chore(deps): update all non-major dependencies#290
chore(deps): update all non-major dependencies#290renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
|
| Command | Status | Duration | Result |
|---|---|---|---|
nx affected --targets=test:eslint,test:sherif,t... |
❌ Failed | 2m 18s | View ↗ |
nx run-many --targets=build --exclude=examples/** |
✅ Succeeded | 36s | View ↗ |
☁️ Nx Cloud last updated this comment at 2026-03-26 09:39:50 UTC
More templates
@tanstack/devtools
@tanstack/devtools-a11y
@tanstack/devtools-client
@tanstack/devtools-ui
@tanstack/devtools-utils
@tanstack/devtools-vite
@tanstack/devtools-event-bus
@tanstack/devtools-event-client
@tanstack/preact-devtools
@tanstack/react-devtools
@tanstack/solid-devtools
@tanstack/vue-devtools
commit: |
8f5167e to
09c56be
Compare
e861232 to
4b90eb1
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughUpdated GitHub Actions workflows and bumped dependency/devDependency versions across root, packages, and example projects; no source code logic or exported API signatures were changed. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
examples/react/bundling-repro/package.json (1)
18-26: Consider pinning@tanstack/ai-*packages to specific versions.Using
"latest"for these AI packages means builds are non-reproducible and could break unexpectedly when new versions are published. While acceptable for a repro/debugging example, consider pinning to specific versions if this example is used for CI or regression testing.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@examples/react/bundling-repro/package.json` around lines 18 - 26, The package.json currently pins multiple `@tanstack/ai` packages to "latest" which makes builds unreproducible; replace the "latest" specifiers for "@tanstack/ai", "@tanstack/ai-anthropic", "@tanstack/ai-client", "@tanstack/ai-gemini", "@tanstack/ai-ollama", "@tanstack/ai-openai", "@tanstack/ai-react", "@tanstack/react-ai-devtools", and "@tanstack/react-devtools" with concrete version numbers (choose a specific semver like "^X.Y.Z" or an exact "X.Y.Z") to lock dependencies for CI/regression tests and update the lockfile accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@examples/react/bundling-repro/package.json`:
- Around line 18-26: The package.json currently pins multiple `@tanstack/ai`
packages to "latest" which makes builds unreproducible; replace the "latest"
specifiers for "@tanstack/ai", "@tanstack/ai-anthropic", "@tanstack/ai-client",
"@tanstack/ai-gemini", "@tanstack/ai-ollama", "@tanstack/ai-openai",
"@tanstack/ai-react", "@tanstack/react-ai-devtools", and
"@tanstack/react-devtools" with concrete version numbers (choose a specific
semver like "^X.Y.Z" or an exact "X.Y.Z") to lock dependencies for CI/regression
tests and update the lockfile accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: de66d22c-d3cb-4f54-a7b2-387035694052
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (26)
.github/workflows/autofix.yml.github/workflows/pr.yml.github/workflows/release.ymlexamples/preact/basic/package.jsonexamples/preact/custom-devtools/package.jsonexamples/react/basic/package.jsonexamples/react/bundling-repro/package.jsonexamples/react/custom-devtools/package.jsonexamples/react/drizzle/package.jsonexamples/react/https/package.jsonexamples/react/start/package.jsonexamples/react/time-travel/package.jsonexamples/solid/basic/package.jsonexamples/solid/devtools-ui/package.jsonexamples/solid/start/package.jsonexamples/vue/basic/package.jsonpackage.jsonpackages/devtools-ui/package.jsonpackages/devtools-utils/package.jsonpackages/devtools-vite/package.jsonpackages/devtools/package.jsonpackages/event-bus/package.jsonpackages/preact-devtools/package.jsonpackages/react-devtools/package.jsonpackages/solid-devtools/package.jsonpackages/vue-devtools/package.json
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Line 26: Replace mutable action references like uses: actions/checkout@v6.0.2
with the immutable commit SHA form (e.g., uses:
actions/checkout@<FULL_COMMIT_SHA>) while preserving the human-friendly tag as a
trailing comment (e.g., # v6.0.2) to maintain readability; update the checkout
usages in the release workflow (the uses: actions/checkout entries) and apply
the same SHA-pinning pattern to the checkout actions referenced in pr.yml (the
uses: actions/checkout entries on the other specified lines).
