chore(deps): bump react from 19.2.7 to 19.2.8 in /website

[dependabot]

Bumps react from 19.2.7 to 19.2.8.

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-afk-docs	Ready	Preview, Comment	Jul 26, 2026 6:53am

[griffinwork40]

🤖 Automated review (hourly sweep), generated by the /review tool — a maintainer will follow up.

Merge decision: MERGE (diff is clean; red Lint & Build is a pre-existing repo-wide gate failure, not caused by this PR)

Target: chore(deps): bump react from 19.2.7 to 19.2.8 in /website
Reviewed ref: 2062930664b30866c1fddb3fa42b4b77a9cde86a · base main · 2 files, +5/−5 · regime: light (dep-bump)
Stated intent: Dependabot bump of react 19.2.7 → 19.2.8 in /website. Upstream 19.2.8 release notes list one change: "React Server Components: Performance improvements when decoding (#37087)".

---

Findings

No critical, high, or medium findings.

1. nit · high confidence · dependency-hygiene · website/package.json:20 · ref:2062930664b3 · citation-type: diff-context
react moves to 19.2.8 while react-dom stays pinned at 19.2.7, leaving the pair transiently skewed on this branch.

"react": "19.2.8",
"react-dom": "19.2.7"

Suggestion: No action required — the skew is semver-legal (see verdict below) and PR #706 bumps react-dom to 19.2.8. Merging #705 and #706 together removes the window entirely.

Security · supply-chain — no issues found — read website/package-lock.json at 2062930664b3. resolved host is registry.npmjs.org, integrity is a well-formed sha512- hash. Hash not network-verified (out of scope).

Lock-file integrity — no issues found — read website/package-lock.json at 2062930664b3. Root packages[""].dependencies.react and node_modules/react.version both read 19.2.8 (no half-updated lock). Absence claim grep-grounded: git show <ref>:website/package-lock.json | grep '"react": "19.2.7"' → 0 matches; exactly one node_modules/react key exists, so no duplicate React copy (the classic hooks/context breaker in a Next.js app) is introduced.

Spec-compliance — assessed against the stated intent. The diff changes exactly the two version records the intent calls for. No unmet requirement, no scope creep.

Blast radius — no issues found. website/package.json is "private": true with its own npm-format lockfile, disjoint from the root pnpm-lock.yaml; the root package.json files allowlist is ["dist/", "scripts/postinstall.mjs", "NOTICE", "assets/demo-placeholder.png"], so the docs site is excluded from the published CLI/daemon bundle. This bump cannot reach npm consumers of agent-afk.

---

CI verdict — neither red check is caused by this diff

Lint & Build (FAILURE) — pre-existing, repo-wide. The failure is in pnpm audit:deps, which dies on Unexpected token '\x1f', "\x1f\x8b\x08..." is not valid JSON — pnpm's _Response.json() parsing a gzip response body from the npm audit endpoint. The tolerance branch in scripts/audit-deps.ts only swallows the failure when isAuditEndpointUnavailable(output) returns true, and that predicate tests exactly 9 markers (scripts/audit-deps-endpoint.ts:18-31):

ERR_PNPM_AUDIT_BAD_RESPONSE · endpoint is being retired · responded with 410
ENOTFOUND · EAI_AGAIN · ECONNREFUSED · ECONNRESET · ETIMEDOUT · fetch failed

The observed gzip/JSON-parse string matches none of the 9, so the tolerance branch does not fire and exit 1 propagates. Confirmed by replaying the marker set against the observed output: 0/9 matched. This is a new failure shape from the same endpoint outage the script was written for — the endpoint now returns gzip bytes rather than a 410, sidestepping the guard.
Evidence it is not PR-specific: Lint & Build is FAILURE on all four open dependabot PRs — #704, #705, #706, #707 — while the last three main CI runs (2026-07-24/25, pre-dating this response-shape change) were green. Nothing in this 2-file website diff reaches scripts/.
Suggestion (repo-level, not this PR's job): add a /is not valid JSON/i or /Unexpected token/i transport marker to TRANSPORT_FAILURE_MARKERS, narrowly scoped to audit-command output so a genuine critical advisory still hard-fails the gate.

Test (windows-latest) (FAILURE) — advisory, and unrelated. .github/workflows/ci.yml:94 sets continue-on-error: ${{ matrix.os != 'ubuntu-latest' }}, so windows/macos are signal-only and structurally cannot block a merge; ubuntu-latest is the required gate and it passed. First-party check-run annotations for this exact SHA report src/paths-exdev.test.ts:72 (AssertionError: expected true to be false) plus repeated src/agent/tools/handlers/bash.ts:255,341 Error: kill ESRCH; the job log additionally shows Windows path-separator assertions in src/agent/tools/dispatcher.test.ts (expected [ '/base', 'D:\extra\read' ] to include '/extra/read'). All are Windows path/process-semantics issues under the known compat grind. Zero references to /website, react, or react-dom in the windows job output.

Version-skew verdict — benign

react-dom@19.2.7 declares peerDependencies: { "react": "^19.2.7" } (website/package-lock.json:4728, read at the reviewed ref). The caret range admits 19.2.8, so there is no ERESOLVE / peer-conflict risk from the one-sided bump. Docs Site (typecheck + build) and the Vercel preview both passed on this SHA, which is consistent.

Merge-relevant summary

• The diff itself is a clean, coherent, single-package patch bump with an intact lock file and no duplicate-React hazard.
• Both red checks are repo-wide/platform issues that a website-only dependency diff cannot cause; the required ubuntu-latest gate is green.
• Lint & Build is still red as a status, so the merge button stays blocked until the audit:deps marker gap is fixed — that fix belongs in its own PR, and it unblocks #704–#707 at once.

What was not checked

• Read against branch HEAD 2062930664b30866c1fddb3fa42b4b77a9cde86a; all citations verified at that ref via git show <ref>:<path>.
• The integrity sha512 was not network-verified against the registry tarball.
• React 19.2.8's upstream changes were taken from the PR body's release notes, not audited at the React source level.
• No tests were run locally; CI results were read, not reproduced.
• Stated intent: PR #705 title + body — spec-compliance assessed.