build(deps): Bump react-dom from 19.2.7 to 19.2.8

[dependabot]

Bumps react-dom from 19.2.7 to 19.2.8.

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

---

Note

Low Risk
Patch-level React update for a Docusaurus docs site with no source changes; typical low-impact dependency maintenance.

Overview
Bumps react-dom from 19.2.7 to 19.2.8 in package.json and refreshes package-lock.json, which also resolves react to 19.2.8 to match react-dom’s peer dependency.

This is a patch release; upstream notes focus on React Server Components decode performance, with no app code changes in this repo.

^{Reviewed by Cursor Bugbot for commit e44704e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react@​19.2.7 ⏵ 19.2.8
	react-dom@​19.2.7 ⏵ 19.2.8

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream diff and scanner findings for supply-chain compromise indicators.Verdict: benign

Patch bump react-dom 19.2.7 → 19.2.8 from the official React repo. Upstream changes are a known-maintainer FlightReply/Server Functions decoding hardening plus facebook/react → react/react reference updates. No malware indicators in the published package path.

Evidence

• Scanner: warn with 0 unicode/confusable/IOC hits. The 25 heuristics are false positives (protocol charCodeAt, comment/cross-spawn/PATTERN.exec matches, Danger token comment, base64 rejection error strings, existing compiler postinstalls, workflow org renames).
• Integrity: Lockfile resolves registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz with a normal sha512; deps remain only scheduler — no new transitives or install scripts on react-dom.
• Scope: Tag v19.2.8 matches commit 1dd4ecb; no stego, unexpected hosts, or lifecycle-script changes in the npm artifact consumers install.

Compatibility Analysis

I'll analyze how react-dom is used here and whether 19.2.8's changes touch those paths.## Compatibility verdict: merge

Patch bump with no react-dom runtime/API surface change for this Docusaurus site.

1) Usage in this repo

• Declared in package.json / lockfile as a direct dep (react-dom@19.2.8); consumed via @docusaurus/* for client render / classic SSR.
• No direct react-dom imports under src/ (custom UI uses react only, e.g. Runnable.tsx).
• No React Server Components / Server Functions / Flight usage.

2) Intersection with upstream changes

Between v19.2.7 and v19.2.8, packages/react-dom/src and packages/react-dom-bindings/src are unchanged. Only metadata (package.json version/repo URLs, peerDependencies.react: ^19.2.8, ReactVersion).

Behavioral commit #37087 touches react-server / react-server-dom-* (decodeAction / Flight reply decoding — noted as Server Functions security/perf). Those paths are not used here.

3) Risks / unknowns

• Low: no public client/react-dom/server API delta for Docusaurus’s usage.
• Peer: react-dom@19.2.8 wants react@^19.2.8; lockfile already has both at 19.2.8 (despite package.json still listing react: ^19.2.6).
• Residual: normal docs build smoke-check only.

4) Recommendation

merge — safe patch; no adoption blockers. Optional follow-up: bump react in package.json to ^19.2.8 so declared versions stay matched.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 61
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved upstream range: 6117d7cca4906492c51fe6a03381e35adfd86e7d..1dd4ecbdabf826f527fc9a58c05ea70375b7d170
• Resolved refs: from=6117d7cca4906492c51fe6a03381e35adfd86e7d to=1dd4ecbdabf826f527fc9a58c05ea70375b7d170
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 25

Top findings

• packages/react-server/src/ReactFlightServer.js:6598 codepoint_decoder :: const command = message.charCodeAt(0);
• packages/react-devtools/package.json:25 shell_process_spawn :: "cross-spawn": "^5.0.1",
• .github/workflows/runtime_commit_artifacts.yml:374 shell_process_spawn :: const {execSync} = require('child_process');
• .github/workflows/runtime_commit_artifacts.yml:397 shell_process_spawn :: return PATTERN.exec(data) != null;
• packages/react-server/src/ReactFlightServer.js:5981 shell_process_spawn :: // We're now past rendering this task and future renders will spawn new tasks for their
• dangerfile.js:28 credential_exfil_indicator :: // DANGER_GITHUB_API_TOKEN=[ENV_ABOVE] yarn danger pr https://github.com/facebook/react/pull/11865
• compiler/packages/snap/package.json:12 lifecycle_script :: "postinstall": "./scripts/link-react-compiler-runtime.sh && perl -p -i -e 's/react\\.element/react.transitional.element/' ../../node_modules/fbt/lib/FbtReactUtil.js && perl -p -i -e 's/didWarnAboutUsingAct = false;/didWarnAboutUsingAct = true;/' ../../node_modules/react-dom/cjs/react-dom-test-utils.development.js",
• compiler/packages/react-forgive/package.json:45 lifecycle_script :: "postinstall": "cd client && yarn install && cd ../server && yarn install && cd ..",
• packages/react-server-dom-webpack/src/server/ReactFlightDOMServerNode.js:643 obfuscation_indicator :: if (encoding.toLowerCase() === 'base64') {
• packages/react-server-dom-webpack/src/server/ReactFlightDOMServerNode.js:646 obfuscation_indicator :: "React doesn't accept base64 encoded file uploads because we don't expect " +
• scripts/error-codes/codes.json:461 obfuscation_indicator :: "473": "React doesn't accept base64 encoded file uploads because we don't except form data passed from a browser to ever encode data that way. If that's the wrong assumption, we can easily fix it.",
• packages/react-server-dom-unbundled/src/server/ReactFlightDOMServerNode.js:643 obfuscation_indicator :: if (encoding.toLowerCase() === 'base64') {
• packages/react-server-dom-unbundled/src/server/ReactFlightDOMServerNode.js:646 obfuscation_indicator :: "React doesn't accept base64 encoded file uploads because we don't expect " +
• packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerNode.js:643 obfuscation_indicator :: if (encoding.toLowerCase() === 'base64') {
• packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerNode.js:646 obfuscation_indicator :: "React doesn't accept base64 encoded file uploads because we don't expect " +
• packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js:651 obfuscation_indicator :: if (encoding.toLowerCase() === 'base64') {
• packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js:654 obfuscation_indicator :: "React doesn't accept base64 encoded file uploads because we don't expect " +
• .github/workflows/compiler_discord_notify.yml:0 workflow_path_touch :: path-touch
• .github/workflows/compiler_prereleases_manual.yml:0 workflow_path_touch :: path-touch
• .github/workflows/compiler_prereleases_nightly.yml:0 workflow_path_touch :: path-touch