Skip to content

chore(deps): lock file maintenance npm packages #286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
renovate merged 1 commit into from
Oct 5, 2025
Merged

chore(deps): lock file maintenance npm packages #286

renovate merged 1 commit into from
Oct 5, 2025

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 5, 2025 •
edited
Loading

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
lockFileMaintenance All locks refreshed
@napi-rs/cli pnpm.catalog.default minor 3.2.0 -> 3.3.0 age adoption passing confidence
@napi-rs/wasm-runtime (source) devDependencies patch 1.0.5 -> 1.0.6 age adoption passing confidence
@types/node (source) devDependencies minor 24.4.0 -> 24.6.2 age adoption passing confidence
@types/react (source) devDependencies minor 19.1.13 -> 19.2.0 age adoption passing confidence
@types/react-dom (source) devDependencies minor 19.1.9 -> 19.2.0 age adoption passing confidence
cross-env devDependencies minor 10.0.0 -> 10.1.0 age adoption passing confidence
esbuild devDependencies patch 0.25.9 -> 0.25.10 age adoption passing confidence
lint-staged devDependencies minor 16.1.6 -> 16.2.3 age adoption passing confidence
oxlint (source) devDependencies minor 1.15.0 -> 1.19.0 age adoption passing confidence
pnpm (source) packageManager minor 10.16.1 -> 10.18.0 age adoption passing confidence
react (source) devDependencies minor 19.1.1 -> 19.2.0 age adoption passing confidence
react-dom (source) devDependencies minor 19.1.1 -> 19.2.0 age adoption passing confidence
rolldown (source) devDependencies patch 1.0.0-beta.37 -> 1.0.0-beta.41 age adoption passing confidence
tsx (source) devDependencies patch 4.20.5 -> 4.20.6 age adoption passing confidence
typescript (source) devDependencies patch 5.9.2 -> 5.9.3 age adoption passing confidence

🔧 This Pull Request updates lock files to use the latest dependency versions.

Release Notes

napi-rs/napi-rs (@​napi-rs/cli)

v3.3.0

Compare Source

napi-rs/napi-rs (@​napi-rs/wasm-runtime)

v1.0.6

Compare Source

kentcdodds/cross-env (cross-env)

v10.1.0

Compare Source

Features
  • add support for default value syntax (152ae6a)

For example:

"dev:server": "cross-env wrangler dev --port ${PORT:-8787}",

If PORT is already set, use that value, otherwise fallback to 8787.

Learn more about Shell Parameter Expansion

evanw/esbuild (esbuild)

v0.25.10

Compare Source

  • Fix a panic in a minification edge case (#​4287)

    This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):

    function identity(x) { return x }
identity({ y: identity(123) })

  • Fix @supports nested inside pseudo-element (#​4265)

    When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

    The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

    However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:

    /* Original code */
::placeholder {
  color: red;
  body & { color: green }
  @​supports (color: blue) { color: blue }
}

/* Old output (with --supported:nesting=false) */
::placeholder {
  color: red;
}
body :is() {
  color: green;
}
@​supports (color: blue) {
   {
    color: blue;
  }
}

/* New output (with --supported:nesting=false) */
::placeholder {
  color: red;
}
body :is() {
  color: green;
}
@​supports (color: blue) {
  ::placeholder {
    color: blue;
  }
}
lint-staged/lint-staged (lint-staged)

v16.2.3

Compare Source

Patch Changes
  • #​1669 27cd541 Thanks @​iiroj! - When using --fail-on-changes, automatically hidden (partially) unstaged changes are no longer counted to make lint-staged fail.

v16.2.2

Compare Source

Patch Changes

  • #​1667 699f95d Thanks @​iiroj! - The backup stash will not be dropped when using --fail-on-changes and there are errors. When reverting to original state is disabled (via --no-revert or --fail-on-changes), hidden (partially) unstaged changes are still restored automatically so that it's easier to resolve the situation manually.

    Additionally, the example for using the backup stash manually now uses the correct backup hash, if available:

    % npx lint-staged --fail-on-changes
✔ Backed up original state in git stash (c18d55a3)
✔ Running tasks for staged files...
✖ Tasks modified files and --fail-on-changes was used!
↓ Cleaning up temporary files...

✖ lint-staged failed because `--fail-on-changes` was used.

Any lost modifications can be restored from a git stash:

  > git stash list --format="%h %s"
  c18d55a3 On main: lint-staged automatic backup
  > git apply --index c18d55a3

v16.2.1

Compare Source

Patch Changes

  • #​1664 8277b3b Thanks @​iiroj! - The built-in TypeScript types have been updated to more closely match the implementation. Notably, the list of staged files supplied to task functions is readonly string[] and can't be mutated. Thanks @​outslept!

    export default {
---  "*": (files: string[]) => void console.log('staged files', files)
+++  "*": (files: readonly string[]) => void console.log('staged files', files)
}

  • #​1654 70b9af3 Thanks @​iiroj! - This version has been published from GitHub Actions using Trusted Publishing for npm packages.

  • #​1659 4996817 Thanks @​iiroj! - Fix searching configuration files when the working directory is a subdirectory of a git repository, and there are package.json files in the working directory. This situation might happen when running lint-staged for a single package in a monorepo.

  • #​1654 7021f0a Thanks @​iiroj! - Return the caret semver range (^) to direct dependencies so that future patch and minor versions are allowed. This enables projects to better maintain and deduplicate their own transitive dependencies while not requiring direct updates to lint-staged. This was changed in 16.2.0 after the vulnerability issues with chalk and debug, which were also removed in the same version.

    Given the recent vulnerabilities in the npm ecosystem, it's best to be very careful when updating dependencies.

v16.2.0

Compare Source

Minor Changes

  • #​1615 99eb742 Thanks @​iiroj! - Added a new option --fail-on-changes to make lint-staged exit with code 1 when tasks modify any files, making the precommit hook fail. This is similar to the git diff --exit-code option. Using this flag also implies the --no-revert flag which means any changes made my tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.

  • #​1611 cd05fd3 Thanks @​rlorenzo! - Added a new option --continue-on-error so that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.

  • #​1637 82fcc07 Thanks @​iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.

  • #​1647 a5ecc06 Thanks @​iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, the DEBUG environment variable is no longer supported — use the --debug to enable debugging

  • #​1636 8db2717 Thanks @​iiroj! - Added a new option --hide-unstaged so that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags --hide-unstaged --no-hide-partially-staged isn't meaningful and behaves the same as just --hide-unstaged.

    Thanks to @​ItsNickBarry for the idea and initial implementation in #​1552.

  • #​1648 7900b3b Thanks @​iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.

Patch Changes
oxc-project/oxc (oxlint)

v1.19.0

Compare Source

🚀 Features
  • b4d716f linter/plugins: Move custom JS plugin config to jsPlugins (#​14133) (overlookmotel)
🐛 Bug Fixes
  • 8879b5a linter/plugins: Add types export to npm/oxlint (#​14219) (overlookmotel)

v1.18.0: oxlint v1.18.0

Compare Source

[1.18.0] - 2025-09-24

This release should fix a critical memory leak when import plugin is enabled in IDEs.

🚀 Features
  • 2481964 linter/exhaustive-deps: Add support for useEffectEvent (#​14041) (Cody Olsen)
🐛 Bug Fixes
  • 444fcf0 linter: Fix false positive in vue/no-required-prop-with-default (#​14066) (yefan)
  • 2186b28 linter: Fix Arc memory leak and lifecycle issues (#​14049) (Boshen)
  • 314c27d linter/plugins: definePlugin apply defineRule to rules (#​14065) (overlookmotel)
  • 7bd01ed linter/plugins: defineRule call createOnce lazily (#​14062) (overlookmotel)
  • fb3e7e3 linter/plugins: defineRule accept visitor with no before / after hooks (#​14060) (overlookmotel)
🚜 Refactor
⚡ Performance
  • ce538c7 linter/plugins: Load methods of globals into local vars (#​14073) (overlookmotel)
  • c2f7459 language_server: Avoid cloning on message conversion (#​14058) (Sysix)
🧪 Testing
  • 2fd4b1e linter/plugins: Rename test (#​14064) (overlookmotel)
  • f2b3934 linter/plugins: Test returning false from before hook skips visitation in ESLint (#​14061) (overlookmotel)
  • b109419 linter/plugins: Align ESLint plugin with Oxlint (#​14059) (overlookmotel)

v1.17.0

Compare Source

🚀 Features
🚜 Refactor
  • bb040bc parser, linter: Replace .mjs files with .js (#​14045) (overlookmotel)
  • 7e0d736 linter/plugins: Rename --experimental-js-plugins to --js-plugins (#​13860) (overlookmotel)

v1.16.0: oxlint v1.16.0

Compare Source

[1.16.0] - 2025-09-16

🚀 Features
  • 97c8d06 linter: Add preserve-caught-error rule (#​13748) (孔辉)
  • 8c19b18 linter/exhaustive-deps: Implement fixer for dep in global scope (#​13783) (camc314)
  • 06bce8f linter/exhaustive-deps: Implement fixer for missing dep (#​13782) (camc314)
  • a8675f4 linter: Add eslint/class-methods-use-this rule (#​12977) (Peter Cardenas)
  • db33196 parser: Adds typescript rule for empty argument list (#​13730) (Karan Kiri)
  • 2751193 linter: Add eslint/no-useless-computed-key rule (#​13428) (yefan)
  • 9a205d1 regex-parser: Parse simple TemplateLiterals (#​13265) (Sysix)
🐛 Bug Fixes
  • a2c91cd linter: Drop rules to allow mutable access to ctx_host in run_external_rules (#​13832) (camc314)
  • 3af1e5d linter/no-unsafe-declaration-merging: Always mark first span as primary (#​13830) (camc314)
  • 1c43c7c linter: Keep message when merging composite fixes (#​13827) (camc314)
  • 26af302 linter/exhaustive-deps: Check stable value is on lhs of assignment expr (#​13815) (camc314)
  • 4bc12d0 linter/exhaustive-deps: Remove impossible comparison with parent kind (#​13814) (camc314)
  • 12baf5e linter/exhaustive-deps: Respect primary span when identifying disable directive location (#​13781) (camc314)
  • fa7400a linter/no-undef: False positive with arguments in functions (#​13763) (camc314)
  • 50e6e3c editor: Restrict servers paths for oxc.path.server (#​13740) (Sysix)
  • b45077d editor: Strip leading slash for bin path on windows (#​13738) (Sysix)
  • 8fa6227 editor: Don't allow oxc.path.server for untrusted workspaces (#​13734) (Sysix)
  • 56da114 linter/react/jsx-handler-names: Do not detect the function name within the inline-function's body block (#​13456) (Takuji Shimokawa)
  • b2bc5b4 linter/react-perf/jsx-no-new-object-as-prop: Skip as/satisfies exprs (#​13718) (camc314)
  • ab51394 raw_transfer: Disable layout assertions on some 32-bit platforms (#​13716) (overlookmotel)
  • 09428f6 linter/plugins: Remove outdated comment (#​13691) (overlookmotel)
  • a294721 linter/plugins: Exit early if JS plugins enabled on unsupported platforms (#​13689) (overlookmotel)
  • 68a2280 linter/plugins: More graceful exit for --experimental-js-plugins CLI option (#​13688) (overlookmotel)
🚜 Refactor
  • 395d40d linter: Derive inmpls for PartialEq, Eq over manual ones (#​13828) (camc314)
  • 8e4cd8f linter/func-names: Use run_once over looping over all nodes (#​13798) (camc314)
  • 7f4e2fe eslint/func-names: Clean up implementation and improve documentation (#​13601) (Antoine Zanardi)
  • 137896a language_server: Split options for linting and formatting (#​13627) (Sysix)
  • 7346099 linter: Move oxlint application code into separate module (#​13745) (overlookmotel)
  • 6dd4107 linter: Remove #[cfg(test)] attributes from tester module (#​13714) (overlookmotel)
  • c40c6ef linter/plugins: Directory for JS plugins-related code (#​13701) (overlookmotel)
  • a0022c1 linter/plugins: Improve error messages for JS plugins (#​13699) (overlookmotel)
  • 1fd993f napi/oxlint: Rename napi/oxlint2 to napi/oxlint (#​13682) (overlookmotel)
⚡ Performance
  • 90c8286 linter: Detect node types from let..else statements (#​13690) (camchenry)
  • 08c05df semantic: Make CFG construction a compile-time feature (#​13678) (Boshen)
🎨 Styling
  • 99a7638 linter: Add comments + re-organise imports (#​13715) (overlookmotel)
🧪 Testing
  • 18a1145 linter: Add debug assertions for skipping rules (#​13724) (camc314)
  • cb080de linter/no-unused-vars: Add test for non ASCII chars in JSX components (#​13820) (camc314)
  • b6eba27 linter/no-undef: Add more test cases for arguments (#​13764) (camc314)
  • fb2d087 linter: Set CWD for tests (#​13722) (overlookmotel)
💼 Other
pnpm/pnpm (pnpm)

