chore(deps): bump react and @types/react

[dependabot]

Bumps react and @types/react. These dependencies needed to be updated together.
Updates react from 19.2.5 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 19.2.14 to 19.2.18

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[srpatcha]

Review — eDB#79 "chore(deps): bump react and @types/react"

head: fa5349f author: app/dependabot ci: green and meaningless — no workflow in this repo runs npm on a pull request

Verdict: npm ci resolves, but this lockfile lands react@19.2.8 against react-dom@19.2.5 — an unmatched pair. React requires the two packages to be the same version; npm accepts it only because react-dom's peer range is a caret. The sibling PR eDB#76 makes the mirror-image bump and comes out matched, so if only one of the two lock regenerations is taken, #76 is the better one.

Findings

#	Severity	File:line	Finding	Recommended fix
1	Medium	package.json:15-16, package-lock.json	The bump is half-applied. react moves to ^19.2.8 while react-dom stays at ^19.1.0, and the regenerated lock pins react 19.2.8 against react-dom 19.2.5 — three patch releases apart. react-dom@19.2.5 declares peerDependencies: {react: "^19.2.5"}, which 19.2.8 satisfies, so npm raises nothing; but React ships react and react-dom as a matched set and does not support running them at different versions. This is a class of breakage that surfaces at runtime in the renderer, not at install.	Bump react-dom to ^19.2.8 in the same PR and regenerate, so the lock pins both at 19.2.8. Alternatively take eDB#76 instead — its lock already resolves both to 19.2.8 (verified) — and close this one.
2	High	.github/workflows/ (all)	No workflow runs npm on pull_request. npm ci and npm run build appear only in nightly.yml:63,69, weekly.yml:64,70 and release.yml:118,121 — scheduled or tag-triggered. A 2654-line lockfile change therefore merges on Analyze (Python), CodeQL and assign, none of which touches node. That is why finding #1 got three green checks, and why the sibling PR eDB#77 — whose lock fails npm ci outright — has the same three.	Add a frontend job to ci.yml on pull_request: actions/setup-node (node 22.x, cache: npm), then npm ci, npx tsc --noEmit, npm run build, npm run test. package.json:10 defines "test": "vitest run" and nothing in CI runs it — the frontend suite has never executed in this repo's CI.
3	High	package-lock.json:1-20	Pre-existing, surfaced here: npm ci fails on origin/master. The lock records "version": "0.1.0" against a package.json at 3.0.1 and omits vitest, jsdom, @testing-library/react and @testing-library/jest-dom that package.json:19-28 declares. Verified: npm ci --dry-run on origin/master → rc 1, EUSAGE … Missing: vitest@2.1.9 from lock file plus 15 more. nightly.yml, weekly.yml and the npm half of release.yml are broken on master today.	This PR fixes it as a side effect, as does eDB#76. Land one regeneration and rebase the rest. Not opening a fix PR: #76 and #79 already cover it (review brief, "Opening fix PRs" — do not duplicate an existing PR).
4	Medium	package-lock.json	This PR, eDB#76 and eDB#77 each regenerate the whole lockfile, so all three conflict. Whichever merges first invalidates the other two, and because of finding #2 that will not show up until a nightly run.	Merge one, then rebase or recreate the others. Do not merge two in sequence without regenerating in between.
5	Medium	.github/workflows/ci.yml:3-8 at this head	The Python matrix never ran here either. This branch forks from 5e436bd (2026-08-25), where ci.yml triggers on pull_request: branches: [main]; this PR targets master, added to the trigger later in f3b1ab0 and absent from this branch.	Rebase onto current master, after eDB#82.

Dependabot's own comment about the missing npm label is already on this PR and is not repeated; the config to fix is .github/dependabot.yml.

Architecture conformance

Conforms. Dependency-metadata and lockfile change confined to Tier 3 eDB (master design §21); no source, import, link or manifest-entry change, so §5.1 dependency direction is untouched. The deviation is against §28's evidence policy, not the architectural law: green checks are offered for a change class this repo does not test on pull requests.

Proposed changes

1. Add the frontend PR job (finding #2) — the prerequisite for judging any of #76/#77/#79 on evidence.
2. Prefer eDB#76 as the single lock regeneration to land: it installs cleanly and leaves react/react-dom matched. Close this one, or fix finding #1 first and let it supersede #76.
3. Rebase or recreate whatever remains afterwards.

Verification I ran

Local, npm 11.17.0 / node 24.19.0, package.json + package-lock.json extracted from each ref:

• this head — npm ci --dry-run → rc 0. Resolved react 19.2.8, react-dom 19.2.5, @types/react 19.2.18, @types/react-dom 19.2.3; root version 3.0.1. react-dom@19.2.5 peer {react: ^19.2.5} — satisfied, which is why install succeeds despite the version skew (finding #1).
• eDB#76 head — npm ci --dry-run → rc 0, resolving react 19.2.8 and react-dom 19.2.8, peer {react: ^19.2.8}. That is the matched pair this PR does not produce.
• origin/master — npm ci --dry-run → rc 1, EUSAGE, sync failure listed above (finding #3).
• eDB#77 head — npm ci --dry-run → rc 1, ERESOLVE (context for finding #2).
• Trigger claim in finding #5 read from git show fa5349fd:.github/workflows/ci.yml against origin/master; git merge-base → 5e436bd.

Not checked

• Nothing was built or run. --dry-run proves the graph resolves, not that the app compiles or renders. No install, no npx tsc --noEmit, no npm run build, no vitest run on this head.
• Finding #1 is not a reproduced failure. The React project's matched-version requirement plus the observed 19.2.8/19.2.5 skew is the basis; I did not run the app to observe a renderer fault, and no frontend test exists in CI that could.
• npm version differs from CI. I used npm 11.17.0; the workflows use node 22.x (npm ~10.9). Not reproduced on npm 10.
• The 2654-line lockfile diff was not reviewed line by line — I inspected the root package block and the react/react-dom/@types entries and relied on npm ci for the rest. Newly added transitive trees (@testing-library/*, jsdom, vitest) were not audited for licence or provenance.

---

Automated architecture review of fa5349fdceee — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.