chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@changesets/cli (source)	2.30.0 → 2.31.0
@swc/core (source)	1.15.26 → 1.15.40
@types/react (source)	19.2.14 → 19.2.15
@typescript-eslint/eslint-plugin (source)	8.58.2 → 8.60.0
@typescript-eslint/parser (source)	8.58.2 → 8.60.0
eslint (source)	10.2.0 → 10.4.1
eslint-plugin-prettier	5.5.5 → 5.5.6
globals	17.5.0 → 17.6.0
jest (source)	30.3.0 → 30.4.2
jest-docblock (source)	30.2.0 → 30.4.0
jest-environment-jsdom (source)	30.3.0 → 30.4.1
pnpm (source)	10.33.0 → 10.34.1
prettier (source)	3.8.2 → 3.8.3
react (source)	19.2.5 → 19.2.6
react-dom (source)	19.2.5 → 19.2.6
react-test-renderer (source)	19.2.5 → 19.2.6
ts-jest (source)	29.4.9 → 29.4.11
typescript-eslint (source)	8.58.2 → 8.60.0

---

Release Notes

changesets/changesets (@​changesets/cli)

v2.31.0

Compare Source

Minor Changes

• #​1889 96ca062 Thanks @​mixelburg! - Error on unsupported flags for individual CLI commands and print the matching command usage to make mistakes easier to spot.

• #​1873 42943b7 Thanks @​mixelburg! - Respond to --help on all subcommands. Previously, --help was only handled when it was the sole argument; passing it alongside a subcommand (e.g. changeset version --help) would silently execute the command instead. Now --help always exits early and prints per-command usage when a known subcommand is provided, or the general help text otherwise.

Patch Changes

• d2121dc Thanks @​Andarist! - Fix npm auth for path-based registries during publish by preserving configured registry URLs instead of normalizing them.

• #​1888 036fdd4 Thanks @​mixelburg! - Fix several changeset version issues with workspace protocol dependencies. Valid explicit workspace: ranges and aliases are no longer rewritten unnecessarily, and workspace path references are handled correctly during versioning.

• #​1903 5c4731f Thanks @​Andarist! - Gracefully handle stale npm info data leading to duplicate publish attempts.

• #​1867 f61e716 Thanks @​Andarist! - Improved detection for published state of prerelease-only packages without latest dist-tag on GitHub Packages registry.

• Updated dependencies [036fdd4, 036fdd4, 036fdd4]:

  • @​changesets/assemble-release-plan@​6.0.10
  • @​changesets/get-dependents-graph@​2.1.4
  • @​changesets/apply-release-plan@​7.1.1
  • @​changesets/get-release-plan@​4.0.16
  • @​changesets/config@​3.1.4

swc-project/swc (@​swc/core)

v1.15.40

Compare Source

Bug Fixes

• (es/minifier) Preserve args for destructured callbacks (#​11830) (21873b0)

• (es/minifier) Avoid generating mangled property names that collide with existing properties (#​11839) (9b4fab5)

• (es/minifier) Respect ecma for iife temp vars (#​11873) (e481934)

• (es/minifier) Preserve default parameter object props (#​11884) (71ff84f)

• (es/parser) Reject object-rest assignment to array/object literal (#​11875) (7b57d1f)

• (es/parser) Reject object rest assignment to literals (#​11881) (4ec2eaf)

• (es/react) Exclude self-recursive hooks from refresh dependency array (#​11838) (9101c71)

• (ts/fast-dts) Strip definite assertions in dts (#​11858) (2ab1b8a)

• (ts/fast-strip) Reject unsafe assertion erasure in binary expressions (#​11828) (aa5b539)

• (typescript) Strip parameter binding defaults in dts (#​11857) (800bc17)

Documentation

• Update agent guidance (#​11842) (bf2d015)

• Add security policy (#​11876) (6c43c2d)

• Clarify security scope for npm packages (#​11877) (4662db8)

• Clarify untrusted input security model (#​11882) (5463777)

Features

• (es/minifier) Fine grained effect analysis of class (#​11814) (c9058ad)

• (swc_cli) Implement all features for swc_cli (#​11797) (9300ede)

Miscellaneous Tasks

• (es/minifier) Fix typo in debug log (#​11866) (3de0254)

• (html) Add webcontainer fallback for @swc/html (#​11860) (7692eed)

Performance

• (ecma) Reduce transformer compat overhead (#​11856) (d03cb71)

• (es/codegen) Speed up JsWriter position and srcmap tracking (#​11867) (dbceade)

• (es/codegen) Remove JsWriter last_srcmap cache (#​11869) (3bc1c2b)

• (es/minifier) Reduce minifier profiling hotspots (#​11853) (28c1091)

• Optimize es parser comment finalization (#​11852) (2959ddf)

Testing

• (es/minifier) Move issue_11835 fixture out of terser folder (#​11840) (3dd3431)

Ci

• Update corepack in publish docker jobs (#​11885) (9a7d954)

• Pass publish docker env explicitly (#​11888) (c5f7547)

• Lock issues closed by merged prs (#​11887) (6bd74e5)

• Provide aarch64 musl linker in publish job (#​11889) (20234fd)

• Fix publish musl linker and windows tests (#​11890) (a798a23)

• Make minifier test path explicit (#​11891) (e7cba97)

Security

• Save CI caches only on main (#​11848) (7582529)

• Update rkyv and Rust dependencies (#​11851) (20d92eb)

• Harden PR workflow permissions (#​11849) (e199564)

v1.15.33

Compare Source

Bug Fixes

• (ci) Update rand lockfile entries (#​11827) (7988966)

• (es/minifier) Fold unary bool nullish coalescing (#​11826) (e39ae3d)

• (es/minifier) Preserve for-init sequence order (#​11837) (16a56d0)

• (es/parser) Parse empty Flow exact object type (#​11836) (3d18a26)

Features

• Move swc ast explorer into workspace (#​11831) (02a8f81)

v1.15.32

Compare Source

Bug Fixes

• (es/flow) Fix Flow type-only modules in script transforms (#​11817) (be38316)

• (es/flow) Avoid restoring module context when flow syntax is enabled (#​11819) (3ed7243)

• (es/minifier) Preserve frozen spread registry keys (#​11825) (347181c)

• (es/parser) Align Flow generic arrow JSX disambiguation (#​11821) (28a7fad)

Features

• (es) Add jsc.preserveSymlinks to swc::Options (#​11813) (fe38342)

v1.15.30

Compare Source

Bug Fixes

• (deploy) Fix musl binding test workflow (#​11804) (c30a522)

• (deploy) Build package ts before Linux GNU binding tests (#​11806) (a3d3ef3)

• (es/jsx) Preserve quoted JSX attribute newlines (#​11796) (9fe56c8)

• (es/minifier) Support full ES version parsing in minify (#​11800) (af1f08f)

• (es/module) Add opt-in symlink-preserving resolver (#​11801) (6028240)

• (es/parser) Allow return type annotation on Flow constructors (#​11790) (d66b29c)

• (es/parser) Support Flow anonymous keyof indexers (#​11792) (452c4e5)

• (es/parser) Add Flow strip RN and RNW regression corpus (#​11799) (23a9109)

Documentation

• Require PR template for pull requests (#​11793) (3a1084a)

Features

• (es/minify) Support extracting comments (#​11798) (5986411)

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.60.0

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.4

Compare Source

🩹 Fixes

• eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#​12294)

❤️ Thank You

• Evyatar Daud @​StyleShit

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.2

Compare Source

🩹 Fixes

• eslint-plugin: [no-deprecated] object destructuring values should be treated as declarations (#​12292)
• eslint-plugin: [no-unsafe-type-assertion] handle crash on recursive template literal types (#​12150)

❤️ Thank You

• Dima Barabash
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.1

Compare Source

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] treat void as nullish in no-unnecessary-condition (#​12241)
• eslint-plugin: [no-unnecessary-type-arguments] handle instantiation expressions (#​12220)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive in logical assignment assertions (#​12278)
• eslint-plugin: [no-unnecessary-type-assertion] preserve phantom type arguments in generic inference (#​12269)
• eslint-plugin: [no-unnecessary-type-assertion] preserve index signatures in undefined unions (#​12257)
• eslint-plugin: [no-unnecessary-type-assertion] fix crash "TypeError: checker.getTypeArguments is not a function" (#​12246)

❤️ Thank You

• anasm266 @​anasm266
• Anshika Jain @​Anshikakalpana
• Ulrich Stark
• yugo innami @​nami8824

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.0

Compare Source

🚀 Features

• eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#​11789)

❤️ Thank You

• Ulrich Stark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.60.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.4

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.2

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

eslint/eslint (eslint)

v10.4.1

Compare Source

v10.4.0

Compare Source

v10.3.0

Compare Source

v10.2.1

Compare Source

prettier/eslint-plugin-prettier (eslint-plugin-prettier)

v5.5.6

Compare Source

Patch Changes

• #​791 b5c96a3 Thanks @​JounQin! - chore: bump all (dev)Dependencies

sindresorhus/globals (globals)

v17.6.0

Compare Source

jestjs/jest (jest)

v30.4.2

Compare Source

Fixes

• [jest-runtime] Fix named imports from CJS modules whose module.exports is a function with own-property exports (#​16150)

v30.4.1

Compare Source

Features

• [jest-config, jest-core, jest-runner, jest-schemas, jest-types] Allow custom runner configuration options via tuple format ['runner-path', {options}] (#​16141)

Fixes

• [jest-runtime] Align CJS-from-ESM default export with Node: module.exports is always the ESM default, __esModule unwrapping is no longer applied (#​16143)

v30.4.0

Compare Source

Features

• [babel-jest] Support collecting coverage from .mts, .cts (and other) files (#​15994)
• [jest-circus, jest-cli, jest-config, jest-core, jest-jasmine2, jest-types] Add --collect-tests flag to discover and list tests without executing them (#​16006)
• [jest-config, jest-runner, jest-worker] Add workerGracefulExitTimeout config option to control how long workers are given to exit before being force-killed (#​15984)
• [jest-config] Add support for jest.config.mts as a valid configuration file (#​16005)
• [jest-config, jest-core, jest-reporters, jest-runner] verbose and silent can now be set per-project; the project-level value overrides the global value for that project's tests (#​16133)
• [@jest/fake-timers] Accept Temporal.Duration in jest.advanceTimersByTime() and jest.advanceTimersByTimeAsync() (#​16128)
• [@jest/fake-timers] Accept Temporal.Instant and Temporal.ZonedDateTime in jest.setSystemTime() and useFakeTimers({now}) (#​16128)
• [@jest/fake-timers] Support faking Temporal.Now.* (#​16131)
• [jest-mock] Add clearMocksOnScope(scope) on ModuleMocker for clearing every mock function exposed on a scope object (#​16088)
• [jest-resolve] Add canResolveSync() on Resolver so callers can detect when a user-configured resolver only exports an async hook (#​16064)
• [jest-runtime] Use synchronous evaluate() for ES modules without top-level await on Node versions that support it (v24.9+), and prefer the synchronous transform path when a sync transformer is configured (#​16062)
• [jest-runtime] Support require() of ES modules on Node v24.9+ (#​16074)
• [jest-runtime] Validate TC39 import attributes (with { type: 'json' }) on ESM imports (#​16127)
• [@jest/transform] Add canTransformSync(filename) on ScriptTransformer so callers can pick the sync vs async transform path (#​16062)
• [jest-util] Add isError helper (#​16076)
• [pretty-format] Support React 19 (#​16123)

Fixes

• [expect-utils] Fix toStrictEqual failing on structuredClone results due to cross-realm constructor mismatch (#​15959)
• [@jest/expect-utils] Prevent toMatchObject/subset matching from throwing when encountering exotic iterables (#​15952)
• [fake-timers] Convert Date to milliseconds before passing to @sinonjs/fake-timers (#​16029)
• [jest] Export GlobalConfig and ProjectConfig TypeScript types (#​16132)
• [jest-circus] Prevent crash when asyncError is undefined for non-Error throws (#​16003)
• [jest-circus, jest-jasmine2] Include Error.cause in JSON failureMessages output (#​15967)
• [jest-config] Fix preset path resolution on Windows when the preset uses subpath exports (#​15961)
• [jest-config] Allow collectCoverage and coverageProvider in project config without a validation warning (#​16132)
• [jest-config] Project config validator now emits "is not supported in an individual project configuration" instead of "probably a typing mistake" for known global-only options (#​16132)
• [jest-environment-node] Fix --localstorage-file warning on Node 25+ (#​16086)
• [jest-reporters] Apply global coverage threshold to unmatched pattern files in addition to glob/path thresholds (#​16137)
• [jest-reporters, jest-runner, jest-runtime, jest-transform] Fix coverage report not showing correct code coverage when using projects config option (#​16140)
• [jest-runtime] Resolve expect and @jest/expect from the internal module registry so test-file imports share the same JestAssertionError as the global expect (#​16130)
• [jest-runtime] Improve CJS-from-ESM interop: __esModule/Babel default unwrap, broader named-export coverage, and shared CJS singleton across importers (#​16050)
• [jest-runtime] Load .js files with ESM syntax but no "type":"module" marker as native ESM (#​16050)
• [jest-runtime] Extend the .js-with-ESM-syntax fallback to require() on Node v24.9+ - falls back to require(esm) when the CJS parser rejects ESM syntax (#​16078)
• [jest-runtime] Fix deadlocks and double-evaluation in concurrent ESM and wasm imports (#​16050)
• [jest-runtime] Fix error when require() is called after the Jest environment has been torn down (#​15951)
• [jest-runtime] Fix missing error when import() is called after the Jest environment has been torn down (#​16080)
• [jest-runtime] Fix virtual unstable_mockModule registrations not respected in ESM (#​16081)
• [jest-runtime] Apply moduleNameMapper when resolving modules with require.resolve() and the paths option (#​16135)

Chore & Maintenance

• [@jest/fake-timers] Upgrade @sinonjs/fake-timers (#​16139)
• [jest-runtime] Use synchronous linkRequests / instantiate for ESM linking on Node v24.9+ (#​16063)

pnpm/pnpm (pnpm)

v10.34.1: pnpm 10.34.1

Compare Source

Patch Changes

• Reject pnpm-lock.yaml entries whose remote tarball resolution: block is missing the integrity field. Previously the worker that extracts a downloaded tarball skipped hash verification when no integrity was supplied and minted a fresh one from the unverified bytes, so an attacker who could both alter the lockfile (e.g. via a pull request that strips integrity:) and serve modified content at the referenced tarball URL could install a tampered package without any error — including under --frozen-lockfile. pnpm now fails closed at lockfile-read time with ERR_PNPM_MISSING_TARBALL_INTEGRITY. Git-hosted tarballs (gitHosted: true or a URL on codeload.github.com / bitbucket.org / gitlab.com) and file: tarballs are exempt — the commit SHA in a git-host URL and the user-controlled local path already anchor the bytes.

Platinum Sponsors

Gold Sponsors

v10.34.0

Compare Source

v10.33.4: pnpm 10.33.4

Compare Source

Patch Changes

• Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

  A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.

• Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #​11341.

Platinum Sponsors

Gold Sponsors

v10.33.3

Compare Source

[v10.33.2

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.