chore(deps): update npm devdependencies

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@elastic/elasticsearch (source)	9.5.0 → 9.5.1			devDependencies	patch
@eslint-react/eslint-plugin (source)	5.18.6 → 5.26.1			devDependencies	minor	5.27.1 (+8)
@eslint/eslintrc	3.3.6 → 3.3.7			devDependencies	patch
@storybook/addon-docs (source)	10.5.10 → 10.6.1			devDependencies	minor	10.6.2
@storybook/addon-themes (source)	10.5.10 → 10.6.1			devDependencies	minor	10.6.2
@storybook/react-vite (source)	10.5.10 → 10.6.1			devDependencies	minor	10.6.2
@vitejs/plugin-react (source)	6.1.1 → 6.1.2			devDependencies	patch
globals	17.11.0 → 17.13.0			devDependencies	minor
postcss (source)	8.5.26 → 8.5.29			devDependencies	patch	8.5.30
postcss-prefixwrap	1.58.0 → 1.59.1			devDependencies	minor
storybook (source)	10.5.10 → 10.6.1			devDependencies	minor	10.6.2
tsc-alias (source)	1.9.2 → 1.9.7			devDependencies	patch
typescript (source)	^6 → 6.0.3			devDependencies	pin
typescript-eslint (source)	8.68.0 → 8.71.1			devDependencies	minor	8.71.2
vite (source)	8.2.2 → 8.3.4			devDependencies	minor

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

elastic/elasticsearch-js (@​elastic/elasticsearch)

v9.5.1

Compare Source

Changelog

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.26.1

Compare Source

🏗️ Internal

• Renamed the internal suggestion message id from "replace" to "suggest". Affected rules:
  • react-x/no-context-provider
  • react-x/no-forward-ref
  • react-x/no-use-context
• react-x/immutability: moved context-dependent helpers from helpers.ts into origins.ts and effects.ts to match the fact-based implementation pattern.
• react-x/globals: moved resolveToFunction from helpers.ts to origins.ts.
• Bumped effect to 4.0.3, tsl-dx to 0.14.1, @tsconfig/node20 to 20.1.10, and @types/node to 20.19.43.

📝 Documentation

• Refreshed spec diff verification dates and notes for react-x rules.

Full Changelog: Rel1cx/eslint-react@v5.26.0...v5.26.1

v5.26.0

Compare Source

✨ New

• Lowered the minimum required Node.js version from >=22.0.0 to >=20.19.0. (#​2020)

Full Changelog: Rel1cx/eslint-react@v5.25.0...v5.26.0

v5.25.0

Compare Source

✨ New

• react-dom/no-unsafe-target-blank: added an allowReferrer option (default: false). When enabled, rel="noopener" alone is accepted and the suggested fix adds rel="noopener" instead of rel="noreferrer noopener", preserving referrer information while still requiring an explicit token. (#​2019) Closes #​2012.

🏗️ Internal

• @eslint-react/ast: added hasParent and hasEnclosingTryBlock shortcuts to Traverse. (#​2016)
• @eslint-react/ast: renamed the types module to tree and narrowed the Extract.unwrap result type. (#​2017)
• @eslint-react/core: removed the unused REACT_BUILTIN_HOOK_NAMES constant.
• Bumped tsdown to 0.23.1, @effect/platform-node to 4.0.3, pnpm to 12.11.2, @types/node to 26.6.5, setup-uv to v10.3.0, and fumadocs and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.24.10...v5.25.0

v5.24.10

Compare Source

📝 Documentation

• Added a link to the Astryx no-react-introspection rule in the react-x/no-children-count and react-x/no-children-map rule documentation.

🏗️ Internal

• Disabled test isolation in the vitest config.
• Reordered react-web-api/no-leaked-event-listener test specs from typical cases to edge cases. (#​2015)
• Unified KNOWN_-prefixed constant names. (#​2014) Affected rules:
  • react-x/no-array-index-key
  • react-x/no-missing-key
• Bumped effect to 4.0.2, @effect/platform-node to 4.0.2, nx to 23.3.0, vite to 8.3.4, lucide-react to 1.53.0, and pnpm to 12.10.1.

Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10

v5.24.9

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: optional chaining in a setState argument (ex: setData(ref.current?.value), setWidth(el?.offsetWidth ?? 0) where el is ref-derived) no longer defeats the ref-value exemption; the ChainExpression wrapper is now unwrapped during ref-source detection. (#​2011)

📝 Documentation

• Aligned rule documentation with the current react.dev reference docs. (#​2013)

Full Changelog: Rel1cx/eslint-react@v5.24.8...v5.24.9

v5.24.8

Compare Source

🐞 Fixes

• react-x/rules-of-hooks: removed the incorrect FIX feature declaration; the rule does not provide an auto-fix and is no longer advertised as fixable. (#​2009)

🏗️ Internal

• Added edge-case test specs from the v5.24.7 change review covering react-x/immutability, react-x/set-state-in-render, react-web-api/no-leaked-event-listener, and the leaked-observer rules.
• Bumped next to 16.4.0, vite to 8.3.3, and related dependencies.

Full Changelog: Rel1cx/eslint-react@v5.24.7...v5.24.8

v5.24.7

Compare Source

🐞 Fixes

• react-x/immutability: no longer reports rebinding a plain local alias of props/state as a mutation; destructured props rebinding and member writes through aliases are still reported. (#​1995)
• react-x/set-state-in-render: setState calls after nested component or hook declarations are now attributed to the outer component again. (#​2004)
• react-x/set-state-in-render: anonymous callbacks passed directly to memo()/forwardRef() are now treated as component render functions. (#​1998)
• react-web-api/no-leaked-fetch: signal alias chains are now resolved recursively, so fetches with aliased signals correctly pair with their cleanup abort call. (#​1997)
• react-web-api/no-leaked-event-listener: bare global addEventListener(...) calls now pair with matching removeEventListener(...) cleanup calls. (#​1996)
• react-web-api/no-leaked-event-listener: a signal destructured from new AbortController() is now recognized. (#​2001)
• react-web-api/no-leaked-resize-observer / react-web-api/no-leaked-intersection-observer: disconnect() / unobserve(...) now only count as cleanup in the cleanup phase; useRef-held observer instances are tracked; unobserve(...) inside the observer callback no longer pairs with observe(...). (#​2002, #​2003)

🏗️ Internal

• Bumped typescript-eslint to 8.71.1 and postcss to 8.5.29.

Full Changelog: Rel1cx/eslint-react@v5.24.6...v5.24.7

v5.24.6

Compare Source

🐞 Fixes

• react-x/no-unused-props: computed member access and destructuring with an identifier key (ex: props[key], const { [key]: value } = props) no longer count as usage of a prop named after the key; the rule now bails out on such dynamic keys instead of reporting actually-used props as unused. (#​1994)
• react-x/set-state-in-effect: object-pattern destructuring of the useState tuple is now resolved by numeric key: a name bound at key 0 (ex: const { 0: value } = useState()) is no longer mistaken for the setter, while key 1 (ex: const { 1: setData } = useState()) is still recognized. (#​1994)
• react-x/set-state-in-render: same useState object-pattern destructuring fix as set-state-in-effect. (#​1994)

Full Changelog: Rel1cx/eslint-react@v5.24.5...v5.24.6

v5.24.5

Compare Source

🏗️ Internal

• Self-linted rule implementations with eslint-plugin-eslint-plugin, removing redundant empty defaultOptions declarations and enforcing meta.defaultOptions for rules with options. (#​1993) Thanks to @​rakleed and @​Rel1cx!
• Minor code cleanups in react-web-api/no-leaked-intersection-observer, react-x/no-create-ref, react-x/no-nested-lazy-component-declarations, and react-x/use-state. Thanks to @​Rel1cx!
• Bumped effect to 4.0.1, pnpm to 12.9.1, fumadocs-core and fumadocs-ui to 16.16.1, lucide-react to 1.52.0, tsl-dx to 0.14.0, and tinybench to 6.2.0. Thanks to @​Rel1cx!

Full Changelog: Rel1cx/eslint-react@v5.24.4...v5.24.5

v5.24.4

Compare Source

🏗️ Internal

• Enable dead-code elimination in tsdown config, producing smaller published packages.

Full Changelog: Rel1cx/eslint-react@v5.24.3...v5.24.4

v5.24.3

Compare Source

🏗️ Internal

• @local/eff: minor code optimizations.
• @eslint-react/shared: minor code optimizations.

Full Changelog: Rel1cx/eslint-react@v5.24.2...v5.24.3

v5.24.2

Compare Source

🏗️ Internal

• @eslint-react/core, @eslint-react/var, the react-dom plugin, and the react-x plugin: replaced in operator checks with the hasProperty helper from @local/eff.
• @eslint-react/shared: documented getNormalizedSettings.
• JSDoc comments are now stripped from the tsdown build output, producing smaller published packages.

Full Changelog: Rel1cx/eslint-react@v5.24.1...v5.24.2

v5.24.1

Compare Source

📝 Documentation

• Added a link to the Astryx no-react-introspection rule in the react-x/no-children-count and react-x/no-children-map rule documentation.

🏗️ Internal

• Disabled test isolation in the vitest config.
• Reordered react-web-api/no-leaked-event-listener test specs from typical cases to edge cases. (#​2015)
• Unified KNOWN_-prefixed constant names in react-x/no-array-index-key and react-x/no-missing-key. (#​2014)
• Bumped effect to 4.0.2, @effect/platform-node to 4.0.2, nx to 23.3.0, vite to 8.3.4, lucide-react to 1.53.0, and pnpm to 12.10.1.

Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10

v5.24.0

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: more value shapes are recognized as ref-derived setState arguments: interpolations in template literals (ex: setData(`${ref.current}`)), tagged templates (both the quasi and a ref-derived tag), object and array literals (ex: setData({ value: ref.current })), and spreads (ex: setData({ ...ref.current })) — previously these fell through to the default case and were reported. (#​1988)

📝 Documentation

• Added eslint-config-xo-react to the website's community presets.

🏗️ Internal

• @local/eff: added predicate combinators and type guards synced with effect, and migrated call sites across the workspace to them. (#​1989)
• react-x/set-state-in-effect, react-x/set-state-in-render, and react-x/use-memo: reworked to the fact-based implementation pattern — fact collection (collect.ts), provenance resolution (origins.ts), and violation inference (effects.ts) are now separate modules, with lib.ts replaced by a pure-AST helpers.ts; set-state-in-effect again classifies a hook name configured as both additionalStateHooks and additionalEffectHooks as a state hook first. (#​1983, #​1985, #​1986)
• react-x/use-state: aligned the nested-expression collectors' visitor keys to callee-first order, matching eslint-visitor-keys; no behavior change. (#​1988)
• Migrated package unit tests to the shared @local/testkit helpers. (#​1987)
• Renamed message ids to kebab-case across all plugins. (#​1984)
• Bumped fumadocs-core and fumadocs-ui to 16.15.18, fumadocs-mdx to 15.4.6, lucide-react to 1.50.0, and @types/node to 26.6.4.

Full Changelog: Rel1cx/eslint-react@v5.23.5...v5.24.0

v5.23.5

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: the ref-derived value exemption now also covers setState calls reached indirectly through functions or hook callbacks invoked from the effect setup, not only setState written directly in the setup body. (#​1982)
• react-x/set-state-in-effect: more ref read shapes are recognized as ref-derived values — <ref-named>.current anywhere in a member chain, locals derived from other ref-derived locals, and reads through a ref/xxxRef parameter. (#​1982)
• react-web-api/no-leaked-event-listener: removeEventListener inside a function called from the effect cleanup now pairs with its addEventListener, fixing false positives for listeners removed on unmount; cleanup calls resolve to the actual functions, so same-named shadowed functions no longer pair by coincidence. (#​1982)

🏗️ Internal

• Bumped effect to 4.0.0 and migrated the repo scripts to the v4 APIs. (#​1981)

Full Changelog: Rel1cx/eslint-react@v5.23.4...v5.23.5

v5.23.4

Compare Source

🐞 Fixes

• Added the missing react-x/static-components rule to the disable-experimental preset. (#​1980)
• Fixed type imports in react-x/exhaustive-deps and react-x/rules-of-hooks (RuleFeature is now imported from @eslint-react/eslint instead of @eslint-react/shared).

📝 Documentation

• react-jsx/no-useless-fragment: clarified the scope of the allowExpressions option and unified experimental-rule callout wording across rule docs.
• react-x: unified cross-rule references in rule docs to full rule names.
• Removed low-relevance entries from the further reading sections of rule docs, and removed a redundant note about eslint being an optional peer dependency.
• Fixed inaccuracies in internal documentation. (#​1980)

🏗️ Internal

• Adopted ts-pattern for type checks in @eslint-react/core, @eslint-react/jsx, and the react-dom plugin, and declared the missing ts-pattern dependencies.
• Added behavior boundary tests for react-jsx/no-useless-fragment.
• Bumped fumadocs-core, fumadocs-ui, and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.23.3...v5.23.4

v5.23.3

Compare Source

🐞 Fixes

• react-x/immutability: reassigning a binding that resolves to component props or state (value = value + "!", count++, including destructuring and for...of rebinding forms) is now reported as a direct mutation, matching upstream react-hooks/immutability; rebinding iterator or shallow-copy bindings remains allowed. (#​1979)
• react-x/set-state-in-effect: ref reads traced through intermediate local computations (ex: const dv = visible - prevVisible.current) are now recognized as ref-derived values, and a preceding early-return guard whose test is ref-derived (ex: if (dv === 0) return;) now exempts the setState calls that follow it — previously only setState nested directly inside a ref-gated if/conditional was exempted. Aligns with react-hooks 7.1.1. (#​1979)

📝 Documentation

• react-x/no-unstable-context-value: documented the React 19 <Context> provider detection heuristic and its name-based limitations. (#​1979)
• Updated the README badges to reference eslint-plugin-react-x.

Full Changelog: Rel1cx/eslint-react@v5.23.2...v5.23.3

v5.23.2

Compare Source

🏗️ Internal

• Removed unused dependencies and fixed phantom dependencies across the workspace.
• Bumped next to 16.3.7, fumadocs-core and fumadocs-ui to 16.15.16, and eslint-plugin-package-json to 1.10.1.

Full Changelog: Rel1cx/eslint-react@v5.23.1...v5.23.2

v5.23.1

Compare Source

🏗️ Internal

• Re-verified and synchronized the IMPL-SPEC diff reports for the following react-x rules. (#​1977, #​1978)
  • react-x/error-boundaries
  • react-x/globals
  • react-x/immutability
  • react-x/purity
  • react-x/refs
  • react-x/set-state-in-effect
  • react-x/set-state-in-render
  • react-x/use-memo
• Bumped typescript-eslint to 8.71.0, tsl-dx to 0.13.7, and pnpm to 12.8.1.

📝 Documentation

• Added argo-cd, griffel, tanstack/table, and eslint-config-studio to the website's community lists.

Full Changelog: Rel1cx/eslint-react@v5.23.0...v5.23.1

v5.23.0

Compare Source

✨ New

• react-x/static-components: dynamic creation-site tracing now follows both sides of logical expressions (ex: const C = DefaultComponent || (() => <div />)) and the last element of sequence expressions (ex: const C = (setup(), () => <div />)), in initializers and reassignments alike. (#​1975)

🐞 Fixes

• react-x/static-components: parameters of nested non-component functions (ex: function render(Comp) { return <Comp /> }) are no longer mistaken for render-created components; definitions are judged by definition type instead of AST node type. (#​1975)
• react-x/static-components: createdHere is now reported once per creation site instead of once per JSX usage; the default diagnostic remains per usage. (#​1975)

🏗️ Internal

• react-x/static-components: restructured the rule to the fact-based implementation pattern — collect.ts (usage facts), origins.ts (creation-site resolution), and effects.ts (effect inference) are now separate modules, with reporting centralized in Program:exit; added 14 boundary test cases covering creation-site resolution, render boundaries, and per-usage reporting. (#​1975)
• Renamed lib.ts to helpers.ts in the fact-based react-x rules (globals, immutability, refs). (#​1976)
• Bumped @effect/language-service to 0.87.3 and oxlint to 1.86.0.

Full Changelog: Rel1cx/eslint-react@v5.22.1...v5.23.0

v5.22.1

Compare Source

🐞 Fixes

• react-x/use-state: directly returning the useState result (ex: return React.useState()) is now allowed regardless of the rule's options, matching the exemption in the original react/hook-use-state rule. Covers explicit, implicit (arrow function), and type-asserted returns; lazy initialization checks still apply. (#​1974, closes #​1963)

📝 Documentation

• Added a note about eslint being an optional peer dependency to the READMEs and the website's getting-started guides.
• Simplified the @eslint-react/kit README to point to the full documentation.

Full Changelog: Rel1cx/eslint-react@v5.22.0...v5.22.1

v5.22.0

Compare Source

✨ New

• react-dom/no-unknown-property: added React 19.3 properties to the known property allowlist. (#​1973)
  • closedby on dialog
  • onFullscreenChange, onFullscreenError (and their Capture variants), credentialless, and maskType — gated on React version >= 19.3.0
  • onLoad on body
  • onScrollEnd (and its Capture variant)
  • shadowrootmode, shadowrootclonable, shadowrootdelegatesfocus, and shadowrootserializable on template

🏗️ Internal

• Bumped fumadocs-core and fumadocs-ui to 16.15.15.

Full Changelog: Rel1cx/eslint-react@v5.21.3...v5.22.0

v5.21.3

Compare Source

🐞 Fixes

• react-x/purity: reverted the v5.21.2 exemption for impure calls in useRef initializer arguments (ex: useRef(document.createElement("div"))); such calls are reported again. (#​1972)

Full Changelog: Rel1cx/eslint-react@v5.21.2...v5.21.3

v5.21.2

Compare Source

🐞 Fixes

• react-x/no-unnecessary-use-prefix: hooks that call other hooks only within nested callbacks, functions named exactly use, and hooks defined in test mock module registrations are no longer reported. (#​1971)
• react-x/no-unused-class-component-members: methods invoked by host environments through refs (React Native's NativeMethods) are no longer reported as unused. (#​1971)
• react-x/purity: async function components in modules without a use client directive and impure calls in useRef initializer arguments are no longer reported. (#​1971)
• react-x/set-state-in-effect: local variables initialized from nested member expressions rooted at a ref are now recognized as ref-derived values and no longer reported. (#​1971)

🏗️ Internal

• @eslint-react/ast: predefined and exported common node-type helpers in the Check namespace and migrated call sites to them.

📝 Documentation

• Website rule docs no longer include the per-rule ## Versions section; a rule's changelog can be viewed directly via the Rule Changelog link under the ## Resources section of each rule doc.

Full Changelog: Rel1cx/eslint-react@v5.21.1...v5.21.2

v5.21.1

Compare Source

🐞 Fixes

• Fixed missed reports where a timer, fetch controller, or observer created in one effect was treated as cleaned up because an unrelated cleanup in another effect referenced a different variable with the same name; identifier matching now resolves both sides to their variables by scope instead of comparing names only. (#​1969) Affected rules:
  • react-web-api/no-leaked-timeout
  • react-web-api/no-leaked-interval
  • react-web-api/no-leaked-fetch
  • react-web-api/no-leaked-resize-observer
  • react-web-api/no-leaked-intersection-observer

🏗️ Internal

• Simplified the react-web-api leaked-resource rules by replacing manual function-context stack tracking with Traverse.findParent ancestor lookup, and added boundary tests covering deeply nested callbacks, cross-effect pairing, and wrapped or referenced setup callbacks. (#​1969) Affected rules:
  • react-web-api/no-leaked-timeout
  • react-web-api/no-leaked-interval
  • react-web-api/no-leaked-fetch
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-resize-observer
  • react-web-api/no-leaked-intersection-observer
• @eslint-react/var: isAssignmentTargetEqual no longer short-circuits same-name identifiers through structural equality; identifier pairs are compared with scope-aware value equality. (#​1969)
• react-x/no-unused-class-component-members: removed the manual class and method context stacks; the enclosing class and method are now resolved at the hit point with Traverse.findParent ancestor lookup, and the per-class member definition/usage maps are initialized lazily. (#​1970)

Full Changelog: Rel1cx/eslint-react@v5.21.0...v5.21.1

v5.21.0

Compare Source

✨ New

• The plugins can now be used with Oxlint without an eslint installation: eslint is now an optional peer dependency across all published packages, and the rule utilities no longer eagerly load the eslint package at import time. (#​1965)

🏗️ Internal

• @eslint-react/core: removed the unused isAssignmentToThisState helper, and simplified the react-x class-component rules (no-access-state-in-setstate, no-class-component, no-direct-mutation-state, no-set-state-in-*) accordingly.
• @eslint-react/eslint: added a local getConstrainedTypeAtLocation helper (adapted from @typescript-eslint/type-utils) so consumers don't need to load @typescript-eslint/type-utils, whose entry point eagerly loads the eslint package. (#​1965)
• Bumped typescript-eslint to 8.70.1, fumadocs to 16.15.14, fumadocs-mdx to 15.4.5, vite to 8.3.1, and other dependencies.

