chore(deps): bump the all-dependencies group across 1 directory with 21 updates by dependabot[bot] · Pull Request #2196 · kriasoft/react-starter-kit

dependabot · 2026-10-19T04:21:42Z

Bumps the all-dependencies group with 21 updates in the / directory:

Package	From	To
@vitest/coverage-v8	`5.0.0`	`5.0.5`
happy-dom	`20.14.3`	`21.0.3`
lint-staged	`17.5.1`	`17.6.0`
mermaid	`11.17.2`	`12.2.0`
oxfmt	`0.67.0`	`0.73.0`
oxlint	`1.82.0`	`1.88.0`
react	`19.3.0`	`19.3.1`
srcpack	`0.3.0`	`1.0.0`
vite	`8.3.0`	`8.3.4`
vitest	`5.0.0`	`5.0.5`
wrangler	`4.131.0`	`4.151.0`
better-auth	`1.7.4`	`1.7.10`
stripe	`22.6.2`	`23.0.0`
hono	`4.13.7`	`4.13.13`
zod	`4.6.2`	`4.6.7`
@tanstack/react-router	`1.170.35`	`1.170.44`
jotai	`2.20.3`	`3.0.1`
react-dom	`19.3.0`	`19.3.1`
@types/node	`26.2.0`	`26.6.5`
@astrojs/react	`6.0.5`	`7.1.0`
dotenv	`17.4.2`	`18.0.8`

Updates @vitest/coverage-v8 from 5.0.0 to 5.0.5

Release notes

Sourced from @vitest/coverage-v8's releases.

v5.0.5

   🐞 Bug Fixes

Keep vite default fs.deny with api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)

Handle quoted file names in --changed - by @sheremet-va in vitest-dev/vitest#11583 (14921)

Add data to the import.meta.hot stub - by @sheremet-va in vitest-dev/vitest#11590 (3a828)

Set skip in skipIf, ignore undefined options - by @sheremet-va in vitest-dev/vitest#11591 (d523a)

Skip builtin loading in async leak detector - by @sheremet-va in vitest-dev/vitest#11598 (fe86a)

Keep the import frame in native loader errors - by @sheremet-va in vitest-dev/vitest#11599 (9697b)

Run hook cleanups when a later hook fails - by @sheremet-va in vitest-dev/vitest#11605 (6c5a4)

Release mocks of finished test files - by @sheremet-va in vitest-dev/vitest#11607 (e9c3d)

Abort all running tests on cancel - by @sheremet-va in vitest-dev/vitest#11606 (6621a)

browser:

Ignore synthetic pagehide events - by @sheremet-va in vitest-dev/vitest#11582 (ca081)

Run plugin buildStart on server creation - by @sheremet-va in vitest-dev/vitest#11593 (ea611)

Drop late connections of closed sessions - by @sheremet-va in vitest-dev/vitest#11600 (f161e)

Wait 30s for the browser to close - by @sheremet-va in vitest-dev/vitest#11601 (6498b)

Run global setup once with instances - by @sheremet-va in vitest-dev/vitest#11596 (8dd67)

reporter:

End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39); on worker crash - by @AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

... (truncated)

Commits

7a825db chore: release v5.0.5 (#11609)
6a11cf6 chore: release v5.0.4 (#11554)
2297d93 fix(coverage): v8 browser memory leak between test files (#11466)
c74e099 fix(deps): update all non-major dependencies (#11167)
33cadea chore: release v5.0.3 (#11409)
a029e76 chore: migrate to oxc (#11367)
428e2e5 chore: release v5.0.2 (#11357)
03630a5 chore: release v5.0.1 (#11275)
See full diff in compare view

Updates happy-dom from 20.14.3 to 21.0.3

Release notes

Sourced from happy-dom's releases.

v21.0.3

👷‍♂️ Patch fixes

Fixes security vulnerability where authorization header was forwarded when redirecting - By @capricorn86

v21.0.2

👷‍♂️ Patch fixes

Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @happy-dom/server-renderer - By @capricorn86

v21.0.1

👷‍♂️ Patch fixes

Adds alias for enabling CSS and iframe loading to @happy-dom/server-renderer - By @capricorn86

v21.0.0

💣 Breaking Changes

Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @capricorn86

An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.

The settings property disableCSSFileLoading has been deprecated

Added the new settings properties enableCSSFileLoading and enableIframePageLoading

v20.14.6

👷‍♂️ Patch fixes

Fixes cookie scope forgery vulnerability - By @capricorn86

v20.14.5

👷‍♂️ Patch fixes

Preserve character references in comment data - By @hampustagerud in task #2409

v20.14.4

👷‍♂️ Patch fixes

End comments at the first comment end tag when it overlaps a comment start tag - By @hampustagerud in task #2407

Commits

875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
f55c7e0 chore: Update security documentation (#2509)
2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
0d4cdbe fix: #2409 Preserve character references in comment data (#2410)
9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...
See full diff in compare view

Updates lint-staged from 17.5.1 to 17.6.0

Release notes

Sourced from lint-staged's releases.

v17.6.0

Minor Changes
#1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*': {
title: 'Fail if PDF files are committed',
task: async (filepaths, { log }) => {
const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
if (pdfFiles.length > 0) {
log('PDF files should not be committed: %s', pdfFiles)
throw new Error('Failed')
}
},
},
})
#1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.
Patch Changes
#1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.
#1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})
#1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

#1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

Changelog

Sourced from lint-staged's changelog.

17.6.0

Minor Changes
#1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*': {
title: 'Fail if PDF files are committed',
task: async (filepaths, { log }) => {
const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
if (pdfFiles.length > 0) {
log('PDF files should not be committed: %s', pdfFiles)
throw new Error('Failed')
}
},
},
})
#1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.
Patch Changes
#1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.
#1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
})
#1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

#1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

Commits

48f9f4e Merge pull request #1857 from lint-staged/changeset-release/main
16b2e21 chore(changeset): release
195f156 docs: improve changeset
0ba6261 fix: create hidden directory only when required
66ac2de docs: fixes to changesets
80af8d7 Merge pull request #1863 from lint-staged/fix-issues
e433488 fix: handle task editing a symlinked file to a regular file, and --fail-on-ch...
e5019b3 fix: handle trailing newlines when detecting changed files
74efec8 ci: run Cygwin and MSYS2 tests on Node.js 26
655b7dc fix: use TypeScript types instead of JSDoc
Additional commits viewable in compare view

Updates mermaid from 11.17.2 to 12.2.0

Release notes

Sourced from mermaid's releases.

mermaid@12.2.0

Minor Changes

#8394 6ac38cb Thanks @jackroberts236! - feat: Add opt-in mindmap coloring by hierarchy depth using mindmap.colorBy: depth and the existing theme palette.

Patch Changes

#8409 419ee68 Thanks @ashishjain0512! - fix: size circle and double-circle nodes from their label instead of minNodeWidth, and trim neo circle padding

#8395 2fb3ff1 Thanks @ashishjain0512! - fix: ELK no longer straightens an edge terminal when that would put a label over another edge, or an edge through a label

#8394 cbf89ab Thanks @jackroberts236! - fix: Keep mindmap HTML labels readable in the neo look on themes that repaint node backgrounds

#8390 430ac9b Thanks @ashishjain0512! - fix: Centre mindmap node labels when htmlLabels is false

#8161 d7532ed Thanks @filipsajdak! - fix: scope a swimlane cluster's DOM id like every other cluster, so two diagrams on one page do not collide

#8270 ad8d61a Thanks @filipsajdak! - fix(rendering): clip an edge for the layout engine that drew it, so a diagram pinning its own engine (bpmn, swimlanes) still renders when the configured default is another one

#8383 9d41c0f Thanks @filipsajdak! - fix(swimlanes): split shared terminal lanes again after crossing cleanup, so an edge that detours around another lane no longer ends on the same attachment point as a neighbouring edge

#8384 6c67397 Thanks @filipsajdak! - fix(swimlanes): move a lane's title band clear of an edge that crosses it, in LR diagrams whose lanes carry no direction of their own and when the edge runs along the band's border

#8366 40124c3 Thanks @SwastikTripathi! - fix: swimlane nodes with no edges keep their source order inside a lane instead of being sorted by ID

mermaid@12.1.0

Minor Changes

#8303 9140716 Thanks @filipsajdak! - feat: add the elk.orientFeedbackEdges option, enabled by default. With the ELK layout, an edge from a node that a subgraph feeds back into that subgraph is now routed downstream instead of around the subgraph. This changes the layout of existing ELK diagrams that contain such edges; set elk.orientFeedbackEdges: false to keep the previous routing.

#8250 fd4f5f2 Thanks @kartben! - feat: add a bitOrder option to packet diagrams. It defaults to ascending, which is the current behaviour, and descending mirrors every row so it reads from that row's highest bit down to its lowest. Fields are still declared lowest bit first and keep their width, so switching a diagram between the two conventions only means changing bitOrder.

Patch Changes

#8330 50c9e55 Thanks @ashishjain0512! - fix: upgrade chevrotain to 13 so mermaid no longer pulls in vulnerable lodash-es@4.17.23

#8259 4c90f5c Thanks @afonsojanu! - fix(sequence): allow whitespace between an actor name and its @{ ... } config object

participant Bob@{ "type" : "database" } parsed fine, but adding a single space before the config object (participant Bob @{ "type" : "database" }) failed with a confusing parse error, even though the plain form without a config object tolerates trailing whitespace just fine.

#8339 c7fa1a5 Thanks @ashishjain0512! - fix: keep ELK class-diagram cardinalities off namespace frames

#8334 d67331d Thanks @ashishjain0512! - fix(class): place cardinality labels beside their relation ends on dagre's sides with ELK, centre dagre's end labels, and stop clipping their text

#8344 99a050b Thanks @pbrolin47! - fix: with the ELK layout, an edge label could sit up to 16px beside its edge instead of centred on it, when the edge's terminal jog was straightened after the label's position was computed. The label is now re-projected onto the straightened route

... (truncated)

Commits

1fb7869 Merge pull request #8432 from mermaid-js/changeset-release/master
34772ca Version Packages
42292ea Merge pull request #8428 from mermaid-js/release/12.2.0
e6c8059 Wrong version set previously
6c55f56 Set mermaid version when Coloring by depth supported in Mindmap
5a0d8cf Fix missing parallel uploads
788f396 Update according to discussion with core-team members
33d0a49 Merge pull request #8411 from mermaid-js/renovate/npm-katex-vulnerability
6538fde Update dependency katex to ^0.18.0 [SECURITY]
ba3022d Merge pull request #8398 from mermaid-js/pebr/12.1.0-tmp
Additional commits viewable in compare view

Updates oxfmt from 0.67.0 to 0.73.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.73.0

💥 BREAKING CHANGES

1ef2888 oxfmt: [BREAKING] Improve --migrate prettier (#27444) (leaysgur)

c2e6d5f formatter_toml: [BREAKING] Add oxc_formatter_toml crate wrapping oxc-toml (#27365) (leaysgur)

🚀 Features

ce4e8dc oxfmt: Support overrides[].parser -> associations[].language migration (#27475) (leaysgur)

a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)

77f8156 oxfmt/lsp: Show root config errors to LSP client (#26014) (Sysix)

c1adce3 oxfmt/lsp: Support astro language (#27388) (leaysgur)

4f024a1 oxfmt: Support astro plugin in --migrate prettier (#27387) (leaysgur)

5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

🐛 Bug Fixes

76ec31b formatter_css: Support css-in-js placeholders in property names and conditions (#27640) (leaysgur)

99bb268 formatter_css: Keep css-in-js placeholder as media type (#27639) (leaysgur)

372849e formatter: Fix crash on css-in-js comment containing interpolation (#27638) (leaysgur)

da692b8 formatter: Wrap export default class|function consistently (#27628) (leaysgur)

21dee96 formatter: Keep parens around TSInstantiationExpression before ! and export (#27626) (leaysgur)

b6eb914 oxfmt: Normalize symlink targets in CLI snapshots (#27498) (camc314)

5dae56f oxfmt/lsp: Return error on config resolving error (#26003) (Sysix)

676cc60 formatter/jsdoc: Preserve paragraphs by checking @description tag width (#27439) (leaysgur)

2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)

db360de oxfmt: Load svelte plugin for svelte-in-mdx-in-md (#27369) (leaysgur)

6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

d730fdd formatter_core: Leave blank frontmatter without dispatcher (#27359) (leaysgur)

📚 Documentation

4a28c91 formatter_css: Clarify missed-semicolon-accepted divergence (#27433) (leaysgur)

408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)

902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)

37b3c48 formatter_markdown: Fix DIVERGENCES.md examples and slug to match behavior (#27358) (leaysgur)

oxfmt v0.72.0

💥 BREAKING CHANGES

e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)

7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)

... (truncated)

Changelog

Sourced from oxfmt's changelog.

[0.73.0] - 2026-10-13

🚀 Features

a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)

5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

📚 Documentation

408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)

902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)

Commits

6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
a495e82 feat(oxfmt): support associations config to specify language over filepath ...
408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
f158bff chore(deps): update npm packages (#26865)
288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
Additional commits viewable in compare view

Updates oxlint from 1.82.0 to 1.88.0

Release notes

Sourced from oxlint's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)

c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)

3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)

598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)

2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)

2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)

6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)

c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)

c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)

8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)

19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)

3bb54f6 linter: Update stale comment (#27519) (overlookmotel)

848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)

oxlint v1.87.0

🚀 Features

42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)

cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)

1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)

7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)

4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)

7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)

e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)

3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)

f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)

7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.88.0] - 2026-10-13

🚀 Features

3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)

e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

Commits

6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
3c361a7 feat(linter/unicorn/prefer-query-selector): add allowWithVariables option (...
2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
9d80eed feat(linter/react/only-export-components): support allowCompoundComponents ...
e05b155 feat(linter): add typescript/no-generated-empty-object-type (#26958)
88a0096 chore(oxlint): require tsgolint 7.0.2003 (#27021)
288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
See full diff in compare view

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
See full diff in compare view

Updates srcpack from 0.3.0 to 1.0.0

Release notes

Sourced from srcpack's releases.

v1.0.0

Screenshots in your bundles

A bundle can now capture a rendered page as images a vision model can actually read — on its own, or next to the code that renders it:
bundles: {
  home: { screenshot: "http://localhost:5173/", onDemand: true },
  pricing: {
    include: "src/pages/pricing/**/*",
    screenshot: { url: "http://localhost:5173/pricing", viewport: &quo...
Description has been truncated