v10.18.0

Compare Source

Minor Changes

  • Added network performance monitoring to pnpm by implementing warnings for slow network requests, including both metadata fetches and tarball downloads.

    Added configuration options for warning thresholds: fetchWarnTimeoutMs and fetchMinSpeedKiBps.
    Warning messages are displayed when requests exceed time thresholds or fall below speed minimums

    Related PR: #​10025.

Patch Changes
  • Retry filesystem operations on EAGAIN errors #​9959.
  • Outdated command respects minimumReleaseAge configuration #​10030.
  • Correctly apply the cleanupUnusedCatalogs configuration when removing dependent packages.
  • Don't fail with a meaningless error when scriptShell is set to false #​8748.
  • pnpm dlx should not fail when minimumReleaseAge is set #​10037.

v10.17.1

Compare Source

Patch Changes
  • When a version specifier cannot be resolved because the versions don't satisfy the minimumReleaseAge setting, print this information out in the error message #​9974.
  • Fix state.json creation path when executing pnpm patch in a workspace project #​9733.
  • When minimumReleaseAge is set and the latest tag is not mature enough, prefer a non-deprecated version as the new latest #​9987.

v10.17.0

Compare Source

Minor Changes

  • The minimumReleaseAgeExclude setting now supports patterns. For instance:

    minimumReleaseAge: 1440
minimumReleaseAgeExclude:
  - "@​eslint/*"

    Related PR: #​9984.

Patch Changes
  • Don't ignore the minimumReleaseAge check, when the package is requested by exact version and the packument is loaded from cache #​9978.
  • When minimumReleaseAge is set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #​9979.
facebook/react (react)

v19.2.0

Compare Source

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features
  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools
New React DOM Features
  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.
Notable changes
  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId
All Changes
React
React DOM
React Server Components
React Reconciler
rolldown/rolldown (rolldown)

v1.0.0-beta.41

Compare Source

🚀 Features
🐛 Bug Fixes

Configuration

📅 Schedule: Branch creation - "before 9am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) October 5, 2025 16:48
@renovate renovate bot force-pushed the renovate/npm-packages branch from c041dcc to b9b6554 Compare October 5, 2025 21:59
@renovate renovate bot merged commit 6f6e737 into main Oct 5, 2025
54 checks passed
@renovate renovate bot deleted the renovate/npm-packages branch October 5, 2025 22:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant