chore(deps): bump the react group with 4 updates

[dependabot]

Summary

React 19.2.8 → 19.3.0, arriving as one PR carrying react, react-dom, @types/react and @types/react-dom together.

This is the first PR produced by the react group added in #362, and it is the evidence that the grouping works: Dependabot raised it within minutes of #362 landing, with react and react-dom both at ^19.3.0. Its predecessor #361 moved react alone and failed 25 suites with "Incompatible React versions".

This body replaces Dependabot's generated text, which omits every Pack template section and therefore fails Review gate. The upstream release notes remain in the PR's commit and comment history.

Root Cause / Decision Record

Not a fix — a dependency update, and the only one in this repository that reaches a taxpayer's browser. .github/dependabot.yml keeps the React packages in their own group precisely so this arrives separately from dev-tooling and gets its own disposition rather than being carried along with unrelated bumps.

React 19.3.0 adds <ViewTransition /> and addTransitionType. Pack uses neither, and this PR adopts neither; the new APIs are additive and the upgrade is a minor version within React 19. The panel and popup are the only React surfaces, and both are covered by the component suites below.

@types/react 19.3.0 moves with the runtime, which is what react-runtime-version-parity and the existing type-checking together enforce.

Scope

• Runtime: React itself. No src/** change.
• Tests: none changed. The full suite was run as the regression check.
• Docs/governance: none.
• Explicitly out of scope: adopting View Transitions or any other 19.3 API; permissions/CSP; Store scope; release publication.

Pack Workflow Preflight

Dependabot branches cannot use tapish-codex/<short-scope>; check-pack-workflow-preflight.mjs warns and accepts this, as it does for forks.

• pnpm workflow:preflight was run before editing/push, or the skip reason is documented.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance or recorded the stale-guidance warning.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

Not applicable: no Sanchika adoption.

• If this PR consumes @sanchika/* packages or copied Sanchika guidance, I
  read sanchika/docs/adoption-pack.md in the coordinated parent worktree.
• If this PR consumes Sanchika, it links ComplyEaze and Axal completion evidence
  and records the Sanchika commit or copied guidance used.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent
  source paths.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are updated if behaviour changed — no behaviour change.

Sensitive Surface Review

• Current tab / portal target binding is preserved or intentionally changed — untouched.
• Download completion remains evidence-backed and fail-closed — untouched.
• Ambiguous side-effect delivery cannot be reported as confirmed success — untouched.
• Service-worker durability impact is understood and documented — none; React does not run in the worker.
• Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing unless every gate in docs/PUBLICATION_READINESS.md is checked.
• Full fiscal year remains source-only and excluded from the next packaged Store build until its evidence gates are recorded.
• Store copy, README status, Privacy QA, and reviewer instructions were reviewed if user-facing behavior changed — no user-facing change.
• CI ZIP creation, provenance, and protected publishing are treated as release evidence, not manual store-submission sign-off.
• PR title uses Conventional Commits so Release Please can bump Pack after merge.

Verification

Run locally in an isolated worktree, on a freshly installed and prepared tree — not from a reused worktree, which under-reports tsc.

Stated precisely, because the head moved after that run: the local results below are from 1fbcf1d, the Dependabot head before this branch was updated from master. The current head c1a1252 adds only that update merge, whose other parent is master at 848b76f — itself verified and merged. The full sequence below was re-run by CI against c1a1252, including the unit suite inside Verify extension, and passed. So the exact current head is verified by CI, and the local run verifies the dependency change itself on a tree CI does not reproduce (fresh install plus wxt prepare, which is where a reused worktree silently under-reports).

• pnpm install --frozen-lockfile
• pnpm exec wxt prepare
• pnpm exec prettier --check . — clean
• pnpm exec eslint . --max-warnings 0 — clean
• pnpm exec tsc --noEmit — clean
• pnpm exec vitest run
• pnpm exec wxt build — Σ Total size 1.15 MB
• node scripts/verify-extension-package.mjs .output/chrome-mv3 — "Pack WXT extension package verification passed."

Vitest, verbatim:

 Test Files  177 passed (177)
      Tests  3313 passed (3313)
   Duration  278.54s (tests 94%, import 5%, transform 1%)
    Isolate  177 workers spawned · ~98ms startup each (spawn + environment, per file)
             at least ~17.31s faster with isolate: false — reuses workers across files instead of one per file

Identical file and test counts to master at 848b76f, so React 19.3.0 introduces no test delta across the panel and popup suites. Packaged size moves 1.12 MB → 1.15 MB, consistent with React's own growth and not with anything new being pulled in.

Not run, and not claimed: pnpm audit --audit-level high, wxt zip, ZIP verification, provenance and Store scripts. Those are release-time gates; this PR publishes nothing. No live authenticated run — the React surfaces are the panel and popup, and this upgrade does not touch acquisition, download evidence or portal interaction.

• pnpm review:gate -- --strict-head-review --wait-head-review-ms 180000 before merge/readiness claim; a missing Codex review blocks readiness:

Left unchecked. Codex review capacity is exhausted until roughly 2026-09-19, so no current-head review can arrive. CI's gate invocation passes --allow-missing-head-review, so the required check does not depend on it.

Artifact Evidence

• CI run: see this PR's checks.
• ZIP artifact: none — not a release PR.
• ZIP SHA-256: not applicable.
• Clean source/tag or head SHA: this PR's head.

PR Review Follow-Up

• GitHub Actions completed.
• Autogenerated Codex/bot review comments inspected after checks completed for the latest head SHA — none exist, and none can arrive while Codex capacity is exhausted.
• Inline review threads are resolved, outdated, or answered with evidence — there are none.
• No commits were pushed after the last required human/bot review without re-review.
• Any follow-up PRs or issues are listed here instead of being left implicit.

Thread/comment	Disposition	Commit or evidence
None — no review threads exist on this PR	accepted	Review-thread query returns zero threads for this head
#361, the ungrouped bump this replaces	superseded	Closed; #362 fixed the grouping, and this PR is the first output of it

Screenshots

None. No user-facing surface changed.

[dependabot]

Labels

The following labels could not be found: dependencies, triage. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.