fix(deps): update patch by renovate[bot] · Pull Request #799 · Jahia/javascript-modules

renovate · 2026-09-22T03:59:02Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint-react/eslint-plugin (source)	`5.19.1` → `5.26.0`
@jahia/cypress	`8.5.0` → `8.6.1`
@types/node (source)	`22.20.3` → `22.20.5`
cypress-terminal-report	`7.3.3` → `7.4.0`
devalue	`6.0.0` → `6.0.2`
globals	`17.12.0` → `17.13.0`
i18next (source)	`26.4.2` → `26.4.3`
magic-string	`1.4.1` → `1.4.3`
pkg-pr-new (source)	`^0.0.88` → `^0.0.91`
prettier (source)	`3.9.7` → `3.9.10`
publint (source)	`0.3.24` → `0.3.25`
react-i18next	`17.0.14` → `17.0.16`
rolldown (source)	`1.2.9` → `1.2.13`
rollup-plugin-sbom	`4.0.0` → `4.0.1`
tsdown (source)	`0.23.0` → `0.23.1`
vite (source)	`8.3.0` → `8.3.4`

Release Notes

Rel1cx/eslint-react (@eslint-react/eslint-plugin)

`v5.26.0`

Compare Source

✨ New

Lowered the minimum required Node.js version from >=22.0.0 to >=20.19.0. (#2020)

Full Changelog: Rel1cx/eslint-react@v5.25.0...v5.26.0

`v5.25.0`

Compare Source

✨ New

react-dom/no-unsafe-target-blank: added an allowReferrer option (default: false). When enabled, rel="noopener" alone is accepted and the suggested fix adds rel="noopener" instead of rel="noreferrer noopener", preserving referrer information while still requiring an explicit token. (#2019) Closes #2012.

🏗️ Internal

@eslint-react/ast: added hasParent and hasEnclosingTryBlock shortcuts to Traverse. (#2016)
@eslint-react/ast: renamed the types module to tree and narrowed the Extract.unwrap result type. (#2017)
@eslint-react/core: removed the unused REACT_BUILTIN_HOOK_NAMES constant.
Bumped tsdown to 0.23.1, @effect/platform-node to 4.0.3, pnpm to 12.11.2, @types/node to 26.6.5, setup-uv to v10.3.0, and fumadocs and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.24.10...v5.25.0

`v5.24.10`

Compare Source

📝 Documentation

Added a link to the Astryx no-react-introspection rule in the react-x/no-children-count and react-x/no-children-map rule documentation.

🏗️ Internal

Disabled test isolation in the vitest config.
Reordered react-web-api/no-leaked-event-listener test specs from typical cases to edge cases. (#2015)
Unified KNOWN_-prefixed constant names in react-x/no-array-index-key and react-x/no-missing-key. (#2014)
Bumped effect to 4.0.2, @effect/platform-node to 4.0.2, nx to 23.3.0, vite to 8.3.4, lucide-react to 1.53.0, and pnpm to 12.10.1.

Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10

`v5.24.9`

Compare Source

🐞 Fixes

react-x/set-state-in-effect: optional chaining in a setState argument (ex: setData(ref.current?.value), setWidth(el?.offsetWidth ?? 0) where el is ref-derived) no longer defeats the ref-value exemption; the ChainExpression wrapper is now unwrapped during ref-source detection. (#2011)

📝 Documentation

Aligned rule documentation with the current react.dev reference docs. (#2013)

Full Changelog: Rel1cx/eslint-react@v5.24.8...v5.24.9

`v5.24.8`

Compare Source

🐞 Fixes

react-x/rules-of-hooks: removed the incorrect FIX feature declaration; the rule does not provide an auto-fix and is no longer advertised as fixable. (#2009)

🏗️ Internal

Added edge-case test specs from the v5.24.7 change review covering react-x/immutability, react-x/set-state-in-render, react-web-api/no-leaked-event-listener, and the leaked-observer rules.
Bumped next to 16.4.0, vite to 8.3.3, and related dependencies.

Full Changelog: Rel1cx/eslint-react@v5.24.7...v5.24.8

`v5.24.7`

Compare Source

🐞 Fixes

react-x/immutability: no longer reports rebinding a plain local alias of props/state as a mutation; destructured props rebinding and member writes through aliases are still reported. (#1995)
react-x/set-state-in-render: setState calls after nested component or hook declarations are now attributed to the outer component again. (#2004)
react-x/set-state-in-render: anonymous callbacks passed directly to memo()/forwardRef() are now treated as component render functions. (#1998)
react-web-api/no-leaked-fetch: signal alias chains are now resolved recursively, so fetches with aliased signals correctly pair with their cleanup abort call. (#1997)
react-web-api/no-leaked-event-listener: bare global addEventListener(...) calls now pair with matching removeEventListener(...) cleanup calls. (#1996)
react-web-api/no-leaked-event-listener: a signal destructured from new AbortController() is now recognized. (#2001)
react-web-api/no-leaked-resize-observer / react-web-api/no-leaked-intersection-observer: disconnect() / unobserve(...) now only count as cleanup in the cleanup phase; useRef-held observer instances are tracked; unobserve(...) inside the observer callback no longer pairs with observe(...). (#2002, #2003)

🏗️ Internal

Bumped typescript-eslint to 8.71.1 and postcss to 8.5.29.

Full Changelog: Rel1cx/eslint-react@v5.24.6...v5.24.7

`v5.24.6`

Compare Source

🐞 Fixes

react-x/no-unused-props: computed member access and destructuring with an identifier key (ex: props[key], const { [key]: value } = props) no longer count as usage of a prop named after the key; the rule now bails out on such dynamic keys instead of reporting actually-used props as unused. (#1994)
react-x/set-state-in-effect: object-pattern destructuring of the useState tuple is now resolved by numeric key: a name bound at key 0 (ex: const { 0: value } = useState()) is no longer mistaken for the setter, while key 1 (ex: const { 1: setData } = useState()) is still recognized. (#1994)
react-x/set-state-in-render: same useState object-pattern destructuring fix as set-state-in-effect. (#1994)

Full Changelog: Rel1cx/eslint-react@v5.24.5...v5.24.6

`v5.24.5`

Compare Source

🏗️ Internal

Self-linted rule implementations with eslint-plugin-eslint-plugin, removing redundant empty defaultOptions declarations and enforcing meta.defaultOptions for rules with options. (#1993) Thanks to @rakleed and @Rel1cx!
Minor code cleanups in react-web-api/no-leaked-intersection-observer, react-x/no-create-ref, react-x/no-nested-lazy-component-declarations, and react-x/use-state. Thanks to @Rel1cx!
Bumped effect to 4.0.1, pnpm to 12.9.1, fumadocs-core and fumadocs-ui to 16.16.1, lucide-react to 1.52.0, tsl-dx to 0.14.0, and tinybench to 6.2.0. Thanks to @Rel1cx!

Full Changelog: Rel1cx/eslint-react@v5.24.4...v5.24.5

`v5.24.4`

Compare Source

🏗️ Internal

Enable dead-code elimination in tsdown config, producing smaller published packages.

Full Changelog: Rel1cx/eslint-react@v5.24.3...v5.24.4

`v5.24.3`

Compare Source

🏗️ Internal

@local/eff: minor code optimizations.
@eslint-react/shared: minor code optimizations.

Full Changelog: Rel1cx/eslint-react@v5.24.2...v5.24.3

`v5.24.2`

Compare Source

🏗️ Internal

@eslint-react/core, @eslint-react/var, the react-dom plugin, and the react-x plugin: replaced in operator checks with the hasProperty helper from @local/eff.
@eslint-react/shared: documented getNormalizedSettings.
JSDoc comments are now stripped from the tsdown build output, producing smaller published packages.

Full Changelog: Rel1cx/eslint-react@v5.24.1...v5.24.2

`v5.24.1`

Compare Source

📝 Documentation

Added a link to the Astryx no-react-introspection rule in the react-x/no-children-count and react-x/no-children-map rule documentation.

🏗️ Internal

Disabled test isolation in the vitest config.
Reordered react-web-api/no-leaked-event-listener test specs from typical cases to edge cases. (#2015)
Unified KNOWN_-prefixed constant names in react-x/no-array-index-key and react-x/no-missing-key. (#2014)
Bumped effect to 4.0.2, @effect/platform-node to 4.0.2, nx to 23.3.0, vite to 8.3.4, lucide-react to 1.53.0, and pnpm to 12.10.1.

Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10

`v5.24.0`

Compare Source

🐞 Fixes

react-x/set-state-in-effect: more value shapes are recognized as ref-derived setState arguments: interpolations in template literals (ex: setData(`${ref.current}`)), tagged templates (both the quasi and a ref-derived tag), object and array literals (ex: setData({ value: ref.current })), and spreads (ex: setData({ ...ref.current })) — previously these fell through to the default case and were reported. (#1988)

📝 Documentation

Added eslint-config-xo-react to the website's community presets.

🏗️ Internal

@local/eff: added predicate combinators and type guards synced with effect, and migrated call sites across the workspace to them. (#1989)
react-x/set-state-in-effect, react-x/set-state-in-render, and react-x/use-memo: reworked to the fact-based implementation pattern — fact collection (collect.ts), provenance resolution (origins.ts), and violation inference (effects.ts) are now separate modules, with lib.ts replaced by a pure-AST helpers.ts; set-state-in-effect again classifies a hook name configured as both additionalStateHooks and additionalEffectHooks as a state hook first. (#1983, #1985, #1986)
react-x/use-state: aligned the nested-expression collectors' visitor keys to callee-first order, matching eslint-visitor-keys; no behavior change. (#1988)
Migrated package unit tests to the shared @local/testkit helpers. (#1987)
Renamed message ids to kebab-case across all plugins. (#1984)
Bumped fumadocs-core and fumadocs-ui to 16.15.18, fumadocs-mdx to 15.4.6, lucide-react to 1.50.0, and @types/node to 26.6.4.

Full Changelog: Rel1cx/eslint-react@v5.23.5...v5.24.0

`v5.23.5`

Compare Source

🐞 Fixes

react-x/set-state-in-effect: the ref-derived value exemption now also covers setState calls reached indirectly through functions or hook callbacks invoked from the effect setup, not only setState written directly in the setup body. (#1982)
react-x/set-state-in-effect: more ref read shapes are recognized as ref-derived values — <ref-named>.current anywhere in a member chain, locals derived from other ref-derived locals, and reads through a ref/xxxRef parameter. (#1982)
react-web-api/no-leaked-event-listener: removeEventListener inside a function called from the effect cleanup now pairs with its addEventListener, fixing false positives for listeners removed on unmount; cleanup calls resolve to the actual functions, so same-named shadowed functions no longer pair by coincidence. (#1982)

🏗️ Internal

Bumped effect to 4.0.0 and migrated the repo scripts to the v4 APIs. (#1981)

Full Changelog: Rel1cx/eslint-react@v5.23.4...v5.23.5

`v5.23.4`

Compare Source

🐞 Fixes

Added the missing react-x/static-components rule to the disable-experimental preset. (#1980)
Fixed type imports in react-x/exhaustive-deps and react-x/rules-of-hooks (RuleFeature is now imported from @eslint-react/eslint instead of @eslint-react/shared).

📝 Documentation

react-jsx/no-useless-fragment: clarified the scope of the allowExpressions option and unified experimental-rule callout wording across rule docs.
react-x: unified cross-rule references in rule docs to full rule names.
Removed low-relevance entries from the further reading sections of rule docs, and removed a redundant note about eslint being an optional peer dependency.
Fixed inaccuracies in internal documentation. (#1980)

🏗️ Internal

Adopted ts-pattern for type checks in @eslint-react/core, @eslint-react/jsx, and the react-dom plugin, and declared the missing ts-pattern dependencies.
Added behavior boundary tests for react-jsx/no-useless-fragment.
Bumped fumadocs-core, fumadocs-ui, and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.23.3...v5.23.4

`v5.23.3`

Compare Source

🐞 Fixes

react-x/immutability: reassigning a binding that resolves to component props or state (value = value + "!", count++, including destructuring and for...of rebinding forms) is now reported as a direct mutation, matching upstream react-hooks/immutability; rebinding iterator or shallow-copy bindings remains allowed. (#1979)
react-x/set-state-in-effect: ref reads traced through intermediate local computations (ex: const dv = visible - prevVisible.current) are now recognized as ref-derived values, and a preceding early-return guard whose test is ref-derived (ex: if (dv === 0) return;) now exempts the setState calls that follow it — previously only setState nested directly inside a ref-gated if/conditional was exempted. Aligns with react-hooks 7.1.1. (#1979)

📝 Documentation

react-x/no-unstable-context-value: documented the React 19 <Context> provider detection heuristic and its name-based limitations. (#1979)
Updated the README badges to reference eslint-plugin-react-x.

Full Changelog: Rel1cx/eslint-react@v5.23.2...v5.23.3

`v5.23.2`

Compare Source

🏗️ Internal

Removed unused dependencies and fixed phantom dependencies across the workspace.
Bumped next to 16.3.7, fumadocs-core and fumadocs-ui to 16.15.16, and eslint-plugin-package-json to 1.10.1.

Full Changelog: Rel1cx/eslint-react@v5.23.1...v5.23.2

`v5.23.1`

Compare Source

🏗️ Internal

Re-verified and synchronized the IMPL-SPEC diff reports for the following react-x rules. (#1977, #1978)
- react-x/error-boundaries
- react-x/globals
- react-x/immutability
- react-x/purity
- react-x/refs
- react-x/set-state-in-effect
- react-x/set-state-in-render
- react-x/use-memo
Bumped typescript-eslint to 8.71.0, tsl-dx to 0.13.7, and pnpm to 12.8.1.

📝 Documentation

Added argo-cd, griffel, tanstack/table, and eslint-config-studio to the website's community lists.

Full Changelog: Rel1cx/eslint-react@v5.23.0...v5.23.1

`v5.23.0`

Compare Source

✨ New

react-x/static-components: dynamic creation-site tracing now follows both sides of logical expressions (ex: const C = DefaultComponent || (() => <div />)) and the last element of sequence expressions (ex: const C = (setup(), () => <div />)), in initializers and reassignments alike. (#1975)

🐞 Fixes

react-x/static-components: parameters of nested non-component functions (ex: function render(Comp) { return <Comp /> }) are no longer mistaken for render-created components; definitions are judged by definition type instead of AST node type. (#1975)
react-x/static-components: createdHere is now reported once per creation site instead of once per JSX usage; the default diagnostic remains per usage. (#1975)

🏗️ Internal

react-x/static-components: restructured the rule to the fact-based implementation pattern — collect.ts (usage facts), origins.ts (creation-site resolution), and effects.ts (effect inference) are now separate modules, with reporting centralized in Program:exit; added 14 boundary test cases covering creation-site resolution, render boundaries, and per-usage reporting. (#1975)
Renamed lib.ts to helpers.ts in the fact-based react-x rules (globals, immutability, refs). (#1976)
Bumped @effect/language-service to 0.87.3 and oxlint to 1.86.0.

Full Changelog: Rel1cx/eslint-react@v5.22.1...v5.23.0

`v5.22.1`

Compare Source

🐞 Fixes

react-x/use-state: directly returning the useState result (ex: return React.useState()) is now allowed regardless of the rule's options, matching the exemption in the original react/hook-use-state rule. Covers explicit, implicit (arrow function), and type-asserted returns; lazy initialization checks still apply. (#1974, closes #1963)

📝 Documentation

Added a note about eslint being an optional peer dependency to the READMEs and the website's getting-started guides.
Simplified the @eslint-react/kit README to point to the full documentation.

Full Changelog: Rel1cx/eslint-react@v5.22.0...v5.22.1

`v5.22.0`

Compare Source

✨ New

react-dom/no-unknown-property: added React 19.3 properties to the known property allowlist. (#1973)
- closedby on dialog
- onFullscreenChange, onFullscreenError (and their Capture variants), credentialless, and maskType — gated on React version >= 19.3.0
- onLoad on body
- onScrollEnd (and its Capture variant)
- shadowrootmode, shadowrootclonable, shadowrootdelegatesfocus, and shadowrootserializable on template

🏗️ Internal

Bumped fumadocs-core and fumadocs-ui to 16.15.15.

Full Changelog: Rel1cx/eslint-react@v5.21.3...v5.22.0

`v5.21.3`

Compare Source

🐞 Fixes

react-x/purity: reverted the v5.21.2 exemption for impure calls in useRef initializer arguments (ex: useRef(document.createElement("div"))); such calls are reported again. (#1972)

Full Changelog: Rel1cx/eslint-react@v5.21.2...v5.21.3

`v5.21.2`

Compare Source

🐞 Fixes

react-x/no-unnecessary-use-prefix: hooks that call other hooks only within nested callbacks, functions named exactly use, and hooks defined in test mock module registrations are no longer reported. (#1971)
react-x/no-unused-class-component-members: methods invoked by host environments through refs (React Native's NativeMethods) are no longer reported as unused. (#1971)
react-x/purity: async function components in modules without a use client directive and impure calls in useRef initializer arguments are no longer reported. (#1971)
react-x/set-state-in-effect: local variables initialized from nested member expressions rooted at a ref are now recognized as ref-derived values and no longer reported. (#1971)

🏗️ Internal

@eslint-react/ast: predefined and exported common node-type helpers in the Check namespace and migrated call sites to them.

📝 Documentation

Website rule docs no longer include the per-rule ## Versions section; a rule's changelog can be viewed directly via the Rule Changelog link under the ## Resources section of each rule doc.

Full Changelog: Rel1cx/eslint-react@v5.21.1...v5.21.2

`v5.21.1`

Compare Source

🐞 Fixes

Fixed missed reports where a timer, fetch controller, or observer created in one effect was treated as cleaned up because an unrelated cleanup in another effect referenced a different variable with the same name; identifier matching now resolves both sides to their variables by scope instead of comparing names only. (#1969) Affected rules:
- react-web-api/no-leaked-timeout
- react-web-api/no-leaked-interval
- react-web-api/no-leaked-fetch
- react-web-api/no-leaked-resize-observer
- react-web-api/no-leaked-intersection-observer

🏗️ Internal

Simplified the react-web-api leaked-resource rules by replacing manual function-context stack tracking with Traverse.findParent ancestor lookup, and added boundary tests covering deeply nested callbacks, cross-effect pairing, and wrapped or referenced setup callbacks. (#1969) Affected rules:
- react-web-api/no-leaked-timeout
- react-web-api/no-leaked-interval
- react-web-api/no-leaked-fetch
- react-web-api/no-leaked-event-listener
- react-web-api/no-leaked-resize-observer
- react-web-api/no-leaked-intersection-observer
@eslint-react/var: isAssignmentTargetEqual no longer short-circuits same-name identifiers through structural equality; identifier pairs are compared with scope-aware value equality. (#1969)
react-x/no-unused-class-component-members: removed the manual class and method context stacks; the enclosing class and method are now resolved at the hit point with Traverse.findParent ancestor lookup, and the per-class member definition/usage maps are initialized lazily. (#1970)

Full Changelog: Rel1cx/eslint-react@v5.21.0...v5.21.1

`v5.21.0`

Compare Source

✨ New

The plugins can now be used with Oxlint without an eslint installation: eslint is now an optional peer dependency across all published packages, and the rule utilities no longer eagerly load the eslint package at import time. (#1965)

🏗️ Internal

@eslint-react/core: removed the unused isAssignmentToThisState helper, and simplified the react-x class-component rules (no-access-state-in-setstate, no-class-component, no-direct-mutation-state, no-set-state-in-*) accordingly.
@eslint-react/eslint: added a local getConstrainedTypeAtLocation helper (adapted from @typescript-eslint/type-utils) so consumers don't need to load @typescript-eslint/type-utils, whose entry point eagerly loads the eslint package. (#1965)
Bumped typescript-eslint to 8.70.1, fumadocs to 16.15.14, fumadocs-mdx to 15.4.5, vite to 8.3.1, and other dependencies.

New Contributors

Dom Porada (@porada) made their first contribution in #1965.

Full Changelog: Rel1cx/eslint-react@v5.20.8...v5.21.0

`v5.20.8`

🐞 Fixes

@eslint-react/core: isJsxLike now recognizes JSX wrapped in TypeScript expressions (as, satisfies, type assertions, and non-null assertions) and await expressions.
@eslint-react/jsx: isFragmentElement now requires the configured jsxFragmentFactory, avoiding an implicit React fragment factory for custom JSX runtimes.

🏗️ Internal

@eslint-react/jsx: exported the AttributeValue type from the package entry point.
@eslint-react/var: renamed the AssignmentTarget type to EnclosingAssignmentTarget and inlined getRequireExpressionArguments into its sole consumer.

Full Changelog: Rel1cx/eslint-react@v5.20.6...v5.20.8

`v5.20.6`

Compare Source

🐞 Fixes

react-x/globals: for...in/for...of loop targets without a declaration (e.g. for (globalValue of items)) are now collected as writes instead of being missed.
react-x/immutability: destructuring assignment targets (e.g. ({ a: props.x } = value)) and for...in/for...of loop targets without a declaration are now collected as mutations instead of being missed.
react-x/purity: builtin alias resolution now preserves the property path, so aliases of impure builtins (const random = Math.random; random(), const { now } = Date; now(), window.Math.random()) are now detected instead of being missed; unknown-global roots are not followed, preventing speculative reports.
react-x/refs: destructuring assignments, for-in/of loop targets, and delete operations on ref.current are now classified as writes instead of being misreported as reads.
react-x/refs: refs passed to constructor calls (new Widget(ref)) and tagged templates are now checked for render-time exposure, same as refs passed to plain functions.
react-x/refs: the mergeRefs exemption for passing refs now survives simple variable aliases (const combine = mergeRefs), resolved position-aware so reassigned aliases lose it again.
react-x/use-memo: reassignments of outer variables through destructuring patterns and for...in/for...of loop targets inside useMemo callbacks are now reported instead of being missed; property mutation targets remain exempt, matching the React Compiler's StoreContext semantics.

🏗️ Internal

@eslint-react/var: split resolve into a value-based resolve and a new origin-based resolveOrigin, and updated the consumers in react-web-api and react-x rules accordingly. (#1964)
Bumped fumadocs to 16.15.12, fumadocs-mdx to 15.4.3, tsl-dx to 0.13.6, eslint-plugin-de-morgan to 2.2.0, and eslint-plugin-regexp to 3.3.1.

Full Changelog: Rel1cx/eslint-react@v5.20.5...v5.20.6

`v5.20.5`

Compare Source

🐞 Fixes

react-web-api/no-leaked-fetch: fixed a false positive where an abort call nested in a callback within the cleanup function (e.g. setTimeout(() => ctrl.abort())) was not recognized, causing a spurious expectedAbortInCleanup report; the abort lookup now finds the nearest enclosing setup/cleanup function instead of requiring the innermost one. (#1962)

Full Changelog: Rel1cx/eslint-react@v5.20.4...v5.20.5

`v5.20.4`

Compare Source

🐞 Fixes

react-web-api/no-leaked-event-listener: listeners that are only added inside the effect cleanup are now reported when the matching removeEventListener is in the setup (reversed setup/cleanup pairing), since a listener attached on unmount is never removed. (#1961)

🏗️ Internal

react-jsx and react-web-api rules: unified rule code style and variable naming across the plugins. (#1960, #1961)

Full Changelog: Rel1cx/eslint-react@v5.20.3...v5.20.4

`v5.20.3`

Compare Source

🏗️ Internal

@eslint-react/ast: replaced getIdentifierAt with the new getMemberChain helper and moved getInnermostCall to its sole consumer in react-x/no-nested-component-definitions. (#1959)
react-dom rules: unified rule code style and variable naming across the plugin, and switched no-find-dom-node to import-aware detection via createImportLookup. (#1958)

Full Changelog: Rel1cx/eslint-react@v5.20.2...v5.20.3

`v5.20.2`

Compare Source

🐞 Fixes

Fixed false negatives in the JSX element resolver used by the react-dom rules: polymorphic components written as member expressions (e.g. <motion.div as="button">) were mistaken for host elements, so the polymorphic prop was ignored and these rules skipped them entirely; they are now resolved through the polymorphic prop and checked like the underlying DOM element. String values of the polymorphic prop are also normalized to lowercase, so as="BUTTON" is treated as button. Affected rules:
- react-dom/no-missing-button-type
- react-dom/no-missing-iframe-sandbox
- react-dom/no-unsafe-iframe-sandbox
- react-dom/no-unsafe-target-blank
- react-dom/no-void-elements-with-children

🏗️ Internal

The normalized polymorphicPropName setting type is corrected from string | null to string — it could never be null at runtime — and the unreachable null branch in the JSX element resolver used by the react-dom rules is removed.

Full Changelog: Rel1cx/eslint-react@v5.20.1...v5.20.2

`v5.20.1`

Compare Source

🐞 Fixes

react-dom/no-flush-sync: flushSync calls are now detected by tracking react-dom imports directly instead of matching by name, so aliased named imports (e.g. import { flushSync as fs } from "react-dom") and default/namespace member calls (e.g. ReactDOM.flushSync()) are reported, while local functions, object methods, and same-named APIs from other packages (e.g. pino's destination().flushSync()) are no longer misreported. (#1954, closes #1943)

🏗️ Internal

react-dom/no-flush-sync and react-dom/no-find-dom-node: API call checks now use core.isAPICall; core.isJsxLike now uses isCreateElementCall.
Added Node types reference to all package tsl/tsdown configs.
Bumped eslint to 10.11.0, eslint-plugin-jsdoc to 64.5.4, eslint-plugin-package-json to 1.9.0, typedoc-plugin-markdown to 4.13.1, @types/node to 26.6.2, pnpm to 12.5.1, and the dprint JSON plugin to 0.24.0.

New Contributors

changbaebang (@changbaebang) made their first contribution in #1954.

Full Changelog: Rel1cx/eslint-react@v5.20.0...v5.20.1

`v5.20.0`

Compare Source

✨ New

react-x/immutability: mutations on for...of iterator variables (e.g. for (const item of items) { item.done = true; }), including destructured iterator bindings, are now reported when the iterated collection resolves through its root identifier to a component's props, a state value, or a shallow copy of either, since the iterator variable is bound to each shared element of the original collection. Member-expression collections (for (const item of props.items)) are traced to their root; for...in loops and right sides without a root identifier are not traced. (#1953, closes #1764)

🏗️ Internal

Bumped @types/node to 26.6.1, tsl-dx to 0.13.5, eslint-plugin-jsdoc to 64.5.2, lucide-react to 1.47.0, and pnpm to 12.4.2.

New Contributors

Michael@WCD (@Michael-WhiteCapData) made their first contribution in #1953.

Full Changelog: Rel1cx/eslint-react@v5.19.1...v5.20.0

Jahia/jahia-cypress (@jahia/cypress)

`v8.6.1`

Compare Source

Set the default mail recipient in the SMTP setup script on Jahia 8.2.4.0 and later, so a mail Jahia sends without a recipient reaches Mailpit (#260)

`v8.6.0`

Compare Source

Added breakAclInheritance and restoreAclInheritance helpers to stop or restore the inheritance of roles on a node.
Added createRole and deleteRole to manage a role from a test through GraphQL, so each project no longer needs its own Groovy script.

archfz/cypress-terminal-report (cypress-terminal-report)

`v7.4.0`

Compare Source

Add support for custom output path patterns, including date patterns in generated file names or paths. issue
Fix retries not being logged to console or files with extended collector enabled. issue
Fix retry titles with custom reporters. issue
Update cypress to 16.1.0 in tests to confirm support.

sveltejs/devalue (devalue)

`v6.0.2`

Compare Source

Patch Changes

12ad9d6: chore: remove dts-buddy

`v6.0.1`

Compare Source

Patch Changes

c13cf6a: fix: populate error.path for values reached through a promise in stringifyAsync
6156b2e: perf: stringify and uneval skip per-character escaping for strings with nothing to escape
e7a9a73: fix: throw Invalid input instead of a raw TypeError for malformed typed array and boxed primitive payloads
6156b2e: perf: only format path when an error is raised
6156b2e: perf: cache quoted property names
9e44253: Fix uneval for typed array views whose backing buffer ends with a partial element

sindresorhus/globals (globals)

`v17.13.0`

Compare Source

Update globals (2026-10-01) (#354) b007369

i18next/i18next (i18next)

`v26.4.3`

Compare Source

perf: ResourceStore.hasLanguageSomeTranslations() no longer enumerates every key of a large bundle on each call. It ran Object.keys() on the whole bundle just to learn whether it had at least one key, and init() / changeLanguage() reach it three times per instance (once while picking the language, twice via setResolvedLanguage()). With large flat bundles and one i18next instance per SSR request reusing the same resources, that showed up as measurable CPU work before any t() call. Bundle objects already found non-empty are now remembered in a WeakSet shared across instances, so later checks are O(1): 2,000 inits with a 6,800-key bundle went from ~750 ms to ~20 ms, the same as a one-key bundle. Only the non-empty result is cached. No API removes single keys from a bundle, so a non-empty bundle stays non-empty, and empty bundles are re-checked every time, so keys added later (backend loads, addResource, addResourceBundle, direct or silent changes) count right away. The only edge case: a bundle emptied by hand with delete on every key while it is still in the store keeps counting as having translations; use removeResourceBundle() for that. Thanks @dmchoi77 for the detailed report (#2449).

Rich-Harris/magic-string (magic-string)

`v1.4.3`

Compare Source

Bug Fixes

preserve inserts when update spans several chunks (#361) (fb89bad)
replace the matched text when an offset is set (#362) (607e8e4)

`v1.4.2`

Compare Source

Bug Fixes

keep the outro when splitting a removed chunk (#358) (2a665f6)
skip empty matches inside removed content in replaceAll (#359) (2eb0f6f)

Performance Improvements

look up removed content without scanning every chunk (#357) (ca9e867)

stackblitz-labs/pkg.pr.new (pkg-pr-new)

`v0.0.91`

Compare Source

`v0.0.90`

Compare Source

prettier/prettier (prettier)

`v3.9.10`

Compare Source

diff

Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance (#20266 by @fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

`v3.9.9`

Compare Source

diff

Markdown: Fix text with `$` been incorrectly parsed as math syntax (#20140 by @fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

`v3.9.8`

Compare Source

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.7 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a

{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.8 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

publint/publint (publint)

[`v0.3.25`](https://redirect.github.co

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-09-22T03:59:07Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

warning Missing version in workspace at "/tmp/renovate/repos/github/Jahia/javascript-modules/javascript-modules-engine", ignoring.
error Couldn't find any versions for "@jahia/javascript-modules-library" that matches "workspace:^"
warning workspace-aggregator-e9a35f41-d145-483b-a8b9-c4b98732abc0 > hydrogen > typescript-plugin-css-modules > stylus > glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
warning workspace-aggregator-e9a35f41-d145-483b-a8b9-c4b98732abc0 > hydrogen > typescript-plugin-css-modules > stylus > glob > inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
Error: Couldn't find any versions for "@jahia/vite-plugin" that matches "workspace:^"
    at MessageError.ExtendableBuiltin (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:721:66)
    at new MessageError (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:750:123)
    at NpmResolver.<anonymous> (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:50353:13)
    at Generator.next (<anonymous>)
    at step (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:310:30)
    at /opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:321:13
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
Error: Couldn't find any versions for "@jahia/vite-plugin" that matches "workspace:^"
    at MessageError.ExtendableBuiltin (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:721:66)
    at new MessageError (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:750:123)
    at NpmResolver.<anonymous> (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:50353:13)
    at Generator.next (<anonymous>)
    at step (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:310:30)
    at /opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:321:13
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
Error: Couldn't find any versions for "@jahia/javascript-modules-library" that matches "workspace:^"
    at MessageError.ExtendableBuiltin (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:721:66)
    at new MessageError (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:750:123)
    at NpmResolver.<anonymous> (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:50353:13)
    at Generator.next (<anonymous>)
    at step (/opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:310:30)
    at /opt/containerbase/tools/yarn/1.22.22/24.21.0/node_modules/yarn/lib/cli.js:321:13
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)

File name: tests/yarn.lock

error This project's package.json defines "packageManager": "yarn@4.18.0". However the current global version of Yarn is 1.22.22.

Presence of the "packageManager" field indicates that the project is meant to be used with Corepack, a tool included by default with all official Node.js distributions starting from 16.9 and 14.19.
Corepack must currently be enabled by running corepack enable in your terminal. For more information, check out https://yarnpkg.com/corepack.

github-actions · 2026-09-22T03:59:31Z

🦜 Chachalog

No changelog entries detected. Learn more about Chachalog.

Create a new entry online or run npx chachalog@0.5.6 prompt to create a new entry locally.

pkg-pr-new · 2026-09-22T04:01:43Z

Open in StackBlitz

yarn add https://pkg.pr.new/@jahia/create-module@799.tgz

yarn add https://pkg.pr.new/@jahia/javascript-modules-library@799.tgz

yarn add https://pkg.pr.new/@jahia/vite-plugin@799.tgz

commit: 716de0a

renovate Bot added the dependencies label Sep 22, 2026

renovate Bot enabled auto-merge (squash) September 22, 2026 03:59

renovate Bot force-pushed the renovate/patch branch 3 times, most recently from 716de0a to fdfc342 Compare September 24, 2026 22:06

renovate Bot changed the title ~~chore(deps): update patch~~ fix(deps): update patch Sep 24, 2026

renovate Bot force-pushed the renovate/patch branch 3 times, most recently from 5f543dd to fda1f44 Compare October 1, 2026 05:00

renovate Bot force-pushed the renovate/patch branch 8 times, most recently from 2b01b06 to ac535ab Compare October 9, 2026 13:04

renovate Bot force-pushed the renovate/patch branch 8 times, most recently from 3bf2db1 to 0d4c14d Compare October 14, 2026 08:38

fix(deps): update patch

1948dce

renovate Bot force-pushed the renovate/patch branch from 0d4c14d to 1948dce Compare October 14, 2026 09:19

Navigation Menu

Repository navigation

fix(deps): update patch - #799

fix(deps): update patch#799
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/patch

renovate Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

✨ New

✨ New

🏗️ Internal

📝 Documentation

🏗️ Internal

🐞 Fixes

📝 Documentation

🐞 Fixes

🏗️ Internal

🐞 Fixes

🏗️ Internal

🐞 Fixes

🏗️ Internal

🏗️ Internal

🏗️ Internal

🏗️ Internal

📝 Documentation

🏗️ Internal

🐞 Fixes

📝 Documentation

🏗️ Internal

🐞 Fixes

🏗️ Internal

🐞 Fixes

📝 Documentation

🏗️ Internal

🐞 Fixes

📝 Documentation

🏗️ Internal

🏗️ Internal

📝 Documentation

✨ New

🐞 Fixes

🏗️ Internal

🐞 Fixes

📝 Documentation

✨ New

🏗️ Internal

🐞 Fixes

🐞 Fixes

🏗️ Internal

📝 Documentation

🐞 Fixes

🏗️ Internal

✨ New

🏗️ Internal

New Contributors

🐞 Fixes

🏗️ Internal

🐞 Fixes

🏗️ Internal

🐞 Fixes

🐞 Fixes

🏗️ Internal

🏗️ Internal

🐞 Fixes

🏗️ Internal

🐞 Fixes

🏗️ Internal

New Contributors

✨ New

🏗️ Internal

New Contributors

Patch Changes

Patch Changes

Bug Fixes

Bug Fixes

Performance Improvements

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

Markdown: Don't let Liquid objects interrupt paragraphs (#​20087 by @​seiyab)

[v0.3.25](https://redirect.github.co

Configuration

Uh oh!

renovate Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

renovate Bot commented Sep 22, 2026 •

edited

Loading

Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance (#20266 by @fisker)

Markdown: Fix text with `$` been incorrectly parsed as math syntax (#20140 by @fisker)

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)

[`v0.3.25`](https://redirect.github.co

renovate Bot commented Sep 22, 2026 •

edited

Loading

github-actions Bot commented Sep 22, 2026 •

edited

Loading

pkg-pr-new Bot commented Sep 22, 2026 •

edited

Loading