Skip to content

chore(deps): bump react from 19.2.3 to 19.2.7#154

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-19.2.7
Open

chore(deps): bump react from 19.2.3 to 19.2.7#154
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/react-19.2.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor

Bumps react from 19.2.3 to 19.2.7.

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

19.2.6 (May 6th, 2026)

React Server Components

19.2.5 (April 8th, 2026)

React Server Components

19.2.4 (January 26th, 2026)

React Server Components

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

19.2.6 (May 6, 2026)

React Server Components

19.2.5 (March 18, 2026)

React Server Components

19.2.4 (Jan 26, 2026)

React Server Components

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump react from 19.2.3 to 19.2.7
2b9f7bc 
Bumps [react](https://github.com/facebook/react/tree/HEAD/packages/react) from 19.2.3 to 19.2.7.
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.7/packages/react)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 1, 2026
@vercel

vercel Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
francescoronel Ready Ready Preview, Comment Jul 1, 2026 1:09pm

@FrancesCoronel Claude

FrancesCoronel commented Jul 1, 2026

Copy link
Copy Markdown
Owner

Dependabot PR Review

Summary: Patch bump — react 19.2.3 → 19.2.7. No breaking changes noted (release notes mention only a Server Actions FormData regression fix).

⚠️ CI is failing — holding off on approval/auto-merge

Both failures are pre-existing, repo-wide issues unrelated to this specific bump (they fail identically on every open Dependabot PR right now):

  • Security audit — npm audit --audit-level=high fails on existing high-severity vulnerabilities already in the lockfile (form-data, undici), not introduced by this PR.
  • Claude Code Review — fails with Workflow initiated by non-human actor: dependabot (type: Bot). .github/workflows/claude-code-review.yml needs allowed_bots: dependabot[bot] (or '*') added to the claude-code-action step to run for bot-authored PRs.

Recommend fixing these on main so Dependabot PRs can pass CI going forward. Will revisit once green.

Generated by Claude Code

@FrancesCoronel Claude

FrancesCoronel commented Jul 1, 2026

Copy link
Copy Markdown
Owner

Dependabot PR Review

Summary: Patch bump — no breaking changes noted.

Package From To Type
react 19.2.3 19.2.7 patch

CI Status

Not clean: Security audit and Claude Code Review are both failing, but for reasons unrelated to this bump — same pre-existing issues affecting every open Dependabot PR right now (see #145 for the root-cause writeup: a pre-existing high-severity form-data vulnerability trips npm audit --audit-level=high, and the Claude review workflow isn't configured to run for bot actors). Lint, type-check, and Vercel deploy are green.

Holding off on approve/auto-merge until CI is clean per policy. This bump itself looks safe to merge once the systemic CI issue is resolved.

Generated by Claude Code

@FrancesCoronel FrancesCoronel mentioned this pull request Jul 1, 2026
Open
@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown

📸 Visual snapshots

Screenshots captured for this PR — view all artifacts.

Page Desktop Mobile
/ desktop mobile
/about desktop mobile
/posts desktop mobile
/speaking desktop mobile
/contact desktop mobile
/portfolio desktop mobile
/testimonials desktop mobile
/organizations desktop mobile
/experience desktop mobile
/education desktop mobile

Full Playwright HTML report: open report

FrancesCoronel
FrancesCoronel approved these changes Jul 1, 2026
View reviewed changes

@FrancesCoronel FrancesCoronel left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch version bump (react 19.2.3 → 19.2.7), no breaking changes noted. Core CI is green: Lint, Type check, Playwright, and Lighthouse all passed. Security audit and Claude Code Review failures are pre-existing/unrelated to this bump — Security audit is failing on already-known transitive vulnerabilities (markdown-it, postcss via next, undici) present on main regardless of this PR, and Claude Code Review fails because dependabot-triggered workflows aren't in the allowed_bots list (a CI config gap, not a code issue). Approving.

Generated by Claude Code

@FrancesCoronel Claude

FrancesCoronel commented Jul 1, 2026

Copy link
Copy Markdown
Owner

Approved, but enable_pr_auto_merge failed: "required checks are failing." Same systemic blocker as #148/#152: branch protection requires Security audit and/or Claude Code Review, both of which fail on every dependabot PR (npm audit baseline vulnerabilities unrelated to this bump, and the Claude Code Review workflow rejecting bot actors). Needs a manual merge, or the required-checks list in branch protection adjusted.

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@FrancesCoronel FrancesCoronel FrancesCoronel approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@FrancesCoronel