chore(deps): update all npm dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/standalone (source)	7.29.2 → 7.29.4
@swc/core (source)	1.15.30 → 1.15.33
@types/node (source)	24.12.2 → 24.12.4
acorn	8.15.0 → 8.16.0
esbuild	0.27.4 → 0.28.0
fflate (source)	0.8.2 → 0.8.3
fs-extra	11.3.4 → 11.3.5
globals	17.5.0 → 17.6.0
npm (source)	10.9.4 → 10.9.8
publint (source)	0.3.18 → 0.3.21
puppeteer (source)	24.42.0 → 24.43.1
react (source)	19.2.5 → 19.2.6
react-dom (source)	19.2.5 → 19.2.6
react-router-dom (source)	7.14.2 → 7.15.1
rollup (source)	4.60.2 → 4.60.4
turbo (source)	2.9.12 → 2.9.14

---

Release Notes

babel/babel (@​babel/standalone)

v7.29.4

Compare Source

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #​17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3

Compare Source

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #​17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #​17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #​17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser
  • #​17782 Improve trailing comma comment handling (@​JLHwung)

📝 Documentation

• #​17847 Replace npmjs.com links with npmx.dev (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-helper-import-to-platform-api, babel-plugin-proposal-import-wasm-source, babel-plugin-transform-json-modules
  • #​17818 Load async Wasm and JSON imports in parallel (@​nicolo-ribaudo)

Committers: 4

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu

swc-project/swc (@​swc/core)

v1.15.33

Compare Source

Bug Fixes

• (ci) Update rand lockfile entries (#​11827) (7988966)

• (es/minifier) Fold unary bool nullish coalescing (#​11826) (e39ae3d)

• (es/minifier) Preserve for-init sequence order (#​11837) (16a56d0)

• (es/parser) Parse empty Flow exact object type (#​11836) (3d18a26)

Features

• Move swc ast explorer into workspace (#​11831) (02a8f81)

v1.15.32

Compare Source

Bug Fixes

• (es/flow) Fix Flow type-only modules in script transforms (#​11817) (be38316)

• (es/flow) Avoid restoring module context when flow syntax is enabled (#​11819) (3ed7243)

• (es/minifier) Preserve frozen spread registry keys (#​11825) (347181c)

• (es/parser) Align Flow generic arrow JSX disambiguation (#​11821) (28a7fad)

Features

• (es) Add jsc.preserveSymlinks to swc::Options (#​11813) (fe38342)

acornjs/acorn (acorn)

v8.16.0

Compare Source

evanw/esbuild (esbuild)

v0.28.0

Compare Source

v0.27.7

Compare Source

v0.27.5

Compare Source

101arrowz/fflate (fflate)

v0.8.3

Compare Source

• Fix buffer over-read for Zip64 extra fields
• Support sync flushes (Z_SYNC_FLUSH in zlib)
  • Allows for immediate decompression of all pushed bytes
  • Enables DEFLATE stream concatenation
• Fix zip/zipSync when using cross-realm Uint8Array
• Improve Zip64 support for streamed or undersized archives
• Update performance estimates in README
• Fix typings for TypeScript v5.7+
• Reduce memory consumption after compression stream completion

jprichardson/node-fs-extra (fs-extra)

v11.3.5

Compare Source

• Fix ensureLink*/ensureSymlink* identical file detection on Windows (#​1068)
• Fix error handling in timestamp preservation code (#​1065, #​1069)
• Fix potential file descriptor leak on error in synchronous timestamp preservation code (#​1066)

sindresorhus/globals (globals)

v17.6.0

Compare Source

npm/cli (npm)

v10.9.8

Compare Source

Dependencies

• workspace: @npmcli/arborist@8.0.5
• workspace: libnpmdiff@7.0.5
• workspace: libnpmexec@9.0.5
• workspace: libnpmfund@6.0.5
• workspace: libnpmpack@8.0.5

v10.9.7

Compare Source

Bug Fixes

• bbcd455 #​9120 arborist: v10 - backport store, lock-only, and override sibling fixes (#​9120) (@​manzoorwanijk)

Dependencies

• cc9a4de #​9130 hoist production @​sigstore dependencies

Chores

• e5c1309 #​9130 dev dependency updates (@​wraithgar)
• workspace: @npmcli/arborist@8.0.4
• workspace: libnpmdiff@7.0.4
• workspace: libnpmexec@9.0.4
• workspace: libnpmfund@6.0.4
• workspace: libnpmpack@8.0.4

v10.9.6

Compare Source

Bug Fixes

• d6fe671 #​9098 arborist: v10 - backport multiple fixes for linked install (#​9098) (@​manzoorwanijk)

Dependencies

• a5dadad #​9067 tar@7.5.11
• 87abb92 #​9067 pacote@20.0.1
• c2f0fd2 #​9067 pacote@19.0.2
• workspace: @npmcli/arborist@8.0.3
• workspace: libnpmdiff@7.0.3
• workspace: libnpmexec@9.0.3
• workspace: libnpmfund@6.0.3
• workspace: libnpmpack@8.0.3

v10.9.5

Compare Source

Bug Fixes

• 794f6c8 #​9011 backport linked strategy fixes from multiple PRs to v10 (#​9011) (@​manzoorwanijk)

Dependencies

• 6717032 #​9056 tuf-js@3.1.0
• e4e25ea #​9056 tinyglobby@0.2.15
• 9464329 #​9056 socks@2.8.7
• 23c3e17 #​9056 postcss-selector-parser@7.1.1
• 77f9c29 #​9056 p-map@7.0.4
• f1a0315 #​9056 npm-install-checks@7.1.2
• ad7d3ac #​9056 normalize-package-data@7.0.1
• 63a7c82 #​9056 node-gyp@11.5.0
• 569d807 #​9056 isexe@3.1.5
• 7dbe993 #​9056 fdir@6.5.0
• f241a38 #​9056 exponential-backoff@3.1.3
• bdeabff #​9056 ci-info@4.4.0
• d8ebcd5 #​9056 aproba@2.1.0
• be1b008 #​9056 spdx-license-ids@3.0.23
• 1005efd #​9056 strip-ansi@7.2.0
• d00bf96 #​9056 diff@5.2.2
• 7a74819 #​9056 debug@4.4.3
• 938db00 #​9056 minipass@7.1.3
• 70e90e5 #​9056 minimatch@9.0.9
• 733ff41 #​9056 glob@10.5.0
• ea8227a #​9056 ansi-styles@6.2.3
• edd20ef #​9056 ansi-regex@6.2.2
• 2592b45 #​9056 agent-base@7.7.4
• 3174366 #​9056 semver@7.7.4
• 380df0e #​9056 tar@7.5.9
• 49025ae #​9056 chalk@5.6.2
• 64601cd #​9056 @npmcli/promise-spawn@8.0.3
• 0e23c00 #​9056 validate-npm-package-name@6.0.2

Chores

• 72cc7de #​9056 template-oss@4.29.0 (@​wraithgar)
• 51711b8 #​9056 dev dependency updates (@​wraithgar)
• workspace: @npmcli/arborist@8.0.2
• workspace: libnpmdiff@7.0.2
• workspace: libnpmexec@9.0.2
• workspace: libnpmfund@6.0.2
• workspace: libnpmpack@8.0.2
• workspace: libnpmpublish@10.0.2

publint/publint (publint)

v0.3.21

Compare Source

Patch Changes

• Suggest adding "sideEffects": false when bundler-oriented package fields or conditions are detected and the field is missing. (#​228)

v0.3.20

Compare Source

Patch Changes

• Suggest adding engines.node when it is missing from detected Node.js packages (#​226)

• Loosen "breaking change" wording in lint messages (7bb3f4f)

v0.3.19

Compare Source

Patch Changes

• Add NESTED_PACKAGE_JSON_FIELD_IGNORED to warn when published nested package.json files define "exports" or "imports", which Node.js ignores outside the package root. (#​224)

• Fix internal browser directory traversal logic (#​224)

puppeteer/puppeteer (puppeteer)

v24.43.1

Compare Source

♻️ Chores

• puppeteer: Synchronize puppeteer versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 2.13.1 to 2.13.2

🛠️ Fixes

• reject BiDi URL restrictions (#​14956) (b2140ae)
• remove networkidle options from setContent (#​14940) (54254e4)
• roll to Firefox 150.0.2 (#​14946) (a588310)

⚡ Performance

• dispose sub-classes correctly (#​14430) (e285ff2)
• optimize url blocking on navigation (#​14945) (e4002a4)

v24.43.0

Compare Source

🎉 Features

• Implement allowlist (#​14897) (e7e31f8)
• roll to Chrome 148.0.7778.56 (#​14918) (65890b7)
• roll to Firefox 150.0 (#​14900) (beab61b)
• support checkboxes and radios in locator.fill (#​14939) (fec05a0)
• webmcp: Add support for untrustedContent WebMCPAnnotation (#​14901) (0314942)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 2.13.0 to 2.13.1

🛠️ Fixes

• Disable WebUIReloadButton experiment (#​14925) (d9639e9)
• do not open DevTools if it is already open (#​14922) (84c9d34)
• do not set global offline flag for allowlist (#​14931) (d6a1003)
• roll to Chrome 148.0.7778.97 (#​14929) (536eb11)
• roll to Firefox 150.0.1 (#​14923) (50438cf)

facebook/react (react)

v19.2.6: 19.2.6 (May 6th, 2026)

Compare Source

React Server Components

• Type hardening and performance improvements
  (by @​eps1lon and @​unstubbable)

remix-run/react-router (react-router-dom)

v7.15.1

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.15.1

v7.15.0

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.15.0

rollup/rollup (rollup)

v4.60.4

Compare Source

2026-05-14

Bug Fixes

• Improve stability of chunk hashes (#​6362)

Pull Requests

• #​6362: fix: stabilize chunk assignment across parallel file reads (@​sonukapoor, @​Sonu Kapoor, @​TrickyPi, @​lukastaegert)
• #​6370: fix(deps): update minor/patch updates (@​renovate[bot])
• #​6371: chore(deps): update dependency lru-cache to v11 (@​renovate[bot], @​lukastaegert)
• #​6372: chore(deps): update react monorepo to v19 (major) (@​renovate[bot])
• #​6373: chore(deps): lock file maintenance (@​renovate[bot], @​lukastaegert)
• #​6375: Resolve vulnerabilities (@​lukastaegert)

v4.60.3

Compare Source

2026-05-04

Bug Fixes

• Ensure nested "exports" variables are not renamed (#​6360)

Pull Requests

• #​6360: fix: do not rename nested "exports" bindings that do not conflict (@​tariqrafique, @​lukastaegert)
• #​6364: chore(deps): update msys2/setup-msys2 digest to e989830 (@​renovate[bot])
• #​6365: fix(deps): update minor/patch updates (@​renovate[bot])
• #​6366: fix(deps): update swc monorepo (major) (@​renovate[bot])
• #​6367: chore(deps): lock file maintenance (@​renovate[bot], @​lukastaegert)
• #​6368: docs: add missing backticks in plugin-development (@​lumirlumir, @​lukastaegert)

vercel/turborepo (turbo)

v2.9.14: Turborepo v2.9.14

Compare Source

[!NOTE]
This release contains important security fixes.

High:

• GHSA-5xc8-49mv-x4mm: Turborepo VSCode Extension command injection

Low:

• GHSA-hcf7-66rw-9f5r: Login callback CSRF/session fixation
• GHSA-3qcw-2rhx-2726: Unexpected local code execution during Yarn Berry detection

What's Changed

Changelog

• release(turborepo): 2.9.12 by @​github-actions[bot] in #​12774
• fix: Restore docs mobile menu by @​anthonyshew in #​12782
• ci: Use pull_request for PR title linting by @​anthonyshew in #​12787
• ci: Scope GitHub Actions caches by branch by @​anthonyshew in #​12788
• test: Validate lockfiles without dependency downloads by @​anthonyshew in #​12789
• Removed unneeded import form hash creation script in docs by @​dancrumb in #​12799
• fix: Validate auth callback state by @​anthonyshew in #​12802
• fix: Harden VS Code extension command execution by @​anthonyshew in #​12800
• fix: Avoid project-local Yarn during detection by @​anthonyshew in #​12801
• chore: Release 2.9.13 by @​anthonyshew in #​12803

New Contributors

• @​dancrumb made their first contribution in #​12799

Full Changelog: vercel/turborepo@v2.9.12...v2.9.14

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday at 10:00am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.