Update npm dependencies#69
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
renovate
Bot
force-pushed
the
renovate/npm-dependencies
branch
from
ff7a197 to
857c0e9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
19.2.14→19.2.151.65.0→1.66.05.8.1→5.8.55.8.1→5.8.55.8.1→5.8.55.8.1→5.8.526.1.0→26.2.0^0.50.0→^0.51.01.65.0→1.66.0^0.22.1→^0.23.011.1.2→11.3.08.59.3→8.60.0Release Notes
oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)
v1.66.0Compare Source
No significant changes
View changes on GitHub
Rel1cx/eslint-react (eslint-plugin-react-dom)
v5.8.5Compare Source
📝 Documentation
docs/rule-implementation-patterns.md) and term-based rule patterns guide (docs/term-based-rule-patterns.md).5.1.0to5.0.0across README and documentation..textlintrc.jsonpatterns.🏗️ Internal
@effect/language-serviceto^0.86.2@takumi-rs/image-responseto^1.3.0@tsconfig/vite-reactto^8.0.6@types/nodeto^25.9.1@types/reactto^19.2.15eslint-plugin-package-jsonto^1.1.0fumadocs-coreto^16.9.0fumadocs-mdxto^15.0.7fumadocs-uito^16.9.0lru-cacheto11.5.0nxto^22.7.3postcssto^8.5.15viteto^8.0.14vitestto^4.1.7pnpmto11.2.1v5.8.4Compare Source
📝 Documentation
Hintpopover with a direct link to the FAQ anchor explaining the project's human/LLM collaboration policy.isClassComponentandJsxConfig.🏗️ Internal
core: SimplifiedisClassComponentby removing thecontextparameter and replacingisClassComponentLoosewith the simplified function.eslint-plugin-react-x: Removed unnecessary optional chaining across multiple rules (immutability,no-unused-state,purity,refs,set-state-in-effect,static-components,use-memo, etc.) and expanded test coverage for edge cases (#1792).actions/setup-nodecache parameter error.@takumi-rs/image-responseto 1.2.1,fumadocs-mdxto 15.0.6,import-integrity-lintto 1.1.1,preactto 10.29.2,tsxto 4.22.1,@typescript-eslintto^8.59.4,@types/nodeto^25.9.0,dompurifyto^3.4.5,pnpmto11.1.3,textlintto 15.7.1, and dprint TypeScript plugin to 0.96.1.tsl.config.ts.pnpm-workspace.yamlfrom^6.0.3to5.9.3..github/zizmor.yml.scripts/verify-lockfile.ts,scripts/verify-devtools.ts, and all references to them.react-jsx/no-children-prop(no logic change).Full Changelog: Rel1cx/eslint-react@v5.8.3...v5.8.4
v5.8.3Compare Source
🐞 Fixes
react-dom/no-unknown-property: Added React 19precedenceandblockingattributes to the known property allowlist with version-gated tag checks, preventing false positives on<style>,<link>, and<script>elements (#1789, #1790).Full Changelog: Rel1cx/eslint-react@v5.8.2...v5.8.3
v5.8.2Compare Source
📝 Documentation
usehook guidance toerror-boundaries,rules-of-hooks, andno-use-contextdocs.eslint-plugin-react-xrule documentation with scenario-based examples, Troubleshooting sections, and Further Reading links across 48 rule docs (#1786).^^^) from documentation examples for better readability (#1785).eslint-plugin-reactwith additional details.🏗️ Internal
pnpm-lock.yaml: bumpednxto 22.7.2 andbrace-expansionto 5.0.5.Full Changelog: Rel1cx/eslint-react@v5.8.1...v5.8.2
nodejs/node (node)
v26.2.0: 2026-05-20, Version 26.2.0 (Current), @aduh95Compare Source
Notable Changes
189d43a193] - doc: markstream.composestable (Matteo Collina) #62562f858c6140e] - (SEMVER-MINOR) fs: addTemporal.Instantsupport toStatsandBigIntStats(Livia Medeiros) #607890cbb3895df] - (SEMVER-MINOR) http: addwriteInformationto send arbitrary 1xx status codes (Tim Perry) #63155Commits
9a394bab84] - benchmark: respect stream/iter broadcast backpressure (Trivikram Kamat) #63314ad98b4620b] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280ba0736a847] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #632555573a6a4a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #632557dc563b8d6] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #63255b55e2b1f4d] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576fd509a755a] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #631118657df39e7] - crypto: harden KeyObject internal slots (Filip Skokan) #63111729274e046] - crypto: reject invalid raw key imports (Filip