[screen-gd]

Summary

Updated for the apps/web TanStack Start layout from #17. The earlier Next.js patch no longer applies, so this branch merges main as is and re-applies only the fixes that still matter.

 apps/web/package.json
-  react, react-dom  19.2.4
+  react, react-dom  19.2.9
 package.json
+  engines.node      >=24.22.1 <25
+.nvmrc              24.22.1

Advisory	Severity	Status
GHSA-xqc2-xf4c-x3h3 (React RSC RCE)	Critical	react 19.2.9. No react-server-dom-* resolves in the lockfile, so the RSC packages are not in use.
Node Oct 21 release (CVE-2026-111497 and others)	High	Node 24.22.1
GHSA-673q / GHSA-2464 / GHSA-p3m5 (Next.js)	Critical/High	no longer applicable: next is gone from main
Vitest 2 criticals	Critical	already fixed on main (vitest 4.1.12)

Evidence

• Before: the PR conflicted with main (372 files changed by Move the app into apps/web as a pnpm workspace #17).
  After: merge commit 520ce53 has a tree identical to origin/main. The follow-up commit touches only the files above.
• pnpm audit: no advisories.
• pnpm lint, pnpm typecheck, pnpm test and pnpm build pass on Node 24.22.1.

Merge Danger

Door: two-way

Blast Radius: deploy

Patch-level React bump. Builds will use Node 24.x from engines.node.

Summary by CodeRabbit

• Chores
  • Updated the project’s required Node.js version and refreshed the web app’s React version. These maintenance updates keep the development environment aligned with the project’s current runtime requirements. No changes to app features or behavior are included.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f98611f1-ce8a-4c93-bcd7-87a785ccde9b

📥 Commits

Reviewing files that changed from the base of the PR and between 6c5686a and d41eba3.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 3

• .nvmrc
• apps/web/package.json
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The pull request sets Node.js to 24.22.1, adds a Node.js engine constraint, and updates the pinned versions of React and React DOM to 19.2.9.

Changes: Runtime and Dependency Versions

Layer / File(s)	Summary
Runtime and React version updates .nvmrc, package.json, apps/web/package.json	.nvmrc specifies Node.js 24.22.1. package.json requires Node.js >=24.22.1 <25. The web package pins React and React DOM to 19.2.9.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to d41eb

This change moves the repository to Node.js 24.22.1 and updates React to 19.2.9. The Node.js pin, the engine constraint and the React versions agree with each other. The PR description names different target versions, so the author may want to confirm which are intended, but this does not block merging.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately and concisely describes the two main changes: updating React to 19.2.9 and pinning Node.js to 24.22.1.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the runtime line,
React hops to a newer sign,
The version pins now match the day,
A tidy engine marks the way,
The rabbit bounds through green-lit code.}

_{Comment @coderabbitai help to get the list of available commands.}