chore(deps): bump react and react-dom to 19.3.0

[dependabot]

Summary

Updates react and react-dom together from 19.2.8 to 19.3.0 so the renderer and core package remain compatible.

Root cause

The original Dependabot change updated only react-dom. After the other dependency PRs refreshed the lockfile, react resolved to 19.3.0 while react-dom remained at 19.2.8 on main. React and its DOM renderer therefore needed to be completed as one coordinated upgrade.

Changes

• Set both react and react-dom declarations to ^19.3.0.
• Regenerated and verified the lockfile at React 19.3.0 / React DOM 19.3.0.
• Kept the PR limited to web/package.json and web/package-lock.json.

Validation

• Root npm ci, build, and all 46 tests passed.
• Web npm ci and npm run types:check passed.
• Next.js 16.3.5 production build passed and generated all 128 static pages.
• Root and web audits reported zero vulnerabilities.
• Browser smoke test passed for hydration, homepage rendering, copy feedback, theme switching, and docs navigation.

Before/after evidence

• Before-fix commit: only React DOM was updated
• After-fix commit: React and React DOM are aligned

Upstream release: React 19.3

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vmup	Ready	Preview	Sep 26, 2026 9:34pm UTC