[renovate]

React and React DOM must have the same exact version. This pins both runtime packages to 19.3.1, including the companion DOM change from #217, and groups future core React minor/patch/pin updates so Renovate keeps the pair together.

Validation: official npm integrity hashes match; frozen-lock installation and actual rendering pass; 28 focused App tests and the full typecheck pass. Normal pre-commit, commit-msg and pre-push hooks passed. Fresh PR CI is pending. Close #217 as superseded after this paired change merges.

The original bot proposal and configuration context are retained below.

---

This PR contains the following updates:

Package	Type	Update	Change
react (source)	dependencies	pin	19 → 19.3.1

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 7am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
qualitylayer	Ignored	Preview	Oct 26, 2026 9:49am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9ff72834-ad6b-4cb4-9c45-8faf097cb574

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Claude finished @maxritter's task in 11s —— View job

---

Incremental review (latest push: 52bdbae "pair React and React DOM updates")

No new issues found.

• .github/renovate.json: the new rule groups react and react-dom as "React runtime". It sits after the generic runtime rule, so its groupName overrides that rule's groupName: null. The supply-chain:runtime label still applies. Including pin in matchUpdateTypes is right, since this PR is a pin.
• qualitylayer/package.json and bun.lock: encrypted paths, skipped as instructed. The package.json diff did show react and react-dom both pinned to 19.3.1, so the two stay matched.

Previously reported issues: none were listed in earlier review context, so nothing is marked resolved or still open.

Note: the PR title and body still describe only the react pin. Renovate should update them to cover the grouped React/React DOM change on its next rebase.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[maxritter]

Thanks for the update. The reviewed changes and required checks pass.