New Contributors

• Dom Porada (@​porada) made their first contribution in #​1965.

Full Changelog: Rel1cx/eslint-react@v5.20.8...v5.21.0

v5.20.8

🐞 Fixes

• @eslint-react/core: isJsxLike now recognizes JSX wrapped in TypeScript expressions (as, satisfies, type assertions, and non-null assertions) and await expressions.
• @eslint-react/jsx: isFragmentElement now requires the configured jsxFragmentFactory, avoiding an implicit React fragment factory for custom JSX runtimes.

🏗️ Internal

• @eslint-react/jsx: exported the AttributeValue type from the package entry point.
• @eslint-react/var: renamed the AssignmentTarget type to EnclosingAssignmentTarget and inlined getRequireExpressionArguments into its sole consumer.

Full Changelog: Rel1cx/eslint-react@v5.20.6...v5.20.8

v5.20.6

Compare Source

🐞 Fixes

• react-x/globals: for...in/for...of loop targets without a declaration (e.g. for (globalValue of items)) are now collected as writes instead of being missed.
• react-x/immutability: destructuring assignment targets (e.g. ({ a: props.x } = value)) and for...in/for...of loop targets without a declaration are now collected as mutations instead of being missed.
• react-x/purity: builtin alias resolution now preserves the property path, so aliases of impure builtins (const random = Math.random; random(), const { now } = Date; now(), window.Math.random()) are now detected instead of being missed; unknown-global roots are not followed, preventing speculative reports.
• react-x/refs: destructuring assignments, for-in/of loop targets, and delete operations on ref.current are now classified as writes instead of being misreported as reads.
• react-x/refs: refs passed to constructor calls (new Widget(ref)) and tagged templates are now checked for render-time exposure, same as refs passed to plain functions.
• react-x/refs: the mergeRefs exemption for passing refs now survives simple variable aliases (const combine = mergeRefs), resolved position-aware so reassigned aliases lose it again.
• react-x/use-memo: reassignments of outer variables through destructuring patterns and for...in/for...of loop targets inside useMemo callbacks are now reported instead of being missed; property mutation targets remain exempt, matching the React Compiler's StoreContext semantics.

🏗️ Internal

• @eslint-react/var: split resolve into a value-based resolve and a new origin-based resolveOrigin, and updated the consumers in react-web-api and react-x rules accordingly. (#​1964)
• Bumped fumadocs to 16.15.12, fumadocs-mdx to 15.4.3, tsl-dx to 0.13.6, eslint-plugin-de-morgan to 2.2.0, and eslint-plugin-regexp to 3.3.1.

Full Changelog: Rel1cx/eslint-react@v5.20.5...v5.20.6

v5.20.5

Compare Source

🐞 Fixes

• react-web-api/no-leaked-fetch: fixed a false positive where an abort call nested in a callback within the cleanup function (e.g. setTimeout(() => ctrl.abort())) was not recognized, causing a spurious expectedAbortInCleanup report; the abort lookup now finds the nearest enclosing setup/cleanup function instead of requiring the innermost one. (#​1962)

Full Changelog: Rel1cx/eslint-react@v5.20.4...v5.20.5

v5.20.4

Compare Source

🐞 Fixes

• react-web-api/no-leaked-event-listener: listeners that are only added inside the effect cleanup are now reported when the matching removeEventListener is in the setup (reversed setup/cleanup pairing), since a listener attached on unmount is never removed. (#​1961)

🏗️ Internal

• react-jsx and react-web-api rules: unified rule code style and variable naming across the plugins. (#​1960, #​1961)

