Skip to content

Update npm dependencies - #904

Merged
renovate[bot] merged 1 commit into
react-rewritefrom
renovate/npm-dependencies
Oct 14, 2026
Merged

renovate[bot] merged 1 commit into
react-rewritefrom
renovate/npm-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 14, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@tanstack/eslint-plugin-query (source) 5.104.1 → 5.104.2 age confidence
@tanstack/react-query (source) 5.104.1 → 5.104.2 age confidence
@tanstack/react-router (source) 1.170.42 → 1.170.44 age confidence
@tanstack/react-table (source) 9.2.8 → 9.3.1 age confidence
@tanstack/router-plugin (source) 1.168.43 → 1.168.45 age confidence
eslint-plugin-react-dom (source) 5.26.0 → 5.26.5 age confidence
eslint-plugin-react-jsx (source) 5.26.0 → 5.26.5 age confidence
eslint-plugin-react-naming-convention (source) 5.26.0 → 5.26.5 age confidence
eslint-plugin-react-x (source) 5.26.0 → 5.26.5 age confidence
lucide-react (source) 1.55.0 → 1.56.0 age confidence
oxc-transform-react (source) ^0.153.0 → ^0.154.0 age confidence
oxfmt (source) ^0.72.0 → ^0.73.0 age confidence
oxlint (source) 1.87.0 → 1.88.0 age confidence
oxlint-plugin-react-doctor (source) 0.9.17 → 0.9.18 age confidence
typescript-eslint (source) 8.71.1 → 8.71.2 age confidence
zod (source) 4.6.5 → 4.6.7 age confidence

Release Notes

TanStack/query (@​tanstack/eslint-plugin-query)

v5.104.2

Compare Source

No changes in this release.

TanStack/query (@​tanstack/react-query)

v5.104.2

Compare Source

Patch Changes
TanStack/router (@​tanstack/react-router)

v1.170.44

Compare Source

Patch Changes

v1.170.43

Compare Source

Patch Changes
TanStack/table (@​tanstack/react-table)

v9.3.1

Compare Source

Patch Changes
  • #​6631 3d3648f - Refresh the AppTable context when the useAppTable owner renders with new options or state, so useTableContext() consumers no longer show stale rows after data is replaced under a cached (React Compiler, useMemo, memo) AppTable element.
  • Updated dependencies [2d5f5b6, 87c6bcc]:
TanStack/router (@​tanstack/router-plugin)

v1.168.45

Compare Source

Patch Changes

v1.168.44

Compare Source

Patch Changes
Rel1cx/eslint-react (eslint-plugin-react-dom)

v5.26.5

Compare Source

🐞 Fixes
  • react-x/set-state-in-effect: a setState on the right side of a short-circuit operator (&&, ||, ??) is now exempt when the left operand is ref-derived (ex: ref.current && setData(1)), matching the existing ref-gated conditional exemption; a left-side setState still runs unconditionally and stays reported. (#​2031)
  • react-x/set-state-in-effect: setup identifiers are now collected from the setup argument of the effect call only; the callee and the deps array are no longer scanned, so a function referenced only in the deps array (ex: useEffect(setup, [helper])) is no longer mistaken for the setup and its setState calls stay unattributed. (#​2031)
  • react-x/set-state-in-effect: arrow function parameters are no longer collected as callback-body setter references (ex: the setState in useMemo((setState) => ..., [])); only actual callback bodies are collected (ex: useMemo(() => setState, [])). (#​2031)

Full Changelog: Rel1cx/eslint-react@v5.26.4...v5.26.5

v5.26.4

Compare Source

🐞 Fixes
  • react-naming-convention/context-name, react-naming-convention/id-name, react-naming-convention/ref-name: the name lookup now stops at function boundaries, so expression-bodied factory functions and custom hooks (ex: export const useAnchor = () => useRef(null)) are no longer misreported; calls inside JSX expressions, computed keys, or class static blocks no longer fall back to the outer variable. (#​2029) Closes #​2026.
  • react-naming-convention/context-name, react-naming-convention/id-name, react-naming-convention/ref-name: the name lookup no longer crosses containers or derived values (ex: const refs = [useRef(null)], const n = useRef(0) + 1), so such calls are no longer reported on the enclosing variable; sequence expressions check only the last value, and unresolvable computed keys (ex: { [key]: useRef(null) }) no longer fall back to the outer variable. (#​2030)

Full Changelog: Rel1cx/eslint-react@v5.26.3...v5.26.4

v5.26.3

Compare Source

🐞 Fixes
  • react-naming-convention/context-name, react-naming-convention/id-name, react-naming-convention/ref-name: an enclosing object literal property key now takes precedence over the outer assignment target when statically known (ex: const refs = { myRef: useRef(0) }); computed keys with string literals (ex: refs["value"] = useRef(null)) are now checked, and unresolvable computed keys are no longer reported. (#​2028)
  • react-naming-convention/ref-name: immediate dereferences of the useRef result through TypeScript type wrappers (ex: (useRef(null) as { current: null }).current, useRef(null)!.current) are no longer reported, extending the #​1375 fix. (#​2028)

Full Changelog: Rel1cx/eslint-react@v5.26.2...v5.26.3

v5.26.2

Compare Source

✨ New
  • react-x/no-unused-props: improved prop usage detection. Props parameters with default values (ex: function Component(props: Props = defaultProps)) are now unwrapped and analyzed, props aliased to a local variable (ex: const alias = props) are tracked through the alias, and template literals without substitutions (ex: props[`foo`]) are recognized as static prop keys. (#​2021)
🐞 Fixes
  • react-x/no-unused-props: a component whose used prop keys cannot be fully determined (ex: it passes the whole props object to another function) now marks all of its declared props as used, so a props declaration shared with another fully analyzable component is no longer reported as unused. (#​2021)
  • react-x/set-state-in-effect: ref-derived values that reach the setState argument through assignment statements (rather than the declaration initializer) are now recognized; only writes that lexically precede the use and live in the use's own function or an ancestor count. (#​2027)
  • react-x/set-state-in-effect: parameters of a helper invoked from the effect setup are now treated as ref-derived when the call-site argument is ref-derived, matched per call site by parameter definition. (#​2027)
  • react-x/set-state-in-effect: a .current read rooted at a function parameter is now recognized as a ref read (ex: setReferenceElement(anchor?.current) where anchor is a RefObject prop); previously only parameters named ref or ending in Ref were recognized. (#​2027)
  • react-x/no-unused-class-component-members: public methods (including function-valued properties) of an exported class component are no longer reported as unused, as they may be part of the component's imperative API invoked by consumers through refs. Data fields, private/protected members, and members of non-exported classes are still reported. (#​2024)
🏗️ Internal
  • Ordered message ids by first usage and unified default/suggestion message id naming across react-dom, react-jsx, react-web-api, and react-x rules. (#​2022)

Full Changelog: Rel1cx/eslint-react@v5.26.1...v5.26.2

v5.26.1

Compare Source

🏗️ Internal
  • react-x/no-context-provider, react-x/no-forward-ref, react-x/no-use-context: renamed the internal suggestion message id from "replace" to "suggest".
  • react-x/immutability: moved context-dependent helpers from helpers.ts into origins.ts and effects.ts to match the fact-based implementation pattern.
  • react-x/globals: moved resolveToFunction from helpers.ts to origins.ts.
  • Bumped effect to 4.0.3, tsl-dx to 0.14.1, @tsconfig/node20 to 20.1.10, and @types/node to 20.19.43.
📝 Documentation
  • Refreshed spec diff verification dates and notes for react-x rules.

Full Changelog: Rel1cx/eslint-react@v5.26.0...v5.26.1

lucide-icons/lucide (lucide-react)

v1.56.0: Version 1.56.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

oxc-project/oxc (oxfmt)

v0.73.0

Compare Source

🚀 Features
  • a495e82 oxfmt: Support associations config to specify language over filepath (#​27437) (leaysgur)
  • 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#​27386) (leaysgur)
📚 Documentation
oxc-project/oxc (oxlint)

v1.88.0

Compare Source

🚀 Features
  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#​27346) (Mikhail Baev)
millionco/react-doctor (oxlint-plugin-react-doctor)

v0.9.18

Compare Source

Patch Changes
  • #​1943 6932e7d Thanks @​aidenybai! - Match API Platform subscription IDs to the provider's resource-and-IDs unsubscribe contract.

  • #​1920 0298eb8 Thanks @​aidenybai! - Do not infer React hooks from relative helper imports in Angular component classes. Continue to check React and React ecosystem imports.

  • #​1926 012e208 Thanks @​aidenybai! - Do not classify a local state transition as a prop-driven adjustment when its only prop dependencies are called notifications. Keep checks for prop values used in guards, results, or reset dependencies.

  • #​1911 bb00a27 Thanks @​aidenybai! - Do not recommend lazy state initialization for cheap primitive toString calls, including numeric React Native Dimensions values. Keep warnings for unproven receivers and nested expensive calls.

  • #​1919 1f6b98a Thanks @​aidenybai! - Report inaccessible parent click actions when descendant handlers stop keyboard-generated clicks from reaching them.

  • #​1928 a68f193 Thanks @​aidenybai! - Match listener cleanup when both branches of conditional options have the same capture value. Keep warnings for differing capture values, changed options, and missing cleanup.

    Recognize exhaustive listener-removal loops extracted into a synchronous helper when the cleanup only invokes that helper.

  • #​1965 695e46e Thanks @​aidenybai! - Add the opt-in --scope contextual reporting mode. Selected rules report existing findings when their owning function, JSX element, or file changes. Other rules retain line filtering. Support deletion-only edits, staged scans, untracked files, and separate result-cache entries while preserving existing scope defaults and diagnostic locations.

  • #​1933 72fab66 Thanks @​aidenybai! - Preserve count-based placeholder identity through a local array before mapping wrappers.

  • #​1907 e2b047b Thanks @​aidenybai! - Preserve numeric placeholder-loop identity through local key aliases, including constant-prefix keys. Continue reporting index aliases for loops over array data.

  • #​1905 a1cff2e Thanks @​aidenybai! - Keep browser reads in helpers defined inside React effects out of server-render diagnostics. Preserve warnings for render callbacks and shadowed effect functions.

  • #​1924 89c6701 Thanks @​aidenybai! - Do not classify zero-argument effect notifications as state payloads sent to a parent. Continue to report callbacks that pass local state.

  • #​1863 e18d7da Thanks @​skoshx! - ESLint adapter now respects rule requires gates. Rules that require capabilities the project doesn't have (like ssr or react-router:8) are now correctly skipped when capabilities are declared, matching the CLI behavior. Fixes false errors on dependency bumps when using the ESLint adapter with explicit capabilities.

  • #​1896 f3f167e Thanks @​skoshx! - Fix async-defer-await warnings on compound guards that compare function parameters with mutable state after an await. Keep these checks after the await so they can detect stale responses. Fixes #​1895.

  • #​1883 909b8e5 Thanks @​skoshx! - fix(effect-needs-cleanup): accept Promise timer that resets its own handle in callback

    Fixes #​1882. The rule no longer flags a timer created in a Promise callback when the timer's own callback resets the handle to null or undefined. This is safe because the timer has already fired when the reset happens, so no live handle is lost.

  • #​1859 281fdc9 Thanks @​skoshx! - Recognize stable functions rendered as JSX components in the same file, including components that return imported exhaustive matchers. Preserve warnings for mixed utility exports, shadowed JSX names, and reassigned bindings.

  • #​1898 a3cbae0 Thanks @​aidenybai! - Accept observer cleanup after tuple loops and a single animation-frame retry chain when cleanup disconnects the observer and cancels the pending frame. Require observer cleanup on every path and keep target-specific unobserve() checks.

  • #​1898 a3cbae0 Thanks @​aidenybai! - Recognize JSX handlers passed to stable local dispatchers with an explicit React return type. Keep reporting callback registries with unknown or non-rendering return types.

  • #​1869 7bebcfc Thanks @​aidenybai! - Use constant Boolean initializers before treating numeric-looking JSX guard names as numbers. Preserve warnings for mutable bindings, destructuring defaults, and numeric values.

  • #​1873 6790398 Thanks @​aidenybai! - Require root route error boundaries only for data routers, since declarative useRoutes configurations do not use data-router error handling.

  • #​1875 ad8bca6 Thanks @​aidenybai! - Recognize legacy React.createClass components so render callbacks retain their instance this instead of being treated as function components.

  • #​1874 c92fec1 Thanks @​aidenybai! - Accept direct anchor children owned by an imported Next Link component, including the legacy Link child API.

  • #​1872 2825dfd Thanks @​aidenybai! - Allow state updater callbacks to reassign their local parameter while still reporting writes to prior-state properties and captured values.

  • #​1878 cc78fa3 Thanks @​aidenybai! - Respect the installed or declared React Native version before reporting removed AsyncStorage and WebView exports. Reuse package-version resolution and track manifests for diagnostic cache invalidation.

  • #​1871 4f8866c Thanks @​aidenybai! - Stop reporting the core SafeAreaView export as removed. It remains implemented even where it is deprecated.

  • #​1880 96bf20f Thanks @​aidenybai! - Restrict App Router path checks to the project app or src/app directory so nested Pages Router paths do not trigger App Router rules.

  • #​1877 4899bc4 Thanks @​aidenybai! - Recognize optional-chain and TypeScript-wrapped response status guards before fetch body reads.

  • #​1879 45f9769 Thanks @​aidenybai! - Avoid treating promise-returning query APIs as array find calls. Keep reports for known arrays and known predicates.

  • #​1866 dfb598a Thanks @​aidenybai! - Recognize static import and require paths wrapped in TypeScript assertions, while retaining warnings for dynamic paths inside those wrappers.

  • #​1870 a293fac Thanks @​aidenybai! - Preserve state used by a render-phase throw, including Suspense promises and errors, instead of recommending a ref.

  • #​1876 1b149ba Thanks @​aidenybai! - Recognize either global timer-clear API as releasing a matching timeout or interval handle, including exhaustive retained timer collections.

  • #​1867 888dc2a Thanks @​aidenybai! - Allow author-provided accessible names on the tooltip role. Preserve naming restrictions on roles that prohibit them and warnings for unsupported tooltip states.

  • #​1868 7e24c41 Thanks @​aidenybai! - Skip missing image sizes advice when next/image explicitly disables optimization, since that path does not generate responsive source candidates.

  • #​1888 e50ba27 Thanks @​aidenybai! - A native wrapping or associated label can give a control its accessible name through its title. Recognize that name while keeping warnings for empty labels, unrelated labels, and custom wrappers.

  • #​1893 91b6991 Thanks @​aidenybai! - A returned scalar formatter can use JSX only when its scalar input is null. React component props do not follow that path. Exclude these formatters while keeping warnings when JSX is reachable for normal props, a reassigned parameter, or another return path.

  • #​1894 d8c0517 Thanks @​aidenybai! - Avoid missing-key warnings for JSX arrays returned as data by module-level object factories with no local use. Keep warnings for component and render methods, local factory uses, and arrays rendered directly as children.

  • #​1891 0d99110 Thanks @​aidenybai! - A class render helper can receive indices from a numeric Array.from placeholder list. Accept these keys only when every visible use proves that placeholder source and the helper does not escape. Keep warnings for mutable data lists and unknown callers.

  • #​1887 712a08a Thanks @​aidenybai! - A focusable action revealed by group hover also becomes visible when it receives keyboard focus. Accept its own focus or focus-visible opacity reveal when that reveal covers the hover scope. Keep warnings for hidden, invisible, non-focusable, and mismatched-scope controls.

  • #​1892 e6457e3 Thanks @​aidenybai! - An updater may copy each state element before a local helper changes those fresh copies. Track that ownership through helper parameters and for-of loops. Keep warnings for shared objects, nested shared fields, replaced elements, and aliases that add shared values.

  • #​1889 d1cd769 Thanks @​aidenybai! - An icon button with a screen-reader-only label is not a text button for visual padding. Ignore hidden label text, but keep visible text and not-sr-only overrides in the check.

  • #​1890 0a8982b Thanks @​aidenybai! - A stable local factory that returns a component or forwardRef component is a valid component export. Inspect the factory return paths and keep warnings for mixed returns, reassigned factories, and unknown factory outputs.

  • #​1915 c1181f0 Thanks @​aidenybai! - Report array-index keys passed as React cloneElement overrides, including imported aliases and static computed keys.

  • #​1902 9e9680b Thanks @​aidenybai! - Allow updater callbacks to mutate a local container when both branches of its conditional initializer create a fresh container. Continue reporting mutations of prior state and shared collections.

  • #​1940 a47c7e0 Thanks @​aidenybai! - Ignore unreachable fresh fallbacks inside a controlled-state selection when the value type excludes null.

  • #​1937 2c5d1a1 Thanks @​aidenybai! - Use the properties read by a resolved local helper when checking object argument dependencies.

  • #​1923 ab83f31 Thanks @​aidenybai! - Accept positional keys for immutable arrays of identical literal placeholders. Keep checks for distinct values, records, spreads, and mutated arrays.

  • #​1942 a410280 Thanks @​aidenybai! - Detect fresh cleanup callbacks through local imported wrappers of DOM event listener APIs.

  • #​1934 7ad2c9b Thanks @​aidenybai! - Track subscriptions pushed into arrays that already contain other owned handles.

  • #​1936 03b21c8 Thanks @​aidenybai! - Do not classify paired Layer.extend lifecycle methods as React event handlers.

  • #​1904 55c2235 Thanks @​aidenybai! - Recognize deterministic lazy ref initialization through an immediately preceding local assignment. Check the resolved value for non-deterministic initialization hidden by aliases.

  • #​1912 683d0c2 Thanks @​aidenybai! - Avoid parent-notification warnings when a local memoized loader only reads props and updates local state. Keep warnings for actual parent callback calls, including asynchronous and direct callback wrappers.

  • #​1909 45f5620 Thanks @​aidenybai! - Recognize named functions passed to React memo and forwardRef as render scopes in rules-of-hooks, including nonstandard internal names. Keep conditional and nested hook checks active.

  • #​1908 738b340 Thanks @​aidenybai! - Recognize object URL cleanup returned on every path after URL creation, including effects that return early before they allocate a URL.

  • #​1906 130fc45 Thanks @​aidenybai! - Prevent boolean-toggle cleanup analysis from crashing when an effect omits its dependency array. Preserve the existing toggle diagnostic and functional-update exemption.

  • #​1931 6ee5988 Thanks @​aidenybai! - Follow guarded observer setup helpers invoked by effect-owned listeners.

  • #​1935 5b301c9 Thanks @​aidenybai! - Recognize loading-set resets paired with cancellation of owned request-map entries.

  • #​1918 b6b2d68 Thanks @​aidenybai! - Recognize react_ujs useContext and useContexts as component registration methods rather than React hooks. Support stable CommonJS and ES module bindings.

  • #​1921 f986f15 Thanks @​aidenybai! - Do not classify an imported use-prefixed function as a React hook when its resolved implementation only returns static data.

  • #​1925 1451cdb Thanks @​aidenybai! - Accept positional keys for plain text rows from string splitting and Boolean filtering. Keep checks for stateful children, unknown split methods, and changed token arrays.

  • #​1929 67531cc Thanks @​aidenybai! - Recognize portal readiness state after DOM container discovery.

  • #​1927 9e305df Thanks @​aidenybai! - Accept index keys for identical map slots that ignore the item and collection values and use the index only as a key. Keep warnings when output depends on an item or an indexed record.

  • #​1913 83bf9ad Thanks @​aidenybai! - Recognize fresh const aliases of effect cancellation guards after await. Keep warnings when a snapshot was captured before suspension or another await can make it stale.

  • #​1930 8bfb598 Thanks @​aidenybai! - Recognize primitive cumulative labels in stateless index-keyed rows.

  • #​1922 4fd3e87 Thanks @​aidenybai! - Accept positional keys for Array.from slots whose count comes from a property or expression. Keep checks when the index reads external records or the source has record entries.

  • #​1901 295becb Thanks @​aidenybai! - Detect unstable nested components created inside React forwardRef and memo render callbacks, including import aliases and TypeScript wrappers.

  • #​1916 8fdead9 Thanks @​aidenybai! - Recognize request ownership predicates and loading resets on proven view, close, and unmount paths. Keep warnings when an invalidated request can leave the loading flag set.

  • #​1917 6331b39 Thanks @​aidenybai! - Keep React hook ordering checks out of files that use a proven non-React JSX runtime. Mixed React files retain the checks.

  • #​1939 0179427 Thanks @​aidenybai! - Recognize object URLs retained in React refs when replacement and unmount both revoke the owned value.

  • #​1932 6bed9f6 Thanks @​aidenybai! - Recognize clearing the state handle of an object URL after revocation.

  • #​1938 a26bc44 Thanks @​aidenybai! - Follow synchronous cleanup helpers that invoke a retained listener disposer on unmount.

  • #​1903 4bcbcd9 Thanks @​aidenybai! - Do not treat directly returned component functions as JSX rendered by their factory. Keep detecting direct component calls and executed render callbacks.

  • #​1910 943ca32 Thanks @​aidenybai! - Avoid cleanup warnings for local functions and state setters named setInterval or setTimeout. Require a global timer or a matching Node timers import before classifying these calls as timer allocations.

  • #​1941 b880403 Thanks @​aidenybai! - Recognize the stable send result of XState React v1 useService when its interpreter is a module singleton.

typescript-eslint/typescript-eslint (typescript-eslint)

v8.71.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

colinhacks/zod (zod)

v4.6.7

Compare Source

Commits:

v4.6.6

Compare Source

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #​6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243f, the pre-rewrite copy of 9c21983 with identical contents.

Commits:

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) October 14, 2026 11:37
@netlify

netlify Bot commented Oct 14, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for ucmacm ready!

Name Link
🔨 Latest commit 4fec392
🔍 Latest deploy log https://app.netlify.com/projects/ucmacm/deploys/6acf69814681f6cb55cf4bac
😎 Deploy Preview https://deploy-preview-904--ucmacm.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@sonarqubecloud

Copy link
Copy Markdown

@renovate
renovate Bot merged commit 3d2c0ae into react-rewrite Oct 14, 2026
10 checks passed
@renovate
renovate Bot deleted the renovate/npm-dependencies branch October 14, 2026 11:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants