React 19.3.0 bump is blocked by @react-three/fiber's <19.3 peer cap

[atomantic]

Problem

Dependabot has opened #7292 (react 19.2.8 → 19.3.0) and #7290 (react-dom
19.2.8 → 19.3.0). Both fail CI at npm ci, before any test runs:

Conflicting peer dependency: react@19.2.8
  peer react@">=19 <19.3" from @react-three/fiber@9.7.0

@react-three/fiber@9.7.0 is the latest stable release and caps React at
>=19 <19.3 for both react and react-dom. That cap reflects real coupling,
not caution: r3f ships its own reconciler and depends on scheduler@^0.27.0,
while React 19.3.0 ships scheduler@0.28.0. Installing with
--legacy-peer-deps would put two scheduler copies under one renderer, so
forcing the resolution is not an acceptable workaround.

@react-three/drei@10.7.8 only requires @react-three/fiber@^9.0.0, so it adds
no second constraint — r3f is the sole blocker.

Note for whoever picks this up: the first CI runs on both PRs showed every job
cancelled rather than failed. That is not a separate problem —
scripts/cancel-current-ci-run.js cancels the whole run on the first job
failure, so the same ERESOLVE produced both symptoms. Re-running the workflow
surfaces the real error.

Fix

Wait for an @react-three/fiber release that widens its React peer range past
19.3, then:

1. Bump @react-three/fiber (and @react-three/drei if its own peer moves) in
   client/package.json.
2. Ask Dependabot to rebase build(deps): bump react from 19.2.8 to 19.3.0 in /client #7292 and build(deps): bump react-dom from 19.2.8 to 19.3.0 in /client #7290 (@dependabot rebase), or close
   them and let it re-open against the new floor.
3. Merge react first, then react-dom — react-dom@19.3.0 peers on
   react@^19.3.0, so the reverse order re-introduces the same ERESOLVE.
4. Run the client 3D suites, which are the surface a reconciler/scheduler
   mismatch would break.

Upstream tracking: https://github.com/pmndrs/react-three-fiber (peer range lives
in that package's package.json; 9.7.0 is current latest, with only
10.0.0-canary.* / 10.0.0-alpha.* published beyond it).

Do not merge either PR until the peer range allows it — the install cannot
succeed.

[atomantic]

Checked npm as of 2026-09-14: no @react-three/fiber release yet widens the React peer cap past <19.3.

• `latest` (9.7.0): `react: '>=19 <19.3'`, `react-dom: '>=19 <19.3'`
• `canary` (10.0.0-canary.979dc2d, published 2026-09-13): `react: '>=19.0 <19.3'`
• `alpha` (10.0.0-alpha.5, published 2026-09-08): `react: '>=19.0 <19.3'`

Every published tag — stable, canary, and alpha — still caps React below 19.3. There's no forceable workaround here (the issue itself rules out --legacy-peer-deps due to the dual-scheduler risk), so this stays blocked until upstream ships a wider range. Marking blocked so the autonomous claim queue skips it until then; re-check npm view @react-three/fiber dist-tags periodically.