…21 updates Bumps the all-dependencies group with 21 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.0` | `5.0.5` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.14.3` | `21.0.3` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.5.1` | `17.6.0` | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.17.2` | `12.2.0` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.67.0` | `0.73.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.82.0` | `1.88.0` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [srcpack](https://github.com/kriasoft/srcpack) | `0.3.0` | `1.0.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.4` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.0` | `5.0.5` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.131.0` | `4.151.0` | | [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.7.4` | `1.7.10` | | [stripe](https://github.com/stripe/stripe-node) | `22.6.2` | `23.0.0` | | [hono](https://github.com/honojs/hono) | `4.13.7` | `4.13.13` | | [zod](https://github.com/colinhacks/zod) | `4.6.2` | `4.6.7` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.35` | `1.170.44` | | [jotai](https://github.com/pmndrs/jotai) | `2.20.3` | `3.0.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.5` | | [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.5` | `7.1.0` | | [dotenv](https://github.com/motdotla/dotenv) | `17.4.2` | `18.0.8` | Updates `@vitest/coverage-v8` from 5.0.0 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8) Updates `happy-dom` from 20.14.3 to 21.0.3 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.14.3...v21.0.3) Updates `lint-staged` from 17.5.1 to 17.6.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.5.1...v17.6.0) Updates `mermaid` from 11.17.2 to 12.2.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.17.2...mermaid@12.2.0) Updates `oxfmt` from 0.67.0 to 0.73.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.73.0/npm/oxfmt) Updates `oxlint` from 1.82.0 to 1.88.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.88.0/npm/oxlint) Updates `react` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `srcpack` from 0.3.0 to 1.0.0 - [Release notes](https://github.com/kriasoft/srcpack/releases) - [Commits](kriasoft/srcpack@v0.3.0...v1.0.0) Updates `vite` from 8.3.0 to 8.3.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite) Updates `vitest` from 5.0.0 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) Updates `wrangler` from 4.131.0 to 4.151.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.151.0/packages/wrangler) Updates `better-auth` from 1.7.4 to 1.7.10 - [Release notes](https://github.com/better-auth/better-auth/releases) - [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md) - [Commits](https://github.com/better-auth/better-auth/commits/v1.7.10/packages/better-auth) Updates `stripe` from 22.6.2 to 23.0.0 - [Release notes](https://github.com/stripe/stripe-node/releases) - [Changelog](https://github.com/stripe/stripe-node/blob/master/CHANGELOG.md) - [Commits](stripe/stripe-node@v22.6.2...v23.0.0) Updates `hono` from 4.13.7 to 4.13.13 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.7...v4.13.13) Updates `zod` from 4.6.2 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.6.2...v4.6.7) Updates `@tanstack/react-router` from 1.170.35 to 1.170.44 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.44/packages/react-router) Updates `jotai` from 2.20.3 to 3.0.1 - [Release notes](https://github.com/pmndrs/jotai/releases) - [Commits](pmndrs/jotai@v2.20.3...v3.0.1) Updates `react-dom` from 19.3.0 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) Updates `@types/node` from 26.2.0 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@astrojs/react` from 6.0.5 to 7.1.0 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/react@7.1.0/packages/integrations/react) Updates `dotenv` from 17.4.2 to 18.0.8 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.4.2...v18.0.8) --- updated-dependencies: - dependency-name: "@vitest/coverage-v8" dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: happy-dom dependency-version: 21.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: lint-staged dependency-version: 17.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: mermaid dependency-version: 12.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: oxfmt dependency-version: 0.73.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: oxlint dependency-version: 1.88.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: react dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: srcpack dependency-version: 1.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: vite dependency-version: 8.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: wrangler dependency-version: 4.151.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: better-auth dependency-version: 1.7.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: stripe dependency-version: 23.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: hono dependency-version: 4.13.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: "@tanstack/react-router" dependency-version: 1.170.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: jotai dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: react-dom dependency-version: 19.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: "@astrojs/react" dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: dotenv dependency-version: 18.0.8 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-26T04:12:22Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 19, 2026

dependabot Bot closed this Oct 26, 2026

dependabot Bot deleted the dependabot/bun/all-dependencies-f2a5efa54f branch October 26, 2026 04:12

Navigation Menu

Repository navigation

chore(deps): bump the all-dependencies group across 1 directory with 21 updates - #2196

chore(deps): bump the all-dependencies group across 1 directory with 21 updates#2196
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/all-dependencies-f2a5efa54f

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.0.5

🐞 Bug Fixes

View changes on GitHub

v5.0.4

🚀 Features

🐞 Bug Fixes

v21.0.3

👷‍♂️ Patch fixes

v21.0.2

👷‍♂️ Patch fixes

v21.0.1

👷‍♂️ Patch fixes

v21.0.0

💣 Breaking Changes

v20.14.6

👷‍♂️ Patch fixes

v20.14.5

👷‍♂️ Patch fixes

v20.14.4

👷‍♂️ Patch fixes

v17.6.0

Minor Changes

Patch Changes

17.6.0

Minor Changes

Patch Changes

mermaid@12.2.0

Minor Changes

Patch Changes

mermaid@12.1.0

Minor Changes

Patch Changes

oxfmt v0.73.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

📚 Documentation

oxfmt v0.72.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

[0.73.0] - 2026-10-13

🚀 Features

📚 Documentation

oxlint v1.88.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

⚡ Performance

📚 Documentation

oxlint v1.87.0

🚀 Features

🐛 Bug Fixes

[1.88.0] - 2026-10-13

🚀 Features

[1.86.0] - 2026-09-28

🚀 Features

19.3.1 (October 14th, 2026)

React Server Components

v1.0.0

Screenshots in your bundles

Uh oh!

dependabot Bot commented on behalf of github Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading