chore(deps): bump the production group across 1 directory with 4 updates

[dependabot]

Bumps the production group with 4 updates in the / directory: react, react-dom, satori and sharp.

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates satori from 0.26.0 to 0.29.0

Release notes

Sourced from satori's releases.

0.29.0

0.29.0 (2026-07-23)

Features

• add support for webp images (#622) (b712d5b), closes #607 #539 #273 #311

0.28.2

0.28.2 (2026-07-21)

Bug Fixes

• replace Yoga build flag for browsers (#774) (dc2e1c5), closes #749

0.28.1

0.28.1 (2026-07-20)

Bug Fixes

• render text matching Object.prototype property names as glyphs (#761) (504b4c9)

0.28.0

0.28.0 (2026-07-14)

Features

• trigger npm publish after OIDC fix (#771) (b5c1f64)

0.27.0

0.27.0 (2026-04-29)

Bug Fixes

• Fixed error when rendering React Fragments inside <svg>

Commits

• b712d5b feat: add support for webp images (#622)
• dc2e1c5 fix: replace Yoga build flag for browsers (#774)
• 504b4c9 fix: render text matching Object.prototype property names as glyphs (#761)
• b5c1f64 feat: trigger npm publish after OIDC fix (#771)
• 8119856 docs: fix flexWrap default from 'wrap' to 'nowrap' (#767)
• 2120646 ci: publish via npm trusted publishing (OIDC) (#770)
• 2d3af44 fix: SSRF guard for server-side image fetches + pluggable fetcher (#769)
• 9feec94 fix: text matching Object.prototype property names rendered as image (#768)
• 91ade3b ci: declare minimum permissions on PR title workflow (#756)
• ab49faf chore: migrate workspace to pnpm 10 (#762)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for satori since your current version.

Updates sharp from 0.35.2 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info. #4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

• Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

• Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

• Reject infinite values when validating numbers. #4553 @​metsw24-max

• Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

• Verify background colour values are numbers. #4556 @​metsw24-max

• Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

• Tighten recomb and affine matrix verification. #4560 @​chatman-media

• Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

• 1018449 Release v0.35.3
• ba303a7 Prerelease v0.35.3-rc.2
• 4f94fc5 Upgrade to sharp-libvips v1.3.2
• c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
• 9a8d002 Docs: Add changelog entry and note about transferable #4520
• 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
• e000d0b Prerelease v0.35.3-rc.1
• 9554ca9 Prerelease v0.35.3-rc.0
• 6a29fd5 Emit warning about native binaries on Linux Electron
• 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
• Additional commits viewable in compare view

[netlify]

✅ Deploy Preview for expressjscom-preview ready!

Name	Link
🔨 Latest commit	5229f11
🔍 Latest deploy log	https://app.netlify.com/projects/expressjscom-preview/deploys/6a6f7c4cc013950008393bc6
😎 Deploy Preview	https://deploy-preview-2468--expressjscom-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 97 (no change from production) Accessibility: 100 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: 80 (no change from production) View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	satori@​0.26.0 ⏵ 0.29.0	+1			+2
	@​types/​react-dom@​19.2.3 ⏵ 19.2.4			+1	-5
	@​types/​react@​19.2.17 ⏵ 19.2.18			+1	-2
	react@​19.2.7 ⏵ 19.2.8
	sharp@​0.35.2 ⏵ 0.35.3			+1	-1
	react-dom@​19.2.7 ⏵ 19.2.8

View full report