fix(deps): update minor updates (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint-react/eslint-plugin (source)	5.24.10 → 5.26.5
oxfmt (source)	0.72.0 → 0.73.0
pnpm (source)	12.11.2 → 12.13.0

---

Release Notes

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.26.5

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: a setState on the right side of a short-circuit operator (&&, ||, ??) is now exempt when the left operand is ref-derived (ex: ref.current && setData(1)), matching the existing ref-gated conditional exemption; a left-side setState still runs unconditionally and stays reported. (#​2031)
• react-x/set-state-in-effect: setup identifiers are now collected from the setup argument of the effect call only; the callee and the deps array are no longer scanned, so a function referenced only in the deps array (ex: useEffect(setup, [helper])) is no longer mistaken for the setup and its setState calls stay unattributed. (#​2031)
• react-x/set-state-in-effect: arrow function parameters are no longer collected as callback-body setter references (ex: the setState in useMemo((setState) => ..., [])); only actual callback bodies are collected (ex: useMemo(() => setState, [])). (#​2031)

Full Changelog: Rel1cx/eslint-react@v5.26.4...v5.26.5

v5.26.4

Compare Source

🐞 Fixes

• The name lookup now stops at function boundaries, so expression-bodied factory functions and custom hooks (ex: export const useAnchor = () => useRef(null)) are no longer misreported; calls inside JSX expressions, computed keys, or class static blocks no longer fall back to the outer variable. (#​2029) Closes #​2026. Affected rules:
  • react-naming-convention/context-name
  • react-naming-convention/id-name
  • react-naming-convention/ref-name
• The name lookup no longer crosses containers or derived values (ex: const refs = [useRef(null)], const n = useRef(0) + 1), so such calls are no longer reported on the enclosing variable; sequence expressions check only the last value, and unresolvable computed keys (ex: { [key]: useRef(null) }) no longer fall back to the outer variable. (#​2030) Affected rules:
  • react-naming-convention/context-name
  • react-naming-convention/id-name
  • react-naming-convention/ref-name

Full Changelog: Rel1cx/eslint-react@v5.26.3...v5.26.4

v5.26.3

Compare Source

🐞 Fixes

• An enclosing object literal property key now takes precedence over the outer assignment target when statically known (ex: const refs = { myRef: useRef(0) }); computed keys with string literals (ex: refs["value"] = useRef(null)) are now checked, and unresolvable computed keys are no longer reported. (#​2028) Affected rules:
  • react-naming-convention/context-name
  • react-naming-convention/id-name
  • react-naming-convention/ref-name
• react-naming-convention/ref-name: immediate dereferences of the useRef result through TypeScript type wrappers (ex: (useRef(null) as { current: null }).current, useRef(null)!.current) are no longer reported, extending the #​1375 fix. (#​2028)

Full Changelog: Rel1cx/eslint-react@v5.26.2...v5.26.3

v5.26.2

Compare Source

✨ New

• react-x/no-unused-props: improved prop usage detection. Props parameters with default values (ex: function Component(props: Props = defaultProps)) are now unwrapped and analyzed, props aliased to a local variable (ex: const alias = props) are tracked through the alias, and template literals without substitutions (ex: props[`foo`]) are recognized as static prop keys. (#​2021)

🐞 Fixes

• react-x/no-unused-props: a component whose used prop keys cannot be fully determined (ex: it passes the whole props object to another function) now marks all of its declared props as used, so a props declaration shared with another fully analyzable component is no longer reported as unused. (#​2021)
• react-x/set-state-in-effect: ref-derived values that reach the setState argument through assignment statements (rather than the declaration initializer) are now recognized; only writes that lexically precede the use and live in the use's own function or an ancestor count. (#​2027)
• react-x/set-state-in-effect: parameters of a helper invoked from the effect setup are now treated as ref-derived when the call-site argument is ref-derived, matched per call site by parameter definition. (#​2027)
• react-x/set-state-in-effect: a .current read rooted at a function parameter is now recognized as a ref read (ex: setReferenceElement(anchor?.current) where anchor is a RefObject prop); previously only parameters named ref or ending in Ref were recognized. (#​2027)
• react-x/no-unused-class-component-members: public methods (including function-valued properties) of an exported class component are no longer reported as unused, as they may be part of the component's imperative API invoked by consumers through refs. Data fields, private/protected members, and members of non-exported classes are still reported. (#​2024)

🏗️ Internal

• Ordered message ids by first usage and unified default/suggestion message id naming across react-dom, react-jsx, react-web-api, and react-x rules. (#​2022)

Full Changelog: Rel1cx/eslint-react@v5.26.1...v5.26.2

v5.26.1

Compare Source

🏗️ Internal

• Renamed the internal suggestion message id from "replace" to "suggest". Affected rules:
  • react-x/no-context-provider
  • react-x/no-forward-ref
  • react-x/no-use-context
• react-x/immutability: moved context-dependent helpers from helpers.ts into origins.ts and effects.ts to match the fact-based implementation pattern.
• react-x/globals: moved resolveToFunction from helpers.ts to origins.ts.
• Bumped effect to 4.0.3, tsl-dx to 0.14.1, @tsconfig/node20 to 20.1.10, and @types/node to 20.19.43.

📝 Documentation

• Refreshed spec diff verification dates and notes for react-x rules.

Full Changelog: Rel1cx/eslint-react@v5.26.0...v5.26.1

v5.26.0

Compare Source

✨ New

• Lowered the minimum required Node.js version from >=22.0.0 to >=20.19.0. (#​2020)

Full Changelog: Rel1cx/eslint-react@v5.25.0...v5.26.0

v5.25.0

Compare Source

✨ New

• react-dom/no-unsafe-target-blank: added an allowReferrer option (default: false). When enabled, rel="noopener" alone is accepted and the suggested fix adds rel="noopener" instead of rel="noreferrer noopener", preserving referrer information while still requiring an explicit token. (#​2019) Closes #​2012.

🏗️ Internal

• @eslint-react/ast: added hasParent and hasEnclosingTryBlock shortcuts to Traverse. (#​2016)
• @eslint-react/ast: renamed the types module to tree and narrowed the Extract.unwrap result type. (#​2017)
• @eslint-react/core: removed the unused REACT_BUILTIN_HOOK_NAMES constant.
• Bumped tsdown to 0.23.1, @effect/platform-node to 4.0.3, pnpm to 12.11.2, @types/node to 26.6.5, setup-uv to v10.3.0, and fumadocs and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.24.10...v5.25.0

oxc-project/oxc (oxfmt)

v0.73.0

Compare Source

🚀 Features

• a495e82 oxfmt: Support associations config to specify language over filepath (#​27437) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#​27386) (leaysgur)

📚 Documentation

• 408d87f oxfmt: Simplify oxfmtrc docs (#​27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#​27362) (leaysgur)

pnpm/pnpm (pnpm)

v12.13.0: pnpm 12.13.0

Compare Source

This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution.

Minor Changes

• Added the pnpm profile command to view and update registry user profile settings.

• Added pnpm token to list, create, and revoke authentication tokens on the registry.

• Added the storeIndexFormat setting. Set it to files to keep a store's package index as one file per package instead of the SQLite index.db, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corrupt index.db.

• Added the nodePackageMap setting, which groups the package-map settings. nodePackageMap.mode: write-only writes node_modules/.package-map.json for other tools without making Node.js load it. mode: load also makes Node.js load the map, like nodeExperimentalPackageMap: true. nodePackageMap.type replaces nodePackageMapType. The old settings still work #​14937.

  nodePackageMap:
    mode: write-only
    type: loose

Patch Changes

Setting up pnpm

• pnpm setup now works when pnpm was installed with npm on macOS. It installed pnpm from npm's bin directory and left a $PNPM_HOME/bin/pnpm that could not run #​16855.

• pnpm runs again after pnpm setup when globalShims enables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" #​16874.

• A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that rust-toolchain.toml names. It used to install the MSVC toolchain.

Installing packages

• On macOS, pnpm install no longer fails with ERR_PNPM_LOCKFILE_WRITE_FILE when the project is on a virtiofs or SMB share. pnpm now falls back to a regular fsync when the file system rejects a full sync #​16846.

• On macOS, pnpm install, pnpm patch-commit, and other commands that load a pnpmfile no longer hang at random.

• pnpm install now puts the executables of a Python build backend's requirements on the PATH while the backend runs. Projects built with uv_build now install. Before, they failed with "uv-build was not properly installed".

• Removing a link: dependency now also removes its symlink from node_modules when nodeLinker is hoisted #​16884.

• pnpm-lock.yaml no longer records the tarball URL of a package installed from a scoped registry, such as one set by @types:registry=, when pnpm can rebuild the URL from that registry #​16866.

Packing, auditing, and pipelines

• pnpm pack and pnpm publish now pack only package.json, the README, the license, and the files named in main and bin when files is an empty array. They used to pack every file in the package #​16889.

• pnpm audit and pnpm audit signatures no longer check runtimes installed through devEngines.runtime, such as node@runtime:24.21.0, against the npm package of the same name. pnpm audit signatures reported these runtimes as having an invalid registry signature #​16869.

• pnpm pipeline now runs the root's tasks when pnpm-workspace.yaml lists only the root in packages or omits packages, as pnpm -r run does. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run, pnpm pipeline now reports that no projects are selected #​16849.

Performance

• pnpm install resolves Python dependencies faster. With --lockfile-only, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects.

• A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace.

• pnpm install with enableModulesDir: false now verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching.

Platinum Sponsors

Gold Sponsors

v12.12.1: pnpm 12.12.1

Compare Source

This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.

Patch Changes

• pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

• pnpm dist-tag add, rm, and ls now support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.

• Added the tool: protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn. pnpm add bun@tool:1.3.0, pnx node@tool:22, and pnx yarn@tool:4 work like the runtime: spelling, which stays supported as an alias. A lockfile written for runtime: stays up to date when package.json switches to tool:, and the other way around.

  A named registry can no longer be called tool.

Platinum Sponsors

Gold Sponsors

v12.12.0: pnpm 12.12.0

Compare Source

This release shares task results and dependency builds through a remote cache, adds the addMissingPeerTypes setting, and lets pnpm add --config and pnpm update manage configuration dependencies. It also fixes dangerouslyAllowAllBuilds running the build scripts of packages that allowBuilds denies.

Minor Changes

• pnpm pipeline can share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remote Cache.

  The remote side-effects cache can also store dependency builds on a Turborepo Remote Cache server. Both caches read the new remoteCache setting, which names the server and holds the signing keys. pnpm pipeline --report records the run under the organization remoteCache.org names.

• Added the addMissingPeerTypes setting, which links the @types package of a peer dependency next to every package that peer-depends on it. For example, a package that peer-depends on react gets the project's @types/react linked next to it. This lets TypeScript find the types of a peer dependency when the global virtual store is on #​15689.

• pnpm add --config and pnpm update now handle configuration dependencies the way they handle other dependencies #​16814.

  pnpm add --config saves a version range in pnpm-workspace.yaml by the same rules as pnpm add, so pnpm add --config my-config@latest saves a range such as ^1.2.0. It also resolves the package again when pnpm-lock.yaml already locks an older version.

  pnpm update updates configuration dependencies within their ranges, and pnpm update --latest moves them to their latest version. A selector such as pnpm update my-config updates only the configuration dependencies it names.

Patch Changes

• A package set to false in allowBuilds no longer runs its build scripts when dangerouslyAllowAllBuilds is true. The two settings together now allow every build except the denied ones. Previously, dangerouslyAllowAllBuilds ignored the denials.

• pnpm now switches to the pnpm version a project pins even when it cannot read its configuration. Previously, a setting it rejected in the global config file, an .npmrc file, or _auth, or a pnpm-workspace.yaml it could not parse, stopped every command, pnpm --version included.

• pnpm update and pnpm why accept --depth Infinity again. They failed with invalid value 'Infinity' for '--depth <DEPTH>' #​16817.

• pnpm deploy without injectWorkspacePackages now binds a peer dependency of a linked workspace package to the version its parent provides, as an injected install does. Previously the deploy failed with ERR_PNPM_DEPLOY_AMBIGUOUS_PEER whenever other packages in the deployed graph depended on different versions of that peer #​16807.

• pnpm deploy --legacy no longer fails with ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER when a workspace dependency of the deployed project declares a workspace: peer dependency that the project does not depend on itself. pnpm now copies that peer from the workspace into the deploy directory.

  An auto-installed peer declared with workspace: now always resolves to the workspace project. Previously, workspace:* and workspace:^1.0.0 peers could be installed from the registry #​16806.

• Repeat installs no longer resolve again when an injected workspace package lists a dependency also as a peer dependency.

• Sped up frozen installs of unchanged injected workspace packages that use hardlinks.

• Sped up workspace discovery with subtree exclusions such as !generated/**.

• A key under a registry URL in the _auth setting that does not start with @ is now skipped with a warning, so a field a later pnpm version adds there no longer breaks this one. A key that holds an authToken object but lacks its @, such as org for @org, is still an error.

Platinum Sponsors

Gold Sponsors

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d1f5c0f4-8bcc-44b6-b805-1f18b3e0e105

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	oxfmt@​0.72.0 ⏵ 0.73.0			+1	+1
	@​anolilab/​prettier-config@​10.0.4
	@​eslint-react/​eslint-plugin@​5.26.5

View full report

[github-actions]

Thank you for following the naming conventions! 🙏

[pkg-pr-new]

Open in StackBlitz

browserslist-config-anolilab

npm i https://pkg.pr.new/browserslist-config-anolilab@1233

@anolilab/commitlint-config

npm i https://pkg.pr.new/@anolilab/commitlint-config@1233

@anolilab/eslint-config

npm i https://pkg.pr.new/@anolilab/eslint-config@1233

@anolilab/lint-staged-config

npm i https://pkg.pr.new/@anolilab/lint-staged-config@1233

@anolilab/oxfmt-config

npm i https://pkg.pr.new/@anolilab/oxfmt-config@1233

@anolilab/oxlint-config

npm i https://pkg.pr.new/@anolilab/oxlint-config@1233

@anolilab/prettier-config

npm i https://pkg.pr.new/@anolilab/prettier-config@1233

@anolilab/stylelint-config

npm i https://pkg.pr.new/@anolilab/stylelint-config@1233

@anolilab/textlint-config

npm i https://pkg.pr.new/@anolilab/textlint-config@1233

commit: d088053

[prisis]

Superseded by #1230, which combines this repo's open Renovate updates into a single branch (every commit preserved, versions reconciled to the highest proposed version, lockfile regenerated, pnpm audit clean). Closing this; it is covered when #1230 merges.