fix(deps): update npm dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@​codemirror/state	6.7.2 → 6.7.4
@​codemirror/view	6.43.10 → 6.43.11
@eslint/compat (source)	2.1.0 → 2.1.1
@tanstack/react-router (source)	1.170.32 → 1.170.34
@tanstack/router-plugin (source)	1.168.35 → 1.168.37
@testing-library/user-event	14.6.6 → 14.6.7
@types/node (source)	24.13.3 → 24.13.4
@types/react-dom (source)	19.2.5 → 19.2.7
eslint-plugin-react-refresh	0.5.5 → 0.5.6
postcss (source)	8.5.26 → 8.5.28
query-string	9.5.0 → 9.5.1
react-error-boundary (source)	6.1.4 → 6.1.5

---

Release Notes

eslint/rewrite (@​eslint/compat)

v2.1.1

Compare Source

Bug Fixes

• preserve markVariableAsUsed return value in compat context (#​503) (66d9790)

TanStack/router (@​tanstack/react-router)

v1.170.34

Compare Source

Patch Changes

• #​8279 aee42c6 - Avoid allocating event-handler arrays and wrapper functions for links without user-supplied event handlers.

• #​8308 9c1871c - Validate navigation and redirect destinations, keep ambiguous relative URLs on the current origin, and constrain prerender requests and output paths. Prevent redirect headers from appearing in serialized server function response bodies.

  Preserve native form HTTP redirects, route error handling and masks for document redirects, and per-navigation destinations for shared loader redirects. Avoid redundant origin parsing and reduce link styling and server-rendering work. Configured origins must already be normalized.

  Keep blocked-link inactive props consistent during React hydration, honor explicit redirect Location headers before checking route options, and refresh Vue link state when destinations become internal. Reuse the protocol-relative URL check while parsing redirect schemes once.

  Reduce React link bundle size by sharing pathname comparisons, state-prop selection, and element creation.

  Share normalized pathname comparisons in Solid and Vue links to reduce bundle size.

• #​8311 9aec5a7 - React Links resolve state props without temporary class-name arrays or unnecessary style copies.

• Updated dependencies [f9836f1, 9c1871c, 9871c06, 0654c0a]:

  • @​tanstack/router-core@1.171.29
  • @​tanstack/history@1.162.3

v1.170.33

Compare Source

Patch Changes

• #​8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

• #​8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

  When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

• #​8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

• #​8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

• #​8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

• #​8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

  • @​tanstack/router-core@1.171.28
  • @​tanstack/history@1.162.2

TanStack/router (@​tanstack/router-plugin)

v1.168.37

Compare Source

Patch Changes

• #​8300 49bcd4d - Refresh compatible build and runtime dependencies.

• Updated dependencies [f9836f1, aee42c6, 49bcd4d, 9c1871c, 9aec5a7, 9871c06, 0654c0a]:

  • @​tanstack/router-core@1.171.29
  • @​tanstack/react-router@1.170.34
  • @​tanstack/router-generator@1.167.35
  • @​tanstack/router-utils@1.162.3

v1.168.36

Compare Source

Patch Changes

• Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, 0caf6b9, ee28348, cf166d1, c18e690]:
  • @​tanstack/router-core@1.171.28
  • @​tanstack/react-router@1.170.33
  • @​tanstack/router-generator@1.167.34

testing-library/user-event (@​testing-library/user-event)

v14.6.7

Compare Source

ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)

v0.5.6

Compare Source

• Support re-exporting namespace components (fixes #​116)

postcss/postcss (postcss)

v8.5.28

Compare Source

• Fixes types regression.

v8.5.27

Compare Source

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

sindresorhus/query-string (query-string)

v9.5.1

Compare Source

• Fix stringifyUrl() dropping a leading # in the fragment identifier and throwing on some absolute URLs 47b5b30

---

bvaughn/react-error-boundary (react-error-boundary)

v6.1.5

Compare Source

• 249: Infer the wrapped component's ref type in withErrorBoundary

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 12f6ebb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cloudoperators.github.io/juno/pr-preview/pr-1961/
Built to branch gh-pages at 2026-09-17 02:30 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[Copilot]

🟡 Changes recommended

Critical error-boundary compatibility issues and a CodeMirror lockfile mismatch remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This Renovate PR updates patch-level npm dependencies across the monorepo and refreshes the shared lockfile.

Changes:

• Updates CodeMirror, TanStack Router, React tooling/types, testing, ESLint, PostCSS, and utility packages.
• Refreshes workspace manifests and transitive lockfile resolutions.

File summaries

File	Summary
pnpm-lock.yaml	Updates dependency resolutions; critical: CodeMirror view/state versions remain mismatched.
packages/url-state-provider/package.json	Updates query-string.
packages/ui-components/package.json	Updates testing and React DOM types.
packages/messages-provider/package.json	Updates React DOM types.
packages/greenhouse-auth-provider/package.json	Updates React DOM types.
packages/config/package.json	Updates ESLint dependencies.
apps/template/package.json	Updates React DOM types.
apps/supernova/package.json	Updates router, error boundary, and type dependencies.
apps/heureka/package.json	Updates router and related dependencies; critical: error-boundary typing and falsy-value handling require changes.
apps/greenhouse/package.json	Updates router, CodeMirror, tooling, and types; critical: error-boundary typing and falsy-value handling require changes.
apps/example/package.json	Updates React DOM types.
apps/doop/package.json	Updates router and React DOM types.
apps/carbon/package.json	Updates error boundary, testing, and React dependencies.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 12/13 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.