chore(deps): bump react-dom from 19.1.0 to 19.2.7 by dependabot[bot] · Pull Request #78 · baanish/agent-render

dependabot · 2026-06-19T15:05:38Z

Bumps react-dom from 19.1.0 to 19.2.7.

Release notes

19.2.7 (June 1st, 2026)

React Server Components

Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

Add more cycle protections (#36236 by @eps1lon and @unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @gnoff, @lubieowoce, @sebmarkbage, @unstubbable)

19.2.3 (December 11th, 2025)

React Server Components

Add extra loop protection to React Server Functions (@sebmarkbage #35351)

19.2.2 (December 11th, 2025)

React Server Components

Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@eps1lon facebook/react#35290)

Patch Promise cycles and toString on Server Functions (@sebmarkbage, @unstubbable #35289, #35345)

19.2.1 (December 3rd, 2025)

React Server Components

Bring React Server Component fixes to Server Actions (@sebmarkbage #35277)

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

<Activity>: A new API to hide and restore the UI and internal state of its children.

useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.

cacheSignal (for RSCs) lets your know when the cache() lifetime is over.

React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

... (truncated)

Changelog

Sourced from react-dom's changelog.

19.2.1 (Dec 3, 2025)

React Server Components

Bring React Server Component fixes to Server Actions (@sebmarkbage #35277)

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

<Activity>: A new API to hide and restore the UI and internal state of its children.

useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.

cacheSignal (for RSCs) lets your know when the cache() lifetime is over.

React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

Added resume APIs for partial pre-rendering with Web Streams:

resume: to resume a prerender to a stream.

resumeAndPrerender: to resume a prerender to HTML.

Added resume APIs for partial pre-rendering with Node Streams:

resumeToPipeableStream: to resume a prerender to a stream.

resumeAndPrerenderToNodeStream: to resume a prerender to HTML.

Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.

Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js

Use underscore instead of : IDs generated by useId

All Changes

React

<Activity /> was developed over many years, starting before ClassComponent.setState (@acdlite @sebmarkbage and many others)

Stringify context as "SomeContext" instead of "SomeContext.Provider" (@kassens #33507)

Include stack of cause of React instrumentation errors with %o placeholder (@eps1lon #34198)

Fix infinite useDeferredValue loop in popstate event (@acdlite #32821)

Fix a bug when an initial value was passed to useDeferredValue (@acdlite #34376)

Fix a crash when submitting forms with Client Actions (@sebmarkbage #33055)

Hide/unhide the content of dehydrated suspense boundaries if they resuspend (@sebmarkbage #32900)

Avoid stack overflow on wide trees during Hot Reload (@sophiebits #34145)

Improve Owner and Component stacks in various places (@sebmarkbage, @eps1lon: #33629, #33724, #32735, #33723)

Add cacheSignal (@sebmarkbage #33557)

... (truncated)

Commits

6117d7c Version 19.2.7 (#36591)
eaf3e95 Version 19.2.6
23f4f9f 19.2.5
90ab3f8 Version 19.2.4
612e371 Version 19.2.3
b910fc1 Version 19.2.2
053df4e Version 19.2.1
8618113 Bump scheduler version (#34671)
1bd1f01 Ship partial-prerendering APIs to Canary (#34633)
2f0649a [Fizz] Remove nonce option from resume-and-prerender APIs (#34664)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.

cloudflare-workers-and-pages · 2026-06-19T15:05:41Z

Deploying agent-render with Cloudflare Pages

Latest commit:	`eb5c6f5`
Status:	🚫 Build failed.

View logs

socket-security · 2026-06-19T15:06:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react-dom@19.1.0 ⏵ 19.2.7	⁺¹		⁺¹

View full report

greptile-apps · 2026-06-19T15:07:06Z

Greptile Summary

This is an automated dependabot PR that bumps react-dom from 19.1.0 to 19.2.7, picking up Server Action fixes, DoS hardening for React Server Functions, and the new React 19.2 features (<Activity>, useEffectEvent, partial pre-rendering resume APIs). The package-lock.json is regenerated accordingly, with scheduler moving from 0.26.0 to 0.27.0 as a transitive update.

react-dom bumped to 19.2.7; scheduler transitively bumped to 0.27.0.
Many "peer": true metadata flags reshuffled in package-lock.json — this is normal npm behaviour when the dependency tree is reresolved.
react stays at 19.1.0 while react-dom@19.2.7 declares "react": "^19.2.7" as its peer dependency, which is a mismatch that was already flagged in a prior review comment.

Confidence Score: 4/5

The lockfile changes look mechanically correct, but react and react-dom are now on different minor versions with an unsatisfied peer dependency constraint that was called out in a prior review.

The react-dom bump itself is straightforward and the lockfile regeneration is normal. The unresolved peer dependency conflict between react@19.1.0 and react-dom@19.2.7 (which requires ^19.2.7) means npm installs may warn or fail in strict environments, and running mismatched minor versions of react and react-dom is not a supported configuration.

package.json — react needs to be co-bumped to 19.2.7 to satisfy react-dom's peer dependency constraint

Important Files Changed

Filename	Overview
package.json	Bumps react-dom from 19.1.0 to 19.2.7; react remains at 19.1.0 while react-dom@19.2.7 declares peerDependency "react": "^19.2.7"
package-lock.json	Lockfile regenerated by npm; react-dom updated to 19.2.7, scheduler bumped to 0.27.0, and numerous peer/dev metadata flags reshuffled as expected after a dependency tree change

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["package.json<br/>react: 19.1.0 (unchanged)"]
    B["package.json<br/>react-dom: 19.2.7 (bumped)"]
    C["package-lock.json<br/>react-dom@19.2.7<br/>peerDep: react ^19.2.7"]
    D["package-lock.json<br/>scheduler@0.27.0 (bumped)"]
    E{{"⚠ Peer dep mismatch<br/>19.1.0 does not satisfy ^19.2.7"}}

    B --> C
    C --> D
    A -->|satisfies?| E
    C -->|requires| E

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["package.json<br/>react: 19.1.0 (unchanged)"]
    B["package.json<br/>react-dom: 19.2.7 (bumped)"]
    C["package-lock.json<br/>react-dom@19.2.7<br/>peerDep: react ^19.2.7"]
    D["package-lock.json<br/>scheduler@0.27.0 (bumped)"]
    E{{"⚠ Peer dep mismatch<br/>19.1.0 does not satisfy ^19.2.7"}}

    B --> C
    C --> D
    A -->|satisfies?| E
    C -->|requires| E

_{Reviews (2): Last reviewed commit: "chore(deps): bump react-dom from 19.1.0 ..." | Re-trigger Greptile}

greptile-apps · 2026-06-19T15:07:10Z

@@ -69,7 +69,7 @@
    "next-themes": "^0.4.6",


React/react-dom version mismatch

react-dom@19.2.7 declares "react": "^19.2.7" as its peer dependency (visible in package-lock.json), but react remains pinned to 19.1.0. 19.1.0 does not satisfy ^19.2.7 (>=19.2.7 <20.0.0). npm 7+ treats unsatisfied peer deps as install errors, so npm install or CI dependency installs may fail, and even if they don't, running mismatched react + react-dom minor versions can trigger subtle reconciler bugs or runtime warnings. react should be bumped to 19.2.7 in the same PR.

kilo-code-bot · 2026-06-19T15:18:06Z

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

This Dependabot PR bumps react-dom from 19.1.0 to 19.2.7 (and the transitive scheduler dependency from 0.26.0 to 0.27.0). The bump itself is valid, but it leaves react pinned at 19.1.0, which no longer satisfies react-dom@19.2.7's peer dependency (react: ^19.2.7). This will cause npm install / npm ci to fail with an ERESOLVE peer-dependency error, and running mismatched react / react-dom minor versions risks subtle reconciler bugs and runtime warnings.

Overview

Severity	Count
CRITICAL	1
WARNING	0
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
`package.json`	68	`react` pinned at `19.1.0` (line 67) while `react-dom@19.2.7` requires `react: ^19.2.7` (peer dependency). Bump `react` to `19.2.7` in this same PR.

ℹ️ This issue is already flagged by an existing review comment (Greptile) anchored at package.json:69, so no duplicate inline comment was posted here.

Files Reviewed (2 files)

package.json — 1 issue (react/react-dom version mismatch; already flagged by an existing review comment)
package-lock.json — 0 issues (scheduler bump from 0.26.0 → 0.27.0 is the expected transitive dependency of react-dom@19.2.7; remaining changes are lock-file peer-flag churn)

Fix these issues in Kilo Cloud

Previous Review Summary (commit 0ee63b6)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `0ee63b6`)

Status: 1 Issue Found | Recommendation: Address before merge

This Dependabot PR bumps react-dom from 19.1.0 to 19.2.7 (and the transitive scheduler dependency from 0.26.0 to 0.27.0). The bump itself is valid, but it leaves react pinned at 19.1.0, which no longer satisfies react-dom@19.2.7's peer dependency (react: ^19.2.7). This will cause npm install / npm ci to fail with an ERESOLVE peer-dependency error, and running mismatched react / react-dom minor versions risks subtle reconciler bugs and runtime warnings.

Overview

Severity	Count
CRITICAL	1
WARNING	0
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
`package.json`	71	`react` pinned at `19.1.0` while `react-dom@19.2.7` requires `react: ^19.2.7` (peer dependency). Bump `react` to `19.2.7` in this same PR.

ℹ️ This issue is already flagged by an existing review comment (Greptile) anchored at package.json:69, so no duplicate inline comment was posted here.

Files Reviewed (2 files)

package.json — 1 issue (react/react-dom version mismatch; already flagged by an existing review comment)
package-lock.json — 0 issues (scheduler bump from 0.26.0 → 0.27.0 is the expected transitive dependency of react-dom@19.2.7)

Fix these issues in Kilo Cloud

_{Reviewed by GLM-5.2 · Input: 55.5K · Output: 5.7K · Cached: 208.3K}

Bumps [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) from 19.1.0 to 19.2.7. - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react-dom) --- updated-dependencies: - dependency-name: react-dom dependency-version: 19.2.7 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

baanish · 2026-06-19T17:07:38Z

Superseded by #79, which bumps this dependency (and the rest of the safe batch) together and is merged into main. react/react-dom were bumped in lockstep there to satisfy the peer constraint that broke #78 alone.

dependabot · 2026-06-19T17:07:41Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 19, 2026

greptile-apps Bot reviewed Jun 19, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/react-dom-19.2.7 branch from 0ee63b6 to eb5c6f5 Compare June 19, 2026 16:49

This was referenced Jun 19, 2026

chore(deps): bump tsx, @types/node, react, react-dom #79

Merged

chore(deps-dev): bump @types/node from 22.19.21 to 26.0.0 #74

Closed

chore(deps-dev): bump tsx from 4.21.0 to 4.22.4 #76

Closed

baanish closed this Jun 19, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/react-dom-19.2.7 branch June 19, 2026 17:07

Navigation Menu

chore(deps): bump react-dom from 19.1.0 to 19.2.7 - #78

chore(deps): bump react-dom from 19.1.0 to 19.2.7#78
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-dom-19.2.7

dependabot Bot commented on behalf of github Jun 19, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jun 19, 2026 •

edited

Loading

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps Bot Jun 19, 2026

Uh oh!

kilo-code-bot Bot commented Jun 19, 2026 •

edited

Loading

CRITICAL

Previous review (commit `0ee63b6`)

Overview

CRITICAL

Uh oh!

baanish commented Jun 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

19.2.4 (January 26th, 2026)

React Server Components

19.2.3 (December 11th, 2025)

React Server Components

19.2.2 (December 11th, 2025)

React Server Components

19.2.1 (December 3rd, 2025)

React Server Components

19.2.0 (Oct 1, 2025)

New React Features

New React DOM Features

19.2.1 (Dec 3, 2025)

React Server Components

19.2.0 (October 1st, 2025)

New React Features

New React DOM Features

Notable changes

All Changes

React

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying agent-render with Cloudflare Pages

Uh oh!

socket-security Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Flowchart

Uh oh!

greptile-apps Bot Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Overview

CRITICAL

Previous review (commit 0ee63b6)

Overview

CRITICAL

Uh oh!

baanish commented Jun 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jun 19, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 19, 2026 •

edited

Loading

socket-security Bot commented Jun 19, 2026 •

edited

Loading

greptile-apps Bot commented Jun 19, 2026 •

edited

Loading

kilo-code-bot Bot commented Jun 19, 2026 •

edited

Loading

Previous review (commit `0ee63b6`)