Skokan) #631348fc9cb9c01] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104288065cb3f] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756ecf3797d09] - debugger: disambiguate probe location binding (Joyee Cheung) #63286bdc57135fd] - debugger: add --help tonode inspectand improve docs (Joyee Cheung) #632012a6e6058e9] - deps: update undici to 8.3.0 (Node.js GitHub Bot) #63377327b927271] - deps: update corepack to 0.35.0 (Node.js GitHub Bot) #633755828fadf52] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217fe127a999b] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #62811a34c4ea159] - deps: V8: cherry-pick435a2cd(Matthias Liedtke) #63136ad91efcc43] - deps: cherry-pick libuv/libuv@a43e543(Ali Hassan) #632225ea6c3ee7e] - deps: add missing static linking targets for libffi (Paolo Insogna) #63168c1f6ba22b4] - deps: update ngtcp2 to 1.22.1 (Node.js GitHub Bot) #628127b8767ef76] - doc: remove unsupported template type from v8.md (René) #63410b2ec1880b1] - doc: fix promise nomenclature instream_iter.md(Antoine du Hamel) #63406cf6cbbd39d] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696da05065d98] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734c31f320fba] - doc: update http2'spushandtrailersevents withrawHeadersparam (YuSheng Chen) #63259f0d008439b] - doc: add Rust toolchain manual installation instructions Windows (Mike McCready) #6336768b1220fbd] - doc: remove inactive members from Triagers list (Antoine du Hamel) #63329189d43a193] - doc: mark stream.compose stable (Matteo Collina) #62562c4fb894039] - doc: fix CHANGELOG (Richard Lau) #632929f319a77e4] - doc: reference correct function in Module docs (Robin Malfait) #632472c13acc88e] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #632117e42c336c9] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #63187d99e0bb6d5] - doc: document Temporal configure flags in BUILDING.md (ChrisJr404) #63248c0ea77b305] - doc: run license-builder (github-actions[bot]) #632328265aba0f4] - doc: add large pull requests contributing guide (Matteo Collina) #62829be241bacc8] - doc: remove unnecessary<!-- eslint-magic comments (Antoine du Hamel) #63200e0b1f092c3] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #63199a3feb15871] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181cafd7667fc] - doc: improve quic documentation (James M Snell) #631573c784edb6f] - doc: update release steps when post-release fails (Rafael Gonzaga) #631319de954e9be] - doc: fix deprecation list in 26.0.0 changelog (Antoine du Hamel) #6314720c553e456] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #631213494eae2c8] - doc: document the latest-vX.x schema (Marco Ippolito) #63033c02413d29d] - doc: remove list of versions inBUILDING.md(Antoine du Hamel) #6311353f9a902a1] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152f858c6140e] - (SEMVER-MINOR) fs: addTemporal.Instantsupport toStatsandBigIntStats(Livia Medeiros) #60789b2ba62ca0e] - fs: makeDateproperties onStatsenumerable (LiviaMedeiros) #633280cbb3895df] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155f712e6856e] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #620173acadae676] - lib: fix typo idenity => identity (Daijiro Wachi) #63112460329e886] - lib: fixes validator message (Daijiro Wachi) #628239438c832b2] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #63017c7d27c82c4] - lib: handle --permission-audit when propagating flags (Rafael Gonzaga) #630479f19915276] - lib: optimize webidl conversion options (Filip Skokan) #62756771afd626a] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #6340267d094a554] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #632359091398f3d] - meta: ignore AI assistants files (Matteo Collina) #6261296f19a16d0] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #6292045f3e3ef11] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710d7afa617bb] - quic: send correct OpenSSL alert for ALPN mismatches (Tim Perry) #63193526313beb8] - quic: fixup quic stream variable chunk len (James M Snell) #632301613c7fe70] - quic: support --allow-net permissions (James M Snell) #6318472ab7444a8] - quic: remove unused env_ variable in session_manager.h/cc (James M Snell) #631772b55656778] - quic: remove unused binding variable in session.cc (James M Snell) #6317783f0d37400] - quic: ignore coverage for quic files (James M Snell) #631497e6b77b14d] - quic: complete the internal implementation of QUIC (James M Snell) #6287671372418f1] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #6288620f40c2c25] - sqlite: keep source database alive during backup (Matteo Collina) #62673592f741bd0] - src: simplify OpenSSL feature gates (Filip Skokan) #63255520ab7ad40] - src: add BoringSSL EVP enumeration fallback (Filip Skokan) #6320612be49acbc] - src: support multiple versions in node.config.json (Marco Ippolito) #63033296f907585] - src: remove unused using declarations in node_task_queue (Mert Can Altin) #631447703f11b3c] - src: skip JS callback for settled Promise.race losers (Felipe Coelho) #6233674ab710c3a] - src,sqlite: remove dead code (Edy Silva) #63204e49154f4c8] - stream: add sync iterable fast path to pipeTo (Trivikram Kamat) #63318537455e98d] - stream: fix merge handling for object-like sources (Trivikram Kamat) #63356e21b8a47f0] - stream: limit iter from sync iterable batches (Trivikram Kamat) #633243bdb64dc67] - stream: cache minimum cursor count in broadcast (Trivikram Kamat) #6332281819add6b] - stream: remove unnecessary check (Antoine du Hamel) #6303022e3579d74] - stream: avoid retrying accepted pipeTo writes (Trivikram Kamat) #63297691915ea94] - stream: validate broadcast writer writev chunks (Trivikram Kamat) #63300253f5f4ca2] - stream: uncork fromWritable writev on chunk error (Trivikram Kamat) #63295aa6913cc4a] - stream: validate fromWritable() options before cache (Trivikram Kamat) #632786c53ddb988] - stream: optimize single-slot push queue drain (Trivikram Kamat) #63274b568649f6f] - stream: preserve toReadableSync batch after backpressure (Trivikram Kamat) #63276cdcefd7e2f] - stream: cache minimum cursor count in share (Trivikram Kamat) #63262ba7000e4f7] - stream: minor stream/iter implementation edits (René) #63132c694999ab8] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398a6d6d51c1b] - test: deflake connection refused proxy tests (Trivikram Kamat) #6339531d89c4f59] - test: avoid repeated writes in watch helper (Trivikram Kamat) #633866f3587c773] - test: deflake watch mode worker test (Trivikram Kamat) #63384a57aebaa73] - test: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) #63161b871cff2db] - test: relax test-memory-usage arrayBuffers check (inoway46) #6324425189bcb95] - test: reduce flakiness ofdifferent-registry-per-thread(Antoine du Hamel) #632445bdb1f8426] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #63361d57bd2bf59] - test: relax min assertion in test-performance-eventloopdelay (Marco) #63100014e1f00c1] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055dd28ff8a80] - test: avoid initial-break wait in restart-message (inoway46) #62060e89a49a13a] - test: move FFI tests toNATIVE_SUITES(Antoine du Hamel) #6316551ef0258ba] - test: update WPT for wasm/jsapi to288c467(Node.js GitHub Bot) #63136c0175a9ba1] - test: use ERM to destroy sqlite database handles after tests (René) #6307683054e8aba] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #627044f1426d361] - test_runner: fix hooks test context (Moshe Atlow) #632856a4c4b7193] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #63283eba9c3481b] - test_runner: add tags option and tag-name filter (Chemi Atlow) #632212ba124f23b] - tls: add unsupported renegotiation error (Filip Skokan) #631617c5048495a] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #630756c574110a7] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #63374f14ed762b3] - tools: add boringssl to tools/nix/openssl-matrix.nix (Filip Skokan) #6320614d3924c48] - tools: fix test426 updater (Antoine du Hamel) #632710d017ece8d] - tools: filter V8 scripts for build toolchain (Richard Lau) #630693859a8700e] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #631104a32ed82bd] - tools: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) #63111oxc-project/oxc (oxfmt)
v0.51.0Compare Source
oxc-project/oxc (oxlint)
v1.66.0Compare Source
🚀 Features
0440b0flinter/eslint: Implementid-matchrule (#22379) (Vladislav Sayapin)65bf119linter: Implement react no-object-type-as-default-prop (#22481) (uhyo)2a6ddcelinter/eslint: Implementno-implied-evalrule (#22391) (Vladislav Sayapin)625758alinter/vitest: Implement padding-around-after-all-blocks rule (#21788) (kapobajza)37680b0linter: Implement react no-unstable-nested-components (#22248) (Jovi De Croock)d8d9c74linter: Implement import/newline-after-import rule (#19142) (Ryuya Yanagi)oxc-project/tsgolint (oxlint-tsgolint)
v0.23.0Compare Source
What's Changed
b6187a3by @renovate[bot] in #92748e2953by @renovate[bot] in #9335eb880fby @renovate[bot] in #936e1f8f97by @renovate[bot] in #939092b34fby @renovate[bot] in #940dprintto pnpmallowBuildsby @camc314 in #968Full Changelog: oxc-project/tsgolint@v0.22.1...v0.23.0
pnpm/pnpm (pnpm)
v11.3.0Compare Source
Minor Changes
Added
pnpm stagewithpublish,list,view,approve,reject, anddownloadsubcommands for npm staged publishing.Added a new setting
trustLockfile. Whentrue,pnpm installskips the supply-chain verification pass that re-appliesminimumReleaseAge/trustPolicy='no-downgrade'to every entry in the loaded lockfile. The install treats the lockfile as already-trusted — useful for closed-source projects where every commit comes from a trusted author. Defaults tofalse; verification stays on by default. Set inpnpm-workspace.yaml.Also cut the memory footprint of the verification pass itself: the per-(registry, name) trust-meta cache previously retained the full packument — dependency graphs, scripts, README, and per-version manifests — for the entire install. On large workspaces (
~4klockfile entries withminimumReleaseAge+trustPolicy: no-downgradeenabled) this could OOM CI runners with a 2GB heap cap. The cache now stores only the fields the trust check actually reads (time, per-version_npmUser.trustedPublisher,dist.attestations.provenance). The abbreviated-metadata cache is similarly projected to just the package-levelmodifiedfield and the set of currently-listed version names. Fixes #11860.Implemented
pnpm pkgcommand natively, followingnpm pkgstandards.Implemented
pnpm repocommand natively, followingnpm repostandards.Implemented
pnpm set-script(aliasss) natively. Adds or updates an entry in thescriptsfield of the project manifest, supportingpackage.json,package.json5, andpackage.yamlformats.Add a
skip-manifest-obfuscationoption forpnpm packandpnpm publish. When enabled, the originalpackageManagerfield and publish lifecycle scripts are kept in the packed/published manifest instead of being stripped. The pnpm-specificpnpmfield continues to be omitted.Patch Changes
pnpm dlxfailing withERR_PNPM_NO_IMPORTER_MANIFEST_FOUNDwhen the installed package's CAS slot is missing itspackage.json. Observed in the wild forpnpm dlx node@runtime:<version>when the GVS slot was populated without the synthesized manifest runtime archives need (they don't ship apackage.jsonof their own, so the synthesized one is the only way it gets there; an existing slot from an earlier code path that skipped the synthesis stays incomplete). The bin link itself is wired up from the resolution and remains valid, sodlxnow falls back to the scopeless package name when the slot's manifest is unreadable — for single-bin packages (the dlx common case, including everyruntime:spec) this matches whatmanifest.binwould have named. Multi-bin packages already require--package=<spec> <bin>to disambiguate and don't enter this code path.pnpm dedupeandpnpm installwhen a dependency graph contains packages with transitive peer dependencies on each other (e.g.@aws-sdk/client-stsand@aws-sdk/client-sso-oidc) andauto-install-peersis enabled. The lockfile no longer flips between two equally-valid forms across consecutive runs. The root cause was thatresolveDependenciespushed onto itspkgAddresses/postponedResolutionsQueuearrays from insidePromise.all-spawned callbacks, so completion-order timing leaked into the array order and downstream cyclic-peer suffix assignment. Fixes #8155.pnpm add <github-shorthand>(and any other wanted-dependency whose alias can't be parsed from the user-supplied spec, e.g. tarball URLs orpnpm/test-git-fetch#sha) was silently dropped from the manifest update and frompendingBuilds. The alias-keyed lookup added in that PR couldn't find awantedDependencywhosealiaswasundefinedat parse time but resolved to a package name only after fetching, so the entry never made it intospecsToUpsert. Restored the original index-based pairing betweendirectDependenciesandwantedDependencies; the catalog-protocol preservation that PR was originally fixing is unaffected because it's driven byrdd.catalogLookup.userSpecifiedBareSpecifier, not by the lookup. Fixes the threerebuilds dependencies/rebuilds specific dependencies/rebuild with pending optionfailures inbuilding/commands/test/build/index.ts.pnpm add --configleaving orphan entries inpnpm-lock.env.yaml(the optional subdependencies of the previously resolved version of the updated config dependency).v11.2.2Compare Source
Patch Changes
configDependencies, the user's CLI flags passed topnpm install(e.g.--no-runtime,--prod,--dev,--no-optional,--node-linker,--cpu/--os/--libc,--offline,--prefer-offline) are now forwarded to pacquet'sinstallsubcommand verbatim. Previously pacquet was invoked with a fixed argument list, so flags like--no-runtimewere silently dropped. Flag forwarding is gated on the command beinginstall/i;add,update, anddedupestill don't forward (their flag surface doesn't line up with pacquet'sinstall).pnpm up(andpnpm add/pnpm remove) failing withpacquet_package_manager::outdated_lockfilewhen pacquet is declared inconfigDependencies. pnpm now passes--ignore-manifest-checkto pacquet so its--frozen-lockfilecheck doesn't fire against the (pre-mutation)package.jsonpnpm hasn't written yet #11797. Requires a pacquet release that supports the flag — bumpPACQUET_VERSIONin the e2e tests once it ships.v11.2.1Compare Source
Patch Changes
optional: truein the env lockfile, matching how optional dependencies are recorded elsewhere inpnpm-lock.yaml. Previously, snapshots for the platform-specific subdeps pulled in via a config dep'soptionalDependencieswere written as empty objects, which was inconsistent with the rest of the lockfile and made it look like those non-host platform variants were required.pickRegistryForPackagereturning the wrong registry for an unscopednpm:alias under a scoped local name. A manifest entry like"@​private/foo": "npm:lodash@^1"was routing thelodashfetch throughregistries["@​private"], even thoughlodashis unscoped and doesn't live on that registry. The npm-alias branch now returns the alias target's own scope (ornullfor an unscoped target, falling through toregistries.default) instead of leaking into the local key's scope.v11.2.0Compare Source
Minor Changes
Experimental: Adding
@pnpm/pacquet(the Rust port of pnpm) toconfigDependenciesinpnpm-workspace.yamlnow delegates the materialization phase ofpnpm installto the pacquet binary. pnpm still owns dependency resolution; pacquet only fetches and imports from the freshly-written lockfile. This is an opt-in preview of the Rust install engine #11723.To configure pacquet in a project, run:
You'll see changes in
pnpm-workspace.yamlandpnpm-lock.yamlthat should be committed. If you experience any issues with pacquet, please let us know by mentioning this in the GitHub issue you create.configDependenciesnow resolve and install one level ofoptionalDependenciesdeclared by the config dependency, withos/cpu/libcplatform filtering applied at install time. This unlocks the esbuild/swc-style pattern where a package ships platform-specific binaries viaoptionalDependencies— a config dependency can now do the same and have the matching binary symlinked next to it in the global virtual store, sorequire('pkg-platform-arch')from inside the config dependency resolves correctly.The env lockfile records all platform variants regardless of host platform, so it remains portable across machines. Each entry in a config dependency's `optionalDe
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.