In `@package.json`:
- Around line 62-65: The `@tanstack` package upgrades introduce breaking changes:
update our build/docs configs accordingly by (1) in typedoc-related code/configs
(search for any Typedoc config files or usages that expect lower-cased output)
remove or adjust any post-processing that lower-cases Typedoc output and ensure
templates/consumers accept the new casing produced by `@tanstack/typedoc-config`
v0.3.3, and (2) in vite.config.ts (look for references to viteConfig or imports
from `@tanstack/vite-config`) migrate the old viteConfig usage to the new shape:
upgrade to Vite 8+ if not already and replace viteConfig options with
rolldownOptions and use the new native resolve.tsconfigPaths behavior (update
imports, option names, and any tsconfig path resolution code). Make these
changes where viteConfig and Typedoc config objects are defined so the project
builds and docs generate correctly with the new `@tanstack` versions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3e3729bd-9872-4d23-b9a5-164d848e5c26
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (26)
.github/workflows/autofix.yml.github/workflows/pr.yml.github/workflows/release.ymlexamples/preact/basic/package.jsonexamples/preact/custom-devtools/package.jsonexamples/react/basic/package.jsonexamples/react/bundling-repro/package.jsonexamples/react/custom-devtools/package.jsonexamples/react/drizzle/package.jsonexamples/react/https/package.jsonexamples/react/start/package.jsonexamples/react/time-travel/package.jsonexamples/solid/basic/package.jsonexamples/solid/devtools-ui/package.jsonexamples/solid/start/package.jsonexamples/vue/basic/package.jsonpackage.jsonpackages/devtools-ui/package.jsonpackages/devtools-utils/package.jsonpackages/devtools-vite/package.jsonpackages/devtools/package.jsonpackages/event-bus/package.jsonpackages/preact-devtools/package.jsonpackages/react-devtools/package.jsonpackages/solid-devtools/package.jsonpackages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (17)
- examples/react/time-travel/package.json
- packages/preact-devtools/package.json
- packages/devtools/package.json
- packages/devtools-ui/package.json
- packages/devtools-utils/package.json
- packages/react-devtools/package.json
- examples/solid/devtools-ui/package.json
- packages/solid-devtools/package.json
- .github/workflows/autofix.yml
- examples/solid/basic/package.json
- packages/vue-devtools/package.json
- examples/react/basic/package.json
- examples/vue/basic/package.json
- examples/preact/basic/package.json
- packages/devtools-vite/package.json
- examples/preact/custom-devtools/package.json
- examples/react/start/package.json
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6.0.1 | ||
| uses: actions/checkout@v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Unpinned GitHub Actions references in workflows:"
rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows
echo
echo "Resolve immutable SHAs for tags touched in this PR:"
for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do
repo=$(awk '{print $1}' <<<"$item")
tag=$(awk '{print $2}' <<<"$item")
sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \
"refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}')
printf "%s@%s -> %s\n" "$repo" "$tag" "$sha"
doneRepository: TanStack/devtools
Length of output: 1721
Pin GitHub Actions to immutable commit SHAs.
Lines 26 and 34 use mutable version tags. Pinning to full commit SHAs improves CI integrity and provenance; keep the tag as a trailing comment for readability. Apply the same pattern to all checkout actions in .github/workflows/pr.yml (lines 26, 42, and 56).
Suggested changes
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
...
- uses: changesets/action@v1.7.0
+ uses: changesets/action@e87c8ed249971350e47fab7515075f44eb134e5b # v1.7.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v6.0.2 | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/release.yml at line 26, Replace mutable action references
like uses: actions/checkout@v6.0.2 with the immutable commit SHA form (e.g.,
uses: actions/checkout@<FULL_COMMIT_SHA>) while preserving the human-friendly
tag as a trailing comment (e.g., # v6.0.2) to maintain readability; update the
checkout usages in the release workflow (the uses: actions/checkout entries) and
apply the same SHA-pinning pattern to the checkout actions referenced in pr.yml
(the uses: actions/checkout entries on the other specified lines).
package.json
Outdated
| "@tanstack/eslint-config": "0.4.0", | ||
| "@tanstack/intent": "^0.0.14", | ||
| "@tanstack/typedoc-config": "0.2.1", | ||
| "@tanstack/vite-config": "0.2.1", | ||
| "@testing-library/jest-dom": "^6.8.0", | ||
| "@tanstack/typedoc-config": "0.3.3", | ||
| "@tanstack/vite-config": "0.5.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
`What are the breaking changes (if any) between:
@tanstack/eslint-config0.3.2 -> 0.4.0@tanstack/typedoc-config0.2.1 -> 0.3.3@tanstack/vite-config0.2.1 -> 0.5.0
Please cite official release notes/changelogs.`
💡 Result:
1) @tanstack/eslint-config 0.3.2 → 0.4.0
- No explicit BREAKING change is called out in the release notes; the only noted change is: “update to
@eslint/jsv10”. [1] - However, the official docs for this config state you must have ESLint v9+ installed, which may be a practical breaking requirement if you were on ESLint 8. [2]
2) @tanstack/typedoc-config 0.2.1 → 0.3.3
- Breaking change introduced in 0.3.0: upgrade to TypeDoc v0.28, and “typedoc output is no longer lower-cased” (marked BREAKING in the release notes). [3]
- 0.3.3 is a patch release (“migrate to tsdown”) and does not list breaking changes. [4]
3) @tanstack/vite-config 0.2.1 → 0.5.0
- 0.3.0: update to Vite v7 (major Vite bump; not labeled breaking in the release note, but it is a major underlying dependency change). [5]
- 0.4.0: “support for bundling dependencies” (not labeled breaking). [6]
- Breaking change in 0.5.0: “Bump to Vite 8 with Rolldown. Drops Vite 6/7 support. Switches to
rolldownOptionsand nativeresolve.tsconfigPaths.” [7]
Sources (official release notes/docs): GitHub Releases for TanStack/config and TanStack Config docs. [1][2][3][4][5][6][7]
Address breaking changes in upgraded @tanstack config packages before merge.
Lines 62–65 upgrade three @tanstack config packages with 0.x minor bumps that introduce breaking changes:
- @tanstack/typedoc-config (0.2.1 → 0.3.3): Breaking change in 0.3.0 — "typedoc output is no longer lower-cased" (output format changed).
- @tanstack/vite-config (0.2.1 → 0.5.0): Breaking change in 0.5.0 — drops support for Vite 6/7, requires Vite 8+, and switches configuration from
viteConfigtorolldownOptionswith nativeresolve.tsconfigPaths.
These upgrades require corresponding changes to the codebase configuration (especially vite.config.ts). Verify and apply necessary config adjustments before merging.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` around lines 62 - 65, The `@tanstack` package upgrades introduce
breaking changes: update our build/docs configs accordingly by (1) in
typedoc-related code/configs (search for any Typedoc config files or usages that
expect lower-cased output) remove or adjust any post-processing that lower-cases
Typedoc output and ensure templates/consumers accept the new casing produced by
`@tanstack/typedoc-config` v0.3.3, and (2) in vite.config.ts (look for references
to viteConfig or imports from `@tanstack/vite-config`) migrate the old viteConfig
usage to the new shape: upgrade to Vite 8+ if not already and replace viteConfig
options with rolldownOptions and use the new native resolve.tsconfigPaths
behavior (update imports, option names, and any tsconfig path resolution code).
Make these changes where viteConfig and Typedoc config objects are defined so
the project builds and docs generate correctly with the new `@tanstack` versions.
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/release.yml (1)
26-34:⚠️ Potential issue | 🟠 MajorPin GitHub Actions to immutable SHAs instead of mutable tags.
Line 26 and Line 34 still use mutable tags (
v6.0.2,v1.7.0). Please pin to full commit SHAs (keep tag as inline comment) to reduce supply-chain risk. This also applies to matching checkout entries in.github/workflows/pr.yml.#!/bin/bash set -euo pipefail echo "Mutable action refs in workflows:" rg -nP '^\s*uses:\s*[^@]+@(?![0-9a-f]{40}\b)\S+' .github/workflows echo echo "Resolve immutable SHAs for tags touched here:" for item in "actions/checkout v6.0.2" "changesets/action v1.7.0"; do repo=$(awk '{print $1}' <<<"$item") tag=$(awk '{print $2}' <<<"$item") sha=$(git ls-remote --refs --tags "https://github.com/${repo}.git" \ "refs/tags/${tag}" "refs/tags/${tag}^{}" | awk 'END{print $1}') printf "%s@%s -> %s\n" "$repo" "$tag" "$sha" done🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release.yml around lines 26 - 34, Replace mutable action refs with immutable commit SHAs: for each uses entry shown (actions/checkout@v6.0.2 and changesets/action@v1.7.0, and any other mutable refs like tanstack/config/.github/setup@main), resolve the tag to its full 40-char commit SHA (e.g., via git ls-remote or the repo's tags API) and update the uses value to repo@<full-sha>, keeping the original tag as an inline comment for readability; also mirror these exact SHA-pinned changes for the matching checkout/uses entries in the pr.yml workflow so all workflow invocations use immutable SHAs.package.json (1)
62-65:⚠️ Potential issue | 🟠 MajorRe-verify breaking config implications for upgraded
@tanstackconfig packages.Line 65 (
@tanstack/vite-config@0.5.0) alongside Line 82 (vite@^7.3.1) may be incompatible depending on current config usage. Line 64 (@tanstack/typedoc-config@0.3.3) can also require doc pipeline adjustments. Please confirm required migrations are already applied before merge.#!/bin/bash set -euo pipefail echo "1) Find usages of `@tanstack/vite-config` and old/new option names:" rg -nP --type=ts --type=js --type=json \ '@tanstack/vite-config|viteConfig|rolldownOptions|resolve\.tsconfigPaths' echo echo "2) Find typedoc config usage and possible output-casing assumptions:" rg -nP --type=ts --type=js --type=json \ '@tanstack/typedoc-config|typedoc|toLowerCase\(|lower-?case' echo echo "3) Show vite versions pinned across manifests:" rg -nP '"vite"\s*:\s*"[^"]+"' --glob '**/package.json'🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` around lines 62 - 65, Upgrade of `@tanstack` packages may introduce breaking config/name changes; re-verify and apply migrations for `@tanstack/vite-config` (0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config` (0.3.3). Search the repo for usages of '@tanstack/vite-config', 'viteConfig', 'rollupOptions', and 'resolve.tsconfigPaths' and update any renamed options or import paths in your Vite config (e.g., viteConfig-related exports), verify vite plugin/api compatibility or pin/bump vite accordingly, and search for '@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions (toLowerCase / lower-case) to update the typedoc pipeline or output casing. After making changes, run the project build/tests and lockfile update to ensure no runtime errors and include migration notes in the PR.
🧹 Nitpick comments (1)
examples/react/bundling-repro/package.json (1)
50-65: Consider adding aengines.nodefield to improve tooling compatibility.The repository and all example packages lack Node version constraints. With Vite
^7.3.1and Wrangler^4.73.0inbundling-repro, and no explicit Node version pinning in CI workflows (pr.yml, release.yml), addingengines.nodeto the root or example package.json files would make local and CI behavior more deterministic.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@examples/react/bundling-repro/package.json` around lines 50 - 65, Add an engines.node field to the package.json (root or this example) to pin a supported Node range for Vite and Wrangler; for example target the current LTS used by those tools (e.g., Node 18.x — something like ">=18.16.0 <21") so local/dev/CI environments are deterministic. Update the package.json containing Vite and Wrangler (the file shown in the diff) to include that engines.node range, and mirror that constraint in CI workflows (pr.yml, release.yml) or GitHub Actions matrix so pipelines use a matching Node version; run the install/test matrix locally or in CI to verify compatibility.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.github/workflows/release.yml:
- Around line 26-34: Replace mutable action refs with immutable commit SHAs: for
each uses entry shown (actions/checkout@v6.0.2 and changesets/action@v1.7.0, and
any other mutable refs like tanstack/config/.github/setup@main), resolve the tag
to its full 40-char commit SHA (e.g., via git ls-remote or the repo's tags API)
and update the uses value to repo@<full-sha>, keeping the original tag as an
inline comment for readability; also mirror these exact SHA-pinned changes for
the matching checkout/uses entries in the pr.yml workflow so all workflow
invocations use immutable SHAs.
In `@package.json`:
- Around line 62-65: Upgrade of `@tanstack` packages may introduce breaking
config/name changes; re-verify and apply migrations for `@tanstack/vite-config`
(0.5.0) vs vite@^7.3.1 and `@tanstack/typedoc-config` (0.3.3). Search the repo for
usages of '@tanstack/vite-config', 'viteConfig', 'rollupOptions', and
'resolve.tsconfigPaths' and update any renamed options or import paths in your
Vite config (e.g., viteConfig-related exports), verify vite plugin/api
compatibility or pin/bump vite accordingly, and search for
'@tanstack/typedoc-config', 'typedoc' and any case-transforming assumptions
(toLowerCase / lower-case) to update the typedoc pipeline or output casing.
After making changes, run the project build/tests and lockfile update to ensure
no runtime errors and include migration notes in the PR.
---
Nitpick comments:
In `@examples/react/bundling-repro/package.json`:
- Around line 50-65: Add an engines.node field to the package.json (root or this
example) to pin a supported Node range for Vite and Wrangler; for example target
the current LTS used by those tools (e.g., Node 18.x — something like ">=18.16.0
<21") so local/dev/CI environments are deterministic. Update the package.json
containing Vite and Wrangler (the file shown in the diff) to include that
engines.node range, and mirror that constraint in CI workflows (pr.yml,
release.yml) or GitHub Actions matrix so pipelines use a matching Node version;
run the install/test matrix locally or in CI to verify compatibility.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e678879d-8d9a-43d3-ba5e-e0fa5aebf4bb
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (26)
.github/workflows/autofix.yml.github/workflows/pr.yml.github/workflows/release.ymlexamples/preact/basic/package.jsonexamples/preact/custom-devtools/package.jsonexamples/react/basic/package.jsonexamples/react/bundling-repro/package.jsonexamples/react/custom-devtools/package.jsonexamples/react/drizzle/package.jsonexamples/react/https/package.jsonexamples/react/start/package.jsonexamples/react/time-travel/package.jsonexamples/solid/basic/package.jsonexamples/solid/devtools-ui/package.jsonexamples/solid/start/package.jsonexamples/vue/basic/package.jsonpackage.jsonpackages/devtools-ui/package.jsonpackages/devtools-utils/package.jsonpackages/devtools-vite/package.jsonpackages/devtools/package.jsonpackages/event-bus/package.jsonpackages/preact-devtools/package.jsonpackages/react-devtools/package.jsonpackages/solid-devtools/package.jsonpackages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (14)
- examples/react/drizzle/package.json
- examples/solid/start/package.json
- packages/devtools-ui/package.json
- packages/solid-devtools/package.json
- examples/solid/basic/package.json
- examples/vue/basic/package.json
- packages/preact-devtools/package.json
- packages/devtools/package.json
- examples/react/https/package.json
- examples/preact/custom-devtools/package.json
- packages/event-bus/package.json
- packages/devtools-vite/package.json
- .github/workflows/autofix.yml
- examples/react/custom-devtools/package.json
There was a problem hiding this comment.
♻️ Duplicate comments (1)
package.json (1)
62-65:⚠️ Potential issue | 🟠 MajorVerify Vite version compatibility with
@tanstack/vite-config0.5.0.The past review correctly identified that
@tanstack/vite-config0.5.0 requires Vite 8+ and drops support for Vite 6/7. However, this PR updatesviteto^7.3.1(Line 82), which would be incompatible with@tanstack/vite-config0.5.0.Either:
- Upgrade
viteto^8.xto match the requirements of@tanstack/vite-config0.5.0, or- Pin
@tanstack/vite-configto a version compatible with Vite 7 (e.g.,0.4.x)Also applies to: 82-82
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` around lines 62 - 65, The package version mismatch: "@tanstack/vite-config"@0.5.0 requires Vite 8+, but this PR sets "vite" to "^7.3.1"; update package.json so versions are compatible by either (A) bumping "vite" to a 8.x version (e.g., "^8.0.0") to match "@tanstack/vite-config"@0.5.0, or (B) pinning "@tanstack/vite-config" to a Vite-7-compatible release (e.g., "0.4.x"); pick one approach and make the corresponding change to the dependency entry for "vite" or "@tanstack/vite-config" so the two packages are aligned.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@package.json`:
- Around line 62-65: The package version mismatch: "@tanstack/vite-config"@0.5.0
requires Vite 8+, but this PR sets "vite" to "^7.3.1"; update package.json so
versions are compatible by either (A) bumping "vite" to a 8.x version (e.g.,
"^8.0.0") to match "@tanstack/vite-config"@0.5.0, or (B) pinning
"@tanstack/vite-config" to a Vite-7-compatible release (e.g., "0.4.x"); pick one
approach and make the corresponding change to the dependency entry for "vite" or
"@tanstack/vite-config" so the two packages are aligned.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 03c422c2-f992-4780-bceb-2f7fb298b00e
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (29)
.github/workflows/autofix.yml.github/workflows/pr.yml.github/workflows/release.ymlexamples/preact/basic/package.jsonexamples/preact/custom-devtools/package.jsonexamples/react/a11y-devtools/package.jsonexamples/react/basic/package.jsonexamples/react/bundling-repro/package.jsonexamples/react/custom-devtools/package.jsonexamples/react/drizzle/package.jsonexamples/react/https/package.jsonexamples/react/start/package.jsonexamples/react/time-travel/package.jsonexamples/solid/a11y-devtools/package.jsonexamples/solid/basic/package.jsonexamples/solid/devtools-ui/package.jsonexamples/solid/start/package.jsonexamples/vue/basic/package.jsonpackage.jsonpackages/devtools-a11y/package.jsonpackages/devtools-ui/package.jsonpackages/devtools-utils/package.jsonpackages/devtools-vite/package.jsonpackages/devtools/package.jsonpackages/event-bus/package.jsonpackages/preact-devtools/package.jsonpackages/react-devtools/package.jsonpackages/solid-devtools/package.jsonpackages/vue-devtools/package.json
🚧 Files skipped from review as they are similar to previous changes (13)
- packages/devtools-vite/package.json
- packages/event-bus/package.json
- packages/devtools-utils/package.json
- packages/vue-devtools/package.json
- examples/react/start/package.json
- examples/solid/devtools-ui/package.json
- examples/solid/start/package.json
- examples/react/https/package.json
- packages/devtools/package.json
- examples/react/drizzle/package.json
- examples/solid/basic/package.json
- examples/preact/basic/package.json
- packages/devtools-ui/package.json
🚀 Changeset Version PreviewNo changeset entries found. Merging this PR will not cause a version bump for any packages. |

This PR contains the following updates:
^7.28.4→^7.29.0^7.28.3→^7.29.1^7.28.4→^7.29.2^7.28.4→^7.29.0^7.28.4→^7.29.02.2.4→2.4.9^1.13.8→^1.30.1^2.10.3→^2.10.5^2.4.3→^2.4.5^1.3.3→^1.3.5^2.1.3→^2.1.5^1.2.0→^1.3.2^4.0.6→^4.2.20.3.2→0.4.0^0.0.14→^0.0.23^1.23.7→^1.28.5^0.1.7→^0.2.19^5.90.1→^5.95.2^5.90.1→^5.95.2^1.132.0→^1.168.4^1.132.0→^1.166.11^1.131.7→^1.166.10^1.132.0→^1.167.8^0.9.0→^0.9.3^1.132.0→^1.167.5^5.90.1→^5.95.2^5.90.1→^5.95.2^1.131.50→^1.168.4^1.131.50→^1.166.11^0.9.0→^0.9.30.4.3→0.5.2^5.90.5→^5.95.2^6.1.0→^6.1.10^10.4.0→^10.4.1^6.8.0→^6.9.1^16.2.0→^16.3.2^19.2.0→^19.2.14^19.2.0→^19.2.14^19.2.0→^19.2.3^6.0.1→^6.0.5^4.10.0→^4.11.1^1.11.19→^1.11.20^0.31.4→^0.31.10^0.44.5→^0.45.1^9.36.0→^9.39.4^4.2.0→^4.4.1^10.5.1→^10.8.0^2.1.16→^2.1.18^27.0.0→^27.4.0^5.64.0→^5.88.1^2.11.1→^2.13.2^0.561.0→^0.577.0^4.0.2→^4.0.322.1.3→22.6.1^8.16.3→^8.20.0^4.0.3→^4.0.410.24.0→10.33.0^10.28.0→^10.29.0^3.4.1→^3.5.1^0.3.13→^0.3.18^19.2.0→^19.2.4^19.2.0→^19.2.4^19.2.0→^19.2.4^19.2.0→^19.2.4^1.7.0→^1.11.0^1.9.9→^1.9.12^1.9.9→^1.9.120.9.0→0.11.1^1.6.5→^1.6.11^3.0.2→^3.5.0^4.0.6→^4.2.2^8.5.0→^8.5.1^1.3.6→^1.4.0~5.9.2→~5.9.3^0.5.8→^0.5.11^8.0.0→^8.0.3^1.17.8→^1.17.10^6.0.2→^6.1.1^3.5.22→^3.5.31^5.1.0→^5.2.0^4.40.3→^4.77.0^8.18.3→^8.20.0^4.3.5→^4.3.6^5.0.8→^5.0.12Release Notes
babel/babel (@babel/core)
v7.29.0Compare Source
v7.29.0 (2026-01-31)
Thanks @simbahax for your first PR!
🚀 New Feature
babel-typesbabel-standalone🐛 Bug Fix
babel-parserextendsclause (@nicolo-ribaudo)babel-traversebabel-plugin-transform-block-scoping,babel-traverse🏃♀️ Performance
babel-generator,babel-runtime-corejs3Committers: 6
babel/babel (@babel/generator)
v7.29.1Compare Source
v7.29.0Compare Source
v7.29.0 (2026-01-31)
Thanks @simbahax for your first PR!
🚀 New Feature
babel-typesbabel-standalone🐛 Bug Fix
babel-parserextendsclause (@nicolo-ribaudo)babel-traversebabel-plugin-transform-block-scoping,babel-traverse🏃♀️ Performance
babel-generator,babel-runtime-corejs3Committers: 6
biomejs/biome (@biomejs/biome)
v2.4.9Compare Source
Patch Changes
#9315
085d324Thanks @ematipico! - Added a new nursery CSS rulenoDuplicateSelectors, that disallows duplicate selector lists within the same at-rule context.For example, the following snippet triggers the rule because the second selector and the first selector are the same:
#9567
b7ab931Thanks @ematipico! - Fixed #7211:useOptionalChainnow detects negated logical OR chains. The following code is now considered invalid:#8670
607ebf9Thanks @tt-a1i! - Fixed #8345:useAdjacentOverloadSignaturesno longer reports false positives for static and instance methods with the same name. Static methods and instance methods are now treated as separate overload groups.#9476
97b80a8Thanks @masterkain! - Fixed#9475: Fixed a panic when Biome analyzed ambient TypeScript modules containing class constructor, getter, or setter signatures that reference local type aliases. Biome now handles these declarations without crashing during semantic analysis.#9553
0cd5298Thanks @dyc3! - Fixed a bug where enabling the rules of a whole group, would enable rules that belonged to a domain under the same group.For example,
linter.rules.correctness = "error"no longer enables React- or Qwik-specific correctness rules unlesslinter.domains.react,linter.domains.qwik, or an explicit rule config also enables them, or their relative dependencies are installed.#9586
4cafb71Thanks @dyc3! - Fixed #8828: Grit patterns usingexport { $foo } from $sourcenow match named re-exports in JavaScript and TypeScript files.#9550
d4e3d6eThanks @dyc3! - Fixed #9548: Biome now parses conditional expressions whose consequent is an arrow function returning a parenthesized object expression.#8696
a7c19ccThanks @Faizanq! - Fixed #8685 wherenoUselessLoneBlockStatementswould remove empty blocks containing comments. The rule now preserves these blocks since comments may contain important information like TODOs or commented-out code.#9557
6671ac5Thanks @datalek! - Fixed #9557: Biome's LSP server no longer crashes on startup when used with editors that don't sendworkspaceFoldersduring initialization. This affected any LSP client that only sendsrootUri, which is valid per the LSP specification.#9455
1710cf1Thanks @omar-y-abdi! - Fixed #9174:useExpectnow correctly rejects asymmetric matchers in Vitest or Jest likeexpect.stringContaining(),expect.objectContaining(), and utilities likeexpect.extend()that are not valid assertions. Previously these constructs caused false negatives, allowing tests without real assertions to pass the lint rule.#9584
956e367Thanks @ematipico! - Fixed a bug where Vue directive attribute values likev-bind:class="{'dynamic': true}"were incorrectly parsed as JavaScript statements instead of expressions. Object literals inside directive values like:class,v-if, andv-htmlare now correctly parsed as expressions, preventing spurious parse errors.#9474
e168494Thanks @ematipico! - Added the new nursery rulenoUntrustedLicenses. This rule disallows dependencies that ship with invalid licenses or licenses that don't meet the criteria of your project/organisation.The rule has the following options:
allow: a list of licenses that can be allowed. Useful to bypass possible invalid licenses from downstream dependencies.deny: a list of licenses that should trigger the rule. Useful to deny licenses that don't fit your project/organisation.When both
denyandalloware provided,denytakes precedence.requireOsiApproved: whether the licenses need to be approved by the Open Source Initiative.requireFsfLibre: whether the licenses need to be approved by the Free Software Foundation.#9544
723798bThanks @ViniciusDev26! - Added an unsafe fix touseConsistentMethodSignaturesthat automatically converts between method-style and property-style signatures.#9555
8a3647bThanks @ematipico! - Fixed#188: the Biome Language Server no longer panics when open files change abruptly, such as during git branch checkouts.#9605
f65c637Thanks @ematipico! - Fixed #9589. Now Biome correctly parses object expressions inside props and directives. The following code doesn't emit errors anymore:#9565
ccb249eThanks @eyupcanakman! - Fixed #9505:noUselessStringConcatno longer reports tagged template literals as useless string concatenations. Tagged templates invoke a function and can return non-string values, so combining them with+is not equivalent to a single template literal.#9534
4d050dfThanks @Netail! - Added the nursery rulenoInlineStyles. The rule disallows the use of inlinestyleattributes in HTML and thestyleprop in JSX, includingReact.createElementcalls. Inline styles make code harder to maintain and can interfere with Content Security Policy.#9611
cddaa44Thanks @gaauwe! - Fixed a regression where Biome LSP could misread editor settings sent throughworkspace/didChangeConfigurationwhen the payload was wrapped in a top-levelbiomekey. This causedrequireConfigurationand related settings to be ignored in some editors.v2.4.8Compare Source
Patch Changes
#9488
bc709f6Thanks @mvanhorn! - Fixed #9463: the "Biome found a configuration file outside of the current working directory" diagnostic now includes the configuration file path and the working directory, giving users actionable information to debug the issue.#9527
2f8bf80Thanks @mdm317! - Fixed #8959: Fixed TypeScript arrow function formatting when a comment appears after=>.#9525
e7b3b10Thanks @ViniciusDev26! - Added the rulenoDrizzleUpdateWithoutWhereto prevent accidental full-table updates when using Drizzle ORM without a.where()clause.#9531
1302740Thanks @ematipico! - Fixed #9187: Astro frontmatter containing regex literals with quotes (/'/,/"/) or dashes (/---/) no longer causes parse errors.#9535
b630d93Thanks @leno23! - Fixed #9524: remove extra space before>whenbracketSameLineis true and the self-closing slash is absent in HTML formatter.#9537
81e6306Thanks @ematipico! - Fixed #9238: The HTML parser no longer incorrectly reports---inside element content (e.g.<td>---</td>) as an "Unexpected value or character" error.#9532
4b64145Thanks @ematipico! - Fixed #9117:biome check --writeno longer falsely reports Svelte and Vue files as changed whenhtml.formatter.indentScriptAndStyleis enabled and the files are already correctly formatted.#9528
61451efThanks @ematipico! - Fixed #9341: Fixed an LSP crash that could corrupt file content when saving with format-on-save enabled.#9538
794f79cThanks @ematipico! - Fixed #9279: The rulenoSubstrnow detects.substr()and.substring()calls in all expression contexts, including variable declarations, function arguments, return statements, and arrow function bodies.#9462
c23272cThanks @ematipico! - Fixed #9370: The resolver now correctly prioritizes more specificexportspatterns over less specific ones. Previously, a pattern like"./*"could match before"./features/*", causing resolution failures for packages with overlapping subpath patterns.#9515
f85c069Thanks @shivamtiwari3! - Fixed #9506 and #9479: BiomeConfiguration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.