Update npm dependencies - #839
Merged
Merged
Conversation
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
✅ Deploy Preview for ucmacm ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.33.2→1.33.30.9.2→0.9.319.1.1→19.2.04.16.0→4.16.1Release Notes
TanStack/form (@tanstack/react-form)
v1.33.3Compare Source
Patch Changes
millionco/react-doctor (oxlint-plugin-react-doctor)
v0.9.3Compare Source
Patch Changes
#1519
83f3ff8Thanks @aidenybai! - Detect Astro projects, run template design rules through Astro's compiler with source-mapped diagnostics, and keep Astro's defaultsharpimage service out of unused-dependency findings.#1489
3d67ca1Thanks @aidenybai! - Recognize default-exported React HoC feature components inno-multi-comp.#1475
1098b9cThanks @aidenybai! - Detect index keys in dynamic React child arrays and data-indexed while loops.#1493
c126684Thanks @aidenybai! - Suppress js-combine-iterations for statically small fixed arrays#1526
992205aThanks @aidenybai! - Detect props that overwrite defaults with undefined before reaching JSX attributes.#1531
8402820Thanks @aidenybai! - Recognize exported VitedefineConfigcallback configs when proving Fast Refresh integrations.#1512
de6d280Thanks @aidenybai! - Avoid reporting local effect helpers as live-state parent notifications when they only call prop-derived transforms or zero-argument lifecycle callbacks.#1499
0cc5efbThanks @aidenybai! - Recognize compound and local stale-request guards after awaited effect work while rejecting mutated guards and conditional cleanup evidence.#1527
d81eedaThanks @aidenybai! - Recognize matching boolean capture modes whenprefer-use-effect-eventverifies paired event listener registration and cleanup.#1496
16972aeThanks @aidenybai! - Recognize terminal promise catch blocks that recover effect state.#1494
5f23826Thanks @aidenybai! - Avoid loading-reset false positives when afinallyreset is guarded by the current async operation or a cleanup-backed mounted ref.#1491
c6bdd2dThanks @aidenybai! - Recognize guarded Map member keys, nullable finder projections, and maximum-derived array lookups in no-non-null-assertion-on-maybe-undefined-result.#1506
57743f8Thanks @aidenybai! - Recognize callback-ref values and measured DOM state paired with mount flags as post-mount state sources.#1524
1938763Thanks @aidenybai! - Resolve ReactuseCallback-wrapped pointer-down handlers when checking pointer capture cancellation.#1513
29e35d5Thanks @aidenybai! - Stop reporting user-facing API key alerts and structured parser token boundaries as hardcoded client secrets.#1505
01ca0b3Thanks @aidenybai! - Skip root test-prefixed JavaScript and TypeScript files in production security scans.#1528
69d19b5Thanks @aidenybai! - Detect URLSearchParams location mirrors in prefer-use-sync-external-store.#1533
2db2a97Thanks @aidenybai! - Reduce scan startup time and workspace contention by loading lightweight rulemetadata, sharing Oxlint subprocess capacity across projects, and reusing
semantic and filesystem analysis within each scan. Keep cached diagnostics
correct when imported browser guards, Next.js manifests, nested project
targets, or TypeScript path configuration change, and ignore explicitly
disabled inline CSS animations and transitions in Remotion rules.
#1540
5268cb4Thanks @skoshx! - fix(server-auth-actions): skip credential-establishing actions via SDK detectionThe
server-auth-actionsrule now correctly skips server actions that perform credential-establishing operations (signup, signin, OTP verification, password reset) by detecting calls to auth SDK methods likesupabase.auth.signUp(),auth.signInWithPassword(), andauth.verifyOtp(). These actions legitimately run for anonymous callers, so requiring authentication would be incorrect.This resolves the documented false positive where credential-establishing endpoints were incorrectly flagged as unauthenticated privileged operations.
Closes #1538
#1467
3728102Thanks @aidenybai! - Upgrade the Oxc toolchain to the latest releases.#1504
b10cd4cThanks @aidenybai! - Avoid reporting conditional wrappers whose click handler only forwards focus to a queried control.#1523
9418a1cThanks @aidenybai! - Avoid no-event-handler false positives for deferred ref focus and state-backed collection ref synchronization.#1474
444e177Thanks @aidenybai! - Detect unescaped dynamic folder path segments in anchoredRegExppatterns.#1515
8170ba2Thanks @aidenybai! - Avoid reporting static wrappers whose click handler only forwards focus to a nested control.#1532
65539afThanks @aidenybai! - Avoid reporting parent callbacks used to synchronize external subscriptions, layout measurements, and imperative controllers.#1520
b07af9dThanks @aidenybai! - Keepno-create-ref-in-function-componentquiet whencreateRef()values are initialized once behind a stableuseRef().currentguard.#1488
d6f02bbThanks @aidenybai! - Detect browser-dependent hydration branches through render-time helpers, mutable aliases, state initializers, and compiled React output.#1492
9512488Thanks @aidenybai! - Report zero-argument constructor allocations passed directly touseRef.#1495
adcee58Thanks @aidenybai! - Recognize stable previous/current transitions and exact convergence guards incomponentDidUpdate.#1497
1f6e181Thanks @aidenybai! - Recognize predictable guarded ref initialization while preserving diagnostics for render-dependent and externally mutable values.#1525
6b64dfaThanks @aidenybai! - Detect external collection mutations, setter callbacks, persistence calls, and async update calls inside React state updater functions.#1509
c672551Thanks @aidenybai! - Keepexhaustive-depsquiet for unconfigured custom Hooks without dependency arrays.#1507
a81b3d6Thanks @aidenybai! - Avoid reporting Intl formatters in plain utilities when their locale or options come from caller input.#1514
660200eThanks @aidenybai! - Require exported custom Hook callbacks to have same-file component prop provenance before reporting render-time callback invocations.#1490
8715808Thanks @aidenybai! - Recognize source-proven listener and timer teardown across stable aliases, local loops, and callback-ref replacement.#1510
3a0b9a0Thanks @aidenybai! - Avoid reporting parent notifications that forward an immutable snapshot from an imported external-subscription hook after also copying it into a comparison ref.#1498
2992a03Thanks @aidenybai! - Avoid flagging intentional JSON normalization at Next.js Pages Router props boundaries.#1521
443082aThanks @aidenybai! - Preserve sequential awaits when ordered operations mutate and observe one shared receiver.#1529
bf470d5Thanks @aidenybai! - Detect hoistable helpers inside compiledforwardRefcomponent wrappers.#1522
b479d7dThanks @aidenybai! - Recognize ref-owned one-shot timer reschedules with helper-based replacement and unmount cleanup.#1541
a9a1f40Thanks @skoshx! - Recognize exact-client SupabaseremoveChannelandremoveAllChannelscleanup for fluent Realtime subscriptions.#1503
5dc936eThanks @aidenybai! - Avoid reporting intentional uncontrolled state selected as the fallback to a controlled prop.#1511
fb5f881Thanks @aidenybai! - Treat custom Hook calls as opaque inno-effect-with-fresh-deps.#1508
a8115b8Thanks @aidenybai! - Avoidno-flush-syncfalse positives for Softmaple Awareness integrations that synchronize editor selections with committed text.#1477
3bc63eaThanks @aidenybai! - Avoid reporting intentionally sequential async traversal that appends await-derived values to an ordered output array.#1476
811a2ffThanks @aidenybai! - Avoid array-lookup reports for fresh array transforms and generated rest helpers with only small fixed omission lists.react-dropzone/react-dropzone (react-dropzone)
v19.2.0Compare Source
Features
shadcn-ui/ui (shadcn)
v4.16.1Compare Source
Patch Changes
#11322
bfa1b5e9a69a155b2f590523d50fda810bde1a9aThanks @AndrewBarba! - fixshadcn buildfailing with ENOENT when registry item names contain path segments (e.g.extension/foo) by creating nested output directories before writing#11352
5ca53ca7c7dea390e0e78091ff7c54adc48c773aThanks @shadcn! - forward search params to registries for server-side dynamic searchConfiguration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.