Full Changelog: Rel1cx/eslint-react@v5.20.3...v5.20.4

v5.20.3

Compare Source

🏗️ Internal

• @eslint-react/ast: replaced getIdentifierAt with the new getMemberChain helper and moved getInnermostCall to its sole consumer in react-x/no-nested-component-definitions. (#​1959)
• react-dom rules: unified rule code style and variable naming across the plugin, and switched no-find-dom-node to import-aware detection via createImportLookup. (#​1958)

Full Changelog: Rel1cx/eslint-react@v5.20.2...v5.20.3

v5.20.2

Compare Source

🐞 Fixes

• Fixed false negatives in the JSX element resolver used by the react-dom rules: polymorphic components written as member expressions (e.g. <motion.div as="button">) were mistaken for host elements, so the polymorphic prop was ignored and these rules skipped them entirely; they are now resolved through the polymorphic prop and checked like the underlying DOM element. String values of the polymorphic prop are also normalized to lowercase, so as="BUTTON" is treated as button. Affected rules:
  • react-dom/no-missing-button-type
  • react-dom/no-missing-iframe-sandbox
  • react-dom/no-unsafe-iframe-sandbox
  • react-dom/no-unsafe-target-blank
  • react-dom/no-void-elements-with-children

🏗️ Internal

• The normalized polymorphicPropName setting type is corrected from string | null to string — it could never be null at runtime — and the unreachable null branch in the JSX element resolver used by the react-dom rules is removed.

Full Changelog: Rel1cx/eslint-react@v5.20.1...v5.20.2

v5.20.1

Compare Source

🐞 Fixes

• react-dom/no-flush-sync: flushSync calls are now detected by tracking react-dom imports directly instead of matching by name, so aliased named imports (e.g. import { flushSync as fs } from "react-dom") and default/namespace member calls (e.g. ReactDOM.flushSync()) are reported, while local functions, object methods, and same-named APIs from other packages (e.g. pino's destination().flushSync()) are no longer misreported. (#​1954, closes #​1943)

🏗️ Internal

• react-dom/no-flush-sync and react-dom/no-find-dom-node: API call checks now use core.isAPICall; core.isJsxLike now uses isCreateElementCall.
• Added Node types reference to all package tsl/tsdown configs.
• Bumped eslint to 10.11.0, eslint-plugin-jsdoc to 64.5.4, eslint-plugin-package-json to 1.9.0, typedoc-plugin-markdown to 4.13.1, @types/node to 26.6.2, pnpm to 12.5.1, and the dprint JSON plugin to 0.24.0.

New Contributors

• changbaebang (@​changbaebang) made their first contribution in #​1954.

Full Changelog: Rel1cx/eslint-react@v5.20.0...v5.20.1

v5.20.0

Compare Source

✨ New

• react-x/immutability: mutations on for...of iterator variables (e.g. for (const item of items) { item.done = true; }), including destructured iterator bindings, are now reported when the iterated collection resolves through its root identifier to a component's props, a state value, or a shallow copy of either, since the iterator variable is bound to each shared element of the original collection. Member-expression collections (for (const item of props.items)) are traced to their root; for...in loops and right sides without a root identifier are not traced. (#​1953, closes #​1764)

🏗️ Internal

• Bumped @types/node to 26.6.1, tsl-dx to 0.13.5, eslint-plugin-jsdoc to 64.5.2, lucide-react to 1.47.0, and pnpm to 12.4.2.

New Contributors

• Michael@​WCD (@​Michael-WhiteCapData) made their first contribution in #​1953.

Full Changelog: Rel1cx/eslint-react@v5.19.1...v5.20.0

v5.19.1

Compare Source

🐞 Fixes

• react-x/immutability: the first parameter of a function is now classified as props only when the function is a confirmed component — one that returns JSX or calls hooks — so mutating the first parameter of a function that merely looks like a component (e.g. an event-handler factory whose returned function never renders and calls no hooks) is no longer reported. (#​1952, closes #​1951)

🏗️ Internal

• react-x/immutability: renamed MUTATING_METHODS/NAVIGATION_HOOKS to KNOWN_MUTATING_METHODS/KNOWN_MUTATING_HOOKS and added precise behavior boundary tests.
• react-x/globals: restructured internals (split into collect, effects, and origins modules) to match the in-progress feat/environment-config implementation; no behavior change.
• Website: awaited the async llms.txt index generation and fixed the website data update step to run before building.
• CI: removed the generated file verification step.
• Bumped typescript-eslint to 8.70.0, react/react-dom to 19.3.0, next to 16.3.5, vite to 8.3.0, effect to 3.22.2, fumadocs to 16.15.10, eslint-plugin-jsdoc to 64.3.9, tailwind-merge to 3.7.0, ansis to 4.4.0, nx to 23.2.1, eslint-plugin-react-refresh to 0.5.6, eslint-plugin-package-json to 1.8.1, @types/node to 26.5.1, @types/react to 19.3.0, @types/react-dom to 19.3.0, and pnpm to 12.4.1.

Full Changelog: Rel1cx/eslint-react@v5.19.0...v5.19.1

v5.19.0

Compare Source

✨ New

• react-x/immutability: direct mutations of props and state are now reported — member assignments, updates, deletions, and mutating method calls are flagged when the mutated value resolves (through variable-declarator aliases) to a component's props, a useState/useReducer state value, or a custom hook matching the additionalStateHooks setting, independent of whether the mutation happens inside a function that reaches a freeze sink. (#​1948, closes #​1941)
• react-x/immutability: added shallow-copy awareness — nested mutations through an object/array literal built by spreading a props or state value (e.g. const copy = { ...state } / const copy = [...state]) are reported, since the nested values are still shared with the original; writes to the copy's own top-level slots are not reported. (#​1948)

Full Changelog: Rel1cx/eslint-react@v5.18.10...v5.19.0

v5.18.10

Compare Source

🐞 Fixes

• The remaining disable-* preset configs in react-x and react-rsc now also register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when combining them with a manually registered plugin. (follow-up to #​1947, see #​1946)

🏗️ Internal

• Website: removed fumadocs-twoslash from serverExternalPackages to fix a prerender error.

Full Changelog: Rel1cx/eslint-react@v5.18.9...v5.18.10

v5.18.9

Compare Source

🏗️ Internal

• Bumped eslint to 10.10.0, vitest to 5.0.0, tsdown to 0.23.0, nx to 23.2.0, dprint to 0.57.4, @types/react-dom to 19.2.7, @eslint/compat to 2.1.1, and @nubjs/nub to 0.8.3.

Full Changelog: Rel1cx/eslint-react@v5.18.8...v5.18.9

v5.18.8

Compare Source

🐞 Fixes

• Preset configs (recommended, strict, etc.) now register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when the plugin is registered manually and a preset is extended at the same time. (#​1947, closes #​1946)

🏗️ Internal

• Re-enabled the import-integrity-lint plugin and patched its path prefix check so sibling directories like examples/preact and examples/preact-compat no longer collide.
• Pinned fast-uri to ^3.1.5 to fix CVE-2026-18446 (GHSA-7p8r-x3mc-p8w7).
• Bumped @effect/language-service to 0.87.2, @effect/platform to 0.97.1, @effect/platform-node to 0.108.1, @nubjs/nub to 0.8.2, @types/node to 26.4.1, dprint to 0.57.0, and lucide-react to 1.39.0.

Full Changelog: Rel1cx/eslint-react@v5.18.7...v5.18.8

v5.18.7

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: no longer misattributes render-phase setState calls to effects when the state updater is passed through a prop function. (#​1945)

🏗️ Internal

• Bumped typescript-eslint to 8.69.0, eslint to 10.9.1, vitest to 4.1.11, @types/node to 26.4.0, @types/react-dom to 19.2.5, eslint-plugin-package-json to 1.8.0, import-integrity-lint to 1.3.0, nx to 23.1.3, publint to 0.3.24, typedoc-plugin-markdown to 4.13.0, and pnpm to 11.25.0.

New Contributors

• Anmol Sharma (@​cyclomati) made their first contribution in #​1945.

Full Changelog: Rel1cx/eslint-react@v5.18.6...v5.18.7

eslint/eslintrc (@​eslint/eslintrc)

v3.3.7

Compare Source

Bug Fixes

• Bump js-yaml to 4.3.1 (#​239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#​243) (bb0d97a)

storybookjs/storybook (@​storybook/addon-docs)

[v10.6.1](https://redirect.github.com/storybookjs/storybook/blob/HEAD/

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-15T06_02_47_159Z-debug-0.log