deps(deps): Bump the react group with 2 updates

[dependabot]

Bumps the react group with 2 updates: react and react-dom.

Updates react from 19.2.4 to 19.2.5

Release notes

Sourced from react's releases.

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

Commits

• 23f4f9f 19.2.5
• See full diff in compare view

Updates react-dom from 19.2.4 to 19.2.5

Release notes

Sourced from react-dom's releases.

19.2.5 (April 8th, 2026)

React Server Components

• Add more cycle protections (#36236 by @​eps1lon and @​unstubbable)

Commits

• 23f4f9f 19.2.5
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Upgrade react and react-dom to 19.2.5 to pull in patch fixes, including stronger cycle protections for React Server Components. No app code changes expected.

• Dependencies
  • react: 19.2.4 → 19.2.5
  • react-dom: 19.2.4 → 19.2.5

^{Written for commit b1ad3c6. Summary will update on new commits.}

Note

Bump react and react-dom from 19.2.4 to 19.2.5

Updates react and react-dom in package.json to ^19.2.5 and regenerates bun.lock with updated integrity hashes.

^{Macroscope summarized b1ad3c6.}

[dependabot]

Labels

The following labels could not be found: bun, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cubic-dev-ai]

No issues found across 2 files

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA b1ad3c6.

Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

License Issues

package.json

Package	Version	License	Issue Type
react	^19.2.5	Null	Unknown License
react-dom	^19.2.5	Null	Unknown License

Allowed Licenses:

MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, CC0-1.0, CC-BY-3.0, CC-BY-4.0, Unlicense, Python-2.0, BlueOak-1.0.0, Artistic-2.0, Zlib, MPL-2.0

OpenSSF Scorecard

Package	Version	Score	Details
npm/react	^19.2.5	Unknown	Unknown
npm/react-dom	^19.2.5	Unknown	Unknown

Scanned Files

• package.json