chore(deps): bump tsx, @types/node, react, react-dom

[baanish]

Consolidates the safe-to-merge npm Dependabot bumps into one PR (the repo's established pattern), and supersedes the individual Dependabot PRs.

Bumps

• tsx 4.21.0 → 4.22.4 (dev) — supersedes chore(deps-dev): bump tsx from 4.21.0 to 4.22.4 #76
• @types/node 22.19.21 → 26.0.0 (dev) — supersedes chore(deps-dev): bump @types/node from 22.19.21 to 26.0.0 #74
• react & react-dom 19.1.0 → 19.2.7 — supersedes chore(deps): bump react-dom from 19.1.0 to 19.2.7 #78

react-dom@19.2.7 requires peer react@^19.2.7, so react and react-dom are bumped together; bumping react-dom alone (as #78 did) fails npm install with ERESOLVE.

One code change, load-bearing for the bump

@types/node 26 tightened the net.Socket data listener parameter to string | Buffer. The one raw-socket read site in tests/selfhosted/api-catalog.test.ts pushes into chunks: Buffer[], so the chunk is narrowed to Buffer explicitly (no encoding is set on the socket, so chunks are always Buffers).

Not included

• eslint-config-next 16 (chore(deps-dev): bump eslint-config-next from 15.5.18 to 16.2.9 #77) — closed separately; it requires Next 16 while this app is on Next 15.5.18 (eslint-config-next is version-locked to next).

Verification

Locally green: lint, typecheck, 236/236 unit tests, functional e2e, build budgets. The 7 visual-regression e2e tests fail identically on clean main (macOS-local vs Linux-CI font anti-aliasing, ~0.01 px ratio) — a pre-existing baseline platform mismatch, not caused by this bump; CI's Linux baselines pass them.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated React and React-DOM to version 19.2.7
  • Updated development dependencies for improved compatibility

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7ae5c075-21a3-4425-942f-25dfd31c3d77

📥 Commits

Reviewing files that changed from the base of the PR and between b8a27dc and d0f6952.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• tests/selfhosted/api-catalog.test.ts

---

📝 Walkthrough

Walkthrough

Bumps react and react-dom from 19.1.0 to 19.2.7, @types/node from 22.19.21 to 26.0.0, and tsx from ^4.21.0 to ^4.22.4 in package.json. In the selfhosted API catalog test, the rawHttpGet socket data callback explicitly types the chunk parameter as Buffer.

Changes

Dependency Updates and Type Fix

Layer / File(s)	Summary
Dependency version bumps package.json	react and react-dom bumped to 19.2.7; @types/node bumped to ^26.0.0 and tsx to ^4.22.4.
Buffer type annotation in rawHttpGet tests/selfhosted/api-catalog.test.ts	socket.on("data") callback parameter explicitly typed as Buffer with comments, keeping chunks aligned with its Buffer[] declaration.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐇 Hop! The versions leap up high,
react and node reach for the sky.
A Buffer chunk now wears its type,
no widening woes, no TypeScript gripe.
Small fixes land with gentle grace —
the rabbit tidies up the place! 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: a routine dependency version bump affecting tsx, @types/node, react, and react-dom as described in the PR objectives.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dep-bumps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​node@​22.19.21 ⏵ 26.0.0
	tsx@​4.21.0 ⏵ 4.22.4	+1		+1
	react@​19.1.0 ⏵ 19.2.7	+1		+1
	react-dom@​19.1.0 ⏵ 19.2.7	+1		+1

View full report

[cloudflare-workers-and-pages]

Deploying agent-render with    Cloudflare Pages

Latest commit:	d0f6952
Status:	✅  Deploy successful!
Preview URL:	https://c848c641.agent-render.pages.dev
Branch Preview URL:	https://chore-dep-bumps.agent-render.pages.dev

View logs

[greptile-apps]

Greptile Summary

This PR consolidates four Dependabot bumps into a single update: tsx 4.21.0→4.22.4, @types/node 22→26, and react/react-dom 19.1.0→19.2.7. The one code change — an explicit (chunk: Buffer) annotation on a raw socket data listener in the self-hosted API catalog test — is the correct fix for @types/node 26 widening that parameter to string | Buffer.

• react and react-dom are bumped together to satisfy react-dom@19.2.7's peer requirement of react@^19.2.7; scheduler moves from 0.26 to 0.27 as a transitive consequence.
• tsx 4.22.x drops get-tsconfig as a direct dependency and bundles its own nested esbuild 0.28.1 instead of sharing the root one.
• @types/node 26 also pulls undici-types from 6.21.0 to 8.3.0.

Confidence Score: 5/5

Straightforward dependency maintenance with a minimal, correct one-line test annotation; no production logic changed.

All three changed files are either lockfile/manifest updates or a single-line type annotation in a test. The annotation is factually correct (no encoding is set on the socket, so chunks are always Buffers at runtime), and the PR description confirms lint, typecheck, and all 236 unit tests pass locally.

No files require special attention.

Important Files Changed

Filename	Overview
package.json	Version ranges updated for react/react-dom (19.1.0→19.2.7 exact pins), @types/node (^22→^26), and tsx (^4.21.0→^4.22.4) — all consistent with lockfile.
package-lock.json	Lockfile faithfully reflects all four package bumps; tsx now carries its own nested esbuild 0.28.1 and drops get-tsconfig, undici-types moves from 6.21.0 to 8.3.0 alongside the @types/node major.
tests/selfhosted/api-catalog.test.ts	Adds explicit (chunk: Buffer) annotation on the socket data listener to satisfy @types/node 26's widened string

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph Before["@types/node 22"]
        A["socket.on('data', chunk => …)\nchunk inferred as: Buffer"]
    end
    subgraph After["@types/node 26"]
        B["socket.on('data', chunk => …)\nchunk inferred as: string | Buffer\n⚠ chunks: Buffer[] type error"]
    end
    subgraph Fix["PR fix"]
        C["socket.on('data', (chunk: Buffer) => …)\nExplicit annotation narrows back to Buffer\n✓ chunks: Buffer[] satisfied"]
    end
    Before --> After
    After --> Fix

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    subgraph Before["@types/node 22"]
        A["socket.on('data', chunk => …)\nchunk inferred as: Buffer"]
    end
    subgraph After["@types/node 26"]
        B["socket.on('data', chunk => …)\nchunk inferred as: string | Buffer\n⚠ chunks: Buffer[] type error"]
    end
    subgraph Fix["PR fix"]
        C["socket.on('data', (chunk: Buffer) => …)\nExplicit annotation narrows back to Buffer\n✓ chunks: Buffer[] satisfied"]
    end
    Before --> After
    After --> Fix

Loading

_{Reviews (1): Last reviewed commit: "chore(deps): bump tsx, @types/node, reac..." | Re-trigger Greptile}

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

Consolidated dependency bump PR: tsx 4.21.0 → 4.22.4, @types/node 22 → 26, react/react-dom 19.1.0 → 19.2.7. The only source change accommodates @types/node 26's widened net.Socket 'data' listener type (string | Buffer).

In tests/selfhosted/api-catalog.test.ts, the data listener is explicitly narrowed to (chunk: Buffer). This is correct — no setEncoding is called on the socket, so chunks are always Buffer at runtime, keeping chunks: Buffer[] and the downstream Buffer.concat(chunks) type-safe. The rationale is accurately documented in the inline comment. Bumping react and react-dom together satisfies the react-dom@19.2.7 peer requirement on react, avoiding the ERESOLVE noted in the superseded PRs.

No security, runtime, or logic issues found.

Static review only — lint/typecheck/tests were not executed in this read-only pass.

Files Reviewed (3 files)

• tests/selfhosted/api-catalog.test.ts — rawHttpGet data listener type narrowing
• package.json — version bumps
• package-lock.json — generated lockfile (dependency manifest only)

---

_{Reviewed by GLM-5.2 · Input: 140.6K · Output: 7K · Cached: 60.5K}