Bump react-dom from 19.2.4 to 19.2.5

[dependabot]

Bumps react-dom from 19.2.4 to 19.2.5.

Release notes

Sourced from react-dom's releases.

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

Commits

• 23f4f9f 19.2.5
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Low risk dependency bump; only updates react-dom (and the lockfile-resolved react) patch versions with no app logic changes.

Overview
Bumps the react-dom dependency from 19.2.4 to 19.2.5.

Updates package-lock.json accordingly, including resolving react/react-dom to 19.2.5 and aligning react-dom’s peer dependency on react to ^19.2.5.

^{Reviewed by Cursor Bugbot for commit 7074c7a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react@​19.2.4 ⏵ 19.2.5
	react-dom@​19.2.4 ⏵ 19.2.5

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7074c7a. Configure here.}

[cursor]

react version range doesn't match react-dom peer dependency

Low Severity

The react dependency is declared as ^19.2.3 in package.json, but the newly bumped react-dom@19.2.5 declares a peerDependency of react: ^19.2.5. While the lockfile currently resolves react to 19.2.5, the declared range in package.json permits versions 19.2.3 and 19.2.4 which wouldn't satisfy the peer dependency. If the lockfile is regenerated, this mismatch could cause peer dependency warnings or installation errors. The react minimum version in package.json needs to be bumped to ^19.2.5 to stay consistent.

Additional Locations (1)

• package-lock.json#L15608-L15610

 

^{Reviewed by Cursor Bugbot for commit 7074c7a. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

Verifying package.json for react / react-dom alignment and any unusual scripts.

Verdict: benign

Evidence

1. Scanner — Report is clean: no Unicode/confusable/IOC/heuristic hits; 14 upstream files scanned over the tagged range ending at commit 23f4f9f (matches the release PR).

2. Provenance — react-dom resolves to the official registry tarball https://registry.npmjs.org/react-dom/-/react-dom-19.2.5.tgz with a normal sha512 integrity entry in package-lock.json; no lifecycle scripts were added in your app’s package.json (only Docusaurus-style scripts).

3. Change shape — Patch 19.2.4 → 19.2.5 from facebook/react; release notes describe RSC cycle protections, consistent with touched paths like ReactFlightReplyServer.js and version bumps across the React monorepo—no typosquatting, no suspicious install hooks in this review scope.

4. Interpretation — Nothing in the checklist contradicts the scanner; there is no disagreement between automated findings and manual criteria.

Non–malware note (merge hygiene): package.json still lists "react": "^19.2.3" while the lockfile pins react and react-dom at 19.2.5 (valid for ^19.2.3). Bumping the declared react range to match react-dom (e.g. ^19.2.5) avoids confusion and keeps peers obvious; that is versioning clarity, not a supply-chain flag.

Compatibility Analysis

Searching the repo for react-dom usage and scanning the upstream change for scope.

1) Where react-dom shows up

• Declared dependency: package.json lists react-dom (with the lockfile pinning the resolved tarball, e.g. react-dom-19.2.5).
• First-party code: Under src/, components and pages import react only (Runnable.tsx, HomepageFeatures.js, pages/index.js, utils/stringify.ts). There are no import / require of react-dom or react-dom/client in this app’s source.
• Effective use: react-dom is supplied for the toolchain—primarily Docusaurus (@docusaurus/core, @docusaurus/preset-classic, etc.) and the usual React peer dependency graph—not for direct app calls.

2) Overlap with 19.2.5 changes

• Release notes describe React Server Components: additional cycle protections (internal hardening around cyclic / invalid RSC scenarios—see upstream #36236).
• No overlap with your code: you are not using RSC APIs or importing react-dom server entrypoints yourself.
• Indirect overlap: only if the bundler / Docusaurus build exercised the exact code paths that changed; that is framework-internal and not something your src/ touches.

3) Risks / unknowns

• Low: Patch release (19.2.4 → 19.2.5), behavior change is defensive (stricter handling of bad cycles), not a public API change.
• react / react-dom pairing: React expects matching versions; your lockfile resolves both react and react-dom to 19.2.5, which is correct.
• Residual unknown: Theoretically, a bugfix could surface new errors in edge-case RSC usage inside a dependency; for a classic Docusaurus doc site, that exposure is typically minimal.

4) Recommendation

Merge — appropriate as a routine patch bump; no direct app usage of the changed surface, and react/react-dom stay aligned in the lockfile. If CI already runs docusaurus build, treat a green build as sufficient confirmation.

---

Malware Scan Summary

• Status: clean
• Warn only mode: true
• Changed upstream files scanned: 14
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved upstream range: 90ab3f89f4824ac763b6f877c6f711200d1338d2..23f4f9f30da9e9af2108c18bb197bae75ab584ea
• Resolved refs: from=90ab3f89f4824ac763b6f877c6f711200d1338d2 to=23f4f9f30da9e9af2108c18bb197bae75ab584ea
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 0

[dependabot]

Looks like react-dom is up-to-date now, so this is no longer needed.