chore(deps): pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	pin	v3 → v3.2.0
node (source)	engines	pin	>=20.19.0 → v26.7.0
node (source)	engines	pin	>=20.12.0 → v26.7.0
pnpm (source)	engines	pin	>=11.20.0 → 11.22.0
react (source)	peerDependencies	pin	^19.1.0 → 19.2.8
react (source)	peerDependencies	pin	>=19.0.0 → 19.2.8
react-dom (source)	peerDependencies	pin	^19.1.0 → 19.2.8
sonner (source)	peerDependencies	pin	^2.0.7 → 2.0.8

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4304d01

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates Node/pnpm engine requirements and aligns some peer dependency version constraints across packages/apps.

Changes:

• Pin engines.node and engines.pnpm to specific versions across multiple package.json files.
• Pin peerDependencies versions (React/ReactDOM/Sonner) in ui-components and greenhouse-auth-provider.
• Update the version comment for actions/create-github-app-token in the release workflow.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/url-state-provider/package.json	Pins Node/pnpm engine versions.
packages/ui-components/package.json	Pins Node/pnpm engines; tightens peer dependency version constraints.
packages/template/package.json	Pins Node/pnpm engine versions.
packages/oauth/package.json	Pins Node/pnpm engine versions.
packages/messages-provider/package.json	Pins Node/pnpm engine versions.
packages/greenhouse-auth-provider/package.json	Pins Node/pnpm engines; tightens React peer dependency.
packages/communicator/package.json	Pins Node/pnpm engine versions.
apps/template/package.json	Pins Node/pnpm engine versions.
apps/heureka/package.json	Pins Node/pnpm engine versions.
apps/example/package.json	Pins Node/pnpm engine versions.
apps/carbon/package.json	Pins Node/pnpm engine versions.
.github/workflows/release.yaml	Updates action version comment.

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cloudoperators.github.io/juno/pr-preview/pr-1870/
Built to branch gh-pages at 2026-08-07 14:12 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

[ERR_PNPM_UNSUPPORTED_ENGINE] Unsupported environment (bad pnpm and/or Node.js version)

Your pnpm version is incompatible with "/tmp/renovate/repos/github/cloudoperators/juno/apps/carbon".

Expected version: 11.22.0
Got: 11.20.0

This is happening because the package's manifest has an engines.pnpm field specified.
To fix this issue, install the required pnpm version globally.

To install the latest version of pnpm, run "pnpm i -g pnpm".
To check your pnpm version, run "pnpm -v".