[dependabot]

Bumps the dev-dependencies group with 2 updates: @testing-library/react and @types/react-dom.

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[asabirov]

Proof claim

Tier: --run — nothing here is visible to a person. It executes in CI and in
developers' test runs, and it must change nothing consumers receive.

Somebody running npm test -w react gets @testing-library/react 16.3.3, in which
dispatching an event no longer re-enters act()
(#1468) — a flake
class in event-driven component tests. The 81 tests pass identically either side, and the
published tarball is byte-identical, so no version bump is owed.

• the command and both outputs
• a test — the react suite, run the same way on both sides
• the last read's verdict — no diff-review was run. Two devDependency patch bumps
  touching no source file; the review would read the same two version strings this
  comment quotes.

Premises

The issue here is Dependabot's own claim, and all four checks hold.

1. The thing it describes still exists. Both packages are declared in exactly one
   place, react/package.json, and nowhere else in the tree
   (git grep 'testing-library/react\|types/react-dom' finds only that file, ten test
   files importing it, and two prose mentions in CONTRIBUTING.md).
2. The diff is what the title says. Against origin/main the branch is one commit,
   10 insertions and 10 deletions. The lockfile moves exactly two entries —
   node_modules/@testing-library/react and node_modules/@types/react-dom — plus the
   workspace's own two specifiers. No transitive drift.
3. It works. Verified below rather than assumed.
4. The whole set is here. No second copy of either pin exists to update alongside it.

One premise that would have been false if taken from the local checkout: git diff main...HEAD here shows six packages moving and @oxc-resolver going backwards. That is
a stale local main (b052fb0), not this branch. Against origin/main (a8b1f05) the
diff is the two packages above.

Before / After

Same machine, same Node (v24.18.0), same npm (11.16.0), same command, clean npm ci on
each side. Base is origin/main at a8b1f05 in a scratch worktree; head is b59a6dd.

Installed versions

BEFORE  @testing-library/react: 16.3.2 | @types/react-dom: 19.2.4
AFTER   @testing-library/react: 16.3.3 | @types/react-dom: 19.2.5

npm test -w react

BEFORE   Test Files  12 passed (12)
              Tests  81 passed (81)
         exit 0

AFTER    Test Files  12 passed (12)
              Tests  81 passed (81)
         exit 0

Wall clock differs (13.2s vs 37.3s) and measures a cold npm/vite cache on the second run,
not the upgrade. It is not evidence of anything and is quoted so nobody reads the log and
wonders.

What consumers receive — npm run build -w react, then sha256 of every published file

BEFORE  5a81629f2af5c2dc6875586851fc853adba6f7209069492214b529ed2643a008  index.css
        c341817671c59d2246baa25b09d20576905f9c90214097acad86a0548008c710  index.js
        fc64079ce3a85b9308ae2fad39c9a923141a1430b4a6701939959039b3898044  index.d.ts

AFTER   5a81629f2af5c2dc6875586851fc853adba6f7209069492214b529ed2643a008  index.css
        c341817671c59d2246baa25b09d20576905f9c90214097acad86a0548008c710  index.js
        fc64079ce3a85b9308ae2fad39c9a923141a1430b4a6701939959039b3898044  index.d.ts

diff -r base/react/dist react/dist  →  exit 0

All three identical, index.d.ts included — which is the one worth checking, since
@types/react-dom is an input to the tsup dts step. Shipped surface vs version agrees
and is green, so the missing version bump is correct rather than an oversight.

Checks

All eleven green, including the five the merge button requires. build runs
npm test -w react, so CI exercised the upgraded library too.