Repository navigation
Update npm dependencies - #900
Merged
Merged
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
✅ Deploy Preview for ucmacm ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
9.2.4→9.2.66.1.1→6.1.24.7.0→4.9.01.86.0→1.87.05.24.0→5.24.85.24.0→5.24.85.24.0→5.24.85.24.0→5.24.81.51.0→1.53.0^0.152.0→^0.153.0^0.71.0→^0.72.01.86.0→1.87.00.9.14→0.9.1712.9.1→12.10.14.21.1→4.21.48.71.0→8.71.18.3.2→8.3.3Release Notes
TanStack/table (@tanstack/react-table)
v9.2.6Compare Source
Patch Changes
#6611
b9b007f- Refactor bundled Intent skills into smaller entry points with references loaded for the current task. Keep core feature architecture and shared state directly discoverable, and move individual features, adapter compositions, and detailed migration guidance into references.Consumers with individual skill permissions or explicit agent mappings must replace retired feature/composition IDs with their owning entry points and refresh Intent mappings. See the Agent Skills guide for the replacement paths.
Updated dependencies [
b9b007f]:v9.2.5Compare Source
Patch Changes
e9158e7- Update TanStack Store dependencies to the latest compatible patch releases.e9158e7]:vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.1.2Compare Source
Fix HMR for compound components (#1484)
Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.
Fix
compiler.logDiagnosticsoption not working (#1483)With
oxc-transform-react>= 0.148, thelogDiagnosticswas not working. This version fixes it and requiresoxc-transform-react>= 0.152 as a peer dependency if you are using thecompileroption.compiler.logDiagnosticsoption is now deprecated and should be swapped for the builtincompiler.reportDiagnostics.Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)
When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.
schoero/eslint-plugin-better-tailwindcss (eslint-plugin-better-tailwindcss)
v4.9.0Compare Source
compare changes
Features
Fixes
❤️ Contributors
v4.8.0Compare Source
compare changes
Features
Fixes
CI
❤️ Contributors
oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)
v1.87.0Compare Source
What's Changed
Full Changelog: oxc-project/eslint-plugin-oxlint@v1.86.0...v1.87.0
Rel1cx/eslint-react (eslint-plugin-react-dom)
v5.24.8Compare Source
🐞 Fixes
react-x/rules-of-hooks: removed the incorrectFIXfeature declaration; the rule does not provide an auto-fix and is no longer advertised as fixable. (#2009)🏗️ Internal
react-x/immutability,react-x/set-state-in-render,react-web-api/no-leaked-event-listener, and the leaked-observer rules.nextto16.4.0,viteto8.3.3, and related dependencies.Full Changelog: Rel1cx/eslint-react@v5.24.7...v5.24.8
v5.24.7Compare Source
🐞 Fixes
react-x/immutability: no longer reports rebinding a plain local alias of props/state as a mutation; destructured props rebinding and member writes through aliases are still reported. (#1995)react-x/set-state-in-render:setStatecalls after nested component or hook declarations are now attributed to the outer component again. (#2004)react-x/set-state-in-render: anonymous callbacks passed directly tomemo()/forwardRef()are now treated as component render functions. (#1998)react-web-api/no-leaked-fetch: signal alias chains are now resolved recursively, so fetches with aliased signals correctly pair with their cleanupabortcall. (#1997)react-web-api/no-leaked-event-listener: bare globaladdEventListener(...)calls now pair with matchingremoveEventListener(...)cleanup calls. (#1996)react-web-api/no-leaked-event-listener: asignaldestructured fromnew AbortController()is now recognized. (#2001)react-web-api/no-leaked-resize-observer/react-web-api/no-leaked-intersection-observer:disconnect()/unobserve(...)now only count as cleanup in the cleanup phase;useRef-held observer instances are tracked;unobserve(...)inside the observer callback no longer pairs withobserve(...). (#2002, #2003)🏗️ Internal
typescript-eslintto8.71.1andpostcssto8.5.29.Full Changelog: Rel1cx/eslint-react@v5.24.6...v5.24.7
v5.24.6Compare Source
🐞 Fixes
react-x/no-unused-props: computed member access and destructuring with an identifier key (ex:props[key],const { [key]: value } = props) no longer count as usage of a prop named after the key; the rule now bails out on such dynamic keys instead of reporting actually-used props as unused. (#1994)react-x/set-state-in-effect: object-pattern destructuring of theuseStatetuple is now resolved by numeric key: a name bound at key 0 (ex:const { 0: value } = useState()) is no longer mistaken for the setter, while key 1 (ex:const { 1: setData } = useState()) is still recognized. (#1994)react-x/set-state-in-render: sameuseStateobject-pattern destructuring fix asset-state-in-effect. (#1994)Full Changelog: Rel1cx/eslint-react@v5.24.5...v5.24.6
v5.24.5Compare Source
🏗️ Internal
eslint-plugin-eslint-plugin, removing redundant emptydefaultOptionsdeclarations and enforcingmeta.defaultOptionsfor rules with options. (#1993) Thanks to @rakleed and @Rel1cx!react-web-api/no-leaked-intersection-observer,react-x/no-create-ref,react-x/no-nested-lazy-component-declarations, andreact-x/use-state. Thanks to @Rel1cx!effectto4.0.1,pnpmto12.9.1,fumadocs-coreandfumadocs-uito16.16.1,lucide-reactto1.52.0,tsl-dxto0.14.0, andtinybenchto6.2.0. Thanks to @Rel1cx!Full Changelog: Rel1cx/eslint-react@v5.24.4...v5.24.5
v5.24.4Compare Source
🏗️ Internal
Full Changelog: Rel1cx/eslint-react@v5.24.3...v5.24.4
v5.24.3Compare Source
🏗️ Internal
@local/eff: minor code optimizations.@eslint-react/shared: minor code optimizations.Full Changelog: Rel1cx/eslint-react@v5.24.2...v5.24.3
v5.24.2Compare Source
🏗️ Internal
@eslint-react/core,@eslint-react/var, thereact-domplugin, and thereact-xplugin: replacedinoperator checks with thehasPropertyhelper from@local/eff.@eslint-react/shared: documentedgetNormalizedSettings.Full Changelog: Rel1cx/eslint-react@v5.24.1...v5.24.2
v5.24.1Compare Source
📝 Documentation
no-react-introspectionrule in thereact-x/no-children-countandreact-x/no-children-maprule documentation.🏗️ Internal
react-web-api/no-leaked-event-listenertest specs from typical cases to edge cases. (#2015)KNOWN_-prefixed constant names inreact-x/no-array-index-keyandreact-x/no-missing-key. (#2014)effectto4.0.2,@effect/platform-nodeto4.0.2,nxto23.3.0,viteto8.3.4,lucide-reactto1.53.0, andpnpmto12.10.1.Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10
lucide-icons/lucide (lucide-react)
v1.53.0: Version 1.53.0Compare Source
What's Changed
groceriesicon by @rrod497 in #4907pen-toolicon by @karsa-mistmere in #4972hiking-stickicon by @kamilasw in #4711soupandsaladicons by @karsa-mistmere in #4971New Contributors
Full Changelog: lucide-icons/lucide@1.52.0...1.53.0
v1.52.0: Version 1.52.0Compare Source
What's Changed
wifi-cogicon by @karsa-mistmere in #4952Full Changelog: lucide-icons/lucide@1.51.0...1.52.0
oxc-project/oxc (oxfmt)
v0.72.0: oxfmt v0.72.0Compare Source
💥 BREAKING CHANGES
e2c68b1oxfmt: [BREAKING] Formatparser:markdownfiles byoxc_formatter_markdown(#27256) (leaysgur)🚀 Features
b538e3cformatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)🐛 Bug Fixes
71e400bformatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)7d0e54dformatter_markdown: Preserve line breaks around Chinese/Japanese characters in allproseWrap(#27331) (leaysgur)e9ae2d8formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#27326) (leaysgur)df85b4coxfmt: Keep blank lines after a line break in Prettier Doc to IR (#27325) (leaysgur)7f65b75formatter: Format assignment target property as assignment-like (#27289) (leaysgur)6c08f2aformatter_css: Apply theurl()import exception to a lone comma group (#27288) (leaysgur)1967302formatter_css: Hug a spacedident (only at the at-rule prelude head (#27283) (leaysgur)2445064formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#27278) (leaysgur)dd72fbfformatter_markdown: Keep container columns as spaces underuseTabs(#27277) (leaysgur)1686018oxfmt: Make one stateconditionalGroupfit up to firsthardline(#27275) (leaysgur)fd4ddceformatter_json: Flatten block comment only array|object (#27274) (leaysgur)267557cformatter,oxfmt: Embed only original JSDoc plugin supported languages (#27241) (leaysgur)2606c60oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#27237) (Nicolas Le Cam)c2de02bformatter: Decide embedded template layout from AST, not source shape (#27218) (leaysgur)c9e1224formatter: HandlequoteProps: consistentfor patterns and computed keys (#27216) (leaysgur)36e14dfformatter: Keep comments between callee and its opener on the callee side (#27172) (leaysgur)6da7657oxfmt: Render diagnostics with source in Stdin mode (#27130) (leaysgur)e9b2ec5oxfmt/lsp: Reload.prettierignoreon watched file change (#27129) (leaysgur)30eb463oxfmt: Check global ignores before resolving nested config in Stdin mode (#27128) (leaysgur)⚡ Performance
72f42a3formatter_markdown: Pre-allocate the IR buffer (#27333) (leaysgur)cea47e3formatter_core: Avoid exponentialwill_breakcheck on nested interned (#27211) (leaysgur)0aba566oxfmt: Do not resolve root js config from nested context (#27147) (leaysgur)📚 Documentation
51506c6formatter_css: Record divergences found in mdn-content (css-in-md) (#27327) (leaysgur)656b81cformatter_markdown: Record unclosed fences closing at a directive's closer (#27279) (leaysgur)66545bfformatter_markdown: Record setext heading wrap divergence (#27221) (leaysgur)af4b269oxfmt: Document whyformat()API does not take cwd (#27131) (leaysgur)millionco/react-doctor (oxlint-plugin-react-doctor)
v0.9.17Compare Source
v0.9.16Compare Source
Patch Changes
#1855
23d6160Thanks @aidenybai! - Avoid sequential-await warnings when local helpers read the same cache entry or delegate to the same imported operation with matching stable arguments. Follow bounded imported helpers to guarded, module-owned Map/WeakMap caches keyed by unchanged function parameters, with dependency fingerprints for cache invalidation. Preserve warnings for distinct imported operations sharing an input, and bound the diagnostic's parallelization advice.Keep diagnostics when a helper computes a cache key with an unknown call or property read. These values can change between calls.
#1855
23d6160Thanks @aidenybai! - Recognize convergent last-item equality guards in no-self-updating-effect, including literal tail replacements and appends with tail-preserving deferred trims.#1855
23d6160Thanks @aidenybai! - Avoid no-derived-state false positives when custom hooks return draft state setters through immutable aliases.#1846
6313667Thanks @aidenybai! - Disablerequire-pnpm-hardeningby default; enable it explicitly throughruleswhen wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.#1811
3242a81Thanks @skoshx! - Fix cache/navigation binding resolution and unsafe mutation parallelization (issue #1810)server-cache-with-object-literal: Properly resolve React.cache imports through aliases and check all argument positions for fresh objects/arrays. Shadowed or non-React cache functions no longer trigger false positives.
nextjs-no-redirect-in-try-catch: Recognize Next.js
unstable_rethrow(error)as a valid error forwarding pattern, suppressing the diagnostic when the caught error is correctly rethrown.server-sequential-independent-await and async-parallel: Detect mutating HTTP requests (POST, PUT, PATCH, DELETE) and preserve their ordering, preventing incorrect parallelization suggestions for operations that must run sequentially.
#1832
8a950f0Thanks @skoshx! - Fixeffect-needs-cleanupfalse positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature(node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., afterResizeObserver.observe()), allowingvoidreturns on the null branch.#1855
23d6160Thanks @aidenybai! - Resolve local Hook-shaped object methods before applying React Hook namespace heuristics, including inspection dispatchers and useEffectEvent.Preserve Hook diagnostics for unresolved invoked callbacks and bound Hook aliases, while resolving proven local callbacks at each call site.
#1855
23d6160Thanks @aidenybai! - Avoid display-name diagnostics for data factories that return descriptors containing JSX icons.Preserve anonymous-component diagnostics for proven array maps and React useMemo callbacks that return render output.
#1855
23d6160Thanks @aidenybai! - Recognize effect-owned timer replacements that clear the previous handle before assignment and release the final timer during teardown.#1855
23d6160Thanks @aidenybai! - Respect Solid JSX applicability in handler naming, DOM property, and module-scope helper advice while preserving React diagnostics in mixed-runtime files.pnpm/pnpm (pnpm)
v12.10.1: pnpm 12.10.1Compare Source
This release fixes
pnpm installfailures after anoverrideschange and on a filtered frozen install withcatalogPrune. It also fixes several bugs in the experimentalnodeLinker.type: loaded, which now keeps its generated files innode_modules.Patch Changes
With
nodeLinker.type: loaded, pnpm now writes its generated files tonode_modules, which projects already ignore in git. The store manifest and loader arenode_modules/.pnpm/.store-manifest.jsonandnode_modules/.pnpm/.store-loader.mjs. Bin shims are innode_modules/.bin.Earlier versions wrote
.pnpm-store.jsonand.pnpm-store-loader.mjsto the project root, and a.pnpmdirectory to the root and to each workspace package. Delete them after reinstalling.With
nodeLinker.type: loaded, packages that ship their ownnode_modulesdirectory, such asnpmwith its bundled dependencies, now load from the store. Before, one such package in the install stopped every Node.js process from starting.With
nodeLinker.type: loaded, scripts can now run a Node.js runtime installed throughdevEngines.runtime. Before, every script that callednodere-ran its own shim until it failed with "Argument list too long".With
nodeLinker.type: loaded, Node.js processes start faster. In a project with 13,000 stored files, the startup overhead per process dropped from 67 ms to 18 ms.pnpm installno longer fails withERR_PNPM_NO_MATCHING_VERSIONafter a change tooverrideswhen the lockfile resolves an optional peer dependency to an npm alias of another package #16654.A frozen install with
catalogPruneno longer removes catalog entries thatpnpm-lock.yamlstill records. Before,pnpm install --frozen-lockfile --filterfailed withERR_PNPM_LOCKFILE_CONFIG_MISMATCHwhen some workspace projects were missing from disk #16638.pnpm install --fix-lockfileno longer removes thedeprecatedandhasBinfields from lockfile entries #6600.With
enableGlobalVirtualStore, an install that updatesnode_modulesnow repairs a package in the global virtual store that an interrupted install left without some of its dependency links or package files. Before, such an install kept the incomplete package if the project'snode_modulesalready recorded it #16642.pnpm installnow skips the Cargo and Python projects inside a nested directory that has its ownpnpm-workspace.yamlor.gitdirectory, such as a git worktree of the same workspace or a separate clone.The
Request tookwarning for package metadata now starts timing when pnpm sends the request. Before, it also counted the time the request waited for a free request slot, so large installs printed it for requests the registry answered quickly.Platinum Sponsors
Gold Sponsors
v12.10.0: pnpm 12.10.0Compare Source
This release adds an experimental
loadednode linker, letspnpm-lock.yamlrecord resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store.Minor Changes
Added experimental
nodeLinker: { type: loaded }installation. Compatible dependencies load directly from the content-addressable store through an automatically registered Node.js loader.nodeLinker.excludedselects packages and their dependency trees to install in the global virtual store.lockfile.includeResolutionSettings: truemakespnpm-lock.yamlrecordautoDedupe,dedupeInjectedDeps,dedupePeerDependentsandlinkWorkspacePackages. Installs then treat a lockfile that records other values as outdated. A lockfile that recordsautoDedupeis reused by later installs on any machine, sopnpm runafterpnpm install --frozen-lockfileno longer starts another install #16583.Patch Changes
Security
pnpm installnow prevents dependency versions with path traversal from writing files outside the global virtual store.pnpm now verifies locked config dependencies against their registry before installing them. Config dependencies must come from an npm registry. The lockfile can no longer replace the integrity of a config dependency pinned with
version+integrity.Lockfile verification now checks the tarballs inside a
variationsresolution against the registry. Aname@versionlockfile entry with an emptyvariationsresolution is now rejected.pnpm audit signaturesnow verifies signatures against the integrity recorded in the lockfile. Packages without a recorded integrity cannot pass signature verification.pnpm installandpnpm publishnow reject archive metadata larger than 64 MiB before reading it into memory. Publishing a pre-built tarball also rejects manifests and README files larger than 64 MiB.Two URL or local path dependencies no longer share a virtual store directory when one URL has
+,#,:, or?where the other has/. Such dependencies, including git dependencies pinned with#, now get a hash suffix on their directory name.The warning about an ignored project
.npmrcregistry setting no longer prints the username and password of a URL-scoped key such as//user:password@registry.example.com/${PATH}/:_authToken.Installing and resolving dependencies
pnpm installnow fails withERR_PNPM_UNSUPPORTED_PROTOCOLwhen a dependency uses a specifier with a protocol pnpm does not support, such as Yarn'spatch:. On Windows, such a specifier failed withos error 123. On other platforms, pnpm linked it to a directory that does not exist. Reading apackage.jsonthat fails now names the file #16590.pnpm installnow fails withERR_PNPM_PACKAGE_MANIFEST_INVALID_ATTRIBUTEwhen a project declares a dependency whose specifier is not a string, such as"is-positive": 42. Before, the dependency was silently left out of the lockfile. AreadPackagehook can still correct the specifier.Fixed
pnpm installfailing withERR_PNPM_CMD_SHIM_RESOLVE_PATHwhen an executable's parent directory contains a dangling symlink.pnpm install --frozen-lockfileno longer fails withERR_PNPM_RESOLUTION_SHAPE_MISMATCHwhen aname@versionlockfile entry has a resolution served by a custom fetcher pnpm/tasks#108.pnpm install --fix-lockfilerepairs a lockfile whose importer references a package that has no snapshot entry, as left by a badly merged lockfile. It failed withERR_PNPM_LOCKFILE_MISSING_DEPENDENCYsince 12.8.0 #16618.When a dependency moves an exact dependency of its own to an older version, a peer dependency that pnpm installed automatically now moves with it. Before,
pnpm installandpnpm dedupekept the newer locked version of the peer, so the lockfile held two copies of it, for example two copies ofvuepnpm/tasks#61.pnpm dedupenow reads registry metadata for a dependency pinned to an exact version, aspnpm installdoes. If the registry metadata disagreed with the package'spackage.json, the lockfile it wrote depended on whetherminimumReleaseAgewas set #16615.Speed and size
Dependency resolution reads cached registry metadata faster. The metadata cache moved to
<cache-dir>/v12/, so the first install after upgrading downloads registry metadata again. A damaged cache entry is downloaded again, or reported as an error when--offlineis set.pnpm cache prunealso removes the metadata cache that older pnpm versions wrote under<cache-dir>/v11/#13512.Package metadata requests no longer wait behind queued tarball downloads when
maxSocketsor a proxy limits the connections to a registry. Large installs resolve faster and print fewerRequest tookwarnings.Sped up installs in large workspaces on macOS when the dependency links already exist. pnpm now keeps a link that already points at the right package without trying to create it first. Relinking the direct dependencies of 1,000 workspace projects took 45 ms, down from 116 ms pnpm/tasks#65.
Commands in a project that pins a different pnpm version start about 13 ms faster on macOS. pnpm now runs the pinned version's binary directly, without the shell script in front of it pnpm/tasks#66.
The pnpm binary is about 0.9 MB smaller, and the arm64 Linux binary is about 1 MB smaller still.
Running scripts and commands
pnpm runno longer prints[ELIFECYCLE] Command failed ...after Ctrl+C ends the script. pnpm still exits the way the script's shell did: on Windows with the shell's exit code (cmdreports-1073741510, PowerShell1), on Unix by re-raisingSIGINT#16579.pnpm run "/<regex>/"now accepts JavaScript regular expression syntax such as lookahead and lookbehind. A selector like"/^hello:(?!b).*$/"failed withERR_PNPM_NO_SCRIPT#16604.pnpm runandpnpm execnow forward--config.*command-line flags to the install started byverifyDepsBeforeRunpnpm/tasks#60.On Windows, a process started by
pnpm runorpnpm execcan again start a child withCREATE_BREAKAWAY_FROM_JOB. That child keeps running after pnpm exits, even if the command fails #16628.Empty
nodeOptionsvalues from command-line flags and environment variables now override lower-priority settings. Scripts retainNODE_OPTIONSfrom the parent environment orextraEnvwhennodeOptionsis empty.pnpm now reads the
failIfNoMatchsetting frompnpm-workspace.yaml, so a filter that matches no workspace project exits with code 1 when the setting istrue. The new--no-fail-if-no-matchflag turns the setting off for one command #16577.Configuration, setup, and pnpm versions
pnpm config get --globalandpnpm config list --globalnow show only the global configuration, also when run inside a project. Settings from the project'spnpm-workspace.yamland.npmrcwere included before. The same applies to--location=global#16598.pnpm now prints config warnings, such as an unset environment variable in
.npmrc, when loading the config fails.pnpm 11 releases older than 11.28.4 can run pnpm 12 again when the
packageManagerfield pins it. Since 12.9.0 they failed withSyntaxError: Invalid or unexpected token#16594.On Windows,
pnpm self-updateno longer runs the update a second time when it replaces apnpm.cmdlinked by pnpm 12.8 or older. cmd.exe read on in the replacedpnpm.cmd, printed an error about a command that is not recognized, and ran the new pnpm once more #16573.pnpm setupnow puts$PNPM_HOME/binfirst onPATHin login shells that inherited it further down, such as the VS Code terminal on macOS. Before, anothernodetook precedence over the one installed bypnpm runtime set node -g. Runpnpm setupConfiguration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.