build(deps-dev): Bump react from 19.2.7 to 19.2.8

[dependabot]

Bumps react from 19.2.7 to 19.2.8.

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react@​19.2.7 ⏵ 19.2.8

View full report

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

⏳ Review in progress...

Cloned, built, ran test suite locally. Identified root cause of CI failures. Full review incoming.

[hermes-exosphere]

🔴 CRITICAL: React version mismatch — react@19.2.8 vs react-dom@19.2.7

This PR bumps only react from 19.2.7 to 19.2.8, but leaves react-dom at 19.2.7. React v19 enforces that react and react-dom MUST be the exact same version. The mismatch causes:

• 14 test suites fail with Incompatible React versions error
• 3 CI check jobs fail (test default, test hook-log-file, test log-debug)
• All React component tests crash at import time

Fix: Dependabot should also bump react-dom to 19.2.8 in the same PR (or merge the companion react-dom PR first, then rebase this one).

Evidence:

• CI logs: react: 19.2.8, react-dom: 19.2.7
• Local reproduction: 14 test suites fail, 117 pass, 2269 tests pass
• Companion PR bumping react-dom to 19.2.8 is already open

React 19.2.8 release notes: Performance improvements when decoding RSC payloads. Non-breaking patch release.

[hermes-exosphere]

Automated Code Review - PR #606

Executive Summary

This is a Dependabot patch bump: react 19.2.7 to 19.2.8. The change itself is trivial (1 line in bun.lock) and the React release is a non-breaking patch with RSC performance improvements. However, the PR is incomplete - it bumps only react without bumping react-dom to match, which causes React v19 runtime version mismatch errors and 14 test suites to fail.

---

Change Architecture

The PR bumps react in bun.lock from version 19.2.7 to 19.2.8. However, react-dom remains at 19.2.7. React v19 enforces that both packages must have identical versions at runtime. This mismatch causes all 14 React component test suites to crash at module import time with: Incompatible React versions: react 19.2.8 vs react-dom 19.2.7.

---

Breaking Changes

No breaking changes in react 19.2.8 itself. However, the incomplete dependency bump creates a runtime break: react and react-dom must be the exact same version in React v19.

---

Issues Found

1. CRITICAL - bun.lock:1052 - react bumped to 19.2.8 but react-dom left at 19.2.7. React v19 enforces exact version match between react and react-dom. See inline comment for details.

---

Logical / Bug Analysis

Root cause: Dependabot opened this PR for the react package only. React v19 requires react and react-dom to have identical versions at runtime. Since the PR only bumps one of the two packages, all 14 React component test suites crash before running any tests.

The companion PR: There is already a Dependabot PR bumping react-dom to 19.2.8. These two should be merged together, or this PR should be rebased after the react-dom bump lands.

Test impact:

• 117 test suites pass (2269 tests) - all non-React tests are fine
• 14 test suites fail - all React component tests (audit, components, contexts)
• The failure is at module import time, not in test logic

---

Evidence - Build & Test Results

Local test run reproduced the exact same failures as CI:

Test Files: 14 failed | 117 passed (131 total)
Tests: 2269 passed (2269 total)

All 14 failures show: Incompatible React versions: react 19.2.8 vs react-dom 19.2.7

CI status:

• test (default): FAIL
• test (hook-log-file): FAIL
• test (log-debug): FAIL
• build: PASS
• test-e2e: PASS
• quality: PASS
• docs: PASS
• OSV-Scanner: PASS
• Socket Security: PASS

---

Issue Linkage

No issue linked. This is a standard Dependabot version bump.

---

Human Review Feedback

No human review comments on this PR. Only the Socket Security bot report (supply chain scores: all 84-100, no concerns).

---

Suggestions

1. Merge strategy: Either merge the companion react-dom 19.2.8 PR first, then rebase this PR, or manually edit this PR to also bump react-dom to 19.2.8.

2. Dependabot grouping: Consider configuring Dependabot to group react and react-dom updates together (they are always released in lockstep). Add to .github/dependabot.yml:
   groups:
   react:
   patterns:
   - "react"
   - "react-dom"
   - "@types/react"
   - "@types/react-dom"

---

Verdict

VERDICT: CHANGES_REQUESTED

---

Automated code review · 2026-07-28 06:02 UTC

[hermes-exosphere]

Automated review found issues: react-dom must be bumped to 19.2.8 alongside react to avoid version mismatch. 14 test suites fail. See inline comment and summary for details.