[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@anolilab/multi-semantic-release (source)	4.4.24 → 4.4.25
@anolilab/prettier-config (source)	10.0.3 → 10.0.4
@eslint-react/eslint-plugin (source)	5.28.2 → 5.28.8
@​vitest/eslint-plugin	1.6.27 → 1.6.28
browserslist@<=4.28.6	>=4.29.3 → >=4.29.4
caniuse-lite	1.0.30001817 → 1.0.30001819
execa	^10.2.0 → ^10.2.1
fast-uri@>=3.0.0 <3.1.3	[^4.2.2 → ^4.2.3](https://renovatebot.com/diffs/npm/fast-uri@>=3.0.0 <3.1.3/4.2.2/4.2.3)
fast-uri@>=4.0.0 <4.1.5	[^4.2.2 → ^4.2.3](https://renovatebot.com/diffs/npm/fast-uri@>=4.0.0 <4.1.5/4.2.2/4.2.3)
oxlint-tsgolint	7.0.2004 → 7.0.2005
undici@<8.10.2 (source)	>=8.12.2 → >=8.12.3

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

anolilab/semantic-release (@​anolilab/multi-semantic-release)

v4.4.25

Compare Source

Dependencies

• @​anolilab/semantic-release-pnpm: upgraded to 8.1.34
• execa: ^10.1.0 → ^10.1.1

anolilab/javascript-style-guide (@​anolilab/prettier-config)

v10.0.4

Compare Source

Dependencies

• prettier: 3.9.6 → 3.9.10

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.28.8

Compare Source

🐞 Fixes

• react-x/purity: builtin member resolution no longer follows computed or unknown middle segments (ex: window[fetch], window.myLibrary.fetch), preventing false reports of non-builtin calls. (#​2074)

🏗️ Internal

• @eslint-react/eslint: added dual-purpose getText for direct or callback-style source text extraction, replacing repeated context.sourceCode.getText wrappers across packages. (#​2073)

Full Changelog: Rel1cx/eslint-react@v5.28.7...v5.28.8

v5.28.7

Compare Source

🐞 Fixes

• react-x/purity: now reports Date calls during render, including Date(), Date(arg), and window.Date(); unlike new Date(arg), Date(arg) ignores its arguments and always returns the current time. (#​2071) Thanks to @​aki05162525!

🏗️ Internal

• Bumped effect and @effect/platform-node to 4.0.6, @tanstack/react-router to 1.170.46, @tanstack/react-start to 1.169.4, and eslint-plugin-de-morgan to 2.3.0.

New Contributors

• TAKAGI AKIHIRO (@​aki05162525) made their first contribution in #​2071.

Full Changelog: Rel1cx/eslint-react@v5.28.6...v5.28.7

v5.28.6

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: the ref-derived parameter exemption now also applies to helpers wrapped in useCallback (ex: measure(ref.current) where measure = useCallback((el) => { setWidth(el.offsetWidth); }, [])). (#​2065) Thanks to @​amhunt!
• react-x/set-state-in-effect: a helper call behind a ref-derived guard (if, ternary, short-circuit, or early return) now exempts the setState calls it reaches, as a setState written in its place would be (ex: if (!anchorRef.current) return; commitPosition(0, true);); call sites are judged individually. (#​2065) Thanks to @​amhunt!

New Contributors

• Andrew Hunt (@​amhunt) made their first contribution in #​2065.

Full Changelog: Rel1cx/eslint-react@v5.28.5...v5.28.6

v5.28.5

Compare Source

✨ New

• react-dom/no-unsafe-target-blank: the suggested fix now adds rel="noreferrer" instead of rel="noreferrer noopener", since noreferrer already implies noopener per the HTML spec; values combining both tokens remain valid. (#​2068)

🏗️ Internal

• Removed redundant transitive dependency overrides. (#​2064)
• Bumped vite to 8.3.5 and lucide-react to 1.61.0.

Full Changelog: Rel1cx/eslint-react@v5.28.4...v5.28.5

v5.28.4

Compare Source

🐞 Fixes

• Reverted the component-scope-bounded identifier resolution introduced in v5.28.3, including the per-component single-report attribution; class declarations in a component body remain recognized as per-render constructions. (#​2062)

  Affected rules:

  • react-x/no-unstable-context-value
  • react-x/no-unstable-default-props

📝 Documentation

• Updated the AST Explorer links across the website docs and recipes.

🏗️ Internal

• @eslint-react/var: removed the boundary option from resolve and resolveObjectType, and the ClassDeclaration resolution in resolveObjectType, following the revert. (#​2062)
• Renamed the Jsx-prefixed @eslint-react/core exports to all-caps JSX (ex: JsxConfig → JSXConfig, isJsxLike → isJSXLike). (#​2061)
• Bumped fumadocs-mdx to 15.4.9.

Full Changelog: Rel1cx/eslint-react@v5.28.3...v5.28.4

v5.28.3

Compare Source

✨ New

• Identifier resolution is now bounded by the enclosing component scope, so render-scoped values referenced from nested callbacks (ex: items.map((item) => <Context.Provider value={foo}>)) are now detected, values declared outside the component (ex: module-level constants) are treated as stable, and nested components report each value only once, attributed to the innermost component. (#​2060)

  Affected rules:

  • react-x/no-unstable-context-value
  • react-x/no-unstable-default-props

• Class declarations (ex: class Foo {} in a component body) are now recognized as per-render constructions, so using one as a context value or default prop is now reported. (#​2060)

  Affected rules:

  • react-x/no-unstable-context-value
  • react-x/no-unstable-default-props

🏗️ Internal

• @eslint-react/var: resolve and resolveObjectType now accept a boundary option that bounds scope-chain traversal to an enclosing component or hook; resolveObjectType also resolves ClassDeclaration nodes. (#​2060)
• Bumped typescript-eslint to 8.72.0, fumadocs-core and fumadocs-ui to 16.17.7, fumadocs-mdx to 15.4.8, lucide-react to 1.60.0, and typedoc-plugin-markdown to 4.14.1.

Full Changelog: Rel1cx/eslint-react@v5.28.2...v5.28.3

browserslist/browserslist (browserslist@<=4.28.6)

v4.29.4

Compare Source

• Fixed joined version bounds in version ray and range queries (by @​ybai08).
• Fixed whitespaces processing (by @​abhu85).

browserslist/caniuse-lite (caniuse-lite)

v1.0.30001819

Compare Source

v1.0.30001818

Compare Source

sindresorhus/execa (execa)

v10.2.1

Compare Source

• Fix types compatibility with exactOptionalPropertyTypes 2b6988b

---

fastify/fast-uri (fast-uri@>=3.0.0 <3.1.3)

v4.2.3

Compare Source

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@4.2.3

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: allow prerelease bump types in the release workflow by @​mcollina in #​230

Full Changelog: fastify/fast-uri@v4.2.2...v4.2.3

nodejs/undici (undici@<8.10.2)

v8.12.3

Compare Source

What's Changed

• ci: use Python 3.14 for the WPT server on macOS by @​mrityunjay-pandey in #​6029
• build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @​dependabot[bot] in #​6006
• build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @​dependabot[bot] in #​5967
• docs: document the options of interceptors.cache() by @​qodelicious in #​6050
• fix(h2): replace a connection that stops responding after a stream timeout by @​mcollina in #​6052
• fix(pool): keep caller async context for queued requests by @​mcollina in #​5982

New Contributors

• @​qodelicious made their first contribution in #​6050

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: cee94f2b-573c-4ed0-95df-bf297f9eafe8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thank you for following the naming conventions! 🙏

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	caniuse-lite@​1.0.30001817 ⏵ 1.0.30001819			+1	+1
	execa@​10.2.1
	oxlint-tsgolint@​7.0.2004 ⏵ 7.0.2005				+1
	@​eslint-react/​eslint-plugin@​5.28.8
	@​vitest/​eslint-plugin@​1.6.28

View full report