Update npm dependencies#783
Merged
Merged
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
✅ Deploy Preview for ucmacm ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.100.14→5.101.05.100.14→5.101.01.170.10→1.170.151.168.13→1.168.1825.9.1→25.9.219.2.15→19.2.171.16.1→1.17.01.67.0→1.68.05.8.7→5.8.135.8.7→5.8.135.8.7→5.8.135.8.7→5.8.13^0.52.0→^0.53.01.67.0→1.68.011.5.0→11.5.219.2.6→19.2.719.2.6→19.2.74.8.3→4.10.08.60.0→8.60.18.0.14→8.0.16Release Notes
TanStack/query (@tanstack/eslint-plugin-query)
v5.101.0Compare Source
Minor Changes
dc54932-no-rest-destructuringnow also flags rest destructuring on custom hooks that return a TanStack Query result. Detection uses the TypeScript type checker and runs only when typed linting is enabled, so untyped projects are unaffected. Closes #8951.TanStack/query (@tanstack/react-query)
v5.101.0Compare Source
Patch Changes
TanStack/router (@tanstack/react-router)
v1.170.15Compare Source
Patch Changes
776d8ef]:v1.170.14Compare Source
Patch Changes
df1076c]:v1.170.13Compare Source
Patch Changes
#7555
ac10815- Fix search middleware composition soretainSearchParamsdoes not restore search params that a downstreamstripSearchParamsremoved.Updated dependencies [
ac10815]:v1.170.12Compare Source
Patch Changes
2cca73c,7a83e67,76b3d3b]:v1.170.11Compare Source
Patch Changes
b4cd5af]:TanStack/router (@tanstack/router-plugin)
v1.168.18Compare Source
Patch Changes
776d8ef]:v1.168.17Compare Source
Patch Changes
#7560
837897f- Fix route HMR so aliased route imports keep generated route properties after hot reloads.Updated dependencies [
df1076c]:v1.168.16Compare Source
Patch Changes
ac10815]:v1.168.15Compare Source
Patch Changes
301f6ba,2cca73c,7a83e67,76b3d3b]:v1.168.14Compare Source
Patch Changes
b4cd5af]:axios/axios (axios)
v1.17.0Compare Source
v1.17.0 — June 1, 2026
This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.
🔒 Security Fixes
socketPath,params, andparamsSerializerreads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)🚀 New Features
transitional.advertiseZstdAcceptEncodingcontrolling whetherzstdis advertised inAccept-Encoding. (#6792, #10920)🐛 Bug Fixes
httpsAgentTLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (#10957)Content-Typefor React NativeFormDataso multipart boundaries can be generated correctly. (#10898)resolveConfigfrom an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (#10891)AxiosHeaders.toJSON()return types and updated CommonJSisCanceltypings to narrow toCanceledError<T>. (#10956, #10952)Authorizationheader from the GitHub build helper whenGITHUB_TOKENis unset. (#10931)🔧 Maintenance & Chores
Http2Sessionsinto its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (#10861)filesallowlist and dropping unneeded unminified bundle source maps. (#10939)fs-extra,qs, docs dependencies, and GitHub Actions dependencies includingactions/dependency-review-actionandzizmorcore/zizmor-action. (#10871, #10879, #10918, #10919, #10934, #10947, #10954, #10960)🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Full Changelog
oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)
v1.68.0Compare Source
No significant changes
View changes on GitHub
Rel1cx/eslint-react (eslint-plugin-react-dom)
v5.8.13Compare Source
📝 Documentation
GoogleCloudPlatform/gke-mcpand removed archivedantfu/shiki-streamfrom community projects on the website.no-multiple-children-in-titlerecipe from the website.🏗️ Internal
RuleListenerreturn type to all rulecreatefunctions (#1845).react-domrules, JSX rules, andnaming-conventionrules (context-name,id-name,ref-name).react-x/no-leaked-conditional-rendering(#1844).pnpmand updated lockfile.tsdownto0.22.2and updated dependencies.merge()calls in rules (#1843).ubuntu-latest.Full Changelog: Rel1cx/eslint-react@v5.8.12...v5.8.13
v5.8.12Compare Source
🪄 Improvements
jsx: AlignedgetChildrenwith Babel'sbuildChildrenandcleanJSXElementLiteralChildpatterns, improving whitespace handling accuracy inreact-jsx/no-useless-fragmentandreact-jsx/no-children-proprules. Migrated child text cleanup to@eslint-react/jsxutilities and removed locallib.tshelpers. (#1836)jsx: RemovedisPaddingWhitespaceAPI and added whitespace boundary tests forreact-jsx/no-useless-fragmentandreact-dom/no-dangerously-set-innerhtml-with-childrenrules. (#1837)jsx: RenamedcleanJSXTextValuetocollapseMultilineTextin the public API and updatedreact-jsx/no-useless-fragmentto use the new name. (#1838)📝 Documentation
🏗️ Internal
scripts/generate-website-icons.pyfor automated icon generation and refined logo geometry across all website assets. (#1833)import-integrity-lintandenhanced-resolve.axiosto^1.17.0andshikito4.2.0.dompurifyandrolldown.no-useless-fragment,no-children-prop, andno-dangerously-set-innerhtml-with-children. (#1836, #1837, #1838)Full Changelog: Rel1cx/eslint-react@v5.8.11...v5.8.12
v5.8.11Compare Source
📝 Documentation
🏗️ Internal
19.2.7(#1827).@fontsource/iosevka-aileand switched to system font fallbacks.6.0.3(#1828).@typescript-eslint/*to8.60.1,react/react-domto19.2.7,nextto16.2.7, and@types/reactto19.2.16.Full Changelog: Rel1cx/eslint-react@v5.8.10...v5.8.11
v5.8.10Compare Source
🐞 Fixes
react-dom/no-unused-class-component-members: Aligned preset details in rule documentation (#1825).react-dom/no-unsafe-iframe-sandbox,react-x/context-name,react-x/id-name,react-x/ref-name,react-x/no-unnecessary-use-prefix,react-x/no-string-style-prop: Fixed missing or incorrect presets in rule documentation (#1826).📝 Documentation
naming-convention: Expanded examples and annotated Ok cases forcontext-name,id-name, andref-namerules (#1819).MyComponentexamples toButtoncomponent in custom rules of props and function component definition recipes (#1823).azat-ioeslint-config to the community presets list.🏗️ Internal
jsx: Consolidated whitespace child predicates and addedisEmptyStringExpressionto the public API (#1820).verify-docs.ts(#1822).AGENTS.mdguide for AI coding agents (#1824)..pkgs/*.viteto^8.0.15andansisto^4.3.1across workspace packages.New Contributors
Full Changelog: Rel1cx/eslint-react@v5.8.9...v5.8.10
v5.8.9Compare Source
🐞 Fixes
react-x/no-direct-mutation-state: Detect nested state mutations and member expressions in assignment expressions (#1818).📝 Documentation
🏗️ Internal
.vscodedirectories from all examples, added missingengines.nodeto Preact examples, cleaned up redundant.config/*.tsfromtsconfig.node.json, and updated.gitignore.eslint,tinyglobby, andtsdownacross workspace packages; added@fontsource/iosevka-aileto the website; reordered CSS imports inlayout.tsx..sentruxbaseline timestamp.Full Changelog: Rel1cx/eslint-react@v5.8.8...v5.8.9
v5.8.8Compare Source
📝 Documentation
kit: Addedis.APICallcallout to the Kit documentation (#1813).jsx: UpdatedgetChildrenandhasChildrenAPI documentation to reflect empty string children behavior.custom-rules-of-childrenrecipe and cross-linked the remaining recipes.🏗️ Internal
react-x/no-misused-capture-owner-stack: Added edge-case tests forcaptureOwnerStack(#1813).data-themeattribute.tsdownversion in@local/configs.trustPolicy: "no-downgrade"and addedminimumReleaseAge: 1440(1 day).eslintto10.4.1across workspace packages.pnpmto11.5.0and refreshed the lockfile.fumadocspackages andtinyexec.eslint-plugin-package-jsonto1.2.0..gitignore.Full Changelog: Rel1cx/eslint-react@v5.8.7...v5.8.8
oxc-project/oxc (oxfmt)
v0.53.0Compare Source
oxc-project/oxc (oxlint)
v1.68.0Compare Source
🚀 Features
e4b1f46linter/typescript: Implementmethod-signature-stylerule (#22679) (Mikhail Baev)bc462calinter/vue: Implement no-reserved-component-names rule (#22741) (bab)ef9e751linter/vue: Implement component-definition-name-casing rule (#22818) (bab)d67f51alinter/vue: Implement require-prop-type-constructor rule (#22708) (bab)8422e8blinter/jsdoc: Implementrequire-yields-descriptionrule (#22805) (Mikhail Baev)fe93f97linter/eslint: Implementprefer-named-capture-grouprule (#22759) (Sebastian Poxhofer)pnpm/pnpm (pnpm)
v11.5.2Compare Source
Patch Changes
Peer dependency resolution now reuses the peer contexts already recorded in the lockfile when those providers are still present in the dependency graph and still satisfy the peer ranges. This avoids unnecessary peer-context rewrites during lockfile regeneration. Current manifest choices remain authoritative: a newly added, explicitly updated, or aliased direct provider, a changed nested provider, or a locked version that no longer satisfies the range still takes precedence.
The lockfile verifier now checks that a registry entry pinning an explicit
tarballURL points at the artifact the registry's own metadata lists for thatname@version. Previously a tampered lockfile could pair a trustedname@versionwith an attacker-chosen tarball URL (and a matching integrity for those bytes), so the install fetched the attacker's bytes. A mismatch — or any entry that can't be confirmed against the registry — is rejected withERR_PNPM_TARBALL_URL_MISMATCH. Non-registry resolutions (file:, git-hosted, etc.) and registry entries without an explicit tarball URL (the URL is reconstructed from name+version+registry, so it is inherently bound) are unaffected; non-standard registry tarball URLs (npm Enterprise, GitHub Packages) still pass because they match the metadata.Fix
pnpm update --recursive --lockfile-only <pkg>@​<version>crashing withInvalid Versionwhen the catalog entry for<pkg>is a version range (e.g.^21.2.10) andcatalogModeisstrictorprefer. The catalog–version comparison now skips the equality check when either side is a range rather than passing a range tosemver.eq(), so range specifiers fall through to the existing mismatch handling instead of throwing #11570.Avoided a Node.js crash when pnpm exits after network requests on Windows.
Fixed packages being materialized into the virtual store without their root-level files (
package.json,LICENSE, README, root entrypoints) when multiplepnpm installprocesses ran against the same store/workspace concurrently. The fast import path used to destructively empty the shared target directory, so a concurrent importer could wipe files another importer had already written; if the surviving files included thepackage.jsoncompletion marker, every later install treated the broken directory as complete and never repaired it. The fast path now imports directly only when it can create the target directory exclusively, and otherwise builds the package in a private temp directory and atomically renames it into place #12197.Fix dependency build scripts not running under the global virtual store (
enableGlobalVirtualStore).In a workspace install, dependency build scripts are deferred to a single
rebuildpass (buildProjects). That pass resolved each package's location from the classicnode_modules/.pnpm/<depPathToFilename>layout, which does not exist under the global virtual store — so native dependencies (e.g. packages usingnode-gyp/prebuild-install) were never built and failed to load at runtime (Cannot find module .../build/Release/*.node).buildProjectsnow resolves the global-virtual-store projection directory (<storeDir>/links/<hash>, computed with the same graph hash the installer uses) whenenableGlobalVirtualStoreis set, and serializes concurrent builds of the same shared projection so parallel workspace projects don't race on the same directory.Don't promote a
runtime:dependency (such as the Node.js version fromdevEngines.runtimeorpnpm runtime set) into a catalog whencatalogModeisstrictorprefer. Aruntime:dependency round-trips todevEngines.runtime, which only recognizes theruntime:protocol; cataloging it rewrote the manifest entry tocatalog:, which broke that round-trip, stranded it indevDependencies, and leftdevEngines.runtimeuntouched.Skip lockfile
minimumReleaseAge/trustPolicyverification for non-registry tarball protocols (for examplefile:), so local tarball dependencies are not incorrectly checked against npm registry metadata.v11.5.1Compare Source
Patch Changes
pnpm auditperformance by pruning non-vulnerable lockfile subtrees and stopping path enumeration once vulnerable findings reach the path cap.npm_config_user_agentfor root lifecycle scripts during headless installs.integrityfield of a remote (non-registry) tarball dependency when its lockfile entry is rebuilt. Re-resolving such a dependency without re-fetching it (for example viapnpm update, or when another dependency changes) produced a resolution with no integrity — URL/tarball resolvers only learn the integrity after the tarball is downloaded — so the previously recorded integrity was dropped, making later installs fail withERR_PNPM_MISSING_TARBALL_INTEGRITY#12067.repositoryfield into the{ type, url }object form when creating the publish manifest, matching npm's behavior. Some registries (e.g. Gitea/Codeberg) reject a stringrepositorywith a 500 Internal Server Error duringpnpm publish#12099.@typescript-eslint/eslint-pluginpeer-depends on both@typescript-eslint/parserandtypescript, and@typescript-eslint/parserpeer-depends ontypescript), pnpm no longer reuses a hoisted instance of the shared peer that was resolved against a different version #12079.facebook/react (react)
v19.2.7Compare Source
facebook/react (react-dom)
v19.2.7Compare Source
shadcn-ui/ui (shadcn)
v4.10.0Compare Source
Minor Changes
7c63c467361dee9e20631b2999040912439b35d4Thanks @shadcn! - add support for GitHub registriesv4.9.0Compare Source
Minor Changes
8e2d2d1439f54260aa0c51747261c220334ec641Thanks @shadcn! - add npx shadcn ejecttypescript-eslint/typescript-eslint (typescript-eslint)
v8.60.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
vitejs/vite (vite)
v8.0.16Compare Source
Bug Fixes
v8.0.15Compare Source
Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
collectAllModulesfunction (#22562) (6978a9c)Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.