Skip to content

build(deps): bump the react-stack group with 3 updates#89

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/react-stack-9c659021d9
Open

build(deps): bump the react-stack group with 3 updates#89
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/react-stack-9c659021d9

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 25, 2026

Bumps the react-stack group with 3 updates: react, react-dom and next.

Updates react from 18.3.1 to 19.2.4

Release notes

Sourced from react's releases.

19.2.4 (January 26th, 2026)

React Server Components

19.2.3 (December 11th, 2025)

React Server Components

19.2.2 (December 11th, 2025)

React Server Components

19.2.1 (December 3rd, 2025)

React Server Components

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

... (truncated)

Changelog

Sourced from react's changelog.

19.2.1 (Dec 3, 2025)

React Server Components

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

React

... (truncated)

Commits

Updates react-dom from 18.3.1 to 19.2.4

Release notes

Sourced from react-dom's releases.

19.2.4 (January 26th, 2026)

React Server Components

19.2.3 (December 11th, 2025)

React Server Components

19.2.2 (December 11th, 2025)

React Server Components

19.2.1 (December 3rd, 2025)

React Server Components

19.2.0 (Oct 1, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

... (truncated)

Changelog

Sourced from react-dom's changelog.

19.2.1 (Dec 3, 2025)

React Server Components

19.2.0 (October 1st, 2025)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features

  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools

New React DOM Features

  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.

Notable changes

  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId

All Changes

React

... (truncated)

Commits

Updates next from 15.5.14 to 16.2.1

Release notes

Sourced from next's releases.

v16.2.1

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • docs: post release amends (#91715)
  • docs: fix broken Activity Patterns demo link in preserving UI state guide (#91698)
  • Fix adapter outputs for dynamic metadata routes (#91680)
  • Turbopack: fix webpack loader runner layer (#91727)
  • Fix server actions in standalone mode with cacheComponents (#91711)
  • turbo-persistence: remove Unmergeable mmap advice (#91713)
  • Fix layout segment optimization: move app-page imports to server-utility transition (#91701)
  • Turbopack: lazy require metadata and handle TLA (#91705)
  • [turbopack] Respect {eval:true} in worker_threads constructors (#91666)

Credits

Huge thanks to @​icyJoseph, @​abhishekmardiya, @​ijjk, @​mischnic, @​unstubbable, @​sokra, and @​lukesandberg for helping!

v16.2.1-canary.7

Core Changes

  • Avoid deprecated TS node10 moduleResolution defaults: #91847
  • [turbopack] Rebuild the docker build scripts: #91799
  • Fix TS6 baseUrl deprecation for extended tsconfig: #91855
  • Add next internal post-build CLI command for Turbopack database compaction: #91336

Example Changes

  • chore(examples): remove with-styletron example: #81842

Misc Changes

  • ci: upload adapter deploy test results: #91846
  • Turbopack: Define Effect as a trait instead of a closure: #89080
  • test: scope css data-url typing to fixture: #91877
  • Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133

Credits

Huge thanks to @​JamBalaya56562, @​ijjk, @​mmastrac, @​sokra, and @​bgw for helping!

v16.2.1-canary.6

Core Changes

  • [Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
  • Upgrade React from 3f0b9e61-20260317 to 8b2e903a-20260320: #91731
  • [Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438

Misc Changes

... (truncated)

Commits
  • ed7d2ce v16.2.1
  • 3e37bb4 docs: post release amends (#91715)
  • a15ec6e docs: fix broken Activity Patterns demo link in preserving UI state guide (#9...
  • 600cd2f Fix adapter outputs for dynamic metadata routes (#91680)
  • 27886d3 Turbopack: fix webpack loader runner layer (#91727)
  • 88fc430 Fix server actions in standalone mode with cacheComponents (#91711)
  • 37aed86 turbo-persistence: remove Unmergeable mmap advice (#91713)
  • d6195ec Fix layout segment optimization: move app-page imports to server-utility tran...
  • 6cb97d6 Turbopack: lazy require metadata and handle TLA (#91705)
  • e6b101a [turbopack] Respect {eval:true} in worker_threads constructors (#91666)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Upgrade the React stack across the monorepo (web and mobile) to React 19 and Next 16 for new features, fixes, and consistent versions.

  • Dependencies
    • react: 18.3.1 → 19.2.4
    • react-dom: 18.3.1 → 19.2.4
    • next: 15.5.14 → 16.2.1

Written for commit f3b0c6f. Summary will update on new commits.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 25, 2026
@vercel
Copy link

vercel bot commented Mar 25, 2026

Deployment failed with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/mediabubble?upgradeToPro=build-rate-limit

Copy link

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

5 issues found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/resident-portal/package.json">

<violation number="1" location="apps/resident-portal/package.json:23">
P1: Next 16.2.1 requires Node >=20.9.0, but the repo engine range still permits >=20.0.0. This can cause CI/dev runtime failures on allowed but unsupported Node versions.</violation>

<violation number="2" location="apps/resident-portal/package.json:27">
P2: React runtime was upgraded to 19.x, but TypeScript type packages remain on 18.x. Keep `@types/react` and `@types/react-dom` in the same major to avoid incorrect typings and TS friction.</violation>
</file>

<file name="apps/admin-dashboard/package.json">

<violation number="1" location="apps/admin-dashboard/package.json:35">
P1: `@types/react` and `@types/react-dom` in devDependencies are still on v18 while react/react-dom are bumped to v19. React 19 has breaking type changes (e.g., `useRef` requires an argument, implicit `children` removed from `FC`, ref callback cleanup). This will cause `typecheck` failures. Bump both type packages to `^19.0.0` to match.</violation>
</file>

<file name="apps/marketing/package.json">

<violation number="1" location="apps/marketing/package.json:25">
P2: Next 16.2.1 requires Node >=20.9.0, but the workspace engine range still allows unsupported Node 20.0–20.8.</violation>

<violation number="2" location="apps/marketing/package.json:25">
P1: Upgrading to Next 16 breaks the existing `next lint` script; linting will fail until the script is migrated.</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.

"jose": "4.15.9",
"lucide-react": "^0.344.0",
"next": "^15.5.14",
"next": "^16.2.1",
Copy link

@cubic-dev-ai cubic-dev-ai bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Next 16.2.1 requires Node >=20.9.0, but the repo engine range still permits >=20.0.0. This can cause CI/dev runtime failures on allowed but unsupported Node versions.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/resident-portal/package.json, line 23:

<comment>Next 16.2.1 requires Node >=20.9.0, but the repo engine range still permits >=20.0.0. This can cause CI/dev runtime failures on allowed but unsupported Node versions.</comment>

<file context>
@@ -20,11 +20,11 @@
     "jose": "4.15.9",
     "lucide-react": "^0.344.0",
-    "next": "^15.5.14",
+    "next": "^16.2.1",
     "next-themes": "^0.4.6",
     "qrcode": "^1.5.4",
</file context>
Fix with Cubic

"next-themes": "^0.4.6",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"react": "^19.2.4",
Copy link

@cubic-dev-ai cubic-dev-ai bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: @types/react and @types/react-dom in devDependencies are still on v18 while react/react-dom are bumped to v19. React 19 has breaking type changes (e.g., useRef requires an argument, implicit children removed from FC, ref callback cleanup). This will cause typecheck failures. Bump both type packages to ^19.0.0 to match.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/admin-dashboard/package.json, line 35:

<comment>`@types/react` and `@types/react-dom` in devDependencies are still on v18 while react/react-dom are bumped to v19. React 19 has breaking type changes (e.g., `useRef` requires an argument, implicit `children` removed from `FC`, ref callback cleanup). This will cause `typecheck` failures. Bump both type packages to `^19.0.0` to match.</comment>

<file context>
@@ -30,10 +30,10 @@
     "next-themes": "^0.4.6",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4",
     "react-i18next": "^14.1.3",
</file context>
Fix with Cubic

"lucide-react": "^0.344.0",
"negotiator": "^1.0.0",
"next": "^15.5.14",
"next": "^16.2.1",
Copy link

@cubic-dev-ai cubic-dev-ai bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Upgrading to Next 16 breaks the existing next lint script; linting will fail until the script is migrated.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/marketing/package.json, line 25:

