Repository navigation
Update npm dependencies - #901
Merged
Merged
Conversation
✅ Deploy Preview for ucmacm ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.8.0→1.9.01.170.41→1.170.429.2.6→9.2.81.168.42→1.168.4326.6.4→26.6.55.24.8→5.24.105.24.8→5.24.105.24.8→5.24.105.24.8→5.24.101.53.0→1.55.07.0.2003→7.0.200412.10.1→12.11.220.1.2→20.1.38.3.3→8.3.4Release Notes
mui/base-ui (@base-ui/react)
v1.9.0Compare Source
Oct 9, 2026
General changes
CssVariablesandDataAttributestypes (#5243) by @superhoomanAccordion
<Accordion.Trigger>'sdata-valueanddata-indexattributes (#5705) by @cpruijsendisabledattribute to<Accordion.Trigger>when using native buttons (#5607) by @atomikshiddenUntilFoundpanels synchronously onbeforematch(#5514) by @aarongarciahAlert Dialog
Autocomplete
autoHighlightfor asynchronous results (#5818) by @atomiksonItemHighlighted. Pointer events may beMouseEventorPointerEvent; typing reports the reasonnone(#5838) by @atomiksactionsRef. CalleventDetails.preventUnmountOnClose()inonOpenChangeto opt out of automatic unmounting (#5734) by @michaldudakCheckbox
aria-labelover associated labels (#5787) by @atomiksCollapsible
disabledattribute to<Collapsible.Trigger>when using native buttons (#5607) by @atomikshiddenUntilFoundpanels synchronously onbeforematch(#5514) by @aarongarciahCombobox
autoHighlightfor asynchronous results (#5818) by @atomiksactionsRef. CalleventDetails.preventUnmountOnClose()inonOpenChangeto opt out of automatic unmounting (#5734) by @michaldudakonItemHighlighted. Pointer events may beMouseEventorPointerEvent; typing reports the reasonnone(#5838) by @atomiksDialog
Drawer
xandyoptions todata-base-ui-swipe-ignore(#5808) by @citrus<Drawer.Provider>(#5921) by @atomiksField
<Field.Control>'sdefaultValuechanges (#5881) by @atomiksMenu
<Menu.FilterProvider>,<Menu.Input>, and theonItemHighlightedcallback (preview) (#5527, #5838, #5840, #5868) by @atomiks and @jjenzz<Menu.Trigger>(#5764) by @sai6855onOpenChangewhen an item press closes the menu (#5789) by @michaldudakNumber Field
<NumberField.ScrubArea>'sonClickonce per click (#5889) by @michaldudakOTP Field
Popover
Preview Card
Radio Group
aria-labelover associated labels (#5787) by @atomiksinputRefforwarding and cleanup (#5775) by @lyzno1Scroll Area
Select
actionsRef. CalleventDetails.preventUnmountOnClose()inonOpenChangeto opt out of automatic unmounting (#5734) by @michaldudakSlider
touchcancelandpointercancel(#5639) by @brijeshb42onValueCommitted(#5779) by @atomiksSwitch
aria-labelover associated labels (#5787) by @atomiksTabs
Toast
Tooltip
All contributors of this release in alphabetical order: @aarongarciah, @atomiks, @brijeshb42, @citrus, @cpruijsen, @flaviendelangle, @jjenzz, @LukasTy, @lyzno1, @mdm317, @michaldudak, @MonstraG, @padd60, @sai6855, @santiago-ramos-02, @sarthakmalik0810, @superhooman, @tjdsksro90
TanStack/router (@tanstack/react-router)
v1.170.42Compare Source
Patch Changes
#8594
2413cc0- reduce component nesting per route match#8602
efc2042- Links of a route that the pending navigation leaves skip deriving the destination location, and clicks and preloads follow the href a Link displays.buildLocationnow buildsmaskandrouteMaskslocations from the same_fromLocationas the destination.#8602
efc2042- Fixed Link destinations that resolve to a route mask are now reused across navigations instead of being rebuilt every time. A mounted Link now follows changes to itshrefandreloadDocumentprops, and React Links no longer each subscribe to a hydration flag.#8579
d35aab4- Cancel pending link preload timers when starting navigation to avoid redundant preloading while the destination is loading.Updated dependencies [
dfe3dea,dfe3dea,dfe3dea,efc2042,efc2042,dfe3dea,663282b]:TanStack/table (@tanstack/react-table)
v9.2.8Compare Source
Patch Changes
f1c3409]:TanStack/router (@tanstack/router-plugin)
v1.168.43Compare Source
Patch Changes
dfe3dea,2413cc0,efc2042,efc2042,dfe3dea,d35aab4,663282b]:Rel1cx/eslint-react (eslint-plugin-react-dom)
v5.24.10Compare Source
📝 Documentation
no-react-introspectionrule in thereact-x/no-children-countandreact-x/no-children-maprule documentation.🏗️ Internal
react-web-api/no-leaked-event-listenertest specs from typical cases to edge cases. (#2015)KNOWN_-prefixed constant names inreact-x/no-array-index-keyandreact-x/no-missing-key. (#2014)effectto4.0.2,@effect/platform-nodeto4.0.2,nxto23.3.0,viteto8.3.4,lucide-reactto1.53.0, andpnpmto12.10.1.Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10
v5.24.9Compare Source
🐞 Fixes
react-x/set-state-in-effect: optional chaining in asetStateargument (ex:setData(ref.current?.value),setWidth(el?.offsetWidth ?? 0)whereelis ref-derived) no longer defeats the ref-value exemption; theChainExpressionwrapper is now unwrapped during ref-source detection. (#2011)📝 Documentation
Full Changelog: Rel1cx/eslint-react@v5.24.8...v5.24.9
lucide-icons/lucide (lucide-react)
v1.55.0: Version 1.55.0Compare Source
What's Changed
mail-doticon by @elenakovelskikh in #3230phone-logicon by @Levi-Bensley in #3598wifi-lockicon by @benhaube in #4913handle-bottom-righticon by @ocavue in #1793screwicon by @edik17 in #4932user-round-staricon by @karsa-mistmere in #3469shield-houseicon by @benhaube in #4602New Contributors
Full Changelog: lucide-icons/lucide@1.54.0...1.55.0
v1.54.0: Version 1.54.0Compare Source
What's Changed
lensicon by @rrod497 in #4923Full Changelog: lucide-icons/lucide@1.53.0...1.54.0
pnpm/pnpm (pnpm)
v12.11.2: pnpm 12.11.2Compare Source
This release fixes
--workspace-concurrency=Infinity, filters set by anupdateConfighook, and store fetches withenable-modules-dir=false.Patch Changes
--workspace-concurrency=Infinitynow runs workspace projects with no concurrency limit. It used to fail withinvalid digit found in string#16793.pnpm installand other recursive commands now apply thefilterandfilterProdthat anupdateConfighook sets. They used to run on every workspace project #16792.enable-modules-dir=falsenow also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.Platinum Sponsors
Gold Sponsors
v12.11.1: pnpm 12.11.1Compare Source
This release fixes two ways
pnpm installcould fail, runs tools of any Rust release throughpnx, and treatsregistry.npmjs.comas an alias of the npm registry.Patch Changes
pnpm installno longer fails whenpackageManagerpins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.pnpm installno longer fails withERR_PNPM_CMD_SHIM_CHMODwhennode_modules/.binholds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.enable-modules-dir=false(enableModulesDir: falsethrough the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing undernode_modules. The setting exists for anode_modulesthat something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain--lockfile-onlyrun still fetches nothing.pnpm packandpnpm publishno longer put.npmignoreand.gitignorefiles in the tarball. Afilesentry that names one still ships it.pnpm now treats
https://registry.npmjs.com/as an alias ofhttps://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.pnx --package=rust@<channel> <tool>runs a tool of that Rust release, for examplepnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets fromrust-toolchain.tomland the target of each--targetargument.pnpm installnow links agent skills for more coding agents. It detects the agent fromANTIGRAVITY_AGENT,COPILOT_AGENT,COPILOT_CLI,CODEX_THREAD_ID,CODEX_SANDBOX,AI_AGENT, andCLAUDE_CODEpnpm/tasks#116.When the registry rejects
pnpm stage publish, the error message now starts with "Failed to stage package".Platinum Sponsors
Gold Sponsors
v12.11.0: pnpm 12.11.0Compare Source
This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the
permissionssetting, and keeps the colors of streamed script output.Minor Changes
pnpm installnow links the agent skills that direct dependencies ship underskills/<name>/SKILL.mdinto the project's agent skill directories, such as.claude/skills. A package's skills are linked only after you approve them withpnpm approve. Theskills.dirssetting chooses the directories pnpm/rfcs#35.Added the
permissionssetting, which records what each dependency may do. Itsbuildcapability works likeallowBuildsand takes precedence over it.pnpm approve-buildswrites topermissionswhenpnpm-workspace.yamlalready has it, and toallowBuildsotherwise.Added
pnpm permissions, which lists the granted and denied permissions and the packages awaiting approval.pnpm approvereviews build scripts and agent skills in one prompt pnpm/rfcs#36.pnpm now installs and runs Rust toolchains.
cargo.enabled,pnpm installinstalls the toolchain named inrust-toolchain.toml. pnpm verifies the release signature, stores the toolchain once per machine, and links it into.pnpm/rust.pnpm runandpnpm execput itscargoandrustcon thePATH.pnpm add -g rust@<channel>installs a toolchain globally. Thecargoandrustccommands run it outside projects that pin their own.pnpm update -g,pnpm ls -g, andpnpm remove -gmanage it like any global package.pnpm add rust@<channel>pins the toolchain inrust-toolchain.toml.pnpm shim add rustadds project-aware shims forcargo,rustc, and the other Rust tools. In a project with arust-toolchain.toml, they run the toolchain the file names and install it on first use. Elsewhere, the next command of the same name onPATHruns, such as rustup's.pnpm runandpnpm execnow keep the colors of script output that they print under the project's name, such as with--stream. pnpm setsFORCE_COLOR=1for these scripts when its own output is in color, unlessFORCE_COLORis already set.Script output is also rendered more cleanly:
\rshows only its last state.pnpm -r runno longer garbles its live output when a script fails while other scripts are still running.Patch Changes
Installing packages
pnpm no longer panics with "unexpected error when polling the I/O driver" when it runs under QEMU user-mode emulation, such as a
linux/amd64container on an Apple Silicon Mac #16696.pnpm view,pnpm update, and other commands that read registry metadata now work behind proxies that end a response by closing the connection without a TLSclose_notifyalert #16704.pnpm now switches to the version a project pins in
packageManagerordevEngines.packageManagereven whenpnpm-workspace.yamlhas a setting the running pnpm cannot read, such as alockfile.includeResolutionSettingssection. If pnpm does not switch, it still reports that setting #16675.When the
pnpmpackage has to download its native binary on first run, it now uses the registry and credentials from.npmrcand from thenpm_config_registryandpnpm_config_registryenvironment variables.COREPACK_NPM_REGISTRYstill takes precedence. A project.npmrcis not read whenCOREPACK_INTEGRITY_KEYSturns off the signature check #16655.pnpm installandpnpm add --confignow applyminimumReleaseAgewhen they resolve a config dependency. A config dependency range resolves to the newest version that is old enough, so a later cleanpnpm install --frozen-lockfileaccepts the lockfile #16660.pnpm removewithcatalogPruneno longer removes catalog entries thatpnpm-lock.yamlstill records for workspace projects missing from disk. Before, a following frozen install failed withERR_PNPM_LOCKFILE_CONFIG_MISMATCH#16679.With
cargo.enabled,pnpm installnow writes the source replacement for vendored crates into.pnpm/crates/config.tomland includes it as optional from.cargo/config.toml. A checkout without.pnpmbuilds with plain Cargo #16659.With
nodeLinker.typeset toloaded, Node.js now stops withERR_PNPM_LOADER_UNSUPPORTED_NODEwhen it preloads the store loader on a version the loader cannot serve. The supported versions are^24.18.0 || >=26.2.0. On other versions, CommonJS packages imported from ESM failed withCannot find moduleon their first relativerequire().On Windows,
pnpm installno longer fails with "The filename, directory name, or volume label syntax is incorrect" when a package contains a file whose name is invalid on Windows, such asicon.svg?as=metadata.d.ts. pnpm removes the invalid characters from the name and prints a warning that lists the renamed files.On Windows, hoisting no longer fails intermittently with link errors when a junction is created or replaced concurrently pnpm/tasks#53.
Resolving dependencies
pnpm install --no-optionalnow installs the peer dependencies a project declares whenautoInstallPeersis on. The lockfile marked such a peeroptional: truewhen another dependency had it as an optional peer.pnpm installandpnpm dedupenow link an optional peer to the workspace package that the workspace root depends on when the picked version matches it. They installed the registry package with the same name and version #16706.Removal overrides such as
"debug>supports-color": "-"now also apply to an optional peer that a package declares only inpeerDependenciesMeta#16681.pnpm addand other installs that re-resolve dependencies now keep the lockeddevEngines.runtimeversion while it still satisfies the declared range #16764.pnpm audit --fix updatenow updates only the dependencies whose locked version is vulnerable #14928.pnpm outdatedandpnpm update --interactivenow applyoverridesbefore they look up the latest version. Before, a dependency overridden to an npm alias was comparedConfiguration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.