chore(deps): update dependencies (React 19.2, ESLint 9.39, plyr 3.8.4)

[repowarden-app]

Summary

Updates multiple dependencies including React runtime and development tools. This PR consolidates 11 dependency updates across production and development dependencies.

Changes

Production Dependencies

• plyr: 3.8.3 → 3.8.4 (patch)
• react: 19.1.1 → 19.2.7 (minor)
• react-dom: 19.1.1 → 19.2.7 (minor)

Development Dependencies

• @eslint/js: 9.33.0 → 9.39.4 (minor)
• @types/react: 19.1.10 → 19.2.17 (minor)
• @types/react-dom: 19.1.7 → 19.2.3 (minor)
• @vitejs/plugin-react: 5.0.0 → 5.2.0 (minor)
• eslint: 9.33.0 → 9.39.4 (minor)
• eslint-plugin-react-refresh: 0.4.20 → 0.5.3 (minor)
• globals: 16.3.0 → 16.5.0 (minor)
• vite: 7.3.0 → 7.3.5 (patch)

Risk Assessment

Risk Level: Medium

• React minor version updates (19.1 → 19.2) may include behavior changes
• ESLint updates should be compatible with the existing flat config (eslint.config.js)
• Multiple minor version bumps across development tooling
• As this is a library, peer dependency ranges should be reviewed to ensure compatibility with the updated React versions

Testing Recommendations

Pre-merge Checklist

• Run full test suite across all target Node.js LTS versions (18, 20, 22)
• Verify ESLint configuration still works correctly with flat config format
• Build library successfully with npm run build
• Test in a consumer application with React 19.2
• Review and update peer dependencies in package.json if needed (especially React peer dependency range)
• Verify TypeScript types compile without errors
• Check that the demo/example application still works correctly
• Ensure Vite dev server and HMR work as expected

Post-merge Actions

• Close overlapping Dependabot PRs: build(deps): bump the npm_and_yarn group across 1 directory with 5 updates #1260, build(deps): bump the npm_and_yarn group across 1 directory with 5 updates #1254, build(deps-dev): bump prettier from 3.6.2 to 3.7.4 #1238 (if they contain any of these updates)
• Monitor for any compatibility issues in downstream consumers

Notes

• The project uses ESLint flat config format which is compatible with ESLint 9.39.4
• Node.js engines requirement (>=16) remains compatible with all updates
• Consider reviewing the React 19.2 release notes for any breaking changes or new features that may affect this library

---

🤖 Generated by RepoWarden

Available Commands

Comment on this PR with any of the following:

• @repowarden-app rebase — Rebase this PR onto the base branch
• @repowarden-app fix-tests — Analyze CI failures and push a fix
• @repowarden-app resolve-comments — Address review feedback and push updates

RepoWarden Checklist

• Dependencies updated
• Lock file regenerated
• CI passing
• Ready to merge

---

💸 Estimated time saved: ~30 min (≈ £25 of engineering time) — based on internal benchmarks for deps update tasks.

---

Transitive CVE Fixes (2)

This PR also patches transitive vulnerabilities via overrides:

• 🟡 jest → ^30.4.2 — low
• 🟡 jest-environment-jsdom → ^30.4.1 — low

---

Supply Chain Safety Report

Warnings (upgraded with caution):

• @types/react@19.2.17 (npm)
  • ⚠️ Package name "@types/react" is very similar to popular package "preact" (edit distance: 1). Verify this is the intended package.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​react-dom@​19.1.9 ⏵ 19.2.3	+1		+1
	@​types/​react@​19.1.12 ⏵ 19.2.17
	vite@​7.3.0 ⏵ 7.3.5	+1	+31	+1
	plyr@​3.8.4
	react@​19.1.1 ⏵ 19.2.7	+1		+1
	globals@​16.3.0 ⏵ 16.5.0			+1
	@​eslint/​js@​9.39.4
	@​vitejs/​plugin-react@​5.0.2 ⏵ 5.2.0	+1
	eslint-plugin-react-refresh@​0.4.20 ⏵ 0.5.3	+1		+1
	react-dom@​19.1.1 ⏵ 19.2.7	+1		+1
	eslint@​9.39.4

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm js-yaml is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: example/plyr-example/package-lock.json → npm/eslint@9.39.4 → npm/js-yaml@4.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[repowarden-app]

This PR has been open for 14 days without being merged, so I'm closing it.

If there was an issue with these changes, please reply with feedback so I can improve!

— RepoWarden

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud