Update npm dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
eslint (source)	10.4.1 → 10.5.0
eslint-plugin-oxlint	1.69.0 → 1.70.0
eslint-plugin-react-dom (source)	5.8.17 → 5.9.0
eslint-plugin-react-jsx (source)	5.8.17 → 5.9.0
eslint-plugin-react-naming-convention (source)	5.8.17 → 5.9.0
eslint-plugin-react-x (source)	5.8.17 → 5.9.0
oxfmt (source)	^0.54.0 → ^0.55.0
oxlint (source)	1.69.0 → 1.70.0
pnpm (source)	11.5.3 → 11.7.0
typescript-eslint (source)	8.61.0 → 8.61.1

---

Release Notes

eslint/eslint (eslint)

v10.5.0

Compare Source

oxc-project/eslint-plugin-oxlint (eslint-plugin-oxlint)

v1.70.0

Compare Source

No significant changes

    View changes on GitHub

Rel1cx/eslint-react (eslint-plugin-react-dom)

v5.9.0

Compare Source

✨ New

• Added react-web-api/no-leaked-intersection-observer rule to prevent leaked IntersectionObserver instances in components and hooks, enabled as warn in the recommended preset (#​1841, #​1868).

🐞 Fixes

• react-web-api/no-leaked-intersection-observer, react-web-api/no-leaked-resize-observer: Report when disconnect is only called inside the observer's own callback, since the callback may never run if the component unmounts before the element intersects or resizes (#​1872).

🏗️ Internal

• Improved CI configuration and updated SECURITY.md documentation (#​1871).
• Bumped fumadocs-core and fumadocs-ui to 16.10.1.

New Contributors

• Maikel van Dort (@​Netail) made their first contribution in #​1868.

Full Changelog: Rel1cx/eslint-react@v5.8.19...v5.9.0

v5.8.19

Compare Source

🏗️ Internal

• Simplified isJsxLike in core package and added behavior boundary tests (#​1869).
• Aligned code style in jsx package with core package (#​1870).
• Updated @types/node to ^25.9.3.

Full Changelog: Rel1cx/eslint-react@v5.8.18...v5.8.19

v5.8.18

Compare Source

🐞 Fixes

• Improved key detection in react-x/no-array-index-key and react-x/no-missing-key rules (#​1867).

📝 Documentation

• Removed 'See Also' sections from custom rule recipes.
• Reordered AST section in kit package docs (#​1866).
• Formatted examples as accordions in kit package docs.

🏗️ Internal

• Removed postinstall script on the website.
• Updated textlint rules for inclusive language.
• Updated dependencies and relaxed eslint peer dependency.

Full Changelog: Rel1cx/eslint-react@v5.8.17...v5.8.18

oxc-project/oxc (oxfmt)

v0.55.0

Compare Source

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#​22935) (AliceLanniste)

oxc-project/oxc (oxlint)

