build(deps): align react-dom with react@19.2.7 (replaces dependabot #8471) (#8557)

## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - The board UI, plugin examples, and plugin SDK all share the same
React dependency graph.
> - Dependabot PR #8471 raised `react` and `@types/react`, but left
`react-dom` and `@types/react-dom` on older 19.x ranges.
> - That let dependency resolution install incompatible React runtime
versions, which makes React refuse to run and breaks UI-oriented test
suites.
> - Current PR policy keeps `pnpm-lock.yaml` owned by CI for
non-dependabot authors, so this PR updates manifests and lets CI
regenerate the lockfile artifact.
> - This pull request replaces #8471 with a complete React toolchain
alignment across the package manifests it touched.
> - The benefit is a single React 19.2.7 runtime graph that keeps
dependency consumers from deduping onto a stale `react-dom` patch.

## Linked Issues or Issue Description

Refs #8471

This PR replaces #8471, which updated `react` and `@types/react` but
left `react-dom` and `@types/react-dom` behind. The resulting dependency
graph can install mismatched `react` and `react-dom` versions, producing
React's incompatible-version runtime error in UI tests.

## What Changed

- Aligned `react-dom` package ranges to `^19.2.7` anywhere the React
dependency set is present.
- Aligned `@types/react-dom` package ranges to the 19.2 line.
- Kept the `react@^19.2.7` and `@types/react@^19.2.17` bumps from #8471.
- Added root pnpm overrides for `react` and `react-dom` so peer-only
consumers resolve to the same 19.2.7 runtime instead of a stale patch.
- Left `pnpm-lock.yaml` out of the PR, per the PR workflow policy; CI
regenerates and shares the lockfile artifact when manifests change.

## Verification

- `cd ui && NODE_ENV=test npx vitest run` passed locally before handoff:
243 files / 1739 tests.
- `NODE_ENV=development pnpm install --lockfile-only --ignore-scripts
--no-frozen-lockfile` passed locally on the rebased branch.
- Confirmed regenerated `pnpm-lock.yaml` resolves `react` and
`react-dom` to 19.2.7 and contains no `react@19.2.4` /
`react-dom@19.2.4` entries.
- GitHub Actions are green on this PR, including `policy`, `Typecheck +
Release Registry`, all general test shards, `Build`, `e2e`, and
`verify`.
- Greptile completed at 5/5 with zero unresolved threads.

## Risks

Low risk. This is a dependency-version alignment only, but React
dependency changes can expose package-manager resolution issues. The
root overrides intentionally constrain the React runtime pair to the
same patch version to avoid that class of failure.

## Model Used

OpenAI Codex based on GPT-5, using command-line tool execution and
GitHub CLI operations in a Paperclip-managed workspace.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>

package.json

@@ -69,7 +69,9 @@
       "embedded-postgres@18.1.0-beta.16": "patches/embedded-postgres@18.1.0-beta.16.patch"
     },
     "overrides": {
-      "rollup": ">=4.59.0"
+      "rollup": ">=4.59.0",
+      "react": "^19.2.7",
+      "react-dom": "^19.2.7"
     }
   }
 }

packages/plugins/examples/plugin-authoring-smoke-example/package.json

@@ -32,7 +32,7 @@
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-typescript": "^12.1.2",
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
+    "@types/react": "^19.2.17",
     "esbuild": "^0.28.1",
     "rollup": "^4.61.1",
     "tslib": "^2.8.1",

packages/plugins/examples/plugin-file-browser-example/package.json

@@ -29,11 +29,11 @@
   },
   "devDependencies": {
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
-    "@types/react-dom": "^19.0.3",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
     "esbuild": "^0.28.1",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "typescript": "^5.7.3"
   },
   "peerDependencies": {

packages/plugins/examples/plugin-hello-world-example/package.json

@@ -23,10 +23,10 @@
   },
   "devDependencies": {
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
-    "@types/react-dom": "^19.0.3",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "typescript": "^5.7.3"
   },
   "peerDependencies": {

packages/plugins/examples/plugin-kitchen-sink-example/package.json

@@ -25,10 +25,10 @@
   "devDependencies": {
     "esbuild": "^0.28.1",
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
-    "@types/react-dom": "^19.0.3",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "typescript": "^5.7.3"
   },
   "peerDependencies": {

packages/plugins/examples/plugin-orchestration-smoke-example/package.json

@@ -33,7 +33,7 @@
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-typescript": "^12.1.2",
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
+    "@types/react": "^19.2.17",
     "esbuild": "^0.28.1",
     "rollup": "^4.61.1",
     "tslib": "^2.8.1",

packages/plugins/plugin-llm-wiki/package.json

@@ -40,10 +40,10 @@
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-typescript": "^12.1.2",
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
-    "@types/react-dom": "^19.0.3",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
     "esbuild": "^0.28.1",
-    "react-dom": "^19.0.0",
+    "react-dom": "^19.2.7",
     "rollup": "^4.61.1",
     "tslib": "^2.8.1",
     "typescript": "^5.7.3",

packages/plugins/plugin-workspace-diff/package.json

@@ -56,11 +56,11 @@
   },
   "devDependencies": {
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
-    "@types/react-dom": "^19.0.3",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
     "esbuild": "^0.28.1",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "typescript": "^5.7.3",
     "vitest": "^4.1.8"
   },

packages/plugins/sdk/package.json

@@ -113,7 +113,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
+    "@types/react": "^19.2.17",
     "typescript": "^5.7.3"
   },
   "peerDependencies": {

ui/package.json

@@ -58,8 +58,8 @@
     "lucide-react": "^0.577.0",
     "mermaid": "^11.12.0",
     "radix-ui": "^1.6.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "react-i18next": "^17.0.7",
     "react-markdown": "^10.1.0",
     "react-router-dom": "^7.16.0",
@@ -72,8 +72,8 @@
     "@storybook/addon-docs": "10.3.5",
     "@storybook/react-vite": "10.4.6",
     "@types/node": "^22.19.21",
-    "@types/react": "^19.0.8",
-    "@types/react-dom": "^19.0.3",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^4.3.4",
     "tailwindcss": "^4.3.0",
     "typescript": "^5.7.3",