chore(deps): bump react-dom and @types/react-dom

[dependabot]

Bumps react-dom and @types/react-dom. These dependencies needed to be updated together.
Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.5

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[helebest]

Automated Dependabot review — ⛔ Not merged (blocked by pre-existing security gates)

Step 1 — Code review ✅

• Consistency: The diff matches the description. package.json + package-lock.json only: react-dom 19.2.7 → 19.2.8, @types/react-dom 19.2.3 → 19.2.5. The lockfile also advances react 19.2.7 → 19.2.8 (transitively pulled by react-dom@19.2.8's peerDependencies: react ^19.2.8) — expected and correct; the top-level react range stays ^19.2.6.
• Correctness / Effectiveness: Patch-level bump. Per the release notes the only change in 19.2.8 is a React Server Components decode performance improvement ([FlightReply] Performance improvements when decoding react/react#37087) — not a surface this app uses. No API/behavioral changes.
• Security: No advisory motivates this bump and it introduces none.
• Conventions & tests: Lockfile-only dependency bump; no functional code change, so no test changes are warranted.

Step 2/3 — Regression & CI ⚠️

Functional gates are green on the head commit:

• ✅ Verify (typecheck + coverage + build + e2e)
• ✅ Gate integrity, ✅ Secret scan (gitleaks), ✅ CodeQL, ✅ Analyze

Two security gates are red, and both fail for reasons unrelated to this PR:

• ❌ Dependency audit (prod, high+) — npm audit --audit-level=high --omit=dev reports a critical in tar reached through the prod chain @mikro-orm/sqlite → sqlite3 → tar.
• ❌ Container scan (trivy) — same root cause: tar CVE-2026-59873 (CRITICAL) + CVE-2026-59874 / CVE-2026-73566 (HIGH) in the built image.

This react-dom bump touches none of those packages. The failures reproduce identically on main, so they are pre-existing and not introduced or fixable by this PR. (Remediating tar requires @mikro-orm/sqlite v7 — a breaking major — or a tar override, which is out of scope here.)

Step 4 — Merge decision ⛔

Not merging. Per the fail-fast policy, CI is not fully green, so the merge step does not run. The blocker is environmental (the tar-rooted security gates that are red across the repo), not a defect in this change. Once those gates are addressed on main, this PR should merge cleanly.

---

Generated by Claude Code