Skip to content

Update npm dependencies - #120

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-dependencies
Open

Update npm dependencies#120
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
eslint-plugin-oxlint 1.87.0 → 1.88.0 age confidence devDependencies minor
eslint-plugin-react-dom (source) 5.24.10 → 5.26.7 age confidence devDependencies minor
eslint-plugin-react-jsx (source) 5.24.10 → 5.26.7 age confidence devDependencies minor
eslint-plugin-react-naming-convention (source) 5.24.10 → 5.26.7 age confidence devDependencies minor
eslint-plugin-react-x (source) 5.24.10 → 5.26.7 age confidence devDependencies minor
node (source) 26.11.1 → 26.12.0 age confidence tools minor
oxfmt (source) ^0.72.0 → ^0.73.0 age confidence devDependencies minor
oxlint (source) 1.87.0 → 1.88.0 age confidence devDependencies minor
oxlint-plugin-react-doctor (source) 0.9.17 → 0.9.18 age confidence devDependencies patch
oxlint-tsgolint 7.0.2003 → 7.0.2004 age confidence devDependencies patch
pnpm (source) 12.11.0 → 12.11.2 age confidence tools patch
react (source) 19.3.0 → 19.3.1 age confidence dependencies patch
react-dom (source) 19.3.0 → 19.3.1 age confidence dependencies patch
typescript-eslint (source) 8.71.1 → 8.71.2 age confidence devDependencies patch

Release Notes

oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)

v1.88.0

Compare Source

What's Changed

New Contributors

Full Changelog: oxc-project/eslint-plugin-oxlint@v1.87.0...v1.88.0

Rel1cx/eslint-react (eslint-plugin-react-dom)

v5.26.7

Compare Source

🏗️ Internal
  • @eslint-react/core: collectors now use the node's source range start as the map key, replacing the shared counter, keys are stable across repeated lints, traceable to source positions when debugging, and slightly cheaper than stringified numbers. (#​2033)

Full Changelog: Rel1cx/eslint-react@v5.26.6...v5.26.7

v5.26.6

Compare Source

🏗️ Internal
  • @eslint-react/core: component and hook collectors now use sequential integer keys instead of random randomBytes hex keys, removing node:crypto from the lint hot path. (#​2032) Thanks to @​kurtextrem!
  • Bumped effect to 4.0.4, ts-pattern to 5.9.2, fumadocs-core and fumadocs-ui to 16.17.3, lucide-react to 1.57.0, oxlint to 1.88.0, typedoc-plugin-markdown to 4.14.0, and undici to 8.12.1.
New Contributors

Full Changelog: Rel1cx/eslint-react@v5.26.5...v5.26.6

v5.26.5

Compare Source

🐞 Fixes
  • react-x/set-state-in-effect: a setState on the right side of a short-circuit operator (&&, ||, ??) is now exempt when the left operand is ref-derived (ex: ref.current && setData(1)), matching the existing ref-gated conditional exemption; a left-side setState still runs unconditionally and stays reported. (#​2031)
  • react-x/set-state-in-effect: setup identifiers are now collected from the setup argument of the effect call only; the callee and the deps array are no longer scanned, so a function referenced only in the deps array (ex: useEffect(setup, [helper])) is no longer mistaken for the setup and its setState calls stay unattributed. (#​2031)
  • react-x/set-state-in-effect: arrow function parameters are no longer collected as callback-body setter references (ex: the setState in useMemo((setState) => ..., [])); only actual callback bodies are collected (ex: useMemo(() => setState, [])). (#​2031)

Full Changelog: Rel1cx/eslint-react@v5.26.4...v5.26.5

v5.26.4

Compare Source

🐞 Fixes
  • react-naming-convention/context-name, react-naming-convention/id-name, react-naming-convention/ref-name: the name lookup now stops at function boundaries, so expression-bodied factory functions and custom hooks (ex: export const useAnchor = () => useRef(null)) are no longer misreported; calls inside JSX expressions, computed keys, or class static blocks no longer fall back to the outer variable. (#​2029) Closes #​2026.
  • react-naming-convention/context-name, react-naming-convention/id-name, react-naming-convention/ref-name: the name lookup no longer crosses containers or derived values (ex: const refs = [useRef(null)], const n = useRef(0) + 1), so such calls are no longer reported on the enclosing variable; sequence expressions check only the last value, and unresolvable computed keys (ex: { [key]: useRef(null) }) no longer fall back to the outer variable. (#​2030)

Full Changelog: Rel1cx/eslint-react@v5.26.3...v5.26.4

v5.26.3

Compare Source

🐞 Fixes
  • react-naming-convention/context-name, react-naming-convention/id-name, react-naming-convention/ref-name: an enclosing object literal property key now takes precedence over the outer assignment target when statically known (ex: const refs = { myRef: useRef(0) }); computed keys with string literals (ex: refs["value"] = useRef(null)) are now checked, and unresolvable computed keys are no longer reported. (#​2028)
  • react-naming-convention/ref-name: immediate dereferences of the useRef result through TypeScript type wrappers (ex: (useRef(null) as { current: null }).current, useRef(null)!.current) are no longer reported, extending the #​1375 fix. (#​2028)

Full Changelog: Rel1cx/eslint-react@v5.26.2...v5.26.3

v5.26.2

Compare Source

✨ New
  • react-x/no-unused-props: improved prop usage detection. Props parameters with default values (ex: function Component(props: Props = defaultProps)) are now unwrapped and analyzed, props aliased to a local variable (ex: const alias = props) are tracked through the alias, and template literals without substitutions (ex: props[`foo`]) are recognized as static prop keys. (#​2021)
🐞 Fixes
  • react-x/no-unused-props: a component whose used prop keys cannot be fully determined (ex: it passes the whole props object to another function) now marks all of its declared props as used, so a props declaration shared with another fully analyzable component is no longer reported as unused. (#​2021)
  • react-x/set-state-in-effect: ref-derived values that reach the setState argument through assignment statements (rather than the declaration initializer) are now recognized; only writes that lexically precede the use and live in the use's own function or an ancestor count. (#​2027)
  • react-x/set-state-in-effect: parameters of a helper invoked from the effect setup are now treated as ref-derived when the call-site argument is ref-derived, matched per call site by parameter definition. (#​2027)
  • react-x/set-state-in-effect: a .current read rooted at a function parameter is now recognized as a ref read (ex: setReferenceElement(anchor?.current) where anchor is a RefObject prop); previously only parameters named ref or ending in Ref were recognized. (#​2027)
  • react-x/no-unused-class-component-members: public methods (including function-valued properties) of an exported class component are no longer reported as unused, as they may be part of the component's imperative API invoked by consumers through refs. Data fields, private/protected members, and members of non-exported classes are still reported. (#​2024)
🏗️ Internal
  • Ordered message ids by first usage and unified default/suggestion message id naming across react-dom, react-jsx, react-web-api, and react-x rules. (#​2022)

Full Changelog: Rel1cx/eslint-react@v5.26.1...v5.26.2

v5.26.1

Compare Source

🏗️ Internal
  • react-x/no-context-provider, react-x/no-forward-ref, react-x/no-use-context: renamed the internal suggestion message id from "replace" to "suggest".
  • react-x/immutability: moved context-dependent helpers from helpers.ts into origins.ts and effects.ts to match the fact-based implementation pattern.
  • react-x/globals: moved resolveToFunction from helpers.ts to origins.ts.
  • Bumped effect to 4.0.3, tsl-dx to 0.14.1, @tsconfig/node20 to 20.1.10, and @types/node to 20.19.43.
📝 Documentation
  • Refreshed spec diff verification dates and notes for react-x rules.

Full Changelog: Rel1cx/eslint-react@v5.26.0...v5.26.1

v5.26.0

Compare Source

✨ New
  • Lowered the minimum required Node.js version from >=22.0.0 to >=20.19.0. (#​2020)

Full Changelog: Rel1cx/eslint-react@v5.25.0...v5.26.0

v5.25.0

Compare Source

✨ New
  • react-dom/no-unsafe-target-blank: added an allowReferrer option (default: false). When enabled, rel="noopener" alone is accepted and the suggested fix adds rel="noopener" instead of rel="noreferrer noopener", preserving referrer information while still requiring an explicit token. (#​2019) Closes #​2012.
🏗️ Internal
  • @eslint-react/ast: added hasParent and hasEnclosingTryBlock shortcuts to Traverse. (#​2016)
  • @eslint-react/ast: renamed the types module to tree and narrowed the Extract.unwrap result type. (#​2017)
  • @eslint-react/core: removed the unused REACT_BUILTIN_HOOK_NAMES constant.
  • Bumped tsdown to 0.23.1, @effect/platform-node to 4.0.3, pnpm to 12.11.2, @types/node to 26.6.5, setup-uv to v10.3.0, and fumadocs and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.24.10...v5.25.0

nodejs/node (node)

v26.12.0: 2026-10-14, Version 26.12.0 (Current), @​richardlau

Compare Source

Notable Changes
  • [1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #​66533
  • [7f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #​66335
Commits
oxc-project/oxc (oxfmt)

v0.73.0

Compare Source

🚀 Features
  • a495e82 oxfmt: Support associations config to specify language over filepath (#​27437) (leaysgur)
  • 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#​27386) (leaysgur)
📚 Documentation
oxc-project/oxc (oxlint)

v1.88.0

Compare Source

🚀 Features
  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#​27346) (Mikhail Baev)
millionco/react-doctor (oxlint-plugin-react-doctor)

v0.9.18

Compare Source

Patch Changes

  • #​1943 6932e7d Thanks @​aidenybai! - Match API Platform subscription IDs to the provider's resource-and-IDs unsubscribe contract.

  • #​1920 0298eb8 Thanks @​aidenybai! - Do not infer React hooks from relative helper imports in Angular component classes. Continue to check React and React ecosystem imports.

  • #​1926 012e208 Thanks @​aidenybai! - Do not classify a local state transition as a prop-driven adjustment when its only prop dependencies are called notifications. Keep checks for prop values used in guards, results, or reset dependencies.

  • #​1911 bb00a27 Thanks @​aidenybai! - Do not recommend lazy state initialization for cheap primitive toString calls, including numeric React Native Dimensions values. Keep warnings for unproven receivers and nested expensive calls.

  • #​1919 1f6b98a Thanks @​aidenybai! - Report inaccessible parent click actions when descendant handlers stop keyboard-generated clicks from reaching them.

  • #​1928 a68f193 Thanks @​aidenybai! - Match listener cleanup when both branches of conditional options have the same capture value. Keep warnings for differing capture values, changed options, and missing cleanup.

    Recognize exhaustive listener-removal loops extracted into a synchronous helper when the cleanup only invokes that helper.

  • #​1965 695e46e Thanks @​aidenybai! - Add the opt-in --scope contextual reporting mode. Selected rules report existing findings when their owning function, JSX element, or file changes. Other rules retain line filtering. Support deletion-only edits, staged scans, untracked files, and separate result-cache entries while preserving existing scope defaults and diagnostic locations.

  • #​1933 72fab66 Thanks @​aidenybai! - Preserve count-based placeholder identity through a local array before mapping wrappers.

  • #​1907 e2b047b Thanks @​aidenybai! - Preserve numeric placeholder-loop identity through local key aliases, including constant-prefix keys. Continue reporting index aliases for loops over array data.

  • #​1905 a1cff2e Thanks @​aidenybai! - Keep browser reads in helpers defined inside React effects out of server-render diagnostics. Preserve warnings for render callbacks and shadowed effect functions.

  • #​1924 89c6701 Thanks @​aidenybai! - Do not classify zero-argument effect notifications as state payloads sent to a parent. Continue to report callbacks that pass local state.

  • #​1863 e18d7da Thanks @​skoshx! - ESLint adapter now respects rule requires gates. Rules that require capabilities the project doesn't have (like ssr or react-router:8) are now correctly skipped when capabilities are declared, matching the CLI behavior. Fixes false errors on dependency bumps when using the ESLint adapter with explicit capabilities.

  • #​1896 f3f167e Thanks @​skoshx! - Fix async-defer-await warnings on compound guards that compare function parameters with mutable state after an await. Keep these checks after the await so they can detect stale responses. Fixes #​1895.

  • #​1883 909b8e5 Thanks @​skoshx! - fix(effect-needs-cleanup): accept Promise timer that resets its own handle in callback

    Fixes #​1882. The rule no longer flags a timer created in a Promise callback when the timer's own callback resets the handle to null or undefined. This is safe because the timer has already fired when the reset happens, so no live handle is lost.

  • #​1859 281fdc9 Thanks @​skoshx! - Recognize stable functions rendered as JSX components in the same file, including components that return imported exhaustive matchers. Preserve warnings for mixed utility exports, shadowed JSX names, and reassigned bindings.

  • #​1898 a3cbae0 Thanks @​aidenybai! - Accept observer cleanup after tuple loops and a single animation-frame retry chain when cleanup disconnects the observer and cancels the pending frame. Require observer cleanup on every path and keep target-specific unobserve() checks.

  • #​1898 a3cbae0 Thanks @​aidenybai! - Recognize JSX handlers passed to stable local dispatchers with an explicit React return type. Keep reporting callback registries with unknown or non-rendering return types.

  • #​1869 7bebcfc Thanks @​aidenybai! - Use constant Boolean initializers before treating numeric-looking JSX guard names as numbers. Preserve warnings for mutable bindings, destructuring defaults, and numeric values.

  • #​1873 6790398 Thanks @​aidenybai! - Require root route error boundaries only for data routers, since declarative useRoutes configurations do not use data-router error handling.

  • #​1875 ad8bca6 Thanks @​aidenybai! - Recognize legacy React.createClass components so render callbacks retain their instance this instead of being treated as function components.

  • #​1874 c92fec1 Thanks @​aidenybai! - Accept direct anchor children owned by an imported Next Link component, including the legacy Link child API.

  • #​1872 2825dfd Thanks @​aidenybai! - Allow state updater callbacks to reassign their local parameter while still reporting writes to prior-state properties and captured values.

  • #​1878 cc78fa3 Thanks @​aidenybai! - Respect the installed or declared React Native version before reporting removed AsyncStorage and WebView exports. Reuse package-version resolution and track manifests for diagnostic cache invalidation.

  • #​1871 4f8866c Thanks @​aidenybai! - Stop reporting the core SafeAreaView export as removed. It remains implemented even where it is deprecated.

  • #​1880 [96bf20f](https://redirect.github.com/millionco/react-doctor/commit/96bf20fb5fe084d2ca436

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) October 12, 2026 01:45
@renovate
renovate Bot requested a review from No767 as a code owner October 12, 2026 01:45
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 12, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from a9cccad to 6c93c9a Compare October 12, 2026 06:35
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 12, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from 6c93c9a to d7fc492 Compare October 13, 2026 01:05
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from d7fc492 to b85c74f Compare October 13, 2026 05:28
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from b85c74f to 427ef10 Compare October 13, 2026 11:02
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from 427ef10 to 4784950 Compare October 13, 2026 20:54
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 13, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from 4784950 to 1025801 Compare October 14, 2026 14:16
renovate-approve[bot]
renovate-approve Bot previously approved these changes Oct 14, 2026
View reviewed changes
@renovate
renovate Bot force-pushed the renovate/npm-dependencies branch from 1025801 to 8b932a3 Compare October 14, 2026 19:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes
@No767 No767 Awaiting requested review from No767 No767 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants