build(deps-dev): Bump react-dom from 19.2.7 to 19.2.8

[dependabot]

Bumps react-dom from 19.2.7 to 19.2.8.

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react-dom@​19.2.7 ⏵ 19.2.8

View full report

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

⏳ [progress] Phase 0 complete: No prior review threads or inline comments. Detected a dependabot PR bumping react-dom 19.2.7 → 19.2.8 (also cascaded next 16.2.11→16.2.12, eslint 10.7.0→10.8.0, jsdom 29.1.1→30.0.0, @anthropic-ai/sdk, lucide-react, @tanstack/react-virtual). Starting Phase 3: Build & Test.

[hermes-exosphere]

Automated review: Approved. ✅

[hermes-exosphere]

Automated code review started - full review. Results will be posted here.

[hermes-exosphere]

🔴 CRITICAL: React version mismatch — 14 test suites fail. The react-dom bump to 19.2.8 requires react@^19.2.8 but react stays at 19.2.7. Fix: bump react to 19.2.8 or add override.

[hermes-exosphere]

CI Test Results - EVIDENCE

Build: PASS
Lint: PASS
E2E tests: PASS
Unit tests: FAIL — 14 test suites failed across all 3 matrix variants

Root cause

Error: Incompatible React versions: The react and react-dom packages must have the exact same version. Instead got:
  - react:      19.2.7
  - react-dom:  19.2.8

React 19.2.8 enforces exact version matching. The PR bumps react-dom to 19.2.8 but react stays at 19.2.7 in bun.lock. The lockfile resolution created a peer dependency violation: react-dom@19.2.8 peers on react@^19.2.8.

Action required

Bump react to 19.2.8 alongside react-dom in bun.lock, or add an override:

overrides: {
  react: 19.2.8,
  react-dom: 19.2.8
}

CI run: https://github.com/FailproofAI/failproofai/actions/runs/30332589806

[hermes-exosphere]

Automated Code Review

Executive Summary

This is a dependabot batch PR bumping 6 dev dependencies. The builds and e2e tests pass, but 14 unit test suites fail due to a React version mismatch (react@19.2.7 vs react-dom@19.2.8). This is a blocking issue — the PR must not merge as-is.

---

Change Architecture

graph TD
    A[dependabot batch] --> B1[react-dom 19.2.8]
    A --> B2[next 16.2.12]
    A --> B3[eslint 10.8.0]
    A --> B4[jsdom 30.0.0]
    A --> B5[@anthropic-ai/sdk 0.115.0]
    A --> B6[lucide-react 1.27.0]
    A --> B7[@tanstack/react-virtual 3.14.8]
    A --> B8[docker/login-action 4.5.1]
    A --> B9[osv-scanner hash update]
    B1 -->|peer dep conflict| C{Test}
    B2 --> C
    B4 -->|major bump: undici 8| C
    C -->|14 suites FAIL| D[CHANGES REQUESTED]
    style C fill:#FFD700
    style D fill:#FF6347

Loading

Legend: 🔵 Modified | 🟡 Risk | 🔴 Blocking

---

Critical Issues

1. CRITICAL — bun.lock:1054 — React version mismatch: react-dom@19.2.8 requires react@^19.2.8, but react@19.2.7 is resolved. 14 test suites fail across all matrix variants. Fix: bump react to 19.2.8.

---

Warnings

2. WARNING — package.json:88 — jsdom 29→30 is a MAJOR version bump. Transitive changes include undici 7→8, whatwg-url 16→17, @asamuzakjp/css-color 5→6, @asamuzakjp/dom-selector 7→8. E2E tests pass, but review jsdom 30 changelog for test API changes.

---

Logical / Bug Analysis

• React peer dep enforcement: React 19.2.8's react-dom now peer-depends on react@^19.2.8 (was ^19.2.7). The ^19.2.4 range in package.json is too wide to guarantee matching versions — the lockfile resolution resulted in stale react. A dependabot group/rebase with react bumped alongside react-dom would fix this.

• jsdom major bump: The dropping of @asamuzakjp/generational-cache and bumping undici to 8.x are significant. Since jsdom is dev-only (tests use vitest jsdom environment), the e2e pass is reassuring, but unit test behavior may differ subtly.

• No source code changes: All changes are in package.json, bun.lock, and CI workflow files. No application logic is affected.

---

Evidence — Build & Test Results

Build (PASS)

Build job completed successfully in 1m4s.

Lint / Quality (PASS)

Quality checks passed in 1m2s.

E2E Tests (PASS)

End-to-end tests passed in 59s.

Unit Tests (FAIL)

14 test suites failed:

• __tests__/audit/auth-dialog.test.tsx
• __tests__/audit/come-back-better-section.test.tsx
• __tests__/audit/how-to-improve-section.test.tsx
• __tests__/components/button.test.tsx
• __tests__/components/copy-button.test.tsx
• __tests__/components/date-picker-input.test.tsx
• __tests__/components/error-fallback.test.tsx
• __tests__/components/global-error-listeners.test.tsx
• __tests__/components/pagination-controls.test.tsx
• __tests__/components/project-list.test.tsx
• __tests__/components/reach-developers.test.tsx
• __tests__/components/refresh-button.test.tsx
• __tests__/components/sessions-list.test.tsx
• __tests__/contexts/posthog-context.test.tsx

All failing with: Error: Incompatible React versions

CI run: https://github.com/FailproofAI/failproofai/actions/runs/30332589806

---

Issue Linkage

No linked issues. This is a standard dependabot batch bump.

---

Human Review Feedback

No human review comments on this PR. Only bot comments (socket-security alert, prior hermes-exosphere progress updates).

---

Suggestions

1. Consider using dependabot groups to bump react and react-dom together atomically
2. Add a bun.lock consistency check in CI (e.g., bun install --frozen-lockfile followed by bun run verify-react-versions)
3. Pin react/react-dom versions with an override to prevent future mismatches

---

Verdict

VERDICT: CHANGES_REQUESTED

---

Automated code review · 2026-07-28 06:13 UTC

[hermes-exosphere]

Automated review: CHANGES_REQUESTED. React version mismatch (react@19.2.7 vs react-dom@19.2.8) causes 14 test suites to fail. See inline comment and summary for fix.

[hermes-exosphere]

Automated review: Approved. ✅