Skip to content

chore(deps): Update all non-major dependencies - #194

Merged
chertik77 merged 1 commit into
mainfrom
renovate/all-minor-patch
Oct 5, 2026
Merged

chore(deps): Update all non-major dependencies#194
chertik77 merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@better-auth/passkey (source) ^1.7.6 → ^1.7.7 age confidence
@daypicker/react (source) ^10.0.1 → ^10.0.2 age confidence
@eslint-react/eslint-plugin (source) ^5.20.8 → ^5.23.4 age confidence
@tanstack/eslint-plugin-query (source) ^5.103.2 → ^5.104.1 age confidence
@tanstack/react-query (source) ^5.103.2 → ^5.104.1 age confidence
@tanstack/react-router (source) 1.170.39 → 1.170.41 age confidence
@tanstack/router-plugin (source) ^1.168.40 → ^1.168.42 age confidence
@thesvg/react (source) ^3.3.8 → ^3.3.11 age confidence
@types/node (source) ^25.9.8 → ^25.9.9 age confidence
better-auth (source) ^1.7.6 → ^1.7.7 age confidence
globals ^17.12.0 → ^17.13.0 age confidence
lint-staged ^17.5.1 → ^17.6.0 age confidence
lucide-react (source) ^1.48.0 → ^1.50.0 age confidence
react-hook-form (source) 7.88.0 → 7.89.0 age confidence
typescript-eslint (source) ^8.70.1 → ^8.71.0 age confidence
vite (source) ^8.3.1 → ^8.3.2 age confidence

Release Notes

better-auth/better-auth (@​better-auth/passkey)

v1.7.7

Compare Source

gpbl/react-day-picker (@​daypicker/react)

v10.0.2

Compare Source

Patch Changes

DayPicker follows Semantic Versioning. See the Releases page on Github for the complete list of changes, diffs and contributors, or the list of versions published on npm.

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.23.4

Compare Source

🐞 Fixes
  • Added the missing react-x/static-components rule to the disable-experimental preset. (#​1980)
  • Fixed type imports in react-x/exhaustive-deps and react-x/rules-of-hooks (RuleFeature is now imported from @eslint-react/eslint instead of @eslint-react/shared).
📝 Documentation
  • react-jsx/no-useless-fragment: clarified the scope of the allowExpressions option and unified experimental-rule callout wording across rule docs.
  • react-x: unified cross-rule references in rule docs to full rule names.
  • Removed low-relevance entries from the further reading sections of rule docs, and removed a redundant note about eslint being an optional peer dependency.
  • Fixed inaccuracies in internal documentation. (#​1980)
🏗️ Internal
  • Adopted ts-pattern for type checks in @eslint-react/core, @eslint-react/jsx, and the react-dom plugin, and declared the missing ts-pattern dependencies.
  • Added behavior boundary tests for react-jsx/no-useless-fragment.
  • Bumped fumadocs-core, fumadocs-ui, and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.23.3...v5.23.4

v5.23.3

Compare Source

🐞 Fixes
  • react-x/immutability: reassigning a binding that resolves to component props or state (value = value + "!", count++, including destructuring and for...of rebinding forms) is now reported as a direct mutation, matching upstream react-hooks/immutability; rebinding iterator or shallow-copy bindings remains allowed. (#​1979)
  • react-x/set-state-in-effect: ref reads traced through intermediate local computations (ex: const dv = visible - prevVisible.current) are now recognized as ref-derived values, and a preceding early-return guard whose test is ref-derived (ex: if (dv === 0) return;) now exempts the setState calls that follow it — previously only setState nested directly inside a ref-gated if/conditional was exempted. Aligns with react-hooks 7.1.1. (#​1979)
📝 Documentation
  • react-x/no-unstable-context-value: documented the React 19 <Context> provider detection heuristic and its name-based limitations. (#​1979)
  • Updated the README badges to reference eslint-plugin-react-x.

Full Changelog: Rel1cx/eslint-react@v5.23.2...v5.23.3

v5.23.2

Compare Source

🏗️ Internal
  • Removed unused dependencies and fixed phantom dependencies across the workspace.
  • Bumped next to 16.3.7, fumadocs-core and fumadocs-ui to 16.15.16, and eslint-plugin-package-json to 1.10.1.

Full Changelog: Rel1cx/eslint-react@v5.23.1...v5.23.2

v5.23.1

Compare Source

🏗️ Internal
  • Re-verified and synchronized the IMPL-SPEC diff reports for the following react-x rules. (#​1977, #​1978)
    • react-x/error-boundaries
    • react-x/globals
    • react-x/immutability
    • react-x/purity
    • react-x/refs
    • react-x/set-state-in-effect
    • react-x/set-state-in-render
    • react-x/use-memo
  • Bumped typescript-eslint to 8.71.0, tsl-dx to 0.13.7, and pnpm to 12.8.1.
📝 Documentation
  • Added argo-cd, griffel, tanstack/table, and eslint-config-studio to the website's community lists.

Full Changelog: Rel1cx/eslint-react@v5.23.0...v5.23.1

v5.23.0

Compare Source

✨ New
  • react-x/static-components: dynamic creation-site tracing now follows both sides of logical expressions (ex: const C = DefaultComponent || (() => <div />)) and the last element of sequence expressions (ex: const C = (setup(), () => <div />)), in initializers and reassignments alike. (#​1975)
🐞 Fixes
  • react-x/static-components: parameters of nested non-component functions (ex: function render(Comp) { return <Comp /> }) are no longer mistaken for render-created components; definitions are judged by definition type instead of AST node type. (#​1975)
  • react-x/static-components: createdHere is now reported once per creation site instead of once per JSX usage; the default diagnostic remains per usage. (#​1975)
🏗️ Internal
  • react-x/static-components: restructured the rule to the fact-based implementation pattern — collect.ts (usage facts), origins.ts (creation-site resolution), and effects.ts (effect inference) are now separate modules, with reporting centralized in Program:exit; added 14 boundary test cases covering creation-site resolution, render boundaries, and per-usage reporting. (#​1975)
  • Renamed lib.ts to helpers.ts in the fact-based react-x rules (globals, immutability, refs). (#​1976)
  • Bumped @effect/language-service to 0.87.3 and oxlint to 1.86.0.

Full Changelog: Rel1cx/eslint-react@v5.22.1...v5.23.0

v5.22.1

Compare Source

🐞 Fixes
  • react-x/use-state: directly returning the useState result (ex: return React.useState()) is now allowed regardless of the rule's options, matching the exemption in the original react/hook-use-state rule. Covers explicit, implicit (arrow function), and type-asserted returns; lazy initialization checks still apply. (#​1974, closes #​1963)
📝 Documentation
  • Added a note about eslint being an optional peer dependency to the READMEs and the website's getting-started guides.
  • Simplified the @eslint-react/kit README to point to the full documentation.

Full Changelog: Rel1cx/eslint-react@v5.22.0...v5.22.1

v5.22.0

Compare Source

✨ New
  • react-dom/no-unknown-property: added React 19.3 properties to the known property allowlist. (#​1973)
    • closedby on dialog
    • onFullscreenChange, onFullscreenError (and their Capture variants), credentialless, and maskType — gated on React version >= 19.3.0
    • onLoad on body
    • onScrollEnd (and its Capture variant)
    • shadowrootmode, shadowrootclonable, shadowrootdelegatesfocus, and shadowrootserializable on template
🏗️ Internal
  • Bumped fumadocs-core and fumadocs-ui to 16.15.15.

Full Changelog: Rel1cx/eslint-react@v5.21.3...v5.22.0

TanStack/query (@​tanstack/eslint-plugin-query)

v5.104.1

Compare Source

No changes in this release.

TanStack/query (@​tanstack/react-query)

v5.104.1

Compare Source

Patch Changes
TanStack/router (@​tanstack/react-router)

v1.170.41

Compare Source

Patch Changes

  • #​8529 60b8ad1 - Compose only enabled route boundaries instead of rendering inactive wrapper components.

  • #​8568 614bc27 - Update TanStack Store to 0.11.2 to prevent unrelated atom reads inside subscription observers from triggering extra notifications.

  • #​8530 ff66a03 - Consolidate the root match context provider while preserving match context in the root shell.

  • #​8522 863c8a7 - Reuse Link href classification and active/inactive results across location updates while preserving live history href formatting.

  • Updated dependencies [d521abd]:

v1.170.40

Compare Source

Patch Changes
TanStack/router (@​tanstack/router-plugin)

v1.168.42

Compare Source

Patch Changes

v1.168.41

Compare Source

Patch Changes
glincker/thesvg (@​thesvg/react)

v3.3.11

Compare Source

Patch Changes
  • fix: drop terms-of-sale link from tintas-vital guidelines (#​1200)

v3.3.10

Compare Source

Patch Changes
  • feat: add tintas-vital icon (#​1190)

v3.3.9

Compare Source

Patch Changes
  • chore: land reviewed open PRs and icon requests (#​1161)
better-auth/better-auth (better-auth)

v1.7.7

Compare Source

Patch Changes

  • #​11476 4186e36 Thanks @​bytaesu! - Return CAPTCHA errors with the correct JSON Content-Type header.

  • #​11469 8620aa9 Thanks @​aryan1306! - Return rate limit errors with a JSON Content-Type header.

  • #​11491 55cb92e Thanks @​bytaesu! - Respect social provider disableSignUp when signing in with an ID token.

  • #​11375 69defbc Thanks @​bytaesu! - Refresh the active organization after sign-in when a session hook selects the initial organization.

  • #​11494 ac54bfd Thanks @​gustavovalverde! - Isolate OAuth state cookies and each OAuth Proxy payload with purpose-specific encryption keys. The oAuthProxy options and supported configuration remain unchanged.

    Upgrade all Better Auth nodes that handle the same cookie-backed OAuth or SAML relay-state flow together. Upgrade every OAuth Proxy participant, including production and preview or development deployments, in the same cutover. OAuth sign-in, account-linking, and cookie-backed SAML sign-in flows started before the upgrade must be restarted. Mixed old and new participants cannot exchange existing state or proxy payloads, and there is no fallback to the previous shared key.

  • #​11494 ac54bfd Thanks @​gustavovalverde! - Magic Link verification now accepts only records issued for Magic Link. Magic
    Link records and database-backed OAuth or SAML state use separate verification
    identifier prefixes. Links and database-backed sign-ins started before the
    upgrade cannot complete; request new Magic Links and restart those sign-ins.
    Upgrade servers sharing verification storage together, and update
    verification.storeIdentifier.overrides rules for these flows to match the new
    magic-link: and auth-state: prefixes. The link token, callback state,
    endpoints, and public option types are unchanged.

    Upgrade installed Better Auth adapters, plugins, and integrations released
    with better-auth alongside it so participating packages use the same release
    version.

  • Updated dependencies [35d7cd3, 07bdf7e]:

sindresorhus/globals (globals)

v17.13.0

Compare Source

lint-staged/lint-staged (lint-staged)

v17.6.0

Compare Source

Minor Changes

  • #​1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

    import { defineConfig } from 'lint-staged/config'

export default defineConfig({
  '*': {
    title: 'Fail if PDF files are committed',
    task: async (filepaths, { log }) => {
      const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
      if (pdfFiles.length > 0) {
        log('PDF files should not be committed: %s', pdfFiles)
        throw new Error('Failed')
      }
    },
  },
})

  • #​1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

    If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

  • #​1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

  • #​1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

    import { defineConfig } from 'lint-staged/config'

export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})

  • #​1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

  • #​1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

lucide-icons/lucide (lucide-react)

v1.50.0: Version 1.50.0

Compare Source

What's Changed
New Contributors

Full Changelog: lucide-icons/lucide@1.49.0...1.50.0

v1.49.0: Version 1.49.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.48.0...1.49.0

react-hook-form/react-hook-form (react-hook-form)

v7.89.0

Compare Source

Changed
  • Add optional @types/react peer dependency
Fixed
  • validateField calling setCustomValidity on refs that don't implement it under native validation
  • Form-level validate running a stale function instead of the latest one
  • Form-level validation leaving stale errors after a successful re-validation
  • Form-level validation running more than once per traversal
  • Stale validation results (resolver, built-in, form-level validate) being applied after reset in onChange and handleSubmit
  • Pending delayError timers for nested paths not being cancelled when a parent validates clean or is reset via resetField
  • getValues(names, { dirtyFields }) returning every row of a field array instead of only the marked entries
  • Field array touched state not being re-indexed when touchedFields is not subscribed
  • useFieldArray emitting touchedFields in form state updates when unnecessary
  • Stale field array root error not clearing once an array operation satisfies the rule
  • useFieldArray marking the form dirty when the array default is null
  • Dirty state lingering for rows removed from a field array
  • setValue with shouldValidate not revalidating deps
  • setValue with shouldValidate not triggering validation for a field array root
  • Validation rules removed from register options at runtime still being applied
  • useController validating required against the input value instead of the controlled value
  • isValid not recomputing when the errors prop is emptied
  • getFieldState(name, formState) with a resolver after reset()
vitejs/vite (vite)

v8.3.2

Compare Source

Bug Fixes
Performance Improvements
Documentation
  • fix dead og-image PNG links in vite6/vite7 changelog entries (#​23594) (1929b4c)
Miscellaneous Chores
Code Refactoring
Tests
  • bundled-dev: accept a rolldown dev runtime with no helper imports (#​23606) (634745d)

Configuration

📅 Schedule: (in timezone Europe/London)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 4, 2026
@vercel

vercel Bot commented Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
task-pro Ready Ready Preview Oct 5, 2026 8:32pm UTC

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 3a6f2ba to 3a60299 Compare October 5, 2026 01:10
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 3a60299 to 64e6d5c Compare October 5, 2026 05:09
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 64e6d5c to 376b098 Compare October 5, 2026 17:07
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 376b098 to 47be2b4 Compare October 5, 2026 20:02
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 47be2b4 to 9403ceb Compare October 5, 2026 20:27
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 9403ceb to 77066e5 Compare October 5, 2026 20:28
@chertik77
chertik77 merged commit f96def8 into main Oct 5, 2026
3 of 4 checks passed
@chertik77
chertik77 deleted the renovate/all-minor-patch branch October 5, 2026 20:55

This branch was successfully deployed

1 active deployment
Preview — 77066e59 Deployed Oct 5, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chertik77