[FlightReply] Performance improvements when decoding - #37087

This PR contains the following updates:

| Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action | pinDigest |  → `3d3c42e` |  |  |
| [actions/setup-node](https://github.com/actions/setup-node) | action | pinDigest |  → `8207627` |  |  |
| [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) | action | pinDigest |  → `e6de054` |  |  |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | action | pinDigest |  → `0ebf471` |  |  |
| [react](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react)) | dependencies | patch | [`19.2.7` → `19.2.8`](https://renovatebot.com/diffs/npm/react/19.2.7/19.2.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react/19.2.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react/19.2.7/19.2.8?slim=true) |
| [react-dom](https://react.dev/) ([source](https://github.com/react/react/tree/HEAD/packages/react-dom)) | dependencies | patch | [`19.2.7` → `19.2.8`](https://renovatebot.com/diffs/npm/react-dom/19.2.7/19.2.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/react-dom/19.2.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/react-dom/19.2.7/19.2.8?slim=true) |

---

### Release Notes

<details>
<summary>react/react (react)</summary>

### [`v19.2.8`](https://github.com/react/react/releases/tag/v19.2.8): 19.2.8 (July 21st, 2026)

[Compare Source](react/react@v19.2.7...v19.2.8)

#### React Server Components

- Performance improvements when decoding
  ([#&#8203;37087](react/react#37087) by [@&#8203;eps1lon](https://github.com/eps1lon))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Reviewed-on: https://gitea.com/gitea/docs/pulls/475
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: Renovate Bot <renovate-bot@gitea.com>

Updates `react` and `react-dom` together to **19.2.8**, and stops
Dependabot from splitting the pair again.

## Why this update

React 19.2.8 (2026-07-21) was released simultaneously with 19.1.9 and
19.0.8 — the backport pattern that signals a security patch. It is:
[#37087](react/react#37087), `[FlightReply]
Performance improvements when decoding`, whose author notes it "fixes
security vulnerabilities in Server Functions."

**That fix does not reach RaioPDF's runtime.** `apps/ui` is a
client-only Vite SPA rendered with `createRoot` inside the Tauri
WebView. There are no Server Components, no Server Functions, and no
`react-server-dom-*` packages anywhere in the lockfile;
`react-dom/server` appears only in vitest files. So this is dependency
hygiene at the current patch floor, not an urgent fix — but it is free,
and it puts the app on the version that carries the patch.

## Why both packages in one commit

`react-dom@19.2.8` declares `react: ^19.2.8` as a peer, and React itself
throws `Incompatible React versions` at runtime if the two differ.
Dependabot's #314 and #318 each moved one half, leaving the pair
mismatched — that is why they were red. This commit moves both.

The `apps/ui` specifiers also tighten from `^19.0.0` to `^19.2.8` so the
manifest records the lockstep floor, matching how the rest of the app's
dependencies are pinned (`pdfjs-dist: ^6.2.108`, `@tauri-apps/api:
^2.11.1`).

## Root-cause fix

`.github/dependabot.yml` now groups `react`, `react-dom`,
`@types/react`, and `@types/react-dom`. Without it, the next React patch
re-creates exactly the split that produced #314 and #318.

## Validation

Rebased onto current `main` (the earlier branch conflicted on
`pnpm-lock.yaml` after `pdfjs-dist` moved to 6.2.108). The regenerated
lockfile diff touches React entries only, and both integrity hashes
match the npm registry.

| Check | Result |
|---|---|
| `pnpm install --frozen-lockfile` | clean |
| `pnpm -r typecheck` | pass |
| `pnpm -r build` | pass |
| `pnpm -r lint` | pass |
| `apps/ui` unit tests | **1003 passed** (118 files) |
| `apps/ui` Playwright smoke | **51 passed**, real Chromium |
| Resolved versions | `react@19.2.8` + `react-dom@19.2.8` |

Supersedes #314 and #318.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

* [Flight] Restore standard React version placeholder

* [Flight Reply] Early bailout if backing entry for Blob deserialization is not a Blob (react#36055)

Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>
(cherry picked from commit 12ba7d8)

* [Flight] Avoid consuming cyclic models multiple times

Co-authored-by: "Sebastian \"Sebbie\" Silbermann" <sebastian.silbermann@vercel.com>
(cherry picked from commit 672b242)

* [FlightReply] Type hardening and performance improvements

Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>
(cherry picked from commit 795203e)

* [FlightReply] Don't drop FormData entries in `decodeReplyFromBusboy` (react#36468)

Fixes a regression from react#36425 where referenced `FormData` entries can
be dropped by `decodeReplyFromBusboy` when files are interleaved with
text fields in the payload.

`decodeReplyFromBusboy` queues text fields that arrive while a file is
being streamed and flushes them after the last file's `'end'`, working
around busboy emitting `'end'` deferred relative to subsequent `'field'`
events. With multiple files interleaved with text, this loses the
relative order of the affected text entries. The reorder was a
long-standing but invisible issue — entries came back in the wrong order
but were all present — until react#36425 tightened how referenced FormData
entries are collected from the backing store to rely on them being
contiguous. With that assumption violated, referenced FormDatas can now
come back with some entries dropped. The pattern is most easily surfaced
through `useActionState` actions that return the submitted `FormData` as
part of their state.

This replaces the tail-flush with a linked list of pending files. Text
fields that arrive while a file is in flight are queued on the tail
file's `queuedFields`; fields that arrive when the list is empty resolve
immediately. `flush()` walks from the head, resolving each completed
file followed by its queued fields, and stops at the first file that
hasn't ended yet. The backing FormData now matches the payload's order,
restoring the contiguity assumption (and fixing the long-standing
reorder as a side effect). The same change is applied to all five copies
in `react-server-dom-{webpack,turbopack,parcel,esm,unbundled}`. Two new
tests cover the multi-file interleave.

fixes vercel/next.js#93822

(cherry picked from commit b91823e)

* [FlightReply] Performance improvements when decoding (react#37087)

This fixes security vulnerabilities in Server Functions.

(cherry picked from commit 1dd4ecb)

* [Flight Reply] Align Rspack decoders with upstream changes

Mirror the selected Reply changes into the Rspack-owned browser, edge, and Node adapters after the dependency-closed upstream backports.

Forward caller-provided array size limits, preserve multipart field/file order, and settle failed async iterators without recursive error re-entry. Add public behavior coverage across every Rspack decoder, action-selection path, cyclic collection type, iterator settlement, and Busboy ordering direction.

This is a tactical source-parity change for the existing proposal branch; it does not make that branch current with React main.

---------

Co-authored-by: Sebastian "Sebbie" Silbermann <sebastian.silbermann@vercel.com>
Co-authored-by: Hendrik Liebau <mail@hendrik-liebau.de>