Update npm dependencies - #806
Merged
Merged
Conversation
✅ Deploy Preview for ucmacm ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.6.0→4.6.14.6.0→4.6.14.6.0→4.6.14.6.0→4.6.11.33.0→1.33.110.6.0→10.7.05.12.0→5.14.55.12.0→5.14.55.12.0→5.14.55.12.0→5.14.51.23.0→1.24.011.10.0→11.12.0^6.0.3→^7.0.08.1.3→8.1.4Release Notes
schedule-x/schedule-x (@schedule-x/calendar)
v4.6.1Compare Source
Bug Fixes
schedule-x/schedule-x (@schedule-x/calendar-controls)
v4.6.1Compare Source
Note: Version bump only for package @schedule-x/calendar-controls
schedule-x/schedule-x (@schedule-x/scroll-controller)
v4.6.1Compare Source
Note: Version bump only for package @schedule-x/scroll-controller
schedule-x/schedule-x (@schedule-x/theme-shadcn)
v4.6.1Compare Source
Note: Version bump only for package @schedule-x/theme-shadcn
TanStack/form (@tanstack/react-form)
v1.33.1Compare Source
Patch Changes
#2206
df52a12- Re-exportuseSelectorfrom TanStack Store adapters and document migration from deprecateduseStore(fixes #2203).Updated dependencies [
3c57f6d,7b3012b,741da6b,3c57f6d,6cd477a,887a129]:eslint/eslint (eslint)
v10.7.0Compare Source
Features
cf2a9bffeat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)f8b873afeat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)557fde8feat: support computedNumber.parseIntmember access inradixrule (#21041) (Pixel)0b4a73bfeat: add suggestions to no-compare-neg-zero (#21034) (den$)96cdd42feat: report invalid signed numeric radix values inradixrule (#21030) (Pixel)Bug Fixes
3e7bf15fix: applyignoreClassesWithImplementsto class expressions (#21069) (Pixel)0d7d70cfix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)75ec753fix: handle static template literals ineqeqeqrule (#21058) (Pixel)b717a22fix: preventeqeqeqnull option from reporting non-equality operators (#21057) (Pixel)e35b05ffix: avoidno-invalid-regexpfalse positive for shadowed RegExp (#21051) (Pixel)a3172b6fix: avoidno-control-regexfalse positive for shadowed RegExp (#21050) (Pixel)d1f637efix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)8859baffix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)a9e5961fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)8a240a7fix: avoid false positives inradixrule for spread arguments (#21044) (Pixel)Documentation
c30d808docs: Update README (GitHub Actions Bot)5139800docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)04174cbdocs: Update README (GitHub Actions Bot)026e130docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)9d42fefdocs: Update README (GitHub Actions Bot)b230159docs: Update README (GitHub Actions Bot)0129972docs: correct**/.jsglob to**/*.jsin config files guide (#21036) (EduardF1)Chores
9489379chore: update dependency @eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])81a4774chore: updates for v9.39.5 release (Jenkins)9835414chore: enable$ExpectTypeannotations in all TypeScript files (#21071) (Francesco Trotta)72adf6bchore: restrictmarkdownlint-cli2updates in renovate (#21067) (lumir)833ec10chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])7ea106dchore: update ecosystem plugins (#21059) (ESLint Bot)8fb550echore: add prettier update commit to.git-blame-ignore-revs(#21056) (lumir)e4e1166chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])0493f53chore: update prettier to v3.9.0 (#21054) (Pixel)1056a99chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])4d4155dci: run ecosystem tests on pull requests (#21027) (sethamus)993539fchore: update dependency @eslint/json to ^2.0.1 (#21042) (renovate[bot])53f8b69test: add error locations tono-constant-binary-expression(#21039) (lumir)5ab71d5refactor: clean up radix rule internals (#21015) (Pixel)a80a9a4chore: update ecosystem plugins (#21035) (ESLint Bot)7c9a029ci: add Node.js 26 to CI (#20847) (lumir)Rel1cx/eslint-react (eslint-plugin-react-dom)
v5.14.5Compare Source
📝 Documentation
🏗️ Internal
check:configsandcheck:docsscripts into a singlecheck:rulesscript.Full Changelog: Rel1cx/eslint-react@v5.14.4...v5.14.5
v5.14.2Compare Source
🐞 Fixes
react-x/globals: added detection for global writes through destructuring assignments and property deletion withdelete. (#1896)react-x/globals: propagated render-time global mutation effects through directly called helpers and stable local aliases. (#1896)🏗️ Internal
react-debugcomponent and source detection,react-naming-conventionnaming rules, andreact-x/immutabilityReact Compiler fixtures.Full Changelog: Rel1cx/eslint-react@v5.14.1...v5.14.2
v5.14.1Compare Source
🐞 Fixes
react-rsc/function-definition: fixed invalid async autofixes for object and class methods with local'use server'directives, including generator and computed methods; accessors and constructors are now reported without an unsafe fix.🏗️ Internal
react-rsc/function-definition, covering directive placement, export resolution, function forms, and autofix behavior.react-rsc/function-definitionandreact-x/unsupported-syntax.Full Changelog: Rel1cx/eslint-react@v5.14.0...v5.14.1
v5.14.0Compare Source
✨ New
react-x/refs: added render-reachability support for function declarations, IIFEs, synchronous array callbacks, and render-time callbacks passed touseMemoanduseReducer. (#1895)react-x/refs: added lazy-initialization support for explicitundefinedguards and for null guards enclosing additional nested conditions. (#1895)🐞 Fixes
react-x/refs: reworked render-time call analysis as an unbounded fixed-point propagation, removing the previous 50-iteration cap. (#1895)react-x/refs: tightened inverted lazy-initialization handling so the non-null branch must unconditionally return or throw. (#1895)react-x/refs: stopped treating!ref.currentas a null guard because initialized refs may contain falsy values. (#1895)🏗️ Internal
react-x/refs: refactored ref aliases, function bindings, JSX refs, and duplicate initialization tracking to use scoped ESLint variable identities and position-aware binding events instead of file-wide identifier names. (#1895)react-x/immutabilityand documented them in the spec diff report.@effect/language-serviceto^0.86.5.preactto^10.29.7.viteto^8.1.4in example apps.dprintJSON plugin to^0.23.0.Full Changelog: Rel1cx/eslint-react@v5.13.2...v5.14.0
v5.13.2Compare Source
🐞 Fixes
react-x/immutability: fixed false positive onref.currentwrite insideuseEffect. (#1894)🏗️ Internal
@types/nodeto^26.1.1.preactto^10.29.6.tsdownto^0.22.4.Full Changelog: Rel1cx/eslint-react@v5.13.1...v5.13.2
v5.13.1Compare Source
🐞 Fixes
react-x/refs: aligned error message wording forreadDuringRender,writeDuringRender, andrefPassedToFunctionwith the React Compiler specification.Full Changelog: Rel1cx/eslint-react@v5.13.0...v5.13.1
v5.13.0Compare Source
✨ New
react-x/refsnow detects nested property writes on a ref's value (e.g.ref.current.inner = value), which are now reported aswriteDuringRenderinstead of being misclassified as a read.react-x/refsnow tracks functions bound to (and called through) simple object-member-expression targets (e.g.object.foo = () => ref.current; object.foo();), closing a gap in the render-reachability analysis that previously only covered plain variable bindings.react-x/refsnow detectsref.currentaccesses inside the lazy initializer function passed directly asuseState's first argument, since it runs synchronously during the initial render unlike other hook-callback arguments.react-x/refsnow exempts calls to a function namedrender(e.g.props.render(ref), a common render-prop pattern) from therefPassedToFunctiondiagnostic, alongside the existingmergeRefs/hook exemptions.🐞 Fixes
react-x/refslazy-init guard-block detection so it is direction-aware: inside the branch of anif (ref.current == null)-style guard that is guaranteed to seeref.currentas null, only a direct write is treated as the (single) valid initialization; reads or values passed to a function there are still reported.🏗️ Internal
react-x/refsinternals, replacingisRefCurrentNullCheckwithgetRefCurrentNullCheckBranchinlib.ts.fumadocspackages andpreact.react-debug/jsxrule.Full Changelog: Rel1cx/eslint-react@v5.12.2...v5.13.0
v5.12.1Compare Source
📝 Documentation
react-x/immutabilityrule description in docs.🏗️ Internal
Full Changelog: Rel1cx/eslint-react@v5.12.0...v5.12.1
lucide-icons/lucide (lucide-react)
v1.24.0: Version 1.24.0Compare Source
What's Changed
toBeRemovedInVersionmetadata and make it optional in schema by @ericfennis with @Copilot in #4513optionicon by @jamiemlaw in #4326doticon by @cnlancehu in #4492circle-euro-signicon by @Guido3000 in #4353server-plusicon by @Turboman3000 in #4232New Contributors
Full Changelog: lucide-icons/lucide@1.23.0...1.24.0
pnpm/pnpm (pnpm)
v11.12.0Compare Source
Minor Changes
a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a{ delegate: <resolution> }envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, wherecafsandfetcherscannot be passed to the hook. Related to pnpm/pnpm#11685.Patch Changes
2b02764: The changed-packages filter (--filter "...[<since>]") no longer allows an option-like<since>value (such as--output=<path>) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest.gitentry, so the filter works in a git worktree checked out inside another repository's tree.43711ce:pnpm outdatedno longer checks the registry for dependencies that are resolved from locallink:,file:, orworkspace:references in the lockfile #12827.3c6718b: Fixed a deadlock in peer dependency resolution:pnpm installhung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installingelectron-builder@26.15.3#12921.252f15e: Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example^1.0.0) could get the highest version found anywhere in the workspace (for example a2.0.0resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry.Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version.
