chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #406 · TanStack/config

renovate · 2026-07-27T01:50:58Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@tanstack/query-core (source)	`^5.101.2` → `^5.104.1`	pnpm.catalog.default	minor
@types/react (source)	`^19.2.17` → `^19.3.0`	pnpm.catalog.default	minor
@types/react-dom (source)	`^19.2.3` → `^19.3.0`	pnpm.catalog.default	minor
@types/semver (source)	`^7.7.1` → `^7.8.0`	pnpm.catalog.default	minor
@vitejs/plugin-react (source)	`^6.0.3` → `^6.1.1`	pnpm.catalog.default	minor	`6.1.2`
@vitejs/plugin-vue (source)	`^6.0.7` → `^6.0.9`	pnpm.catalog.default	patch
@vue/language-core (source)	`^3.1.5` → `^3.3.12`	pnpm.catalog.default	patch
actions/checkout	`v7.0.0` → `v7.0.1`	action	patch
danielroe/provenance-action	`v0.1.1` → `v0.2.0`	action	minor
eslint (source)	`^10.7.0` → `^10.12.0`	pnpm.catalog.default	minor
globals	`^17.7.0` → `^17.13.0`	pnpm.catalog.default	minor
markdown-link-extractor	`^4.0.3` → `^4.0.4`	pnpm.catalog.default	patch
nx (source)	`23.0.2` → `23.2.1`	pnpm.catalog.default	minor
pnpm (source)	`12.4.2` → `12.9.0`	packageManager	minor	`12.9.1`
pnpm (source)	`>=12.4.2` → `>=12.9.0`	engines	minor	`12.9.1`
prettier (source)	`^3.9.5` → `^3.9.9`	pnpm.catalog.default	patch
publint (source)	`^0.3.21` → `^0.3.25`	pnpm.catalog.default	patch
react (source)	`^19.2.7` → `^19.3.0`	pnpm.catalog.default	minor
react-dom (source)	`^19.2.7` → `^19.3.0`	pnpm.catalog.default	minor
tsdown (source)	`^0.22.4` → `^0.23.0`	pnpm.catalog.default	minor
type-fest	`^5.8.0` → `^5.10.0`	pnpm.catalog.default	minor
typescript-eslint (source)	`^8.63.0` → `^8.71.0`	pnpm.catalog.default	minor	`8.71.1`
vite (source)	`^8.1.4` → `^8.3.2`	pnpm.catalog.default	minor	`8.3.3`
vitest (source)	`^4.1.10` → `^4.1.11`	pnpm.catalog.default	patch
voidzero-dev/setup-vp	`v1.15.0` → `v1.21.1`	action	minor
vue (source)	`^3.5.39` → `^3.5.43`	pnpm.catalog.default	patch
zizmorcore/zizmor-action	`v0.5.7` → `v0.6.4`	action	minor

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

TanStack/query (@tanstack/query-core)

`v5.104.1`

Compare Source

No changes in this release.

`v5.104.0`

Compare Source

Minor Changes

#11650 5279b05 - Build projects with Vite 8

`v5.103.3`

Compare Source

No changes in this release.

`v5.103.2`

Compare Source

Patch Changes

#11524 8a28904 - Ignore removal requests for query instances that are no longer stored in the cache.

`v5.103.1`

Compare Source

Patch Changes

#11512 8330b2f - Handle plain objects with an own constructor data property during structural sharing and query-key hashing.
#11510 3212966 - Preserve null values returned by custom streamedQuery reducers instead of replacing them with initialValue.

`v5.103.0`

Compare Source

Minor Changes

#11438 e57f816 - Export the FocusManager, OnlineManager, and TimeoutManager types so their methods appear in the generated reference docs.

Patch Changes

#11332 fdae2ce - Reuse the shared query option resolver for refetch intervals to reduce bundle size.
#11436 a1119e5 - ref(hydration): remove outdated dehydratedAt fallback
#11502 cbf77bf - Prevent longer partial query-key filters with trailing undefined values from matching shorter query keys.

Patch Changes

#11302 578e5c2 - Reduce the Query Core bundle size by removing unused symbol descriptions and
simplifying internal helpers.

`v5.102.4`

Compare Source

Patch Changes

#11293 a05df6a - Avoid scheduling stale timeouts for disabled query observers.

`v5.102.3`

Compare Source

`v5.102.2`

Compare Source

Patch Changes

#11263 80fbf73 - Export MutationCacheConfig and QueryCacheConfig.

`v5.102.1`

Compare Source

Patch Changes

#11260 134890d - Type hydration input as a partial dehydrated state so omitted mutation and query collections are supported.

`v5.102.0`

Compare Source

Minor Changes

#10658 c6fc17c - add query and infiniteQuery methods, deprecate old imperative methods

Patch Changes

#11161 34f7cee - fix(query-core): clear a stale select error when the observer switches to a query without data, and reset isPlaceholderData on select-error results to match the declared result types, so a previous query's select error no longer leaks into the new result
#11253 b4368c4 - Improve hydration performance by skipping no-op data transforms and default error-redaction callbacks.
Export dehydrateQuery.
#11214 5bb089d - Reduce observer churn overhead by removing observers in place instead of copying the observer list for every unsubscribe.
#11011 ba4650c - fix(query-core): reset isPlaceholderData when select throws on placeholder data
#11224 294d4e6 - Fix queryOptions and infiniteQueryOptions return types so exported inferred options can be emitted in declaration files without leaking internal data tag symbols.
#11225 1f631b3 - Skip unused result tracking when notifying useQueries listeners without a combine function.
#11215 01a02bf - Avoid repeatedly synchronizing the same tracked property across all observers in useQueries.
#11172 18c1c1e - Reattach MutationObserver to its current mutation when a listener subscribes again, so a useMutation result no longer stays pending after React tears down and re-establishes the subscription mid-mutation.
#11128 5448063 - Ignore a retained pendingThenable settlement callback invoked after the thenable has settled. Holding a reference to resolve/reject and calling it later used to overwrite status and reason even though the underlying promise had already settled, leaving the thenable advertising a state that disagreed with its value.
#8737 2215bb0 - fix: make mutation variables optional when undefined extends TVariables
#11221 1ef4208 - Remove experimental render-time prefetching and the promise property from query results.
#11218 5981771 - Release a mutation's retryer once its execution settles, so the settled promise no longer keeps that mutation's result, variables and context in memory for as long as the mutation cache retains it.
#11163 4a9bef6 - Release a query's retryer once its fetch settles, so the settled promise no longer keeps that fetch's raw result in memory alongside the structurally shared state.data (or after the query is reset or removed).
#11036 bef4bc7 - Resolve suspense when query data is set programmatically via setQueryData or streamedQuery. Previously, fetchOptimistic returned only the fetch promise, which left the Suspense boundary stuck until the queryFn completed — even when data already existed in the cache. The fix uses Promise.race with a cache subscriber to release suspense as soon as data becomes available.
#11234 9656dc4 - Notify every query observer when another observer unsubscribes synchronously during the same query update.
#11211 326aaf1 - fix: resetQueries now preserves the queries matched before query.reset() changes their state.
#11065 3e83601 - Memoize falsy combine results when the function and query results are unchanged.

`v5.101.4`

Compare Source

`v5.101.3`

Compare Source

Patch Changes

#11084 7e3c822 - Improve partialMatchKey performance in query-core.

vitejs/vite-plugin-react (@vitejs/plugin-react)

`v6.1.1`

Compare Source

Add `compiler.logDiagnostics` option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when `builder.sharedPlugins` is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

`v6.1.0`

Compare Source

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'

export default defineConfig({
  plugins: [
     react({ compiler: true })
  ]
})

`v6.0.5`

Compare Source

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

`v6.0.4`

Compare Source

Fixed `$RefreshSig$ is not defined` error when running `vite dev` with `NODE_ENV=production`

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined.
This error is now fixed.

vitejs/vite-plugin-vue (@vitejs/plugin-vue)

`v6.0.9`

Bug Fixes

deps: update all non-major dependencies (#812) (b2b559d)
plugin-vue: initialize compiler correctly (#475) (127b03f)
plugin-vue: transpile TS in templates with empty script block (#838) (189148e)

Miscellaneous Chores

deps: update dependency obug to v3 (#846) (3180192)

`v6.0.8`

Features

plugin-vue: add forced vapor mode option (#766) (d59c3c0)

Bug Fixes

deps: update all non-major dependencies (#781) (d369e5a)

vuejs/language-tools (@vue/language-core)

`v3.3.12`

Compare Source

language-core

security: improved handling of untrusted Vue files (cea0698)
feat: infer first parameter type of default factory for defineModel (1be73b8)
feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)
fix: keep union props when using withDefaults (084f30f)
fix: keep inference-only props string single-line with block comments (55ca36f)
fix: support calling template bindings without .value (7ad4a94)
fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)
fix: pad directive hook signatures to check short-arity directive bindings (94052b8)
fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)
fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)
fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)
fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)
perf: precompile attribute glob matchers (7d2e603)

component-meta

fix: stop checking JS Vue files as TS (045a6a7)

typescript-plugin

fix: don't abort reference span fix-up at style-less files (e46126c)

tsc

fix: prevent watch mode crash on incremental build (a59da36)

vscode

perf: reduce focus mode overhead (b0936d1)

Contributors: @johnsoncodehk, @serkodev, @KazariEX, @00200200, @camonunez, @Cherry, @hungateJoseph, @uturnr, @ValentinYoushkevich, @xia-chao

`v3.3.11`

Compare Source

language-core

fix: generate full fragment props for type checking (fd6dada)

language-service

fix: invalidate tag and prop casing detection after template changes (879ee9a)

component-meta

fix: invalidate module resolution caches when deleting files (8359c44)

tsc

fix: make extension retry errors serializable across IPC (05ab009)

vscode

feat: make the welcome page configurable (3134351) (317ab6a)

Contributors: @serkodev, @pierreedbrg

`v3.3.10`

Compare Source

language-core

fix: ignore trailing whitespace after generic parameter commas (6e3aea9)
fix: resolve v-for item type over generic sources (8e78c5d)
fix: do not extract SFC blocks across inline Markdown code (055b9c7)

language-service

fix: serialize template data provider access across concurrent requests (2808dbe)

typescript-plugin

fix: resolve requests against the owning project (10c9168)

tsc

fix: support different extension sets across project references (cb65247)

vscode

feat: patch typescript.js via --require to support read-only file systems (0c47258)
fix: isolate custom TypeScript plugin paths between profiles (47216a9)
fix: update output file name for production (5616255)

Contributors: @serkodev, @KazariEX, @lazerg

`v3.3.9`

Compare Source

language-core

feat: check unused generic type parameters (9d08c43)

language-service

fix: preserve trailing and current directive modifiers when completing inside a directive, and when filtering duplicates (3e362fb) (d8afe9e) (f4e584b)

component-meta

feat: expose runtime values of enum members in schema (00ce7ec)
fix: keep getProgramAndFile free of side effects (c99eb00)

workspace

feat: migrate build and tests to typescript-native-bridge (c4e58ea)

Contributors: @KazariEX, @johnsoncodehk, @lazerg, @seanogdev, @valentinpalkovic

`v3.3.8`

Compare Source

language-core

feat: support vapor directives (6a5334c)
refactor: pass end offsets to Boundary.start and drop the unmapped string literal key generation branch (894a2aa) (4e343d4)

workspace

chore: upgrade to TypeScript 7 and support @typescript/typescript6 (1ef7ecb)

Contributors: @KazariEX, @liangmiQwQ, @WaldemarEnns

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Skip running unsafe pr check if input is default by @aiqiaoy in #2518
Trim only ascii whitespace for branch by @aiqiaoy in #2521
Escape values passed to --unset by @aiqiaoy in #2530
Various dependency updates

danielroe/provenance-action (danielroe/provenance-action)

`v0.2.0`

Compare Source

compare changes

🚀 Enhancements

Respect pnpm's trustPolicyExclude (2f0f52d)
Detect loss of npm staged publishing approval (fc86c9a)

📖 Documentation

Update action description (e78b179)
Add link to pnpm v10.21 trustPolicy 🎉 (fd8dd3c)

🏡 Chore

Add licence (cafd196)
Revert pnpm trust policy and restore provenance action (4320fb9)
Release v0.0.2 (194cad5)
Migrate to pnpm v11 (#99)

✅ Tests

Improve coverage of lockfile parsing utils (a9d6553)
Migrate to vitest (07fa732)
Add api responses as fixtures + test provenance utils (fd6ed30)

🤖 CI

Pin github actions to full-length commit shas (9426311)
Add agent-scan workflow to flag bot-authored PRs (81568f7)

❤️ Contributors

Daniel Roe (@danielroe)

eslint/eslint (eslint)

`v10.12.0`

Compare Source

Features

4618052 feat: handle astral letters in new-cap (#21357) (sary)
4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

67eb586 docs: Update README (GitHub Actions Bot)
5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
8816c1d docs: Update README (GitHub Actions Bot)
3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

`v10.11.0`

Compare Source

Features

d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
6c789ff docs: Update README (GitHub Actions Bot)
5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

`v10.10.0`

Compare Source

Features

264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
5661fa6 feat: no-extra-bind false negatives with class fields and static blocks ([#21260](https://redirect.github.com/eslint/eslint/issues/21

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-07-27T01:51:13Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 8e8ec87d-41d0-4732-b1a8-a219f7204cac

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

📝 Walkthrough

Walkthrough

The pull request updates pinned GitHub Actions commits, raises the required pnpm version, and updates selected workspace catalog versions for development tools and runtime packages.

Changes

Dependency updates

Layer / File(s)	Summary
Workflow action pin updates `.github/workflows/*.yml`	Checkout references are updated to v7.0.1; provenance-action and zizmor-action pins are also raised.
Package manager and catalog versions `package.json`, `pnpm-workspace.yaml`	The required pnpm version is raised to 11.17.0, and selected catalog entries are updated.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

TanStack/router-security#75 — Tracks overlapping pinned actions/checkout updates.
TanStack/workflow#11 — Tracks overlapping GitHub Actions and package dependency updates.
TanStack/pacer#76 — Tracks related repository dependency and workflow pin updates.
TanStack/state#1 — Tracks the pnpm, workflow, and catalog dependency updates.
TanStack/template#3 — Tracks overlapping checkout, pnpm, and catalog updates.
TanStack/persist#3 — Tracks the listed Renovate dependency updates.

Suggested reviewers: lachlancollins

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description lists the dependency updates but omits the required Changes, Checklist, and Release Impact sections from the repository template.	Add the required template sections and state whether tests were run, whether a changeset is needed, and whether the changes are release-impacting.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the pull request as an update to non-major dependencies and matches the dependency and GitHub Actions changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/all-minor-patch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-07-27T01:51:21Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
nx@23.0.2 ⏵ 23.2.1	⁺⁹	⁺²³
@types/semver@7.7.1 ⏵ 7.8.0			⁺¹	⁺³
typescript-eslint@8.63.0 ⏵ 8.71.0			⁺¹
@types/react-dom@19.2.3 ⏵ 19.3.0	⁺¹		⁺¹
@tanstack/query-core@5.101.2 ⏵ 5.104.1	^-1		⁺¹
@types/react@19.2.17 ⏵ 19.3.0	⁺¹		⁺¹
vitest@4.1.10 ⏵ 4.1.11	⁺¹	⁺²	⁺¹
publint@0.3.21 ⏵ 0.3.25			⁺¹	⁺⁴
vite@8.1.4 ⏵ 8.3.2	⁺¹		⁺¹
markdown-link-extractor@4.0.3 ⏵ 4.0.4
react@19.2.7 ⏵ 19.3.0	⁺¹		⁺¹
globals@17.7.0 ⏵ 17.13.0			⁺¹	^-1
tsdown@0.22.5 ⏵ 0.23.0			⁺¹
@vitejs/plugin-vue@6.0.7 ⏵ 6.0.9	⁺¹		⁺¹	^-1
@vitejs/plugin-react@6.0.3 ⏵ 6.1.1			⁺¹
type-fest@5.8.0 ⏵ 5.10.0	⁺¹		⁺¹
vue@3.5.39 ⏵ 3.5.43			⁺¹
react-dom@19.2.7 ⏵ 19.3.0			⁺¹
@vue/language-core@3.3.7 ⏵ 3.3.12	⁺¹			^-1
eslint@10.7.0 ⏵ 10.12.0	⁺¹
prettier@3.9.5 ⏵ 3.9.9			⁺¹

View full report

socket-security · 2026-07-27T01:51:23Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	High CVE: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF CVE: GHSA-r4gj-5m52-g5wh Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF (HIGH) Affected versions: >= 1.17.0 < 1.20.0 Patched version: 1.20.0 From: pnpm-lock.yaml → `npm/nx@23.2.1` → `npm/axios@1.18.1` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.18.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

nx-cloud · 2026-07-27T01:51:34Z

View your CI Pipeline Execution ↗ for commit 3576322

Command	Status	Duration	Result
`nx affected --targets=test:sherif,test:docs,tes...`	✅ Succeeded	11s	View ↗
`nx run-many --target=build`	✅ Succeeded	6s	View ↗

☁️ Nx Cloud last updated this comment at 2026-10-06 01:26:26 UTC

github-actions · 2026-07-27T01:51:38Z

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

pkg-pr-new · 2026-07-27T01:51:40Z

npm i https://pkg.pr.new/@tanstack/eslint-config@406

npm i https://pkg.pr.new/@tanstack/publish-config@406

npm i https://pkg.pr.new/@tanstack/typedoc-config@406

npm i https://pkg.pr.new/@tanstack/vite-config@406

commit: 3576322

changeset-bot · 2026-10-03T22:03:08Z

⚠️ No Changeset found

Latest commit: 3576322

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

renovate Bot added the dependencies Pull requests that update a dependency file label Jul 27, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from e6b6079 to a0232d5 Compare August 3, 2026 16:41

renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 35fea62 to 0e1c482 Compare August 9, 2026 00:56

renovate Bot requested a review from a team as a code owner August 9, 2026 00:56

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 33e9689 to c27f336 Compare August 10, 2026 22:49

renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 5f21cec to 5ed91df Compare September 3, 2026 22:35

renovate Bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from 005b194 to 74d741d Compare September 11, 2026 00:56

renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 7c44697 to 2557c32 Compare September 13, 2026 13:07

chore(deps): update all non-major dependencies

3576322

Navigation Menu

Repository navigation

chore(deps): update all non-major dependencies - #406

chore(deps): update all non-major dependencies#406
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

socket-security Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

nx-cloud Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Add compiler.logDiagnostics option

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#​1439)

Add experimental native React Compiler support (#​1419)

Fixed the react compiler preset filter to be linear (#​1353)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

Bug Fixes

Miscellaneous Chores

Features

Bug Fixes

language-core

component-meta

typescript-plugin

tsc

vscode

language-core

language-service

component-meta

tsc

vscode

language-core

language-service

typescript-plugin

tsc

vscode

language-core

language-service

component-meta

workspace

language-core

workspace

🚀 Enhancements

📖 Documentation

🏡 Chore

✅ Tests

🤖 CI

❤️ Contributors

Features

Bug Fixes

Documentation

Chores

Features

Bug Fixes

Documentation

Chores

Features

Configuration

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

socket-security Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nx-cloud Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

renovate Bot commented Jul 27, 2026 •

edited

Loading

Add `compiler.logDiagnostics` option

Respect environment sourcemap option for React Compiler transform when `builder.sharedPlugins` is enabled (#1439)

Add experimental native React Compiler support (#1419)

Fixed the react compiler preset filter to be linear (#1353)

Fixed `$RefreshSig$ is not defined` error when running `vite dev` with `NODE_ENV=production`

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

socket-security Bot commented Jul 27, 2026 •

edited

Loading

socket-security Bot commented Jul 27, 2026 •

edited

Loading

nx-cloud Bot commented Jul 27, 2026 •

edited

Loading

github-actions Bot commented Jul 27, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 27, 2026 •

edited

Loading

changeset-bot Bot commented Oct 3, 2026 •

edited

Loading