chore(deps): bump react from 18.3.1 to 19.2.8

[dependabot]

Bumps react from 18.3.1 to 19.2.8.

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

19.2.6 (May 6th, 2026)

React Server Components

• Type hardening and performance improvements (#36425 by @​eps1lon and @​unstubbable)

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

19.2.3 (December 11th, 2025)

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #35351)

19.2.2 (December 11th, 2025)

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon facebook/react#35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #35289, #35345)

19.2.1 (December 3rd, 2025)

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #35277)

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

... (truncated)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

19.2.6 (May 6, 2026)

React Server Components

• Type hardening and performance improvements (@​eps1lon, @​unstubbable #36425)

19.2.5 (March 18, 2026)

React Server Components

• Add more cycle protections (@​eps1lon, @​unstubbable #36236)

19.2.4 (Jan 26, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (@​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable #35632)

19.2.3 (Dec 11, 2025)

React Server Components

• Add extra loop protection to React Server Functions (@​sebmarkbage #35351)

19.2.2 (Dec 11, 2025)

React Server Components

• Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@​eps1lon #35290)
• Patch Promise cycles and toString on Server Functions (@​sebmarkbage, @​unstubbable #35289, #35345)

19.2.1 (Dec 3, 2025)

React Server Components

• Bring React Server Component fixes to Server Actions (@​sebmarkbage #35277)

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

... (truncated)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• 6117d7c Version 19.2.7 (#36591)
• eaf3e95 Version 19.2.6
• 23f4f9f 19.2.5
• 90ab3f8 Version 19.2.4
• 612e371 Version 19.2.3
• b910fc1 Version 19.2.2
• 053df4e Version 19.2.1
• 5667a41 Bump next prerelease version numbers (#34639)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

[rubenvdlinde]

Holding this major React 18→19 bump for manual review — Docusaurus 3.10 pins React 18; upgrading to 19 needs a coordinated Docusaurus/React-19 compatibility check, not an auto-merge.

[rubenvdlinde]

Tested rather than guessed, overnight. It works — but there is an ordering problem, so I have not merged it.

Evidence

Built the site with react@19.2.8 + react-dom@19.2.8 and ran the full suite against it:

	React 18.3.1	React 19.2.8
npm run build	clean, 0 errors	clean, 0 errors
AI-baseline checks	15/15	15/15
Deep suite (banner, game, AI page)	34/34	34/34
Site-wide smoke (28 routes, both locales)	identical results	identical results

The smoke suite asserts zero console errors on every route, which is where a hydration regression would show — the exact failure mode a React major is most likely to cause. React 19 produced no difference at all.

@docusaurus/core@3.10.2 already accepts react: ^18.0.0 || ^19.0.0.

Why it is not merged

@conduction/docusaurus-preset still declares react: ^18.0.0 as a peer dependency. Installing React 19 here only works under --legacy-peer-deps, which this repo does use, but that means the graph is inconsistent rather than correct.

The right order is:

1. Widen the peer range to ^18.0.0 || ^19.0.0 in the design system, ideally with the preset's own tests run against 19.
2. Publish (the release path came back last night — needs an npm automation token, since a publish token demands an OTP).
3. Then merge this.

Doing it the other way round leaves every consumer of the preset with a peer range that lies.

Your call on whether to take that route or merge now on the strength of the evidence above.