chore(deps): bump react from 19.2.7 to 19.2.8

[dependabot]

Bumps react from 19.2.7 to 19.2.8.

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 34e9d18e84

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep react-dom on the exact React version

With a fresh install from this lockfile, react resolves to 19.2.8 while react-dom remains pinned to 19.2.7. React 19's renderer compatibility check requires these packages to have exactly matching versions, so importing react-dom/client in src/main.tsx throws an incompatible-version error before either frontend renders. Upgrade react-dom and its lockfile entry to 19.2.8 alongside React.

Useful? React with 👍 / 👎.

[helebest]

Automated Dependabot review

Step 1 — Code review

• Consistency: Version-only bump of react 19.2.7 → 19.2.8 in package.json + package-lock.json, matching the description.
• Correctness / effectiveness: Patch release; the single documented change is a React Server Components decoding performance improvement (#37087) — not a code path this app uses. Low risk.
• Security: No advisory against this package in the bump.
• Test coverage: No functional source change; regression is covered by the existing suite.

Steps 2 & 3 — Regression / CI

• ❌ Verify (typecheck + coverage + build + e2e) failed on this run. A React patch bump is an unlikely cause; this is most plausibly the known intermittent graph e2e flake and would want a single rerun to confirm — but see below, it is moot for the merge decision.
• Gate integrity ✓, Secret scan ✓, CodeQL ✓.
• ❌ Also blocked by two required checks: Dependency audit (prod, high+) and Container scan (trivy).

The audit/trivy failures are pre-existing on the base branch and unrelated to this bump. They reproduce across every open PR re-run today: the audit flags the @google-cloud/storage → gaxios / googleapis / teeny-request / uuid transitive tree; trivy flags newly-published CVEs in tar (CVE-2026-59873, CRITICAL), js-yaml (CVE-2026-59869) and fast-uri (CVE-2026-16221). main last passed CI on 2026-07-18, before these advisories were published.

Step 4 — Decision: not merged. Per fail-fast, I am not merging while required checks are red (mergeable_state: blocked). Unblocking requires (a) triaging the base-branch vulnerabilities on main, and (b) a Verify rerun to clear the flake. The bump itself is low-risk.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — ❌ not merging

Step 1 (code review) / Step 2 (regression): this bump introduces a real break, reproduced locally.

React requires react and react-dom to be the exact same version. This PR bumps react to 19.2.8 but leaves react-dom at 19.2.7, so React throws at initialization:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version.

On this branch, npm run typecheck and npm run lint pass (the mismatch is a runtime invariant, not a type error), but the entire Vitest suite fails to run — 74/74 test files error with the message above. This is the cause of the failing Verify check on this PR.

Step 3 (CI): additionally, the required Dependency audit (prod, high+) and Container scan (trivy) checks are red repo-wide (pre-existing, unrelated to this bump).

Decision: not merged. react and react-dom must be bumped together. Recommend adding a react group to dependabot.yml covering both packages, or ·@·d·ependabot r·ecreate once react-dom@19.2.8 is available, otherwise this PR should be closed.

---

Generated by Claude Code

[helebest]

Automated Dependabot review — not merged (fail-fast) ❌

Scope: react 19.2.7 → 19.2.8.

Blocking finding (Step 2 — regression): the required Verify check fails — this PR bumps only react and leaves react-dom at 19.2.7. React requires react and react-dom at the exact same version:

Error: Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:
  - react:      19.2.8
  - react-dom:  19.2.7

All 74 test files error at import of react-dom, so the suite cannot run. Per fail-fast, the PR was not merged.

Recommended resolution: bump react and react-dom together to 19.2.8 (React ships them in lockstep). Grouping the two in the Dependabot config would prevent this split going forward. ·@·d·ependabot r·ecreate after grouping should produce a mergeable PR.

---

Generated by Claude Code