fix(deps): update npm dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@graphql-codegen/cli (source)	7.4.2 → 7.4.3
@graphql-codegen/typescript-operations (source)	6.1.7 → 6.1.9
@storybook/addon-docs (source)	10.6.0 → 10.6.1
@storybook/addon-links (source)	10.6.0 → 10.6.1
@storybook/react-vite (source)	10.6.0 → 10.6.1
@tanstack/react-query (source)	5.103.2 → 5.103.3
@tanstack/react-router (source)	1.170.38 → 1.170.41
@tanstack/router-plugin (source)	1.168.40 → 1.168.42
eslint-plugin-storybook (source)	10.6.0 → 10.6.1
storybook (source)	10.6.0 → 10.6.1
vite (source)	8.3.0 → 8.3.1
vitest (source)	5.0.0 → 5.0.3

---

Release Notes

dotansimha/graphql-code-generator (@​graphql-codegen/cli)

v7.4.3

Compare Source

Patch Changes

• #​10983
  8512e51
  Thanks @​eddeee888! - Add missing --check in CLI --help config

dotansimha/graphql-code-generator (@​graphql-codegen/typescript-operations)

v6.1.9

Compare Source

Patch Changes

• #​11001
  65e5599
  Thanks @​eddeee888! - Fix typescript-operations generating
  invalid interface declarations for @oneOf inputs when declarationKind is interface
  (#​10996).

  A @oneOf input with multiple fields is a union, so it is always generated as a type alias; a
  single-field @oneOf input keeps the configured declarationKind.input. typescript and
  typescript-operations share this rule through the new getOneOfInputDeclarationKind export from
  @graphql-codegen/visitor-plugin-common.

• Updated dependencies
  [65e5599]:

  • @​graphql-codegen/visitor-plugin-common@7.2.7

v6.1.8

Compare Source

Patch Changes

• #​10982
  e5361bc
  Thanks @​eddeee888! - Fix out-of-memory errors with deeply nested,
  widely reused fragments
  (#​10940).

  The type cache used while generating selection set types was keyed by every fragment-expanded
  field path, so its keys grew exponentially with fragment nesting. Keys are now built from the
  selection set as written, referencing fragment spreads by name, so they stay linear in the size of
  the documents. The exported getFieldNames helper from @graphql-codegen/visitor-plugin-common,
  which built those expanded paths, is removed.

• Updated dependencies
  [e5361bc,
  1d1153b,
  be69e9d]:

  • @​graphql-codegen/visitor-plugin-common@7.2.6
  • @​graphql-codegen/plugin-helpers@7.4.0

storybookjs/storybook (@​storybook/addon-docs)

v10.6.1

Compare Source

• Addon A11y: Fix vision simulator color filters in Firefox - #​36153, thanks @​ghengeveld!
• Addon Vitest: Support Vitest 5 browser tests - #​36270, thanks @​valentinpalkovic!
• CLI: Fix vitest ERESOLVE on fresh Next.js apps. - #​36310, thanks @​obvious-autobuild!
• Core: Fix build crash when ref reachability check fails mid-request - #​36181, thanks @​shilman!
• Core: Restore the change-detection CTA in the sidebar - #​36214, thanks @​ghengeveld!
• TanStack: Support both interpolatePath signatures - #​36333, thanks @​BaconMan1168!
• Telemetry: One tools-command record per invocation with CLI toolset and tool names - #​36210, thanks @​kasperpeulen!

TanStack/query (@​tanstack/react-query)

v5.103.3

Compare Source

Patch Changes

• #​11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
• Updated dependencies []:
  • @​tanstack/query-core@5.103.3

TanStack/router (@​tanstack/react-router)

v1.170.41

Compare Source

Patch Changes

• #​8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

• #​8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

• #​8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

• #​8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

• Updated dependencies [d521abd]:

  • @​tanstack/router-core@1.171.34

v1.170.40

Compare Source

Patch Changes

• #​8436 f5ffd38 - Skip unused Link preload cleanup when preloading is disabled and ignore queued viewport notifications after their effect has been cleaned up.

• Updated dependencies [488d046, 0c1b5e3, 3cdd1af]:

  • @​tanstack/router-core@1.171.33

v1.170.39

Compare Source

Patch Changes

• #​8435 73bfc15 - Avoid hydration-triggered rerenders for links that do not compare URL hashes while preserving hash-sensitive active state and ClientOnly behavior.

TanStack/router (@​tanstack/router-plugin)

v1.168.42

Compare Source

Patch Changes

• Updated dependencies [60b8ad1, 614bc27, d521abd, ff66a03, 863c8a7]:
  • @​tanstack/react-router@1.170.41
  • @​tanstack/router-core@1.171.34
  • @​tanstack/router-generator@1.167.40

v1.168.41

Compare Source

Patch Changes

• Updated dependencies [f5ffd38, 488d046, 0c1b5e3, 3cdd1af]:
  • @​tanstack/react-router@1.170.40
  • @​tanstack/router-core@1.171.33
  • @​tanstack/router-generator@1.167.39

vitejs/vite (vite)

v8.3.1

Compare Source

Bug Fixes

• deps: update all non-major dependencies (#​23482) (3c752c8)
• deps: update all non-major dependencies (#​23537) (e8990c4)
• deps: update rolldown-related dependencies (#​23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#​23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#​23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#​23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#​23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#​23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#​23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#​23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#​23566) (63567c7)
• update optimizeDeps.include comment (#​23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#​23491) (f4b4431)
• remove duplicate configurations (#​23532) (9abd99b)
• replace find with some (#​23554) (af7cdf6)

vitest-dev/vitest (vitest)

v5.0.3

Compare Source

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #​11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in #​11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #​11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in #​11281 and #​11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in #​11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in #​11361 and #​11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in #​11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in #​11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in #​11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in #​11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in #​11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in #​11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in #​11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in #​11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in #​11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in #​11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in #​11329 and #​11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in #​11395 (346d3)

    View changes on GitHub

v5.0.2

Compare Source

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in #​11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in #​11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in #​11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in #​11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in #​11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in #​11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in #​11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in #​11299 (a0a93)
• ui:
  • Persist authentication cookie beyond current browser session  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11066 (f8819)

    View changes on GitHub

v5.0.1

Compare Source

   🚀 Features

• ui:
  • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11189 (5dc4b)
  • Add focused trace view layout mode  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #​11190 (376dc)

   🐞 Bug Fixes

• Exit 1 when vitest list fails collection  -  by @​hamed-bavar in #​11145 and #​11146 (6108b)
• Keep parse error details in static collection  -  by @​hamed-bavar in #​11150 and #​11151 (7c818)
• Avoid recursive prototype in automocking  -  by @​sheremet-va in #​11195 (99fc5)
• Prevent false Vitest import resolution  -  by @​sheremet-va in #​11196 (b426c)
• Keep metadata file when clearing the cache  -  by @​sheremet-va in #​11199 (73614)
• Correct typos in error message and comments  -  by @​shinji00222 and Shinji in #​11187 (115c3)
• Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by @​LukeAbby in #​11175 (498fb)
• Share the server on self-referencing extends  -  by @​sheremet-va in #​11034 (23dda)
• Warn when deprecated deps.optimizer.web is used  -  by @​im10furry in #​11214 (2ce29)
• browser:
  • Avoid double quotes in config.define  -  by @​sheremet-va in #​11198 (972e2)
• doctor:
  • Measure vm pools for custom environments  -  by @​sheremet-va in #​11212 (91ab1)
• expect:
  • Correct return value in toMatchAriaSnapshot  -  by @​sheremet-va in #​11208 (c119b)
• fakeTimers:
  • Force queueMicrotask and nextTick in toNotFake  -  by @​kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @​hi-ogawa in #​11261 (a47d7)
• snapshot:
  • Report obsolete keys next to skipped tests  -  by @​hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11157 and #​11158 (17e2b)
• types:
  • Make public declarations self-contained  -  by @​ZoeySigel in #​11141 (45546)
• ui:
  • Fix collapse/expand suite with file name search  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11260 (0a712)
  • Fix explorer file summary count  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #​11125 (05982)
• utils:
  • Fix deepMerge to handle prototype  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11215 (4944c)

    View changes on GitHub

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 86aa74f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

Copilot review overview

🟢 Approval recommended

The patch updates are consistently reflected across manifests and the generated lockfile.

Review effort: Balanced
Findings: None

What changed in this PR

Updates patch-level npm dependencies across the Juno monorepo.

Changes:

• Updates Vite, TanStack libraries, and GraphQL Code Generator.
• Regenerates the pnpm lockfile with matching transitive dependencies.

File	Description
pnpm-lock.yaml	Locks updated direct and transitive dependencies.
apps/​doop/​package.json	Updates Vite and TanStack packages.
apps/​greenhouse/​package.json	Updates Vite and TanStack packages.
apps/​heureka/​package.json	Updates Vite, TanStack, and GraphQL Code Generator.
apps/​supernova/​package.json	Updates Vite and TanStack packages.
apps/​template/​package.json	Updates Vite.
packages/​communicator/​package.json	Updates Vite.
packages/​greenhouse-auth-provider/​package.json	Updates Vite.
packages/​k8s-client/​package.json	Updates Vite.
packages/​messages-provider/​package.json	Updates Vite.
packages/​oauth/​package.json	Updates Vite.
packages/​template/​package.json	Updates Vite.
packages/​ui-components/​package.json	Updates Vite.
packages/​url-state-provider/​package.json	Updates Vite.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cloudoperators.github.io/juno/pr-preview/pr-2038/
Built to branch gh-pages at 2026-10-07 19:02 UTC. Preview will be ready when the GitHub Pages deployment is complete.