../../node_modules/fbt/lib/FbtReactUtil.js && perl -p -i -e 's/didWarnAboutUsingAct = false;/didWarnAboutUsingAct = true;/' ../../node_modules/react-dom/cjs/react-dom-test-utils.development.js",
compiler/packages/react-forgive/package.json:45 lifecycle_script :: "postinstall": "cd client && yarn install && cd ../server && yarn install && cd ..",
packages/react-server-dom-webpack/src/server/ReactFlightDOMServerNode.js:643 obfuscation_indicator :: if (encoding.toLowerCase() === 'base64') {
packages/react-server-dom-webpack/src/server/ReactFlightDOMServerNode.js:646 obfuscation_indicator :: "React doesn't accept base64 encoded file uploads because we don't expect " +
scripts/error-codes/codes.json:461 obfuscation_indicator :: "473": "React doesn't accept base64 encoded file uploads because we don't except form data passed from a browser to ever encode data that way. If that's the wrong assumption, we can easily fix it.",
packages/react-server-dom-unbundled/src/server/ReactFlightDOMServerNode.js:643 obfuscation_indicator :: if (encoding.toLowerCase() === 'base64') {
packages/react-server-dom-unbundled/src/server/ReactFlightDOMServerNode.js:646 obfuscation_indicator :: "React doesn't accept base64 encoded file uploads because we don't expect " +
packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerNode.js:643 obfuscation_indicator :: if (encoding.toLowerCase() === 'base64') {
packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerNode.js:646 obfuscation_indicator :: "React doesn't accept base64 encoded file uploads because we don't expect " +
packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js:651 obfuscation_indicator :: if (encoding.toLowerCase() === 'base64') {
packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js:654 obfuscation_indicator :: "React doesn't accept base64 encoded file uploads because we don't expect " +
.github/workflows/compiler_discord_notify.yml:0 workflow_path_touch :: path-touch
.github/workflows/compiler_prereleases_manual.yml:0 workflow_path_touch :: path-touch
.github/workflows/compiler_prereleases_nightly.yml:0 workflow_path_touch :: path-touch

Bumps [react](https://github.com/react/react/tree/HEAD/packages/react) from 19.2.7 to 19.2.8. - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) --- updated-dependencies: - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added Changed Required label for PR that categorizes merge commit message as "Changed" for changelog dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 28, 2026

cursor Bot reviewed Jul 28, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/react-19.2.8 branch from e9e5b6f to 56a15f5 Compare July 29, 2026 16:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): Bump react from 19.2.7 to 19.2.8 - #1069

build(deps): Bump react from 19.2.7 to 19.2.8#1069
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-19.2.8

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited by cursor Bot

Loading

Uh oh!

socket-security Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

19.2.8 (July 21st, 2026)

React Server Components

Uh oh!

socket-security Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 28, 2026

Choose a reason for hiding this comment

Mismatched React package versions

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Compatibility Analysis

1) Local usage

2) Intersection with upstream changes

3) Risks / unknowns

4) Recommendation

Malware Scan Summary

Top findings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 28, 2026 •

edited by cursor Bot

Loading

socket-security Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading