chore(deps): bump vocs to 2.10.0 and waku to 1.0.0-rc.1

[scode2277]

What does this PR change?

Closes the work started in #625 and #626. Neither could land alone, because vocs and waku have to move together.

• vocs 2.6.2 to 2.10.0, waku 1.0.0-beta.6 to 1.0.0-rc.1. The chore(deps): bump the pnpm-minor group across 1 directory with 7 updates #625 bumped vocs alone, which re-resolved vocs' subtree while waku's stayed pinned, leaving two copies of @vitejs/plugin-rsc in the lockfile. Two RSC plugin instances means two client-reference registries in one build, so the flight stream never closes and the build hangs instead of erroring. chore(deps): bump waku from 1.0.0-beta.6 to 1.0.0-rc.0 #626 bumped waku alone, blocked by ScrollRestoration crashes the whole site on waku ≥ 1.0.0-beta.9 wevm/vocs#626: waku beta.9 removed unstable_events from useRouter(), which vocs 2.8.x calls in ScrollRestoration.tsx. This pairing matches vocs' own tested catalog.
• react and react-dom 19.2.8 to 19.3.0, plus @types/react and @types/react-dom to ^19.3.0. Required by vocs 2.10.0 (peer: ^19.3.0) and waku rc.1 (peer: ~19.3.0).
• react-server-dom-webpack added as an explicit dependency at 19.3.0. pnpm overrides do not apply to auto-installed peers, so it silently stayed at 19.2.7 against React 19.3.0. It must match react exactly.
• New overrides for @vitejs/plugin-rsc and @vitejs/plugin-react. These stop vocs and waku resolving to different copies, so the hang cannot recur on the next bump. They look like no-ops today because they are working as intended.
• New override capping es-module-lexer at <3. All three consumers cap at 2.x, and forcing 3.0.2 fails the build with RangeError: Maximum call stack size exceeded in unplugin-icons.

Type of change

• New content
• Edit to existing content
• Outline / structure change
• Typo or formatting fix
• Tooling / config

If applicable

• Editing existing content: tagged the current contributors from the attribution list
• Framework has a steward: asked them to review
• Outline change: updated vocs.config.ts with the dev: true parameter
• Want community feedback: shared this PR in our Discord

Stuck on anything? Just write it here and we're happy to help.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​react-dom@​19.2.7 ⏵ 19.3.0
	react-server-dom-webpack@​19.2.7 ⏵ 19.3.0		+16	+1
	@​types/​react@​19.2.18 ⏵ 19.3.0
	react@​19.2.8 ⏵ 19.3.0	+1		+1
	vocs@​2.6.2 ⏵ 2.10.0	+7		+1
	react-dom@​19.2.8 ⏵ 19.3.0			+1
	waku@​1.0.0-beta.6 ⏵ 1.0.0-rc.1	+1		+1

View full report

[frameworks-volunteer]

Model: x-ai/grok-4.6 Reasoning: medium Provider: openrouter

Security: no secrets, no injection surface, no eval/deserial. Socket Security passed. Overrides pin known packages (@vitejs/plugin-rsc, @vitejs/plugin-react, es-module-lexer <3) to stop dual RSC plugin copies and the lexer stack overflow. react-server-dom-webpack 19.3.0 matches React 19.3.0.

QA: diff matches the description (vocs 2.10.0 + waku rc.1 together, React 19.3.0, explicit RSC webpack dep). Lint passed. Preview job skipped; Cloudflare Pages still pending — not blocking.

Approve. Coordinated bump is the right fix for #625/#626.

[cloudflare-workers-and-pages]

Deploying frameworks with    Cloudflare Pages

Latest commit:	6361764
Status:	✅  Deploy successful!
Preview URL:	https://87e15d7a.frameworks-573.pages.dev
Branch Preview URL:	https://chore-bump-vocs.frameworks-573.pages.dev

View logs