[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint-react/eslint-plugin (source)	5.28.8 → 5.30.1
globals	17.13.0 → 17.14.0
oxfmt (source)	0.75.0 → 0.78.0
pnpm (source)	12.16.1 → 12.18.0

---

Release Notes

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.30.1

Compare Source

🐞 Fixes

• react-x/no-duplicate-key: in .map() callbacks, all statically known keys are now treated as repeating, not only bare string literals.
• react-jsx/no-leaked-semicolon: same-line leaked semicolons after an expression container are now detected (ex: <div>{x};</div>, <div>{cond && <span />};</div>).

🏗️ Internal

• Removed the Vercel deploy step from the release workflow.

Full Changelog: Rel1cx/eslint-react@v5.30.0...v5.30.1

v5.30.0

Compare Source

✨ New

• @eslint-react/eslint-plugin: added the all-type-checked preset, which extends all with the rules that require type information. (#​2095)
• @eslint-react/eslint-plugin: added the experimental @eslint-react/unstable-exhaustive-deps rule, forked from exhaustive-deps, with a hooks option modeled on Biome's useExhaustiveDependencies (closureIndex/dependenciesIndex for custom Hooks, and stableResult for stable results). The rule lives in the unified plugin's own src/rules while incubating and is enabled in the all preset (and thereby in all-type-checked). (#​1698, #​2078, #​2095) Thanks to @​dgesteves!
• react-x/set-state-in-effect: reworked around explicit effect roots, recursive value resolution, and a synchronous call graph. Stable aliases, multi-level helpers, named setups, IIFEs, and useCallback/useMemo/useEffectEvent wrappers now share one resolution path; indirect diagnostics point at the effect-side trigger and dedupe by setter sink; async functions remain deferred. (#​2075)
• react-x/static-components: JSX member expression tags (ex: <Namespace.Bar />) are now analyzed. (#​2114)

🐞 Fixes

• react-x/error-boundaries: optional-chained createElement calls are recognized as JSX-like return values. (#​2084)
• react-x/no-direct-mutation-state: state assignments in nested constructor blocks (if, loops, try, and bare blocks) are no longer reported. (#​2088)
• react-x/no-duplicate-key: only keys that provably have a duplicate are now reported. Unique siblings in a partially duplicate group (ex: [A, B, B]) are no longer reported, and duplicates followed by a unique key (ex: [A, A, B]) are now correctly reported; keys collected through Children.toArray() and Children.map() are no longer reported; only elements returned by .map() callbacks are checked; literal keys are no longer overwritten by later keys; and .map() calls on array literals with at most one element are skipped. (#​2108)
• react-x/no-duplicate-key: the fast-path text check now matches bare key attributes and keys separated from = by whitespace (ex: <div key />, <div key = {id} />), so such elements are no longer silently skipped.
• react-x/no-missing-component-display-name: memo components passed to generic HOCs are recognized, so anonymous ones require a display name. (#​2084)
• react-x/no-missing-context-display-name: the autofix now applies to exported contexts and no longer produces invalid syntax for multi-declarator declarations. (#​2088, #​2089)
• react-x/no-missing-key: elements with a spread attribute are no longer reported as missing key, and TypeScript-wrapped iterator callbacks are unwrapped before checking. (#​2086, #​2088)
• react-x/no-nested-component-definitions: array pattern element defaults and memo propsAreEqual comparators are no longer reported as nested components; optional-chained createElement returns are recognized. (#​2084)
• react-x/no-unstable-context-value and react-x/no-unstable-default-props: shadowed Boolean(), String(), and Number() calls are no longer reported. (#​2089)
• react-x/no-unused-class-component-members: statically resolvable computed member reads and destructuring are counted as usages. (#​2088)
• react-x/refs: non-null guards whose terminating branch is a try statement, an all-terminating switch with a default clause, or an all-terminating while (true)/for (;;)/do...while loop are now recognized, so ref writes reached only when the ref is null are no longer reported. (#​2093, #​2109)
• react-x/set-state-in-effect: TypeScript-wrapped setups are resolved; zero-argument setters called directly in the setup are reported; timer or event callbacks nested in useCallback/useEffectEvent are no longer treated as synchronous setters; every possible setter is reported when the callee may resolve to more than one; the ref-derived exemption applies to any argument position of a custom state hook's setter; ref-derived early-return guards gate the following statements inside try/switch/bare blocks and loop bodies or update clauses; ref provenance follows IIFEs; nested and outer effect setups are analyzed independently; and setter calls reached through the same effect-side trigger are reported once per setter name. (#​2075, #​2082, #​2083)
• react-x/static-components: the render-boundary check now requires that at least one declaration of the component binding lives inside a render body, instead of only checking the first declaration. (#​2110)
• react-x/static-components: static components wrapped by useMemo or useCallback (ex: useMemo(() => External, [])) are no longer reported; the memoized value is traced instead of the hook call itself. (#​2113, closes #​1762) Thanks to @​itisrmk!
• react-x/use-state: calls in computed object property keys and JSX subtrees are now detected by the lazy-initialization check. (#​2080)
• react-jsx/no-children-prop-with-children: children supplied through a statically resolvable computed key in a createElement props object is now detected. (#​2086)
• react-jsx/no-children-prop: children supplied through a statically resolvable computed key in a createElement props object is now detected, and the suggestion to move children into element content is no longer offered when a following spread attribute could override it. (#​2086, #​2102)
• react-jsx/no-leaked-semicolon: leaked semicolons between a JSX child and its parent's closing tag on the same line are now detected. (#​2102)
• react-jsx/no-useless-fragment: fragments with a spread attribute are no longer reported, and lone-CR whitespace, including &#​13;, is treated as formatting padding like LF and CRLF. (#​2086, #​2092)
• react-dom/no-dangerously-set-innerhtml-with-children: empty expression containers and comment-only children no longer count as children; lone-CR whitespace, including &#​13;, no longer counts either. (#​2086, #​2092)
• react-dom/no-hydrate and react-dom/no-render: autofixes now skip calls with extra or spread arguments and calls whose return values are used, and no longer prepend the new import at the top of the file — existing imports are reused, duplicates are skipped, and new imports are placed after file-level directives, header comments, and existing imports. (#​2103, #​2104)
• react-dom/no-script-url: namespaced attributes such as xlink:href are now checked for javascript: URLs. (#​2086)
• react-dom/no-unsafe-iframe-sandbox: sandbox permissions are matched as whole whitespace-separated tokens, fixing false positives like sandbox="not-allow-scripts". (#​2112)
• react-dom/no-unsafe-target-blank: the suggestion for a missing rel attribute now inserts it after the last JSX attribute, so a spread attribute cannot override the suggested value. (#​2086)
• react-dom/no-use-form-state: autofix-added imports now reuse existing imports, avoid duplicates, and follow file-level directives, header comments, and existing imports. (#​2104)
• react-dom/no-void-elements-with-children: comment-only/empty containers, newline-only formatting whitespace, and lone-CR whitespace, including &#​13;, no longer count as children. (#​2086, #​2092)
• react-web-api/no-leaked-event-listener: dot access and static computed access (including simple template-literal keys) now match as the same property; optional-chained listeners, event types, and receivers pair with their cleanup; string-literal and template-literal option keys are recognized; cyclic signal alias chains no longer recurse forever; and function-parameter callees are no longer mistaken for the enclosing function. (#​2085, #​2092, #​2093, #​2100)
• react-web-api/no-leaked-fetch: signal option keys written as string literals or simple template literals are recognized. (#​2093)
• react-web-api/no-leaked-intersection-observer and react-web-api/no-leaked-resize-observer: observe(...) and unobserve(...) now pair on optional-chained elements. (#​2093)
• react-debug/function-component: only the first argument of memo/forwardRef is treated as the wrapped component; propsAreEqual comparators returning JSX are no longer reported, and functions in that position no longer inherit the surrounding binding or wrapper flags. Array pattern element defaults are no longer reported, and optional-chained createElement returns are recognized. (#​2084)

🪄 Improvements

• Added fast-path text checks so rules skip AST traversal when their target term is absent from the file. (#​2088)

  Affected rules:

  • react-x/no-children-count
  • react-x/no-children-for-each
  • react-x/no-children-map
  • react-x/no-children-only
  • react-x/no-children-to-array
  • react-x/no-clone-element
  • react-x/no-direct-mutation-state
  • react-x/no-implicit-children
  • react-x/no-implicit-key
  • react-x/no-implicit-ref
  • react-x/no-nested-lazy-component-declarations
  • react-x/no-unused-class-component-members

• JSX and createElement rules no longer resolve spread props, since a spread's contents are unknown; only direct attributes and properties are inspected. (#​2086)

  Affected rules:

  • react-x/no-missing-key
  • react-jsx/no-children-prop
  • react-jsx/no-children-prop-with-children
  • react-jsx/no-useless-fragment
  • react-dom/no-dangerously-set-innerhtml
  • react-dom/no-dangerously-set-innerhtml-with-children
  • react-dom/no-missing-button-type
  • react-dom/no-missing-iframe-sandbox
  • react-dom/no-string-style-prop
  • react-dom/no-unsafe-iframe-sandbox
  • react-dom/no-unsafe-target-blank
  • react-dom/no-void-elements-with-children

• react-x/no-unknown-property: attribute-tag, DOM-property, and standard-name lookups are cached per React version and resolved lazily. (#​2086)

• react-x/set-state-in-effect and react-x/set-state-in-render: setters are recognized only as the second element of a useState array destructuring; tuple-index access and object-pattern numeric keys are no longer detected. (#​2075)

📝 Documentation

• Added a TanStack Redact example and updated the website's community projects list. (#​2079)
• Added known-issues references for eslint-plugin-react-jsx (#​2102), eslint-plugin-react-dom (#​2103), eslint-plugin-react-web-api, and eslint-plugin-react-x, and removed their next-step sections.
• Documented known limitations and workarounds for react-jsx/no-comment-textnodes, react-jsx/no-key-after-spread, and react-jsx/no-leaked-dollar. (#​2102)
• Synced the migration tables with rule features and updated the configuration and third-party plugin docs. (#​2106)
• Synced the website recipe snippets with the hardened sample rules, and corrected the noExplicitSpreadProps recipe to state that it provides no autofix. (#​2089, #​2107)
• Updated the FAQ, glossary, examples pages, the contributing guide's monorepo architecture diagram and package/example listings, and the term-based rule implementation patterns.

🏗️ Internal

• @eslint-react/ast, @eslint-react/core, and @local/testkit: added tests for AST tree types, core semantic interfaces, and type utilities.
• @eslint-react/ast: added the Collect and Analyze namespaces and Traverse.simpleTraverse; Analyze.isUnconditionallyTerminating now handles try statements, terminating switch statements with a default clause, and terminating while (true)/for (;;)/do...while loops; Compare.isEqual now compares ChainExpression, regex literals, and member computed/optional flags; Collect now traverses for initializers and updates; renamed Check.isConditional to Check.isConditionalOrLoop; added Check.isArrayPatternElementDefault, Check.isObjectPatternElementDefault, Check.isLoopStatement, and Extract.getJSXName; improved private identifier handling; removed the general-purpose Extract.getMemberChain, Extract.getPropertyName, Extract.findProperty, and Extract.getAssignmentTargets helpers in favor of resolveAssignmentTargets from @eslint-react/var and rule-local traversal. (#​2080, #​2083, #​2084, #​2086, #​2092, #​2093, #​2099, #​2100)
• @eslint-react/core: moved the createElement helpers to @eslint-react/jsx; component detection now checks wrapper argument positions and unwraps chain expressions; improved render-method detection and qualified type names; narrowed the accepted node types of hook/component detection helpers. (#​2075, #​2077, #​2084, #​2099)
• @eslint-react/var: added resolveOriginChain, isProvenanceEqual, hasDefault, and resolveAssignmentTargets; expanded resolveObjectType and createImportLookup, which now exposes isModuleBinding instead of hasNamespace; made isValueEqual identity-only (use isProvenanceEqual for structural provenance); and removed resolveBindingTarget/BindingTarget, with binding targets now unwrapped inline. (#​2085, #​2086, #​2088, #​2100)
• @local/samples: hardened the sample rules. (#​2107)
• @local/testkit: added a verifyAndFix helper for testing rules with autofixes. (#​2078)
• Bumped dependencies across the workspace, including eslint to 10.14.0, typescript-eslint to 8.72.1, next to 16.4.5, vitest to 5.1.0, tsdown to 0.23.7, nx to 24.0.4, oxlint to 1.91.0, vite to 8.3.6, effect to 4.1.2, and the fumadocs packages to 16.18.0.
• Collapsed multi-line expressions in react-x/static-components origins; no behavioral changes.
• Enforced a 1-day dependency maturity period; served README assets from the jsDelivr CDN; restricted website deployments to stable releases via a Vercel deploy hook; refactored the publish workflow trigger and pinned zizmor through its official action.
• Removed the ko-fi sponsorship and funding configuration.
• Removed the now-unused @typescript-eslint/typescript-estree dependency from @eslint-react/ast, @eslint-react/core, @eslint-react/var, and eslint-plugin-react-x. (#​2080)
• Removed the unused inlinedDependencies field from the monorepo package configuration.
• Unified test language options and reorganized the test harness: tsconfig fixtures replace the per-JSX-emit tester factories, and untyped parsing disables typescript-estree's single-run inference. (#​2105)
• Unwrapped multi-line comments to single lines across packages, plugins, and scripts; no behavioral changes.

New Contributors

• Diogo Esteves (@​dgesteves) made their first contribution in #​2078.
• Rahul Kashyap (@​itisrmk) made their first contribution in #​2113.

Full Changelog: Rel1cx/eslint-react@v5.28.8...v5.30.0

sindresorhus/globals (globals)

v17.14.0

Compare Source

• Update globals (2026-11-01) (#​355) 7abfb5d

---

oxc-project/oxc (oxfmt)

v0.78.0: oxfmt v0.78.0

Compare Source

🐛 Bug Fixes

• ab78621 formatter_css/less: Print ~ escape consistently (#​29089) (Yuji Sugiura)
• 91721d2 formatter_css/less: Print Less % selectors (#​29088) (Yuji Sugiura)
• 449e91f oxfmt: Format ts-in-astro as TSX (#​29080) (leaysgur)
• 8d8845e formatter/jsdoc: Strip * prefixes from multiline default value (#​28910) (leaysgur)
• cdb1501 formatter/jsdoc: Handle every line terminator in multi-line JSDoc types (#​28909) (leaysgur)
• fd51bff jsdoc: Handle every line terminators as newline (#​28902) (leaysgur)
• 2f80765 formatter_toml: Format whitespace-only document to empty (#​28899) (leaysgur)
• 5e1e02c formatter_graphql: Allow empty document (#​28898) (leaysgur)
• 06e72c0 formatter/tailwind: Normalize CR in Tailwind template with preserveWhitespace (#​28896) (leaysgur)

⚡ Performance

• 934ca98 formatter: Use Arc for tailwind options across embedding (#​29079) (leaysgur)
• dde9c5c formatter_htmlish: Skip </script escape if possible (#​29078) (leaysgur)
• dc4d918 formatter: Format embedded expr of one name without parsing (#​29077) (leaysgur)

📚 Documentation

• eb2eb2d formatter_htmlish: Cover block elements in DIVERGENCES.md#interpolation-element-as-text (#​28901) (leaysgur)
• 0f4ec80 formatter/tailwind: Note Tailwind sorting tears escaped whitespace apart (#​28900) (leaysgur)

v0.77.0: oxfmt v0.77.0

Compare Source

💥 BREAKING CHANGES

• 00d1a67 oxfmt: [BREAKING] Format parser:vue files by oxc_formatter_htmlish (#​28848) (leaysgur)

🚀 Features

• 9a81e58 formatter_htmlish: Format Vue templates (#​28847) (leaysgur)
• 119d82f formatter: Format a template's expressions and handlers as JsRoot (#​28846) (leaysgur)

🐛 Bug Fixes

• fa66fde oxlint,oxfmt: Resolve Vite+ config root from the config file directory (#​28801) (MK (fengmk2))
• 4d4104d formatter_htmlish: Preserve doctype case in embedded (#​28797) (leaysgur)
• ebfd40a formatter: Sort Tailwind calls printed as member chains (#​28800) (Yuji Sugiura)
• e62e5cb formatter: Decide quotes of a Tailwind key printed as one class (#​28798) (Yuji Sugiura)
• 959edc1 formatter: Don't sort templates in nested non-Tailwind calls (#​28794) (Yuji Sugiura)
• 6ffbe32 formatter/jsdoc: Prevent @tag from being moved to the line start (#​28835) (leaysgur)
• 94fbef5 formatter_css: Treat comments in style attr as fill items (#​28832) (leaysgur)
• e4a80f7 formatter_css: Normalize selectors inside :deep, :slotted and :local (#​28805) (leaysgur)
• 255c5cc formatter: Measure Tailwind class argument after collapsing whitespace (#​28745) (Lee Jaeha / Adam)
• e6c4fef formatter: Decide template and object key layouts from collapsed Tailwind classes (#​28791) (Yuji Sugiura)
• 0b44164 formatter: Decide JSX opening element layout from collapsed Tailwind class string (#​28744) (Lee Jaeha / Adam)
• b8ba9ae formatter: Print decorators on rest parameters (#​28731) (YT)

⚡ Performance

• 2766d07 oxfmt: Spawn Prettier workers on demand (#​28789) (YT)
• 07627f7 oxfmt: Use worker_threads for tinypool again (#​28787) (Yuji Sugiura)

v0.76.0: oxfmt v0.76.0

Compare Source

💥 BREAKING CHANGES

• 296623d oxfmt: [BREAKING] Format parser:html files by oxc_formatter_htmlish (#​28273) (Yuji Sugiura)

🚀 Features

• 336b2c1 oxfmt: Support html-in-js templates closing a dynamic tag name (#​28389) (Yuji Sugiura)
• 0a42af6 formatter_htmlish: Format end tags of omitted html, head and body (#​28388) (Yuji Sugiura)
• 44d8c2b formatter_htmlish: Implement HTML-ish formatter Html variant (#​28272) (Yuji Sugiura)
• 36e5ddb oxfmt: Add debug span for reading files (#​28204) (leaysgur)

🐛 Bug Fixes

• dbcc358 formatter: Keep arrow conditional body parens before a leading function/class (#​28710) (Yuji Sugiura)
• fef809a formatter_htmlish: Handle XHTML (#​28703) (leaysgur)
• f3dd201 formatter_htmlish: Keep SVG text under xml:space="preserve" as written (#​28382) (Yuji Sugiura)
• fb3aefa formatter: Keep source parens around html-in-js placeholders past comments (#​28381) (Yuji Sugiura)
• e738dae formatter: Quote keys added in an HTML event handler with single quotes (#​28380) (Yuji Sugiura)
• 2e7a629 oxfmt: Format HTML in a <script> body as an embedded part (#​28379) (Yuji Sugiura)
• f00862b formatter: Keep parens around a generic function type in a type assertion (#​28173) (vidigoat)
• 9ead5c4 formatter: Handle this.b and super.b like foo.b (#​28200) (leaysgur)
• 72a54cf formatter: Break parens of (a + b)[c] like (a + b).c (#​28199) (leaysgur)
• b8f4f34 formatter: Print x.b and x.#b samely (#​28193) (leaysgur)
• 9ddccb7 formatter: Keep parens for private field (#​28188) (leaysgur)

⚡ Performance

• b6f1ac9 formatter_markdown: Bump parser to 0.0.4 and skip unread work (#​28713) (leaysgur)
• 633ee96 formatter_css: Use u32 spans (#​28708) (leaysgur)
• f680ee1 formatter_yaml: Use multiline flag for flow scalars (#​28707) (leaysgur)
• ff7c203 formatter_css: Avoid repeated scans and allocations in values (#​28706) (leaysgur)
• 7cd46cb formatter_htmlish: Search script end tags by < in embedded (#​28704) (leaysgur)
• 46f8efd formatter_graphql: Print block string lines borrowed from the source (#​28701) (leaysgur)
• dce1485 formatter_htmlish: Skip escaping attr values without the chosen quote (#​28700) (leaysgur)
• e9392c8 formatter_core: Search line terminators with memchr (#​28699) (leaysgur)
• ceb26be formatter_htmlish: Use char to escape attr quotes (#​28697) (leaysgur)
• 8239dac parser: Replace dragonbox_ecma with zmij_ecma (#​28282) (Boshen)

📚 Documentation

• 303d9e8 formatter: Strengthen start-token-no-double-parens rationale (#​28711) (Yuji Sugiura)
• a82ce83 oxfmt: Update unclassified divergence (#​28685) (Yuji Sugiura)
• 7f18c20 formatter_htmlish: Note class and srcset are formatted with embeddedLanguageFormatting: off (#​28465) (Yuji Sugiura)
• 01ed68a oxfmt,formatter_htmlish,formatter: Clean up behavior comments (#​28384) (Yuji Sugiura)
• a363c27 formatter_css,formatter_yaml: Point parser citations at AGENTS.md (#​28466) (Yuji Sugiura)
• 6586050 formatter_core: Document tab width in text width policy (#​28393) (leaysgur)
• 49fbffb formatter_core: Tighten FORMATTER_POLICY (#​28206) (leaysgur)

pnpm/pnpm (pnpm)

v12.18.0: pnpm 12.18

Compare Source

pnpm 12.18.0 packs, publishes, and installs packages with platform variants on pnpr registries. It also adds per-skill approval of agent skills and pnpm store add for offline installs from downloaded tarballs. Repeat installs and verifyDepsBeforeRun no longer read the package.json of unchanged workspace projects. The release fixes several peer dependency resolution bugs too.

Minor Changes

Agent skills

• pnpm now names the link to a dependency's agent skill after the skill alone. A skill that the @acme/kit package ships in skills/auth/ is linked as .claude/skills/auth, not .claude/skills/pnpm-@acme+kit-auth. The next install replaces links with the old names. pnpm lists the linked skills in a # pnpm block of each agent skill directory's .gitignore #​17455.

  When two approved packages ship a skill of the same name, or the name is already taken in an agent skill directory, pnpm links the skill as pnpm-<package>-<skill>. Before, the install failed.

• pnpm approve now asks which agent skills to link when a package ships more than one. pnpm records the chosen skills as a list, such as permissions.<pkg>.skills: [guide, migrate], and does not offer the other skills for approval again. The first time a project approves a skill, pnpm approve also asks which agent directories to link skills into, and records the answer under skills.dirs.

• pnpm links agent skills nested in category directories, such as skills/engineering/implement/SKILL.md, up to three levels below skills/. Before, it linked only the skills directly under skills/.

Platform variants

These features need a registry declared with serverType: pnpr.

• pnpm pack packs one archive per entry of publishConfig.variants, each platform variant as <name>-<version>~<tag>.tgz. pnpm pack --variant <target> packs only the archive whose entry lists that target. pnpm pack --json prints the integrity and size of every archive it writes.

• pnpm publish publishes a package's publishConfig.variants. pnpm uploads every archive before the publish request that references them. Publishing variants to any other registry is refused unless --no-variants is given, which publishes only the archive that targets any.

• pnpm publish --upload-variant <target> uploads the archive of one publishConfig.variants entry to the registry's staging area and prints <target>=<integrity>. pnpm publish --variant-integrity <target>=<integrity> then publishes the version from archives that other jobs uploaded. With --recursive, each value names its package as <name>~<target>=<integrity>.

• pnpm publish -r --batch now uploads each package archive on its own request and skips archives the registry already holds, so the batch request no longer grows with the archives it publishes. A batch of more than 256 packages still carries every archive inline. Packages with publishConfig.variants can be published in a batch. A batch with variants that would reference more than 256 archives on one registry fails with ERR_PNPM_BATCH_PUBLISH_TOO_MANY_ARCHIVES pnpm/tasks#244.

• pnpm publish --provenance signs one statement that names every archive of a version with publishConfig.variants. A platform variant's archive is named by the version's package URL with a variant qualifier.

• Rerunning pnpm publish after the version was already published now succeeds when the published version is the same release. pnpm compares the archives, the provenance statement when the rerun signs one, and the dist-tag. When the published version differs, the publish fails with ERR_PNPM_PUBLISHED_RELEASE_DIFFERS, which names what differs.

• pnpm installs the platform variant of a package that fits the host, or the package's own archive when none does. The lockfile records every variant. A version published with variants only, and no archive for other hosts, installs on a host one of the variants fits. On any other host, an optional dependency is skipped, and any other dependency fails with an error that lists the platforms the version is published for.

• supportedArchitectures platform lists accept platform tags, the same tags publishConfig.variants entries name. An entry can state floors and an ABI, such as linux-x64-manylinux_2_28, darwin-arm64-macos_14_0, linux-x64-napi8 or linux-x64-node127, and any Node.js OS and CPU, such as freebsd-x64. The spellings accepted before still work.

• With supportedArchitectures set, pnpm also fetches into the store the variants that the other listed platforms need, when it downloads a package with platform variants.

pnpr registries

• pnpm downloads less metadata from a registry declared with serverType: pnpr. A large package document leaves out the manifests of rarely picked versions, and pnpm fetches one only when it picks that version. In a benchmark that resolves 787 packages, the package documents shrank from 30.3 MB to 2.5 MB gzipped. pnpm caches these documents in v12/metadata-pnpr, and the pnpm cache commands cover them.

  pnpm warns when a registry that is not declared serverType: pnpr turns out to be pnpr. For a registry declared serverType: pnpr, a minimumReleaseAge longer than 30 days fails with ERR_PNPM_UNSUPPORTED_MINIMUM_RELEASE_AGE.

• pnpm publish sends release notes to registries declared with serverType: pnpr. A package's notes are the section for its version in CHANGELOG.md, or the notes that pnpm version -r composed from change intents. --release-notes <file> gives the notes from a file, and --no-release-notes sends none. --publication-name names a release published with --batch.

  In a workspace that uses pnpm's versioning, pnpm version -r --release-notes <file> puts a summary above the composed notes of the release.

  pnpm view <pkg>@<version> releaseNotes, pnpm outdated --notes, and pnpm update --interactive show the release notes from these registries.

Store and hooks

• pnpm store add now prepares the store for offline installs from package tarballs downloaded some other way. After pnpm store add ./tarballs/*.tgz, pnpm install --offline --frozen-lockfile installs each registry package whose lockfile entry pins one of those tarballs #​2978.

• Custom pnpmfile fetchers can use fetchers.gitHostedTarball, fetchers.git, and fetchers.binary pnpm/tasks#191.

Patch Changes

Installing packages

• Running node or pnpm install in a project that pins a Node.js version pnpm has not downloaded yet no longer hangs when a globalPnpmfile is configured #​17530.

• pnpm install with enableGlobalVirtualStore no longer fails on Windows for a dependency from a named registry, such as gh: or npmjs: #​17665.

• Concurrent installs that share a global virtual store no longer fail with ERR_PNPM_CMD_SHIM_SYMLINK_BIN when they link the same executable at the same time #​17587.

• pnpm install and pnpm ci now succeed when dependency skills are approved but no agent skill directory exists. The skills stay unlinked until a directory exists #​17574.

• Commands run from a workspace package now use the same default store as the workspace root. Before, pnpm add in a package could fail with ERR_PNPM_UNEXPECTED_STORE when the workspace root was its own mount point and the home store was on another volume, as in a sandbox or a container.

  A workspace installed with the old behavior may need one pnpm install --force from the workspace root.

• pnpm deploy now keeps a symlink in the project whose target is missing from the source, such as a link into a node_modules directory that was removed after the build. Deploy used to drop such a link silently #​17571.

• pnpm install now links the runtime that an earlier pnpm install --no-runtime skipped, and pnpm install --no-runtime removes a runtime that an earlier install linked #​17542.

• With enableGlobalVirtualStore, pnpm install again runs a dependency's build scripts in a project whose global virtual store slot another project already built, unless the side-effects cache has build output to restore for it. A build that writes only outside its own package, such as a git hook installer, now takes effect in every project #​17526.

• Commands of a package whose bin paths contain excess parent directory segments, such as ../dist/cli.js, are no longer missing. Such paths now resolve inside the package #​17586.

• Generated POSIX shell shims now quote their paths, so shell special characters in a path stay literal.

Lockfile and local paths

• Packages from the default registry keep plain lockfile keys, even when a prefix such as npmjs points at the registry set as registry. A dependency written with such a prefix shares the plain entry of the same package. The next install rewrites keys that earlier versions qualified this way #​17575.

• `pnpm ins

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2ac5b01c-f07b-44af-bcc5-cf86011be6c1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Thank you for following the naming conventions! 🙏

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	globals@​17.14.0
	oxfmt@​0.75.0 ⏵ 0.78.0	+8
	@​anolilab/​eslint-config@​31.0.1 ⏵ 31.0.3	-1			+1
	@​eslint-react/​eslint-plugin@​5.30.1

View full report

[pkg-pr-new]

Open in StackBlitz

browserslist-config-anolilab

npm i https://pkg.pr.new/browserslist-config-anolilab@1265

@anolilab/commitlint-config

npm i https://pkg.pr.new/@anolilab/commitlint-config@1265

@anolilab/eslint-config

npm i https://pkg.pr.new/@anolilab/eslint-config@1265

@anolilab/lint-staged-config

npm i https://pkg.pr.new/@anolilab/lint-staged-config@1265

@anolilab/oxfmt-config

npm i https://pkg.pr.new/@anolilab/oxfmt-config@1265

@anolilab/oxlint-config

npm i https://pkg.pr.new/@anolilab/oxlint-config@1265

@anolilab/prettier-config

npm i https://pkg.pr.new/@anolilab/prettier-config@1265

@anolilab/stylelint-config

npm i https://pkg.pr.new/@anolilab/stylelint-config@1265

@anolilab/textlint-config

npm i https://pkg.pr.new/@anolilab/textlint-config@1265

commit: 4192144