chore(deps): bump react-dom and @types/react-dom

[dependabot]

Bumps react-dom and @types/react-dom. These dependencies needed to be updated together.
Updates react-dom from 19.2.5 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.

Updates @types/react-dom from 19.2.3 to 19.2.5

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[srpatcha]

Review — eDB#76 "chore(deps): bump react-dom and @types/react-dom"

head: 0d0a0ca author: app/dependabot ci: green and meaningless — no workflow in this repo runs npm on a pull request

Verdict: The dependency change is coherent — npm ci resolves, and react/react-dom both land on 19.2.8. But the PR is much larger than its title: it also regenerates a package-lock.json that has been out of sync with package.json on master, where npm ci currently fails outright. That repair is welcome and is the more important half of this PR, and it is exactly the half no check here exercises.

Findings

#	Severity	File:line	Finding	Recommended fix
1	High	.github/workflows/ (all)	No workflow runs npm on pull_request. npm ci and npm run build appear only in nightly.yml:63,69, weekly.yml:64,70 and release.yml:118,121 — scheduled or tag-triggered. A 2655-line lockfile change therefore merges on the strength of Analyze (Python), CodeQL and assign, none of which touches node. The concrete cost is visible right now in the sibling PR eDB#77, whose lockfile fails npm ci with ERESOLVE and carries the same three green checks.	Add a frontend job to ci.yml on pull_request: actions/setup-node (node 22.x, cache: npm), then npm ci, npx tsc --noEmit, npm run build, npm run test. package.json:10 defines "test": "vitest run" and nothing in CI runs it — the frontend test suite has never executed in this repo's CI.
2	High	package-lock.json:1-20	Pre-existing, surfaced here: npm ci fails on origin/master. The lock records "version": "0.1.0" against a package.json at 3.0.1, and omits vitest, jsdom, @testing-library/react and @testing-library/jest-dom that package.json:19-28 declares. Verified: npm ci --dry-run on origin/master → rc 1, EUSAGE … Missing: vitest@2.1.9 from lock file plus 15 more. So nightly.yml, weekly.yml and the npm half of release.yml are broken on master today, and have been since the frontend test dependencies were added without regenerating the lock.	This PR fixes it as a side effect, and so does eDB#79. Land the regeneration once and rebase the rest. Not opening a fix PR: #76 and #79 already cover it (review brief, "Opening fix PRs" — do not duplicate an existing PR).
3	Medium	package-lock.json	This PR, eDB#77 and eDB#79 each regenerate the whole lockfile, so all three conflict with each other. Whichever merges first invalidates the other two, and because of finding #1 nobody will find out from CI — the stale lock will simply fail on the next nightly.	Merge one, then close-and-recreate or rebase the others. Do not merge two of the three in sequence without regenerating in between.
4	Medium	.github/workflows/ci.yml:3-8 at this head	The Python matrix never ran here either. This branch forks from 5e436bd (2026-08-25), where ci.yml triggers on pull_request: branches: [main]; this PR targets master, added to the trigger later in f3b1ab0 and absent from this branch.	Rebase onto current master, after eDB#82.

Not a finding: bumping only react-dom while leaving react at ^19.1.0 is safe here, because the caret range floats react to 19.2.8 and the lock pins both at 19.2.8 — a matched pair, which is what React requires. Note that the sibling PR eDB#79 does the mirror-image bump and does not come out matched; see that review.

Dependabot's own comment about the missing npm label is already on this PR and is not repeated; the config to fix is .github/dependabot.yml.

Architecture conformance

Conforms. Dependency-metadata and lockfile change confined to Tier 3 eDB (master design §21); no source, import, link or manifest-entry change, so §5.1 dependency direction is untouched. Where it deviates is §28's evidence policy rather than the architectural law — a green check list is presented for a change class this repo does not test on pull requests at all.

Proposed changes

1. Add the frontend PR job (finding #1). It is the prerequisite for judging any of #76/#77/#79 on evidence.
2. Merge exactly one lock regeneration — this PR is a reasonable choice, since unlike #77 it installs and unlike #79 it leaves react and react-dom matched.
3. Rebase or recreate the other two afterwards.

Verification I ran

Local, npm 11.17.0 / node 24.19.0, package.json + package-lock.json extracted from each ref:

• this head — npm ci --dry-run → rc 0. Resolved react 19.2.8, react-dom 19.2.8, @types/react 19.2.14, @types/react-dom 19.2.5; root package version 3.0.1, matching package.json. react-dom@19.2.8 declares peerDependencies: {react: ^19.2.8} and the resolved react satisfies it exactly.
• origin/master — npm ci --dry-run → rc 1, EUSAGE, sync failure listed above (finding #2).
• eDB#77 head — npm ci --dry-run → rc 1, ERESOLVE (context for finding #1).
• eDB#79 head — npm ci --dry-run → rc 0, but resolves react 19.2.8 against react-dom 19.2.5.
• Trigger claim in finding #4 read from git show 0d0a0cad:.github/workflows/ci.yml against origin/master; git merge-base → 5e436bd.

Not checked

• Nothing was built or run. --dry-run proves the graph resolves, not that the app compiles. No npm ci install, no npx tsc --noEmit, no npm run build, no vitest run on this head. rc 0 is a resolution result and nothing more.
• npm version differs from CI. I used npm 11.17.0; the workflows use node 22.x (npm ~10.9). I did not reproduce on npm 10.
• The 2655-line lockfile diff was not reviewed line by line. I inspected the root package block and the react/react-dom/@types entries and otherwise relied on npm ci to validate integrity. I did not audit the newly added transitive packages (@testing-library/*, jsdom, vitest and their trees) for licence or provenance.
• No React 19.1→19.2 behavioural change was assessed against browser/; there is no frontend test run to detect one.

---

Automated architecture review of 0d0a0cad4d4c — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.