<comment>Upgrading to Next 16 breaks the existing `next lint` script; linting will fail until the script is migrated.</comment>

<file context>
@@ -22,7 +22,7 @@
     "lucide-react": "^0.344.0",
     "negotiator": "^1.0.0",
-    "next": "^15.5.14",
+    "next": "^16.2.1",
     "next-mdx-remote": "^6.0.0",
     "next-themes": "^0.3.0",
</file context>
Fix with Cubic

"react": "^18.3.1",
"react-dom": "^18.3.1",
"react": "^19.2.4",
"react-dom": "^19.2.4",
Copy link

@cubic-dev-ai cubic-dev-ai bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: React runtime was upgraded to 19.x, but TypeScript type packages remain on 18.x. Keep @types/react and @types/react-dom in the same major to avoid incorrect typings and TS friction.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/resident-portal/package.json, line 27:

<comment>React runtime was upgraded to 19.x, but TypeScript type packages remain on 18.x. Keep `@types/react` and `@types/react-dom` in the same major to avoid incorrect typings and TS friction.</comment>

<file context>
@@ -20,11 +20,11 @@
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
+    "react": "^19.2.4",
+    "react-dom": "^19.2.4",
     "react-qr-code": "^2.0.18",
     "sonner": "^1.7.4",
</file context>
Fix with Cubic

"lucide-react": "^0.344.0",
"negotiator": "^1.0.0",
"next": "^15.5.14",
"next": "^16.2.1",
Copy link

@cubic-dev-ai cubic-dev-ai bot Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Next 16.2.1 requires Node >=20.9.0, but the workspace engine range still allows unsupported Node 20.0–20.8.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/marketing/package.json, line 25:

<comment>Next 16.2.1 requires Node >=20.9.0, but the workspace engine range still allows unsupported Node 20.0–20.8.</comment>

<file context>
@@ -22,7 +22,7 @@
     "lucide-react": "^0.344.0",
     "negotiator": "^1.0.0",
-    "next": "^15.5.14",
+    "next": "^16.2.1",
     "next-mdx-remote": "^6.0.0",
     "next-themes": "^0.3.0",
</file context>
Fix with Cubic

Bumps the react-stack group with 3 updates: [react](https://github.com/facebook/react/tree/HEAD/packages/react), [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) and [next](https://github.com/vercel/next.js).


Updates `react` from 18.3.1 to 19.2.4
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.4/packages/react)

Updates `react-dom` from 18.3.1 to 19.2.4
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.4/packages/react-dom)

Updates `next` from 15.5.14 to 16.2.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.14...v16.2.1)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: react-stack
- dependency-name: react-dom
  dependency-version: 19.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: react-stack
- dependency-name: next
  dependency-version: 16.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: react-stack
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/react-stack-9c659021d9 branch from adb247e to f3b0c6f Compare March 25, 2026 21:10
@vercel
Copy link

vercel bot commented Mar 25, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
gateflow-admin-dashboard Ready Ready Preview, Comment Mar 25, 2026 9:15pm
gateflow-client-dashboard Error Error Mar 25, 2026 9:15pm
gateflow-marketing Ready Ready Preview, Comment Mar 25, 2026 9:15pm
gateflow-resident-portal Ready Ready Preview, Comment Mar 25, 2026 9:15pm

@github-actions
Copy link

📦 Affected Packages

  • @gate-access/ui (component library)
  • admin-dashboard (Next.js app)
  • client-dashboard (Next.js app)
  • marketing (Next.js site)
  • scanner-app (React Native)

Diff: +3385 / -10245 lines

Auto-generated by pr-labels.yml

@github-actions
Copy link

Lighthouse CI — Marketing Site

Category 📱 Mobile 🖥 Desktop
Performance 🔴 58/100 🔴 64/100
Accessibility 🟡 94/100 🟡 94/100
Best Practices 🟢 96/100 🟢 96/100
SEO 🟡 92/100 🟡 92/100

Core Web Vitals (Mobile)
LCP: 16017ms | FCP: 3270ms | TBT: 320ms | CLS: 0.000

Plan: pagespeed_100 — Target: 100/100 all categories
Thresholds in .lighthouserc.js

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file size/S Small change (11–50 lines)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants