Align React RSC init floor with 19.2.6

[southpolesteve]

Summary

• align the init/build React upgrade guard with react-server-dom-webpack@19.2.6
• treat React 19.2.5 as below the App Router RSC floor so projects upgrade before installing RSDW
• update init coverage for the new boundary

Context

React published GHSA-rv78-f8rc-xrxh for react-server-dom-* packages. The workspace catalog and lockfile already resolve to 19.2.6 on main; this PR keeps vinext's App Router init path aligned with that patched release.

GHSA-rv78-f8rc-xrxh

Validation

• ./node_modules/.bin/vp test tests/init.test.ts
• ./node_modules/.bin/vp check tests/init.test.ts
• git diff --check origin/main...HEAD

[southpolesteve]

/bigbonk review please

[ask-bonk]

LGTM. Straightforward security-motivated version bump.

Checked:

• Catalog + peer deps — pnpm-workspace.yaml catalog, packages/vinext/package.json peerDependencies, and tests/fixtures/static-export/package.json all consistently bumped to ^19.2.6 for react, react-dom, and react-server-dom-webpack.
• Upgrade gate in init.ts — getReactUpgradeDeps threshold correctly moved from patch < 5 to patch < 6 (line 177), so projects on 19.2.5 now get upgraded before RSDW is installed. Comments updated to match.
• cli.ts comment — Generalized from "react<19.2.5" to "older React versions", which is better since the exact floor will keep moving.
• Test updates — tests/init.test.ts correctly uses 19.2.5 as the "below floor" version and 19.2.6 as the "new enough" version. The existing 19.2.3 and 18.3.1 tests still exercise the older-version paths.
• Lockfile — Mechanical 19.2.5→19.2.6 substitution across all workspace importers and snapshot hashes. Spot-checked several entries; consistent throughout.
• minimumReleaseAgeExclude — React packages are already excluded from the 1440-minute release age gate in pnpm-workspace.yaml, so the fresh 19.2.6 resolves without issues. Good.

No functional concerns. The GHSA-rv78-f8rc-xrxh advisory makes this a good candidate for a quick merge.

[ask-bonk]

Review posted. Approved PR #1118 -- the changes are clean and correct. All version references (catalog, peer deps, fixture package.json, upgrade gate threshold, tests) are consistently bumped from 19.2.5 to 19.2.6 to address GHSA-rv78-f8rc-xrxh. No issues found.

github run

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/vinext@1118

commit: fd990d0

[github-actions]

Example	Preview	Production	Original
app-router-cloudflare	preview	production
pages-router-cloudflare	preview	production
app-router-playground	preview	production	original
realworld-api-rest	preview	production
nextra-docs-template	preview	production
benchmarks	preview	production
hackernews	preview	production	original