build(deps-dev): Bump react-dom from 19.2.7 to 19.2.8 by dependabot[bot] · Pull Request #607 · FailproofAI/failproofai

dependabot · 2026-07-27T21:06:05Z

Bumps react-dom from 19.2.7 to 19.2.8.

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)
React Server Components
Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

socket-security · 2026-07-27T21:06:18Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react-dom@19.2.7 ⏵ 19.2.8

View full report

hermes-exosphere · 2026-07-28T05:44:57Z

Automated code review started - full review. Results will be posted here.

Bumps [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) from 19.2.7 to 19.2.8. - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) --- updated-dependencies: - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

hermes-exosphere · 2026-07-28T05:51:12Z

⏳ [progress] Phase 0 complete: No prior review threads or inline comments. Detected a dependabot PR bumping react-dom 19.2.7 → 19.2.8 (also cascaded next 16.2.11→16.2.12, eslint 10.7.0→10.8.0, jsdom 29.1.1→30.0.0, @anthropic-ai/sdk, lucide-react, @tanstack/react-virtual). Starting Phase 3: Build & Test.

hermes-exosphere

Automated review: Approved. ✅

hermes-exosphere · 2026-07-28T06:05:54Z

Automated code review started - full review. Results will be posted here.

hermes-exosphere · 2026-07-28T06:13:36Z

 "react": ["react@19.2.7", "", {}, "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ=="],

- "react-dom": ["react-dom@19.2.7", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.7" } }, "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ=="],
+ "react-dom": ["react-dom@19.2.8", "", { "dependencies": { "scheduler": "^0.27.0" }, "peerDependencies": { "react": "^19.2.8" } }, "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ=="],


🔴 CRITICAL: React version mismatch — 14 test suites fail. The react-dom bump to 19.2.8 requires react@^19.2.8 but react stays at 19.2.7. Fix: bump react to 19.2.8 or add override.

hermes-exosphere · 2026-07-28T06:14:46Z

CI Test Results - EVIDENCE

Build: PASS
Lint: PASS
E2E tests: PASS
Unit tests: FAIL — 14 test suites failed across all 3 matrix variants

Root cause

Error: Incompatible React versions: The react and react-dom packages must have the exact same version. Instead got:
- react: 19.2.7
- react-dom: 19.2.8

React 19.2.8 enforces exact version matching. The PR bumps react-dom to 19.2.8 but react stays at 19.2.7 in bun.lock. The lockfile resolution created a peer dependency violation: react-dom@19.2.8 peers on react@^19.2.8.

Action required

Bump react to 19.2.8 alongside react-dom in bun.lock, or add an override:

overrides: {react: 19.2.8,react-dom: 19.2.8}

CI run: https://github.com/FailproofAI/failproofai/actions/runs/30332589806

hermes-exosphere · 2026-07-28T06:15:10Z

Automated Code Review

Executive Summary

This is a dependabot batch PR bumping 6 dev dependencies. The builds and e2e tests pass, but 14 unit test suites fail due to a React version mismatch (react@19.2.7 vs react-dom@19.2.8). This is a blocking issue — the PR must not merge as-is.

Change Architecture

graph TD
A[dependabot batch] --> B1[react-dom 19.2.8]
A --> B2[next 16.2.12]
A --> B3[eslint 10.8.0]
A --> B4[jsdom 30.0.0]
A --> B5[@anthropic-ai/sdk 0.115.0]
A --> B6[lucide-react 1.27.0]
A --> B7[@tanstack/react-virtual 3.14.8]
A --> B8[docker/login-action 4.5.1]
A --> B9[osv-scanner hash update]
B1 -->|peer dep conflict| C{Test}
B2 --> C
B4 -->|major bump: undici 8| C
C -->|14 suites FAIL| D[CHANGES REQUESTED]
style C fill:#FFD700
style D fill:#FF6347

Legend: 🔵 Modified | 🟡 Risk | 🔴 Blocking

Critical Issues

CRITICAL — bun.lock:1054 — React version mismatch: react-dom@19.2.8 requires react@^19.2.8, but react@19.2.7 is resolved. 14 test suites fail across all matrix variants. Fix: bump react to 19.2.8.

Warnings

WARNING — package.json:88 — jsdom 29→30 is a MAJOR version bump. Transitive changes include undici 7→8, whatwg-url 16→17, @asamuzakjp/css-color 5→6, @asamuzakjp/dom-selector 7→8. E2E tests pass, but review jsdom 30 changelog for test API changes.

Logical / Bug Analysis

React peer dep enforcement: React 19.2.8's react-dom now peer-depends on react@^19.2.8 (was ^19.2.7). The ^19.2.4 range in package.json is too wide to guarantee matching versions — the lockfile resolution resulted in stale react. A dependabot group/rebase with react bumped alongside react-dom would fix this.
jsdom major bump: The dropping of @asamuzakjp/generational-cache and bumping undici to 8.x are significant. Since jsdom is dev-only (tests use vitest jsdom environment), the e2e pass is reassuring, but unit test behavior may differ subtly.
No source code changes: All changes are in package.json, bun.lock, and CI workflow files. No application logic is affected.

Evidence — Build & Test Results

Build (PASS)

Build job completed successfully in 1m4s.

Lint / Quality (PASS)

Quality checks passed in 1m2s.

E2E Tests (PASS)

End-to-end tests passed in 59s.

Unit Tests (FAIL)

14 test suites failed:

__tests__/audit/auth-dialog.test.tsx
__tests__/audit/come-back-better-section.test.tsx
__tests__/audit/how-to-improve-section.test.tsx
__tests__/components/button.test.tsx
__tests__/components/copy-button.test.tsx
__tests__/components/date-picker-input.test.tsx
__tests__/components/error-fallback.test.tsx
__tests__/components/global-error-listeners.test.tsx
__tests__/components/pagination-controls.test.tsx
__tests__/components/project-list.test.tsx
__tests__/components/reach-developers.test.tsx
__tests__/components/refresh-button.test.tsx
__tests__/components/sessions-list.test.tsx
__tests__/contexts/posthog-context.test.tsx

All failing with: Error: Incompatible React versions

CI run: https://github.com/FailproofAI/failproofai/actions/runs/30332589806

Issue Linkage

No linked issues. This is a standard dependabot batch bump.

Human Review Feedback

No human review comments on this PR. Only bot comments (socket-security alert, prior hermes-exosphere progress updates).

Suggestions

Consider using dependabot groups to bump react and react-dom together atomically
Add a bun.lock consistency check in CI (e.g., bun install --frozen-lockfile followed by bun run verify-react-versions)
Pin react/react-dom versions with an override to prevent future mismatches

Verdict

VERDICT: CHANGES_REQUESTED

Automated code review · 2026-07-28 06:13 UTC

hermes-exosphere

Automated review: CHANGES_REQUESTED. React version mismatch (react@19.2.7 vs react-dom@19.2.8) causes 14 test suites to fail. See inline comment and summary for fix.

hermes-exosphere

Automated review: Approved. ✅

Lands #652 on this branch. React refuses to render when `react` and `react-dom` are not the exact same version, so the matching react-dom bump from #607 rides along: #652 on its own failed 15 component test files with `Incompatible React versions`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014GcYCCtSc5VGD6YCoxsrsY

dependabot · 2026-08-10T09:13:57Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026

dependabotBotforce-pushed the dependabot/bun/react-dom-19.2.8 branch from 1176f60 to 4981ad8Compare July 28, 2026 05:45

hermes-exosphere approved these changes Jul 28, 2026
View reviewed changes

hermes-exosphere reviewed Jul 28, 2026
View reviewed changes

hermes-exosphere requested changes Jul 28, 2026
View reviewed changes

hermes-exosphere approved these changes Jul 28, 2026
View reviewed changes

hermes-exosphere mentioned this pull request Jul 28, 2026
build(deps-dev): Bump react from 19.2.7 to 19.2.8 #606
Closed

This was referenced Aug 5, 2026
build(deps-dev): Bump react and @types/react #652
Closed
[failproofaid] Split failproofai into a CLI + Rust background daemon #632
Merged

NiveditJain closed this Aug 10, 2026

dependabotBot deleted the dependabot/bun/react-dom-19.2.8 branch August 10, 2026 09:14

Navigation Menu

Uh oh!

build(deps-dev): Bump react-dom from 19.2.7 to 19.2.8 - #607

build(deps-dev): Bump react-dom from 19.2.7 to 19.2.8#607
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/react-dom-19.2.8

dependabotBot commented on behalf of githubJul 27, 2026•
edited
Loading

Uh oh!

socket-securityBot commented Jul 27, 2026•
edited
Loading

Uh oh!

hermes-exosphere commented Jul 28, 2026

Uh oh!

hermes-exosphere commented Jul 28, 2026

Uh oh!

hermes-exosphere left a comment

Uh oh!

hermes-exosphere commented Jul 28, 2026

Uh oh!

hermes-exosphereJul 28, 2026

Uh oh!

hermes-exosphere commented Jul 28, 2026

Uh oh!

hermes-exosphere commented Jul 28, 2026

Uh oh!

hermes-exosphere left a comment

Uh oh!

hermes-exosphere left a comment

Uh oh!

dependabotBot commented on behalf of githubAug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabotBot commented on behalf of githubJul 27, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

19.2.8 (July 21st, 2026)

React Server Components

Uh oh!

socket-securityBot commented Jul 27, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hermes-exosphere commented Jul 28, 2026

Uh oh!

hermes-exosphere commented Jul 28, 2026

Uh oh!

hermes-exosphere left a comment

Choose a reason for hiding this comment

Uh oh!

hermes-exosphere commented Jul 28, 2026

Uh oh!

hermes-exosphereJul 28, 2026

Choose a reason for hiding this comment

Uh oh!

hermes-exosphere commented Jul 28, 2026

CI Test Results - EVIDENCE

Root cause

Action required

Uh oh!

hermes-exosphere commented Jul 28, 2026

Automated Code Review

Executive Summary

Change Architecture

Critical Issues

Warnings

Logical / Bug Analysis

Evidence — Build & Test Results

Issue Linkage

Human Review Feedback

Suggestions

Verdict

Uh oh!

hermes-exosphere left a comment

Choose a reason for hiding this comment

Uh oh!

hermes-exosphere left a comment

Choose a reason for hiding this comment

Uh oh!

dependabotBot commented on behalf of githubAug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabotBot commented on behalf of githubJul 27, 2026•
edited
Loading

socket-securityBot commented Jul 27, 2026•
edited
Loading