Skip to content

fix(deps): update minor updates (minor) - #1190

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/minor-updates
Closed

fix(deps): update minor updates (minor)#1190
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/minor-updates

Conversation

@renovate

@renovate renovate Bot commented Oct 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@eslint-react/eslint-plugin (source) 5.22.1 → 5.23.5 age confidence
axios@<1.18.0 (source) >=1.19.0 → >=1.20.0 age confidence
browserslist@<=4.28.6 >=4.28.9 → >=4.29.3 age confidence
fast-uri@>=3.0.0 <3.1.3 [^4.1.5 → ^4.2.1](https://renovatebot.com/diffs/npm/fast-uri@>=3.0.0 <3.1.3/4.1.5/4.2.1) age confidence
fast-uri@>=4.0.0 <4.1.5 [^4.1.5 → ^4.2.1](https://renovatebot.com/diffs/npm/fast-uri@>=4.0.0 <4.1.5/4.1.5/4.2.1) age confidence
globals 17.12.0 → 17.13.0 age confidence
ip-address@<=10.1.0 >=10.5.1 → >=10.7.3 age confidence
lint-staged 17.3.0 → 17.6.0 age confidence
shell-quote ^1.11.0 → ^1.12.0 age confidence
shell-quote@>=1.1.0 <=1.8.3 [>=1.10.0 → >=1.12.0](https://renovatebot.com/diffs/npm/shell-quote@>=1.1.0 <=1.8.3/1.10.0/1.12.0) age confidence
svgo@>=4.0.0 <4.0.2 (source) [>=4.0.2 → >=4.1.0](https://renovatebot.com/diffs/npm/svgo@>=4.0.0 <4.0.2/4.0.2/4.1.0) age confidence
tinypool@<2.1.2 >=2.1.2 → >=2.2.0 age confidence
undici@<8.10.2 (source) >=8.10.2 → >=8.11.2 age confidence

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.23.5

Compare Source

🐞 Fixes
  • react-x/set-state-in-effect: the ref-derived value exemption now also covers setState calls reached indirectly through functions or hook callbacks invoked from the effect setup, not only setState written directly in the setup body. (#​1982)
  • react-x/set-state-in-effect: more ref read shapes are recognized as ref-derived values — <ref-named>.current anywhere in a member chain, locals derived from other ref-derived locals, and reads through a ref/xxxRef parameter. (#​1982)
  • react-web-api/no-leaked-event-listener: removeEventListener inside a function called from the effect cleanup now pairs with its addEventListener, fixing false positives for listeners removed on unmount; cleanup calls resolve to the actual functions, so same-named shadowed functions no longer pair by coincidence. (#​1982)
🏗️ Internal
  • Bumped effect to 4.0.0 and migrated the repo scripts to the v4 APIs. (#​1981)

Full Changelog: Rel1cx/eslint-react@v5.23.4...v5.23.5

v5.23.4

Compare Source

🐞 Fixes
  • Added the missing react-x/static-components rule to the disable-experimental preset. (#​1980)
  • Fixed type imports in react-x/exhaustive-deps and react-x/rules-of-hooks (RuleFeature is now imported from @eslint-react/eslint instead of @eslint-react/shared).
📝 Documentation
  • react-jsx/no-useless-fragment: clarified the scope of the allowExpressions option and unified experimental-rule callout wording across rule docs.
  • react-x: unified cross-rule references in rule docs to full rule names.
  • Removed low-relevance entries from the further reading sections of rule docs, and removed a redundant note about eslint being an optional peer dependency.
  • Fixed inaccuracies in internal documentation. (#​1980)
🏗️ Internal
  • Adopted ts-pattern for type checks in @eslint-react/core, @eslint-react/jsx, and the react-dom plugin, and declared the missing ts-pattern dependencies.
  • Added behavior boundary tests for react-jsx/no-useless-fragment.
  • Bumped fumadocs-core, fumadocs-ui, and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.23.3...v5.23.4

v5.23.3

Compare Source

🐞 Fixes
  • react-x/immutability: reassigning a binding that resolves to component props or state (value = value + "!", count++, including destructuring and for...of rebinding forms) is now reported as a direct mutation, matching upstream react-hooks/immutability; rebinding iterator or shallow-copy bindings remains allowed. (#​1979)
  • react-x/set-state-in-effect: ref reads traced through intermediate local computations (ex: const dv = visible - prevVisible.current) are now recognized as ref-derived values, and a preceding early-return guard whose test is ref-derived (ex: if (dv === 0) return;) now exempts the setState calls that follow it — previously only setState nested directly inside a ref-gated if/conditional was exempted. Aligns with react-hooks 7.1.1. (#​1979)
📝 Documentation
  • react-x/no-unstable-context-value: documented the React 19 <Context> provider detection heuristic and its name-based limitations. (#​1979)
  • Updated the README badges to reference eslint-plugin-react-x.

Full Changelog: Rel1cx/eslint-react@v5.23.2...v5.23.3

v5.23.2

Compare Source

🏗️ Internal
  • Removed unused dependencies and fixed phantom dependencies across the workspace.
  • Bumped next to 16.3.7, fumadocs-core and fumadocs-ui to 16.15.16, and eslint-plugin-package-json to 1.10.1.

Full Changelog: Rel1cx/eslint-react@v5.23.1...v5.23.2

v5.23.1

Compare Source

🏗️ Internal
  • Re-verified and synchronized the IMPL-SPEC diff reports for the following react-x rules. (#​1977, #​1978)
    • react-x/error-boundaries
    • react-x/globals
    • react-x/immutability
    • react-x/purity
    • react-x/refs
    • react-x/set-state-in-effect
    • react-x/set-state-in-render
    • react-x/use-memo
  • Bumped typescript-eslint to 8.71.0, tsl-dx to 0.13.7, and pnpm to 12.8.1.
📝 Documentation
  • Added argo-cd, griffel, tanstack/table, and eslint-config-studio to the website's community lists.

Full Changelog: Rel1cx/eslint-react@v5.23.0...v5.23.1

v5.23.0

Compare Source

✨ New
  • react-x/static-components: dynamic creation-site tracing now follows both sides of logical expressions (ex: const C = DefaultComponent || (() => <div />)) and the last element of sequence expressions (ex: const C = (setup(), () => <div />)), in initializers and reassignments alike. (#​1975)
🐞 Fixes
  • react-x/static-components: parameters of nested non-component functions (ex: function render(Comp) { return <Comp /> }) are no longer mistaken for render-created components; definitions are judged by definition type instead of AST node type. (#​1975)
  • react-x/static-components: createdHere is now reported once per creation site instead of once per JSX usage; the default diagnostic remains per usage. (#​1975)
🏗️ Internal
  • react-x/static-components: restructured the rule to the fact-based implementation pattern — collect.ts (usage facts), origins.ts (creation-site resolution), and effects.ts (effect inference) are now separate modules, with reporting centralized in Program:exit; added 14 boundary test cases covering creation-site resolution, render boundaries, and per-usage reporting. (#​1975)
  • Renamed lib.ts to helpers.ts in the fact-based react-x rules (globals, immutability, refs). (#​1976)
  • Bumped @effect/language-service to 0.87.3 and oxlint to 1.86.0.

Full Changelog: Rel1cx/eslint-react@v5.22.1...v5.23.0

axios/axios (axios@<1.18.0)

v1.20.0

Compare Source

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#​11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#​11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#​11087, #​11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#​11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#​11094, #​11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#​11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#​11096)

🔧 Maintenance & Chores

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

browserslist/browserslist (browserslist@<=4.28.6)

v4.29.3

Compare Source

  • Updated Firefox ESR.

v4.29.2

Compare Source

  • Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

v4.29.1

Compare Source

v4.29.0

Compare Source

  • Added query continuations across lines and array entries (by @​fzlzjerry).
fastify/fast-uri (fast-uri@>=3.0.0 <3.1.3)

v4.2.1

Compare Source

What's Changed

  • fix: make mailto normalization idempotent for authority recipients by @​mcollina in #​219

Full Changelog: fastify/fast-uri@v4.2.0...v4.2.1

v4.2.0

Compare Source

What's Changed

Full Changelog: fastify/fast-uri@v4.1.5...v4.2.0

sindresorhus/globals (globals)

v17.13.0

Compare Source

beaugunderson/ip-address (ip-address@<=10.1.0)

v10.7.3

Compare Source

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.2...v10.7.3

v10.7.2

Compare Source

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.1...v10.7.2

v10.7.1

Compare Source

What's Changed

Full Changelog: beaugunderson/ip-address@v10.7.0...v10.7.1

v10.7.0

Compare Source

What's Changed

  • Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in #​225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

Compare Source

What's Changed

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

lint-staged/lint-staged (lint-staged)

v17.6.0

Compare Source

Minor Changes

  • #​1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

    import { defineConfig } from 'lint-staged/config'

export default defineConfig({
  '*': {
    title: 'Fail if PDF files are committed',
    task: async (filepaths, { log }) => {
      const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
      if (pdfFiles.length > 0) {
        log('PDF files should not be committed: %s', pdfFiles)
        throw new Error('Failed')
      }
    },
  },
})

  • #​1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

    If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

  • #​1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

  • #​1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

    import { defineConfig } from 'lint-staged/config'

export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})

  • #​1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

  • #​1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

v17.5.1

Compare Source

Patch Changes

  • #​1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

    A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

v17.5.0

Compare Source

Minor Changes
  • #​1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.
Patch Changes

  • #​1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

  • #​1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

  • #​1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

v17.4.1

Compare Source

Patch Changes
  • #​1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.
ljharb/shell-quote (shell-quote)

v1.12.0

Compare Source

Fixed
  • [New] parse: support here-documents (&lt;&lt;) #31
Commits
  • [New] parse: support tab-stripping here-documents (&lt;&lt;-) dbfac37
  • [New] parse: support output process substitution (&gt;() 2053315
  • [New] parse: support the case test-next terminator (;;&) 7d688b9
  • [New] parse: support the case fall-through terminator (;&) f27010e
  • [New] parse: support redirecting output despite noclobber (&gt;|) b78d19c
  • [New] parse: support opening a file for reading and writing (&lt;&gt;) 21cc333
  • [New] parse: support redirecting stdout and stderr (&&gt;) 6ad6cd2
  • [New] parse: support appending stdout and stderr (&&gt;&gt;) 90cde9c
  • [Dev Deps] update @ljharb/eslint-config 3a7b4ae
svg/svgo (svgo@>=4.0.0 <4.0.2)

v4.1.0

Compare Source

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#​2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

  • disallowed control characters such as &#&#8203;1;, &#xB;, and &#x1F;;
  • UTF-16 surrogate code points such as &#xD800;;
  • invalid XML code points such as &#xFFFF;.

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

  • Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#​2263).
  • Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#​2264).
  • Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&#&#8203;9;script: from bypassing detection while preserving elements in unrelated custom namespaces (#​2268).

These changes address:

Dependencies
  • Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#​2244).
Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

tinylibs/tinypool (tinypool@<2.1.2)

v2.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: tinylibs/tinypool@v2.1.2...v2.2.0

nodejs/undici (undici@<8.10.2)

v8.11.2

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.11.1...v8.11.2

v8.11.1

Compare Source

What's Changed

Full Changelog: nodejs/undici@v8.11.0...v8.11.1

v8.11.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.10.2...v8.11.0

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from prisis as a code owner October 6, 2026 11:00
@renovate renovate Bot added the c: dependencies Pull requests that adds/updates a dependency label Oct 6, 2026
@coderabbitai

coderabbitai Bot commented Oct 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 6b860890-2a10-4b55-921d-3899e5dfb551

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

Thank you for following the naming conventions! 🙏

@socket-security

socket-security Bot commented Oct 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedglobals@​17.13.01001008695100
Updatedshell-quote@​1.11.0 ⏵ 1.12.0100 +110010093100
Updated@​eslint-react/​eslint-plugin@​5.22.1 ⏵ 5.23.599 +110010096 +1100

View full report

@renovate
renovate Bot force-pushed the renovate/minor-updates branch from 308b8d2 to 8e3bbd6 Compare October 6, 2026 12:12
@renovate
fix(deps): update minor updates
e2b46e2 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
@renovate
renovate Bot force-pushed the renovate/minor-updates branch from 8e3bbd6 to e2b46e2 Compare October 6, 2026 13:30
This was referenced Oct 6, 2026
Merged
Merged
@prisis

prisis commented Oct 6, 2026

Copy link
Copy Markdown
Member

Superseded by the combined dependency-update PR already merged into main.

@prisis prisis closed this Oct 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@prisis prisis Awaiting requested review from prisis prisis is a code owner

Assignees

No one assigned

Labels

c: dependencies Pull requests that adds/updates a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@prisis