a38adda:pnpm self-update <version>now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory.6a85968:pnpm stage listnow stops paginating after a fail-safe cap of 1000 pages, so a misbehaving registry cannot keep the command looping forever.eee7c9a:verify-deps-before-runno longer spawns apnpm installwhen pnpm is executed in a directory that has nopackage.json. A mistyped command run outside a project (for examplepnpm witch 10 login) used to crash with a confusing error from the spawned install; now it fails with the regular "no package.json found" error.v11.11.0Compare Source
Minor Changes
508b8c2: Added thepnpm accesscommand for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access.Patch Changes
c70e33e: AllowallowBuildsentries for git-hosted packages to match by repository URL without pinning the resolved commit hash. This lets trusted git repositories keep running their build scripts after branch updates without approving each new commit, while package-name-only rules still do not approve git-hosted artifacts.3067e4f: Reduced peak memory usage during cold-cache dependency resolution. The metadata fetch is memoized for the whole resolution phase, and it was retaining each package's raw registry response body (used only to mirror the response to disk) for that entire time. The memoized cache now holds a body-less copy, so the raw body only lives as long as the call that writes the disk mirror. On large graphs that fetch full metadata (e.g. withminimumReleaseAgeortrustPolicyenabled) this cuts peak RSS by roughly 30%, back in line with pnpm 10. The resolved lockfile is unchanged.51300fd: Prevent a craftedpnpm-lock.yamlfrom writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g.../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshotversion: "../../x") is now rejected atformatGlobalVirtualStorePath, the single point every global-virtual-store slot path funnels through — closing the same escape in the isolated linker, the resolver's dependency-graph builder, and the config-dependency installer.f8058eb: Reject symlinkedpnpm-lock.yamlfiles when reading or writing the env lockfile document.9318a11: AllowregistriesandnamedRegistriesto be configured in the globalconfig.yamlfile.51300fd: Fixed a path traversal vulnerability where a dependency whose manifestnamewas a scoped path traversal (e.g.@x/../../../<path>) could be written outsidenode_modulesto an attacker-controlled location duringpnpm install, even with--ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.14332f0: Fail instead of silently removing an optional dependency's locked entries frompnpm-lock.yamlwhen the registry cannot resolve it. Previously, when registry metadata lacked a version that the lockfile already pinned (for example, a mirror that had not synced a recent release yet),pnpm installandpnpm dedupesilently dropped the optional dependency's entries — emptying maps such as the platform binaries of@napi-rs/canvas— so the lockfile differed between machines and frozen installs on other hosts had nothing to link #12853.fecfe83: Fixed peer dependency resolution withautoInstallPeerswhen a workspace package depends on a version of a package that a transitive dependency's self-contained closure also provides for itself. The peer providers that are attached to the root project for reuse are no longer peer-resolved a second time in the root context, so packages inside such a closure no longer get their peers bound to the root project's incompatible version #4993.5a4daec:${...}environment-variable placeholders in thehttpProxy,httpsProxy,noProxy,proxy, andnoproxysettings are no longer expanded when these settings come from a project'spnpm-workspace.yaml. They now receive the same protection already applied toregistry,namedRegistries, andpnprServer.d1da02e:pnpm publishno longer prints credentials when the target registry is configured with inlineuser:pass@credentials (e.g.registry=https://user:pass@example.com/). They are now redacted both from the "publishing to registry" line and from the OIDC (trusted publishing) failure messages.dcfc611:pnpm self-updatenow honorstrustPolicy=no-downgrade. It resolves the target pnpm version against full registry metadata, so it refuses to switch to a version whose supply-chain trust evidence is weaker than an earlier-published one, the same way a regular install does.a8ad82d: Register thepnalias in generated shell completion scripts.25bd5c3: Fixed standalone installer downgrades from pnpm v12 to v11.23996e9:pnpm runtime set <name> <version>now validates its arguments: the name must benode,deno, orbun, and the version must not contain a comma. Previously these were interpolated straight into apnpm addselector, where an unsupported name or a comma (e.g.node 22,is-positive) could be misread as a list of packages or a local directory and install unintended packages or bins.microsoft/TypeScript (typescript)
v7.0.2Compare Source
vitejs/vite (vite)
v8.1.4Compare Source
Features
Bug Fixes
import.meta.urlin preload function as-is (#22839) (f1f90ed)Documentation
@defaultforserver.cors(#22859) (70435b2)Miscellaneous Chores
Code Refactoring
Tests
Build System
onwarnwithonLog(#22741) (c581b55)Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.