v1.70.0

Compare Source

🚀 Features

• 2e8bda4 linter/vue: Implement no-dupe-keys rule (#​23350) (bab)
• 1490a0a linter/react: Implement react-compiler rule (#​23202) (Boshen)
• dd560ae linter/unicorn: Implement no-array-fill-with-reference-type rule (#​23397) (Mikhail Baev)
• af36c2f linter: Add schema for react/jsx-curly-brace-presence (#​23400) (WaterWhisperer)
• 47d34a3 linter: Add schema for react/jsx-handler-names (#​23393) (WaterWhisperer)
• f4250d0 linter: Add schema for unicorn/import-style (#​23386) (WaterWhisperer)
• 30c74ce linter: Add schema for jsx_a11y/no-noninteractive-element-to-interactive-role (#​23384) (Sysix)
• cfbe8dc linter: Add schema for jsx_a11y/no-interactive-element-to-noninteractive-role (#​23382) (WaterWhisperer)
• d15b7ff linter: Add schema for typescript/no-restricted-types (#​23381) (WaterWhisperer)
• 028a811 linter: Add schema for jsx-a11y/media-has-caption (#​23377) (Sysix)
• b3b1038 linter: Add schema for jsx-a11y/label-has-associated-control (#​23376) (Sysix)
• 7ada6b2 linter: Add schema for jsx_a11y/no-distracting-elements (#​23379) (WaterWhisperer)
• ee3dd49 linter: Add schema for jsx-a11y/img-redundant-alt (#​23374) (Sysix)
• df5f8dd linter: Add short descriptions to most lint rules. (#​23365) (Connor Shea)
• e3fd735 linter: Add schema for jsx_a11y/alt-text (#​23369) (Sysix)
• 0f2fff4 linter: Add schema for react/exhaustive-deps (#​23372) (Mikhail Baev)
• e3e4e10 linter: Add schema for react_perf/jsx-no-new-object-as-prop (#​23368) (Mikhail Baev)
• 9366d44 linter: Add schema for unicorn/prefer-at (#​23366) (WaterWhisperer)
• f57b55d linter: Add schema for typescript/array-type (#​23355) (Sysix)
• 0dcf912 linter: Add schema for typescript/ban-ts-comment (#​23354) (Sysix)
• 51fa83e linter: Add schema for react/no-did-update-set-state (#​23357) (Mikhail Baev)
• 59db0bd linter: Add schema for consistent-generic-constructors (#​23353) (Sysix)
• c4775c0 linter: Add schema for typescript/consistent-type-assertions (#​23349) (Sysix)
• 6e516f7 linter: Add schema for typescript/consistent-type-imports (#​23348) (Sysix)
• 012134d linter: Add schema for react/jsx-no-target-blank (#​23345) (WaterWhisperer)
• 0806aae linter: Add schema for jsx_a11y/no-noninteractive-tabindex (#​23337) (Mikhail Baev)
• 0708b5a linter: Add schema for react/jsx-filename-extension (#​23315) (Mikhail Baev)
• 150bce1 linter: Add schema for typescript/no-empty-object-type (#​23309) (Sysix)
• f9e36f1 linter: Add schema for typescript/no-duplicate-type-constituents (#​23308) (Sysix)
• 937accf linter: Add schema for typescript/no-invalid-void-type (#​23307) (Sysix)
• 3e042b9 linter: Add schema for typescript/no-misused-promises (#​23306) (Sysix)
• da212d1 linter: Add schema for typescript/no-unnecessary-condition (#​23305) (Sysix)
• f8f0d38 linter: Add schema for typescript/parameter-properties (#​23304) (Sysix)
• 2275fc7 linter: Add schema for typescript/prefer-nullish-coalescing (#​23302) (Sysix)
• d353858 linter: Add schema for typescript/prefer-string-starts-ends-with (#​23301) (Sysix)
• 03060f5 linter: Add schema for typescript/triple-slash-reference (#​23300) (Sysix)
• 6619cee linter: Add schema for promise/param-names (#​23298) (Sysix)
• 8bf108e linter: Add schema for promise/catch-or-return (#​23297) (Sysix)
• 48158d0 linter: Add schema for vitest/consistent-each-for (#​23294) (Sysix)
• 7e74c98 linter: Add schema for vitest/consistent-test-filename (#​23293) (Sysix)
• ff94d4a linter: Add schema for vitest/consistent-vitest-vi (#​23292) (Sysix)
• 2409a10 linter: Add schema for vitest/prefer-import-in-mock (#​23291) (Sysix)
• 3d782b7 linter: Add schema for react/no-unstable-nested-components (#​23287) (Mikhail Baev)
• 0a0bc2f linter/jsx-a11y: Add allowedRedundantRoles option to no-redundant-roles (#​22820) (bab)
• 80758a5 linter/vue: Implement no-side-effects-in-computed-properties rule (#​23282) (bab)
• e3869ac linter: Add schema for react/no-object-type-as-default-prop (#​23279) (Mikhail Baev)
• 4480609 linter: Add schema for react/jsx-props-no-spreading (#​23276) (Mikhail Baev)
• 08d68a5 linter/react: Implement jsx-no-literals rule (#​23145) (kapobajza)
• 9a2788b linter/unicorn: Implement prefer-export-from rule (#​22935) (AliceLanniste)
• bdb723c linter/unicorn: Implement prefer-single-call rule (#​23235) (Yuzhe Shi)
• 31543ed linter: Add schema for vue/define-props-destructuring (#​23252) (Sysix)
• 21b6c3d linter: Add schema for oxc/no-async-endpoint-handlers (#​23251) (Sysix)
• e77ff81 linter: Add schema for unicorn/prefer-object-from-entries (#​23249) (Mikhail Baev)
• bcac2d6 linter: Add schema for jest/vitest/no-restricted-matchers (#​23247) (Sysix)
• 539f036 linter: Add schema for jest/vitest/no-restricted-*-methods (#​23246) (Sysix)
• dd1b927 linter/vue: Implement require-default-prop rule (#​22951) (bab)
• 3f018e7 linter: Add schema for unicorn/no-instanceof-builtins (#​23225) (Mikhail Baev)
• e0d0f78 linter: Verify promise/no-callback-in-promise schema (#​23141) (beanscg)
• 123d4f4 linter: Add schema for jest/vitest/valid-expect (#​23185) (Sysix)
• 46c8a21 linter: Add schema for jest/vitest/require-top-level-describe (#​23184) (Sysix)
• 41465cf linter: Add schema for jest/vitest/prefer-snapshot-hint (#​23183) (Sysix)
• d068b9b linter: Add schema for jest/vitest/prefer-expect-assertions (#​23181) (Sysix)
• 064a1ee linter: Add schema for jest/prefer-ending-with-an-expect (#​23180) (Sysix)
• d046797 linter: Add schema for jest/vitest/no-standalone-expect (#​23179) (Sysix)
• 137b9a6 linter: Add schema for jest/vitest/no-large-snapshots (#​23178) (Sysix)
• 0f3e4a5 linter: Add schema for jest/vitest/no-hooks (#​23177) (Sysix)
• cd0b384 linter: Add schema for unicorn/explicit-length-check (#​23155) (Mikhail Baev)
• 01b74c4 linter: Add schema for jest/no-deprecated-functions (#​23136) (Sysix)
• 9d6a387 linter: Add schema for unicorn/catch-error-name (#​23137) (Mikhail Baev)
• 0da8efa linter: Add schema for jest/vitest/max-nested-describe (#​23131) (Sysix)
• d71c9fd linter: Add schema for eslint/no-use-before-define (#​23129) (Sysix)

🐛 Bug Fixes

• 26ddac6 linter: Avoid config schema generation for jsx_a11y/no-noninteractive-element-interactions (#​23385) (Sysix)
• 40556ad linter: Parse jsx-a11y/control-has-associated-label config with DefaultRuleConfig (#​23373) (Sysix)
• 71e9648 linter: Expose no-noninteractive-element-interactions schema (#​23283) (camc314)
• 6c86d1c linter/react-perf: Correct nativeAllowList all schema (#​23229) (camc314)
• 4dd52de linter/react-perf: Re-generate stale snapshots (#​23228) (camc314)
• 8f3db61 linter: Allow options for eslint/capitalized-comments (#​23139) (Sysix)

⚡ Performance

• f09707e linter: jest/no-deprecated-functions store config version as usize (#​23138) (Sysix)

📚 Documentation

• f682e25 linter: Remove manually written options doc for eslint/prefer-arrow-callback (#​23438) (Mikhail Baev)
• 64c942c linter: Remove manually written options doc for eslint/no-sequences (#​23420) (Mikhail Baev)
• 14abf32 linter/react-perf: Use autogenerated docs (#​23227) (camc314)

pnpm/pnpm (pnpm)

v11.7.0

Compare Source

Minor Changes

• Added a new setting frozenStore (--frozen-store) that lets pnpm install run against a package store on a read-only filesystem (e.g. a Nix store, a read-only bind mount, an OCI layer). When enabled, pnpm opens the store's SQLite index.db through the immutable=1 URI — bypassing the WAL/-shm sidecar creation that otherwise fails on a read-only directory — and suppresses every store-write path (the index.db writer and the project-registry write). Pair it with --offline --frozen-lockfile against a fully-populated store. Under the global virtual store, package directories live inside the store, so if the store is missing the build output of a package whose lifecycle scripts are approved (or that has a patch), pnpm fails up front with ERR_PNPM_FROZEN_STORE_NEEDS_BUILD rather than crashing mid-build on a read-only write — seed the store with those builds first. Incompatible with --force and with a configured pnpr server, since both write into the store; the side-effects cache is likewise not written under frozenStore. If the store is missing its content directory, the install fails fast with ERR_PNPM_FROZEN_STORE_INCOMPLETE rather than attempting to initialize it. The read-only immutable=1 open requires Node.js >=22.15.0, >=23.11.0, or >=24.0.0; on older runtimes --frozen-store fails with a clear ERR_PNPM_FROZEN_STORE_UNSUPPORTED_NODE error. Bin-linking also tolerates a read-only store: under the global virtual store a package's bin source lives inside the store, so the chmod that makes it executable would be refused — with EPERM/EACCES, or with EROFS on a genuinely read-only filesystem. That chmod is redundant when the seed already ships its bins executable with a normalized shebang, so it is now skipped in that case, while a non-executable bin (or one still carrying a Windows CRLF shebang) on a read-only store still errors.

• When pacquet (the Rust port of pnpm) is declared in configDependencies, pnpm now delegates dependency resolution to it too — not just materialization — provided the installed pacquet is new enough to support full resolving installs (>= 0.11.7).

  Previously pacquet only ran in frozen-install mode: pnpm always resolved the dependency graph itself (writing pnpm-lock.yaml) and handed pacquet a finished lockfile to fetch / import / link. With pacquet >= 0.11.7, a non-frozen pnpm install (default isolated nodeLinker, plain install) is delegated to pacquet end-to-end in a single pass — pacquet resolves the manifests, writes the lockfile, and materializes node_modules. pnpm detects the capability from the installed pacquet's version; older pacquet releases keep the resolve-then-materialize split, and add / update / remove still resolve in pnpm (it has to mutate the manifests first). This remains an opt-in preview of the Rust install engine #​11723.

• Added a new opt-in --batch flag to pnpm publish --recursive that sends all selected packages to the registry in a single PUT /-/pnpm/v1/publish request instead of one request per package. The target registry has to implement the batch publish endpoint (pnpr does); registries that don't are reported with a clear ERR_PNPM_BATCH_PUBLISH_UNSUPPORTED error. The batch is processed all-or-nothing by pnpr: if any package in the batch fails validation, none of the packages are published.

Patch Changes

• Reject path-traversal and reserved dependency aliases (such as ../../../escape, .bin, .pnpm, or node_modules) that come from a lockfile rather than a freshly resolved manifest. A crafted lockfile alias could otherwise be joined directly under a hoisted node_modules directory, letting package files be written outside the intended install root or overwrite pnpm-owned layout.

  The fix adds two layers:

  • The nodeLinker: hoisted graph builder now validates each alias at the directory sink (safeJoinModulesDir), matching the validation pnpm already performs when resolving aliases from manifests.
  • The lockfile verification gate (verifyLockfileResolutions) now runs an always-on, policy-independent check that rejects any importer or snapshot dependency alias that is not a valid package name, failing the install early — before any fetch or filesystem work — for every node linker at once.

• Made shared package child resolution deterministic when the same package is reached through multiple contexts. pnpm now chooses the shallowest occurrence, then importer order, then parent path, instead of letting request timing decide the child context and missing-peer report pnpm/pnpm#12358.

• Fix garbled summary line after submitting pnpm update -i and pnpm audit --fix -i. The interactive checkbox prompt previously printed every selected choice's full table row (label, current/target versions, workspace, URL) joined by commas, producing a wall of text after pressing Enter. The summary now lists only the selected package names (or vulnerability keys) by setting an explicit short per choice; the in-progress selection UI is unchanged.

• Prevent pnpm patch-remove from removing files outside the configured patches directory.

• Fixed pnpm publish ignoring strictSsl: false when publishing to registries with self-signed certificates. The strictSSL option is now forwarded to libnpmpublish / npm-registry-fetch so that strict-ssl=false in .npmrc or strictSsl: false in pnpm-workspace.yaml is respected during publish, the same way it is for pnpm install pnpm/pnpm#12012.

• Fixed Cannot destructure property 'manifest' of 'manifestsByPath[rootDir]' as it is undefined regression introduced in 11.6.0 when running pnpm add <pkg> outside a workspace on Windows. selectProjectByDir was keying the resulting ProjectsGraph by opts.dir instead of project.rootDir, so downstream manifestsByPath lookups missed when the two paths normalized differently (typically drive-letter casing). pnpm/pnpm#12379

• Git dependencies that point to a subdirectory of a repository (repo#commit&path:/sub/dir) keep their path in the lockfile again. Since the integrity of git-hosted tarballs started being pinned in the lockfile, any install that actually downloaded the tarball rebuilt the lockfile resolution as { integrity, tarball, gitHosted } and dropped the path field, while installs served from the store kept it — so the field disappeared seemingly at random. Without path, later installs from that lockfile silently unpacked the repository root instead of the subdirectory #​12304.

• Fixed nondeterministic lockfile output that made pnpm dedupe --check fail intermittently in CI. When a locked peer provider was pinned for a dependency that has no child dependencies of its own, the pinned provider leaked into the shared parent scope, so siblings resolved after it could pick up an optional peer they should not see. Which siblings were affected depended on resolution order, which varies with network timing.

• Sped up pnpm install with a frozen lockfile by running lockfile verification (the policy revalidation gate added for minimumReleaseAge/trustPolicy and the tarball-URL anti-tamper check) concurrently with fetching and linking instead of blocking the whole install on it. Dependency lifecycle scripts are still held back until verification succeeds, so no script runs on an unverified lockfile: if verification fails the install aborts before any dependency build, and if linking finishes first the install waits for the verification verdict before completing.

• User-defined npm_config_* environment variables are now preserved during lifecycle script execution. Previously, all npm_-prefixed env vars were stripped, which caused user-set variables like npm_config_platform_arch to be lost pnpm/pnpm#12399.

• pnpm can now use different auth tokens for different package scopes, even when those scopes use the same registry URL.

  Previously, auth was selected only by registry URL. If @org-a and @org-b both used https://npm.pkg.github.com/, they had to share the same token. This caused problems for registries that issue tokens per organization or per scope.

  Configure a scope-specific token by adding the package scope after the registry URL in the auth key:

  @​org-a:registry=https://npm.pkg.github.com/
  @​org-b:registry=https://npm.pkg.github.com/
  
  //npm.pkg.github.com/:@​org-a:_authToken=${ORG_A_TOKEN}
  //npm.pkg.github.com/:@​org-b:_authToken=${ORG_B_TOKEN}
  
  //npm.pkg.github.com/:_authToken=${FALLBACK_TOKEN}

  pnpm login --registry=https://npm.pkg.github.com --scope=@​org-a writes the token to the same scope-specific auth key.

  When installing or publishing @org-a/*, pnpm uses ORG_A_TOKEN. For @org-b/*, pnpm uses ORG_B_TOKEN. Packages without a matching scope continue to use the registry-wide fallback token.

• pnpm setup no longer prompts to approve build scripts for @pnpm/exe when installing the standalone executable. pnpm links the platform-specific binary itself, so the package's install scripts are skipped during the global self-install #​12377.

• Close lockfile reads deterministically before rewriting lockfiles and keep pacquet's virtual store directory length aligned with pnpm on Windows.

• A 304 Not Modified answer from the registry now renews the cached metadata file's mtime, so the minimumReleaseAge freshness shortcut keeps serving resolutions from the cache. Previously, once a cached packument grew older than minimumReleaseAge, every subsequent install re-validated it against the registry forever, because a 304 never rewrites the file.

• Updated dependency ranges. Notably:

  • @pnpm/logger peer dependency range moved to ^1100.0.0.
  • msgpackr 1.11.8 → 2.0.4 (store index files remain byte-compatible in both directions).
  • open ^7.4.2 → ^11.0.0, memoize ^10 → ^11, cli-truncate ^5 → ^6, pidtree ^0.6 → ^1.
  • @yarnpkg/core 4.5.0 → 4.8.0, @rushstack/worker-pool 0.7.7 → 0.7.18, @cyclonedx/cyclonedx-library 10.0.0 → 10.1.0, @pnpm/config.nerf-dart ^1 → ^2, @pnpm/log.group 3.0.2 → 4.0.1, @pnpm/util.lex-comparator ^3 → ^4.

• Updated @zkochan/cmd-shim to v9.0.6.

• Fixed a Windows-only hang where a failed command could take 20–46 seconds to exit. On error, pnpm enumerates descendant processes (via pidtree) to terminate them, which on Windows shells out to wmic/PowerShell Get-CimInstance Win32_Process — a lookup that is extremely slow on some machines. The lookup is now bounded by a short timeout so it can no longer stall the process exit.

v11.6.0

Compare Source

Minor Changes

• pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.

• 615c669: Added support for configuring URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, for example:

  npm_config_//registry.npmjs.org/:_authToken=<token>
  pnpm_config_//registry.npmjs.org/:_authToken=<token>
  

  This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.

• Raised the default network concurrency from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

Patch Changes

• Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.io/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.
• Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran #​12324.
• Platform-specific optional dependencies are now skipped even when their os/cpu/libc fields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless of supportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g. @nx/nx-win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform binaries are skipped without even downloading them #​11702.

typescript-eslint/typescript-eslint (typescript-eslint)

v8.61.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.