fix(deps): update dependency react (19.2.7 → 19.2.8)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
react (source)	19.2.7 → 19.2.8

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

react/react (react)

v19.2.8: 19.2.8 (July 21st, 2026)

Compare Source

React Server Components

• Performance improvements when decoding
  (#​37087 by @​eps1lon)

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

PR PR 641: fix(deps): update dependency react (19.2.7 → 19.2.8)

Recommendation

Approve. This is a bot-generated Renovate dependency update that has already been merged. The PR represents a merge commit (78eecf2) bringing main into the renovate branch after the actual update was merged separately in commit 67014c4. All CI checks pass (Lint, Build, Tests, Typecheck, Docker Build).

Change Summary

• Package: react (19.2.7 → 19.2.8)
• Diff: Empty (this PR is a merge commit, not the actual update)
• Source: The actual update was merged via commit 67014c4 and is confirmed present in package-lock.json lines 9351–9368.

Security Note

The linked upstream commit PR 37087 (included in v19.2.8) is titled "[FlightReply] Performance improvements when decoding" with the explicit note "This fixes security vulnerabilities in Server Functions." This is a favorable security posture for Dispatch as a Next.js application.

Standards Compliance

• Dependency update follows standard pattern (patch version bump only, no breaking changes)
• No application code changes introduced
• All CI gates passed
• No linked issues required review

Unknowns / Needs Verification

The empty diff (0 changed files, 0 additions, 0 deletions) is expected for a merge-only PR. The actual dependency change is in the repository and confirmed by the package-lock.json scan showing react and react-dom both at version 19.2.8.

Tool Harness Findings

Tool harness completed 2 loop rounds with 4 planned requests. Git status confirms many untracked evidence files. The git log shows the merge structure: 78eecf2 is the merge commit, 67014c4 is the original react update commit.

Linked Sources Verification

• Source 9 (compare): Confirms react v19.2.7 → v19.2.8 with 2 commits including the security fix
• Source 10 (release): Confirms v19.2.8 published July 21st, 2026 with FlightReply decoding improvements

No blockers identified.