Bump react and @types/react in /apps/web

[dependabot]

Bumps react and @types/react. These dependencies needed to be updated together.
Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

[samrusani]

Closing rather than merging, because this bumps half of an exact-pinned pair.

apps/web/package.json pins both exactly, no caret:

"react": "19.2.7",
"react-dom": "19.2.7"

This moves react to 19.2.8 and leaves react-dom at 19.2.7. pnpm install still succeeds, because 19.2.8 satisfies react-dom's ^19.2.7 peer range, so the mismatch does not surface at install time. It surfaces at module load, which is every render-based test file, pnpm build via react-dom/server, and the Playwright suites.

CI confirms it: Web tests, types, accessibility, and budgets fails here. The gate is working, which is why this is a close-and-refile rather than a near miss.

Please re-file with react-dom moved in the same diff and the lockfile regenerated so it records react-dom@19.2.8(react@19.2.8). @types/react-dom at 19.2.3 does not need to move. It is then a trivial patch bump.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.