Update npm dependencies - #107
Merged
Merged
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
from
September 7, 2026 15:30
3f5f37b to
4c685ca
Compare
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
from
September 7, 2026 22:57
4c685ca to
de05abb
Compare
No767
approved these changes
Sep 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
19.2.5→19.2.710.9.1→10.10.01.80.0→1.82.05.10.1→5.11.05.18.6→5.19.05.18.6→5.19.05.18.6→5.19.05.18.6→5.19.017.11.0→17.12.0^0.65.0→^0.67.01.80.0→1.82.00.9.12→0.9.1312.1.0→12.3.48.68.0→8.70.0Release Notes
eslint/eslint (eslint)
v10.10.0Compare Source
oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)
v1.82.0Compare Source
What's Changed
Full Changelog: oxc-project/eslint-plugin-oxlint@v1.81.0...v1.82.0
v1.81.0Compare Source
What's Changed
Full Changelog: oxc-project/eslint-plugin-oxlint@v1.80.0...v1.81.0
azat-io/eslint-plugin-perfectionist (eslint-plugin-perfectionist)
v5.11.0Compare Source
compare changes
🚀 Features
(077f5d4)
🐞 Bug Fixes
(dbcd0b8)
(7fd2e9b)
(0418393)
❤️ Contributors
Rel1cx/eslint-react (eslint-plugin-react-dom)
v5.19.0Compare Source
✨ New
react-x/immutability: direct mutations of props and state are now reported — member assignments, updates, deletions, and mutating method calls are flagged when the mutated value resolves (through variable-declarator aliases) to a component's props, auseState/useReducerstate value, or a custom hook matching theadditionalStateHookssetting, independent of whether the mutation happens inside a function that reaches a freeze sink. (#1948, closes #1941)react-x/immutability: added shallow-copy awareness — nested mutations through an object/array literal built by spreading a props or state value (e.g.const copy = { ...state }/const copy = [...state]) are reported, since the nested values are still shared with the original; writes to the copy's own top-level slots are not reported. (#1948)Full Changelog: Rel1cx/eslint-react@v5.18.10...v5.19.0
v5.18.10Compare Source
🐞 Fixes
disable-*preset configs inreact-xandreact-rscnow also register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when combining them with a manually registered plugin. (follow-up to #1947, see #1946)🏗️ Internal
fumadocs-twoslashfromserverExternalPackagesto fix a prerender error.Full Changelog: Rel1cx/eslint-react@v5.18.9...v5.18.10
v5.18.9Compare Source
🏗️ Internal
eslintto10.10.0,vitestto5.0.0,tsdownto0.23.0,nxto23.2.0,dprintto0.57.4,@types/react-domto19.2.7,@eslint/compatto2.1.1, and@nubjs/nubto0.8.3.Full Changelog: Rel1cx/eslint-react@v5.18.8...v5.18.9
v5.18.8Compare Source
🐞 Fixes
recommended,strict, etc.) now register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when the plugin is registered manually and a preset is extended at the same time. (#1947, closes #1946)🏗️ Internal
import-integrity-lintplugin and patched its path prefix check so sibling directories likeexamples/preactandexamples/preact-compatno longer collide.fast-urito^3.1.5to fix CVE-2026-18446 (GHSA-7p8r-x3mc-p8w7).@effect/language-serviceto0.87.2,@effect/platformto0.97.1,@effect/platform-nodeto0.108.1,@nubjs/nubto0.8.2,@types/nodeto26.4.1,dprintto0.57.0, andlucide-reactto1.39.0.Full Changelog: Rel1cx/eslint-react@v5.18.7...v5.18.8
v5.18.7Compare Source
🐞 Fixes
react-x/set-state-in-effect: no longer misattributes render-phasesetStatecalls to effects when the state updater is passed through a prop function. (#1945)🏗️ Internal
typescript-eslintto8.69.0,eslintto10.9.1,vitestto4.1.11,@types/nodeto26.4.0,@types/react-domto19.2.5,eslint-plugin-package-jsonto1.8.0,import-integrity-lintto1.3.0,nxto23.1.3,publintto0.3.24,typedoc-plugin-markdownto4.13.0, andpnpmto11.25.0.New Contributors
Full Changelog: Rel1cx/eslint-react@v5.18.6...v5.18.7
sindresorhus/globals (globals)
v17.12.0Compare Source
50a2119__webpack_layer__global (#351)779a11aoxc-project/oxc (oxfmt)
v0.67.0Compare Source
🛡️ Security
9a612d5deps: Update npm packages (#26178) (renovate[bot])v0.66.0Compare Source
oxc-project/oxc (oxlint)
v1.82.0Compare Source
🚀 Features
6a0e19clinter/eslint/no-unmodified-loop-condition: SupportcheckConditionalExpressionsoption (#26249) (camc314)v1.81.0Compare Source
📚 Documentation
d5be037linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)millionco/react-doctor (oxlint-plugin-react-doctor)
v0.9.13Compare Source
Patch Changes
#1651
ffc2d14Thanks @aidenybai! - Upgrade the Oxc parser and Oxlint runtime while preserving hard failures for broken JS plugins.#1652
f7efb7dThanks @aidenybai! - Keep ESLint presets on React Doctor's curated low-noise rule behavior and honor configured capabilities when a rule declaresdisabledWhen, including suppressing manual-memoization diagnostics for React Compiler projects.#1646
05ef989Thanks @aidenybai! - Keep the interactive score header intact in narrow split views and invalidate locally stale scan results when rule implementations change.Report standalone Three.js render loops that use
requestAnimationFrameinstead of the renderer-managedsetAnimationLoopAPI.Include standalone Three.js, supported React framework, Remotion, and React Three Fiber ecosystem packages in automatic workspace project discovery.
#1739
a04b933Thanks @aidenybai! - Avoidartifact-env-leakfalse positives from vendored source-map content and intentionally public token names.#1730
adc3a91Thanks @skoshx! - Fixrn-no-raw-textfalse positives in components that return only direct<fbt>or<fbs>elements.#1732
2c4560fThanks @skoshx! - Classify fragment returns that contain only translation elements and static text as text-producing components.#1723
e1d4c51Thanks @skoshx! - Preventrn-no-raw-textreports for<fbt>content passed through verified React Native text wrappers.#1658
905607fThanks @skoshx! - Prevent stack overflows while resolving deeply nested local function references. React Doctor now stops following a reference chain after a bounded number of steps instead of aborting the lint scan.#1717
17eeeb5Thanks @skoshx! - Fix arerender-state-only-in-handlersfalse positive when a member hook consumes state.#1706
afa1780Thanks @aidenybai! - Avoid false positives for loading resets infinally, animation duration utilities, and string message substring searches.#1734
025d69dThanks @skoshx! - Fixjs-set-map-lookupsfalse positives for substring checks on values returned by the globalStringconstructor.#1725
0f59a3bThanks @aidenybai! - Runtest-noiserules in ambiguous product-named directories such astools,demo, andmigrationswhen they are below a recognized application source root. Explicit test surfaces and root-level tooling or example directories remain excluded.#1668
5bc88aeThanks @skoshx! - Ignore browser-global names in TypeScript-only positions so interface and type property keys are not reported as unsafe module-scope runtime access.#1673
4bf7affThanks @aidenybai! - Use the nearest workspace root when detecting Fast Refresh ownership so nested checkouts keep the correct rule coverage.#1671
bd08406Thanks @aidenybai! - Stop recommendingflatMapas a guaranteed performance improvement for.map().filter(Boolean). The rule now suggests a single-passreduceorfor...ofrewrite only for measured hot paths.#1663
2b0f06eThanks @aidenybai! - Improve repeated effect analysis and deeply nested JSX performance, preserve derived-state detection through transparent TypeScript wrappers, and upgrade Oxc parser and linter dependencies.#1624
8c2f03aThanks @aidenybai! - Make React cleanup a first-class part of React Doctor with diagnostics for complex React functions and repeated JSX composition. Keep whole-project unused file, export, type, dependency, and import-cycle analysis as explicit opt-in rules while removing the separate Deslop packages, experimental language server, and IDE extensions.#1654
6416370Thanks @aidenybai! - Add component-composition and correctness rules for shadcn, Radix UI, Base UI, React Aria, TanStack Table, and TanStack Virtual behind six new project capabilities (shadcnfromcomponents.json; the rest from their package dependencies). Dialog surfaces that render no title part and carry no accessible name are reported across all three libraries (shadcn DialogContent/SheetContent/AlertDialogContent/DrawerContent, Radix Dialog.Content and AlertDialog.Content, Base UI Dialog.Popup and AlertDialog.Popup). Icon-sized shadcn Buttons with no accessible name, shadcn FormItem fields wrapping a FormControl without a FormLabel, and Base UI Field.Root controls without a Field.Label are reported as unlabeled. Raw Input, Textarea, and Button controls placed directly inside shadcn InputGroup are reported in favor of its InputGroupInput, InputGroupTextarea, and InputGroupAddon parts, and presence-onlydata-[selected]:/data-[disabled]:Tailwind variants on command items are reported because cmdk renders both attributes as"true"or"false". TanStack Form submit handlers that call the form'shandleSubmitwithoutevent.preventDefault()are reported because the browser still performs a native full-page submission. Tabs triggers provably inside the root without the list part are reported for shadcn, Radix, and Base UI; the existingshadcn-tabs-trigger-requires-listrule is now enabled by default for shadcn projects through the capability gate and no longer risks false positives on extracted trigger subcomponents. React Aria Dialogs without a Heading or aria-label are reported as unnamed. TanStack Tabledata/columnsoptions that provably get a new array identity every render (inline literals, render-scoped const arrays, fresh?? []fallbacks, inline.filter()/.map()transforms) are reported for rebuilding row and column models each render and looping auto-reset features, and elements measured by TanStack Virtual'smeasureElementwithout adata-indexattribute are reported because the virtualizer drops the measurement.#1742
28d4343Thanks @aidenybai! - Avoid cleanup false positives for callback refs, observer iteration, and effect-local stored disposers.pnpm/pnpm (pnpm)
v12.3.4: pnpm 12.3.4Compare Source
Patch Changes
Sped up dependency resolution in large workspaces #14352.
pnpm 12 now accepts the boolean settings as command-line flags on every command that takes them in pnpm 11, for example
pnpm install --unsafe-perm,pnpm add foo --offline, andpnpm install --dangerously-allow-all-builds. pnpm 12 rejected them withunexpected argument, which failed every install on Vercel, whose build runspnpm install --unsafe-perm#14346.pnpm removenow accepts--unsafe-perm, the same flagpnpm install,pnpm add, andpnpm updatetake.Platinum Sponsors
Gold Sponsors
v12.3.3: pnpm 12.3.3Compare Source
Patch Changes
Fixed concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file #14353.
Sped up writing the lockfile in large workspaces #14352.
Sped up dependency resolution in large workspaces #14352.
pnpm now runs through Node.js when it was installed by a tool that skips build scripts, such as Vercel's
packageManagerprovisioning, Bun, Deno, ornpm install --ignore-scripts. Those installs previously failed withsyntax error near unexpected token ')'. They still cannot run pnpm on Windows. On macOS only a shell can start it #14346.Platinum Sponsors
Gold Sponsors
v12.3.2: pnpm 12.3.2Compare Source
Patch Changes
pnpm audit --fix updateno longer aborts when a vulnerable package has no safe version inside its declared range #14508. The run updates every package it can and lists the rest as remaining.pnpm installno longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use pnpm/pnpm#14485.Sped up installs that have no lockfile. pnpm now links packages whose dependency subtree has no peer dependencies into the virtual store while resolution is still running.
pnpm runandpnpm execnow start without reinstalling on filesystems that keep sub-millisecond mtimes, such as NTFS. Previously, every run on those filesystems reinstalled first pnpm/pnpm#14486.pnpm importnow keeps the versions recorded inpackage-lock.json,npm-shrinkwrap.json, oryarn.lockwhen it generatespnpm-lock.yaml. A range inpackage.json, a catalog, or an override still decides which versions are eligible, and the recorded version is preferred among them. The generated lockfile previously could pin newer versions than the source lockfile #14476.pnpm importin a workspace now imports every workspace project into the shared lockfile. It previously imported only the project in the current directory.pnpm importnow fails withERR_PNPM_LOCKFILE_NOT_FOUNDwhen none of the three source lockfiles is present. It also fails withERR_PNPM_YARN_LOCKFILE_PARSE_FAILEDwhen it cannot parseyarn.lock. It previously generated a lockfile from scratch in both cases.pnpm importalways resolves locally. It warns when--pnpr-serveror thepnpr-serversetting is given and does not use the server.Sped up installs in large workspaces. Discovering the workspace projects no longer enumerates every matched directory to learn which manifest files it holds #14352.
Sped up installs in large workspaces. The resolver and the peer pass allocate less for every dependency edge #14352.
pnpm self-update,pnpm with, and automatic package-manager version switching no longer wait through registry retry delays when a configured registry has no signatures andregistry.npmjs.orgis unavailable #14483.Sped up installs in large workspaces. Saving the lockfile is faster, and the install finishes without waiting for memory cleanup #14352.
pnpm installnow relinks workspace packages whenpublishConfig.linkDirectorychanges. Frozen installs report an outdated lockfile until it is regenerated pnpm/pnpm#14488.The pnpm npm wrapper keeps its placeholder shebang-less so pnpm 11 can install pnpm 12 through the version store. Wrapper installs must allow lifecycle scripts to install the native binary #14502.
Sped up dependency resolution when there is no lockfile, and for the dependencies a lockfile does not cover.
Sped up installs in large workspaces. Workspace
link:targets and importer ids are now derived from the paths' suffixes under the workspace root #14352.pnpm installnow reports "Already up to date" when local tarball dependencies have not changed #14495.pnpm updatenow accepts--ignore-scriptsand skips lifecycle scripts during the update pnpm/pnpm#14512.Sped up installs that restore a deleted
node_modulesfrom a warm global virtual store. pnpm no longer re-links packages that are already fully present in the global virtual store #14510.Platinum Sponsors
Gold Sponsors
v12.3.1: pnpm 12.3.1Compare Source
Patch Changes
Sped up installs in large workspaces: the anchor for re-rendering workspace
link:targets is now derived once per project instead of once per dependency edge, and project ordering hashes paths by their raw bytes #14352.After a self-update from pnpm 12.2 to 12.3, global commands such as
node,npm, andyarnfailed withunexpected argument '--shim' found. Global commands now launch normally, and their first launch migrates the global bin directory to native shims. When self-update downgrades to pnpm 12.2 or older, it keeps the newer native shims so those commands continue to work.Sped up installs in large workspaces. The check that verifies each project against the lockfile now runs the projects in parallel #14352.
Platinum Sponsors
Gold Sponsors
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.