LGTM. Straightforward security-motivated version bump.

Checked:

• Catalog + peer deps — pnpm-workspace.yaml catalog, packages/vinext/package.json peerDependencies, and tests/fixtures/static-export/package.json all consistently bumped to ^19.2.6 for react, react-dom, and react-server-dom-webpack.
• Upgrade gate in init.ts — getReactUpgradeDeps threshold correctly moved from patch < 5 to patch < 6 (line 177), so projects on 19.2.5 now get upgraded before RSDW is installed. Comments updated to match.
• cli.ts comment — Generalized from "react<19.2.5" to "older React versions", which is better since the exact floor will keep moving.
• Test updates — tests/init.test.ts correctly uses 19.2.5 as the "below floor" version and 19.2.6 as the "new enough" version. The existing 19.2.3 and 18.3.1 tests still exercise the older-version paths.
• Lockfile — Mechanical 19.2.5→19.2.6 substitution across all workspace importers and snapshot hashes. Spot-checked several entries; consistent throughout.
• minimumReleaseAgeExclude — React packages are already excluded from the 1440-minute release age gate in pnpm-workspace.yaml, so the fresh 19.2.6 resolves without issues. Good.

No functional concerns. The GHSA-rv78-f8rc-xrxh advisory makes this a good candidate for a quick merge.