Skip to content

Update npm dependencies - #120

Merged
renovate[bot] merged 1 commit into
mainfrom
renovate/npm-dependencies
Oct 18, 2026
Merged

renovate[bot] merged 1 commit into
mainfrom
renovate/npm-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
eslint (source) 10.12.0 → 10.13.0 age confidence devDependencies minor
eslint-plugin-oxlint 1.87.0 → 1.88.0 age confidence devDependencies minor
eslint-plugin-react-dom (source) 5.24.10 → 5.28.1 age confidence devDependencies minor
eslint-plugin-react-jsx (source) 5.24.10 → 5.28.1 age confidence devDependencies minor
eslint-plugin-react-naming-convention (source) 5.24.10 → 5.28.1 age confidence devDependencies minor
eslint-plugin-react-x (source) 5.24.10 → 5.28.1 age confidence devDependencies minor
node (source) 26.11.1 → 26.12.0 age confidence tools minor
oxfmt (source) ^0.72.0 → ^0.73.0 age confidence devDependencies minor
oxlint (source) 1.87.0 → 1.88.0 age confidence devDependencies minor
oxlint-plugin-react-doctor (source) 0.9.17 → 0.9.18 age confidence devDependencies patch
oxlint-tsgolint 7.0.2003 → 7.0.2004 age confidence devDependencies patch
pnpm (source) 12.11.0 → 12.14.0 age confidence tools minor
react (source) 19.3.0 → 19.3.1 age confidence dependencies patch
react-dom (source) 19.3.0 → 19.3.1 age confidence dependencies patch
typescript-eslint (source) 8.71.1 → 8.71.2 age confidence devDependencies patch

Release Notes

eslint/eslint (eslint)

v10.13.0

Compare Source

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#​21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#​21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#​21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#​21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#​21287) (lumir)

Chores

oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)

v1.88.0

Compare Source

What's Changed

New Contributors

Full Changelog: oxc-project/eslint-plugin-oxlint@v1.87.0...v1.88.0

Rel1cx/eslint-react (eslint-plugin-react-dom)

v5.28.1

Compare Source

🐞 Fixes
  • react-dom/no-unknown-property: fixed a false positive where the React camelCase SVG prop renderingIntent was reported as an unknown property, including on code produced by this rule's own autofix for rendering-intent. (#​2055)
  • react-jsx/no-useless-fragment: the auto-fixer no longer unwraps fragments outside JSX whose children are all whitespace (ex: const x = <> </>; or return <>\n</> with allowExpressions: false); the previous fix produced syntactically invalid JavaScript such as const x = ;. These fragments are still reported, just without a fix. (#​2055)
📝 Documentation
  • Aligned rule docs, comments, and diagnostic messages with actual behavior across the plugins. (#​2055)
🏗️ Internal
  • Bumped eslint to 10.13.0, pnpm to 12.14.0, tsl-dx to 0.15.0, @effect/language-service to 0.87.5, and lucide-react to 1.59.0.
  • Added a TanStack Start example project.

Full Changelog: Rel1cx/eslint-react@v5.28.0...v5.28.1

v5.28.0

Compare Source

✨ New
  • @eslint-react/eslint-plugin: the general-purpose presets now enable JSX syntax support via languageOptions.parserOptions.ecmaFeatures.jsx: true, so you no longer need to configure it yourself. (#​2049) Affected presets:
    • recommended
    • recommended-typescript
    • recommended-type-checked
    • strict
    • strict-typescript
    • strict-type-checked
🏗️ Internal
  • Bumped fumadocs-core and fumadocs-ui to 16.17.5, and lucide-react to 1.58.0.

Full Changelog: Rel1cx/eslint-react@v5.27.4...v5.28.0

v5.27.4

Compare Source

🐞 Fixes
  • @eslint-react/jsx: resolveAttributeValue now handles a parser-tolerated JSXFragment in attribute value position (ex: <a href=<></> />), reporting it as kind "element" instead of falling through to undefined; as a result, react-dom/no-missing-iframe-sandbox now reports <iframe sandbox=<></> /> instead of silently skipping it. (#​2048)

Full Changelog: Rel1cx/eslint-react@v5.27.3...v5.27.4

v5.27.3

Compare Source

🐞 Fixes
  • react-jsx/no-key-after-spread: the fast-path text check now matches key assignments with whitespace around = (ex: <div {...props} key = {id} /> or a newline before =), so such elements are no longer silently skipped. (#​2043) Thanks to @​amir-rahmanii!
  • react-jsx/no-children-prop: a children prop alongside nested children content (ex: <div children="x">y</div>, createElement("div", { children: "x" }, "y")) is no longer reported by this rule — that conflict case belongs to react-jsx/no-children-prop-with-children — removing the unsafe merge suggestion and the duplicate diagnostics. (#​2044) Thanks to @​amir-rahmanii!
  • react-jsx/no-children-prop-with-children: empty expression containers (ex: {}, {/* comment */}) are no longer treated as meaningful children, so <div children="x">{/* comment */}</div> is no longer reported. (#​2045) Thanks to @​amir-rahmanii!
📝 Documentation
  • react-naming-convention/ref-name: corrected the additionalRefHooks example to use the /pattern/flags RegExp string form; a bare (a|b) string is treated as exact equality and never matches. (#​2042) Thanks to @​amir-rahmanii!
  • The settings docs examples for the additional hooks settings now use full RegExp strings. (#​2047)
🏗️ Internal
  • @eslint-react/jsx: hasChildren now treats empty expression containers as non-meaningful, aligned with getChildren. (#​2045)
  • react-x: refactored the internals of set-state-in-effect, set-state-in-render, and static-components for readability; no behavior change. (#​2041)
  • Bumped vitest to 5.0.5, next to 16.4.2, fumadocs-core and fumadocs-ui to 16.17.4, and undici to 8.12.2.

Full Changelog: Rel1cx/eslint-react@v5.27.2...v5.27.3

v5.27.2

Compare Source

🏗️ Internal
  • Added the missing @tsconfig/node20 and @types/node dependencies to the workspace packages. (#​2040)
  • Bumped effect and @effect/platform-node to 4.0.5, import-integrity-lint to 1.3.1, and sort-package-json to 4.1.0. (#​2040)

Full Changelog: Rel1cx/eslint-react@v5.27.1...v5.27.2

v5.27.1

Compare Source

🐞 Fixes
  • Lifecycle methods defined as class properties (ex: componentDidMount = () => { this.setState(...) }, including type-expression-wrapped values) are now reported just like the method shorthand form. (#​2039) Affected rules:
    • react-x/no-set-state-in-component-did-mount
    • react-x/no-set-state-in-component-did-update
    • react-x/no-set-state-in-component-will-update
  • Effect cleanups are now recognized when the useEffect call is nested in an outer return (ex: return useEffect(() => () => { ... })), so resources released there are no longer reported as leaked. (#​2039) Affected rules:
    • react-web-api/no-leaked-event-listener
    • react-web-api/no-leaked-fetch
    • react-web-api/no-leaked-intersection-observer
    • react-web-api/no-leaked-interval
    • react-web-api/no-leaked-resize-observer
    • react-web-api/no-leaked-timeout
🏗️ Internal
  • @eslint-react/ast: added the Check.isFunctionOrClass and Check.isTypeOrChainExpression helpers; parent lookups across ast, core, and the rules are now bounded at enclosing function/class boundaries. (#​2039)
  • @eslint-react/core: isUseEffectSetupCallback and isUseEffectCleanupCallback reimplemented on bounded parent lookups. (#​2039)

Full Changelog: Rel1cx/eslint-react@v5.27.0...v5.27.1

v5.27.0

🐞 Fixes
  • react-web-api/no-leaked-event-listener: cleanups returned through conditional expressions (ex: return cond ? () => window.removeEventListener(...) : null) are now recognized and no longer reported. (#​2038)
  • react-web-api/no-leaked-fetch: effect setups wrapped in type expressions (ex: useEffect((() => { fetch(...) }) as any, [])) are now recognized. (#​2038)
  • react-debug/function-component: computed string-literal displayName keys (ex: App["displayName"] = "...") are now recognized. (#​2038)
📝 Documentation
  • Revised the rule implementation pattern guides and refined the core ideas and layer dependency model in the fact-based rule implementation docs. (#​2034, #​2035)
🏗️ Internal
  • @eslint-react/core: accuracy and consistency fixes in detection helpers. (#​2038)
  • react-x: the custom tsl config now enforces the fact-based layer dependency order. (#​2036)
  • Bumped react and react-dom to 19.3.1, and next to 16.4.1.

Full Changelog: Rel1cx/eslint-react@v5.26.7...v5.27.0

v5.26.7

Compare Source

🏗️ Internal
  • @eslint-react/core: collectors now use the node's source range start as the map key, replacing the shared counter, keys are stable across repeated lints, traceable to source positions when debugging, and slightly cheaper than stringified numbers. (#​2033)

Full Changelog: Rel1cx/eslint-react@v5.26.6...v5.26.7

v5.26.6

Compare Source

🏗️ Internal
  • @eslint-react/core: component and hook collectors now use sequential integer keys instead of random randomBytes hex keys, removing node:crypto from the lint hot path. (#​2032) Thanks to @​kurtextrem!
  • Bumped effect to 4.0.4, ts-pattern to 5.9.2, fumadocs-core and fumadocs-ui to 16.17.3, lucide-react to 1.57.0, oxlint to 1.88.0, typedoc-plugin-markdown to 4.14.0, and undici to 8.12.1.
New Contributors

Full Changelog: Rel1cx/eslint-react@v5.26.5...v5.26.6

v5.26.5

Compare Source

🐞 Fixes
  • react-x/set-state-in-effect: a setState on the right side of a short-circuit operator (&&, ||, ??) is now exempt when the left operand is ref-derived (ex: ref.current && setData(1)), matching the existing ref-gated conditional exemption; a left-side setState still runs unconditionally and stays reported. (#​2031)
  • react-x/set-state-in-effect: setup identifiers are now collected from the setup argument of the effect call only; the callee and the deps array are no longer scanned, so a function referenced only in the deps array (ex: useEffect(setup, [helper])) is no longer mistaken for the setup and its setState calls stay unattributed. (#​2031)
  • react-x/set-state-in-effect: arrow function parameters are no longer collected as callback-body setter references (ex: the setState in useMemo((setState) => ..., [])); only actual callback bodies are collected (ex: useMemo(() => setState, [])). (#​2031)

Full Changelog: Rel1cx/eslint-react@v5.26.4...v5.26.5

v5.26.4

Compare Source

🐞 Fixes
  • The name lookup now stops at function boundaries, so expression-bodied factory functions and custom hooks (ex: export const useAnchor = () => useRef(null)) are no longer misreported; calls inside JSX expressions, computed keys, or class static blocks no longer fall back to the outer variable. (#​2029) Closes #​2026. Affected rules:
    • react-naming-convention/context-name
    • react-naming-convention/id-name
    • react-naming-convention/ref-name
  • The name lookup no longer crosses containers or derived values (ex: const refs = [useRef(null)], const n = useRef(0) + 1), so such calls are no longer reported on the enclosing variable; sequence expressions check only the last value, and unresolvable computed keys (ex: { [key]: useRef(null) }) no longer fall back to the outer variable. (#​2030) Affected rules:
    • react-naming-convention/context-name
    • react-naming-convention/id-name
    • react-naming-convention/ref-name

Full Changelog: Rel1cx/eslint-react@v5.26.3...v5.26.4

v5.26.3

Compare Source

🐞 Fixes
  • An enclosing object literal property key now takes precedence over the outer assignment target when statically known (ex: const refs = { myRef: useRef(0) }); computed keys with string literals (ex: refs["value"] = useRef(null)) are now checked, and unresolvable computed keys are no longer reported. (#​2028) Affected rules:
    • react-naming-convention/context-name
    • react-naming-convention/id-name
    • react-naming-convention/ref-name
  • react-naming-convention/ref-name: immediate dereferences of the useRef result through TypeScript type wrappers (ex: (useRef(null) as { current: null }).current, useRef(null)!.current) are no longer reported, extending the #​1375 fix. (#​2028)

Full Changelog: Rel1cx/eslint-react@v5.26.2...v5.26.3

v5.26.2

Compare Source

✨ New
  • react-x/no-unused-props: improved prop usage detection. Props parameters with default values (ex: function Component(props: Props = defaultProps)) are now unwrapped and analyzed, props aliased to a local variable (ex: const alias = props) are tracked through the alias, and template literals without substitutions (ex: props[`foo`]) are recognized as static prop keys. (#​2021)
🐞 Fixes
  • react-x/no-unused-props: a component whose used prop keys cannot be fully determined (ex: it passes the whole props object to another function) now marks all of its declared props as used, so a props declaration shared with another fully analyzable component is no longer reported as unused. (#​2021)
  • react-x/set-state-in-effect: ref-derived values that reach the setState argument through assignment statements (rather than the declaration initializer) are now recognized; only writes that lexically precede the use and live in the use's own function or an ancestor count. (#​2027)
  • react-x/set-state-in-effect: parameters of a helper invoked from the effect setup are now treated as ref-derived when the call-site argument is ref-derived, matched per call site by parameter definition. (#​2027)
  • react-x/set-state-in-effect: a .current read rooted at a function parameter is now recognized as a ref read (ex: setReferenceElement(anchor?.current) where anchor is a RefObject prop); previously only parameters named ref or ending in Ref were recognized. (#​2027)
  • react-x/no-unused-class-component-members: public methods (including function-valued properties) of an exported class component are no longer reported as unused, as they may be part of the component's imperative API invoked by consumers through refs. Data fields, private/protected members, and members of non-exported classes are still reported. (#​2024)
🏗️ Internal
  • Ordered message ids by first usage and unified default/suggestion message id naming across react-dom, react-jsx, react-web-api, and react-x rules. (#​2022)

Full Changelog: Rel1cx/eslint-react@v5.26.1...v5.26.2

v5.26.1

Compare Source

🏗️ Internal
  • Renamed the internal suggestion message id from "replace" to "suggest". Affected rules:
    • react-x/no-context-provider
    • react-x/no-forward-ref
    • react-x/no-use-context
  • react-x/immutability: moved context-dependent helpers from helpers.ts into origins.ts and effects.ts to match the fact-based implementation pattern.
  • react-x/globals: moved resolveToFunction from helpers.ts to origins.ts.
  • Bumped effect to 4.0.3, tsl-dx to 0.14.1, @tsconfig/node20 to 20.1.10, and @types/node to 20.19.43.
📝 Documentation
  • Refreshed spec diff verification dates and notes for react-x rules.

Full Changelog: Rel1cx/eslint-react@v5.26.0...v5.26.1

v5.26.0

Compare Source

✨ New
  • Lowered the minimum required Node.js version from >=22.0.0 to >=20.19.0. (#​2020)

Full Changelog: Rel1cx/eslint-react@v5.25.0...v5.26.0

v5.25.0

Compare Source

✨ New
  • react-dom/no-unsafe-target-blank: added an allowReferrer option (default: false). When enabled, rel="noopener" alone is accepted and the suggested fix adds rel="noopener" instead of rel="noreferrer noopener", preserving referrer information while still requiring an explicit token. (#​2019) Closes #​2012.
🏗️ Internal
  • @eslint-react/ast: added hasParent and hasEnclosingTryBlock shortcuts to Traverse. (#​2016)
  • @eslint-react/ast: renamed the types module to tree and narrowed the Extract.unwrap result type. (#​2017)
  • @eslint-react/core: removed the unused REACT_BUILTIN_HOOK_NAMES constant.
  • Bumped tsdown to 0.23.1, @effect/platform-node to 4.0.3, pnpm to 12.11.2, @types/node to 26.6.5, setup-uv to v10.3.0, and fumadocs and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.24.10...v5.25.0

nodejs/node (node)

v26.12.0: 2026-10-14, Version 26.12.0 (Current), @​richardlau

Compare Source

Notable Changes
  • [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #​66533
  • [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #​66335
Commits

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) October 12, 2026 01:45
@renovate
renovate Bot requested a review from No767 as a code owner October 12, 2026 01:45
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 12, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 12, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 14, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 14, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 15, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 15, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 16, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 16, 2026
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 16, 2026
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from a409aed to 2df4f49 Compare October 18, 2026 11:24
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from 2df4f49 to 1ce2db9 Compare October 18, 2026 13:57
@renovate
renovate Bot merged commit b6929d0 into main Oct 18, 2026
1 check passed
@renovate
renovate Bot deleted the renovate/npm-dependencies branch October 18, 2026 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant