Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 3, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@eslint/eslintrc ^3.3.1^3.3.3 age confidence
@eslint/js (source) ^9.37.0^9.39.2 age confidence
eslint (source) ^9.37.0^9.39.2 age confidence
eslint-config-next (source) 15.5.415.5.12 age confidence
eslint-plugin-boundaries ^5.0.2^5.4.0 age confidence
eslint-plugin-react-refresh ^0.4.23^0.5.0 age confidence
eslint-plugin-storybook (source) ^10.1.4^10.2.7 age confidence
prettier (source) ^3.6.2^3.8.1 age confidence
typescript-eslint (source) ^8.46.0^8.54.0 age confidence

Release Notes

eslint/eslintrc (@​eslint/eslintrc)

v3.3.3

Compare Source

Bug Fixes
eslint/eslint (@​eslint/js)

v9.39.2

Compare Source

v9.39.1

Compare Source

v9.39.0

Compare Source

v9.38.0

Compare Source

Features
  • ce40f74 feat: update complexity rule to only highlight function header (#​20048) (Atul Nair)
  • e37e590 feat: correct no-loss-of-precision false positives with e notation (#​20187) (Francesco Trotta)
Bug Fixes
  • 50c3dfd fix: improve type support for isolated dependencies in pnpm (#​20201) (Francesco Trotta)
  • a1f06a3 fix: correct SourceCode typings (#​20114) (Pixel998)
Documentation
  • 462675a docs: improve web accessibility by hiding non-semantic character (#​20205) (루밀LuMir)
  • c070e65 docs: correct formatting in no-irregular-whitespace rule documentation (#​20203) (루밀LuMir)
  • b39e71a docs: Update README (GitHub Actions Bot)
  • cd39983 docs: move custom-formatters type descriptions to nodejs-api (#​20190) (Percy Ma)
Chores
eslint/eslint (eslint)

v9.39.2

Compare Source

v9.39.1

Compare Source

v9.39.0

Compare Source

v9.38.0

Compare Source

Features

  • ce40f74 feat: update complexity rule to only highlight function header (#​20048) (Atul Nair)
  • e37e590 feat: correct no-loss-of-precision false positives with e notation (#​20187) (Francesco Trotta)

Bug Fixes

  • 50c3dfd fix: improve type support for isolated dependencies in pnpm (#​20201) (Francesco Trotta)
  • a1f06a3 fix: correct SourceCode typings (#​20114) (Pixel998)

Documentation

  • 462675a docs: improve web accessibility by hiding non-semantic character (#​20205) (루밀LuMir)
  • c070e65 docs: correct formatting in no-irregular-whitespace rule documentation (#​20203) (루밀LuMir)
  • b39e71a docs: Update README (GitHub Actions Bot)
  • cd39983 docs: move custom-formatters type descriptions to nodejs-api (#​20190) (Percy Ma)

Chores

vercel/next.js (eslint-config-next)

v15.5.12

Compare Source

v15.5.11

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • Tracing: Fix memory leak in span map (#​85529)
  • fix: ensure LRU cache items have minimum size of 1 to prevent unbounded growth (#​89134)
  • Turbopack: fix NFT tracing of sharp 0.34 (#​82340)
  • Turbopack: support pattern into exports field (#​82757)
  • NFT tracing fixes (#​84155 and #​85323)
  • Turbopack: validate CSS without computing all paths (#​83810)
  • feat: implement LRU cache with invocation ID scoping for minimal mode response cache (#​89129)
Credits

Huge thanks to @​timneutkens, @​mischnic, @​ztanner, and @​wyattjoh for helping!

v15.5.10

Compare Source

Please refer the following changelogs for more information about this security release:

v15.5.9

Compare Source

v15.5.8

Compare Source

v15.5.7

Compare Source

v15.5.6

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • Turbopack: don't define process.cwd() in node_modules #​83452
Credits

Huge thanks to @​mischnic for helping!

v15.5.5

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes
  • Split code-frame into separate compiled package (#​84238)
  • Add deprecation warning to Runtime config (#​84650)
  • fix: unstable_cache should perform blocking revalidation during ISR revalidation (#​84716)
  • feat: experimental.middlewareClientMaxBodySize body cloning limit (#​84722)
  • fix: missing next/link types with typedRoutes (#​84779)
Misc Changes
  • docs: early October improvements and fixes (#​84334)
Credits

Huge thanks to @​devjiwonchoi, @​ztanner, and @​icyJoseph for helping!

javierbrea/eslint-plugin-boundaries (eslint-plugin-boundaries)

v5.4.0: Enhance External/Local Dependency Classification for Monorepos

Compare Source

eslint-plugin-boundaries v5.4.0

  • feat(#​349): Add boundaries/flag-as-external setting to allow better control over external module identification
  • feat(#​420): Remove rules validation during linting runtime to improve performance. Validation is performed at configuration load time using eslint schema validation.
  • chore: bump @​boundaries/elements to 1.2.0

@​boundaries/elements v1.2.0

  • feat: Add rootPath and flagAsExternal options to allow better control over external module identification.

website

  • feat: Add boundaries/flag-as-external setting to allow better control over external module identification
  • feat: Add "Monorepo Setup" guide to the documentation, explaining how to configure the plugin in monorepo projects using boundaries/flag-as-external setting.

v5.3.1: Fix elements selector validation

Compare Source

@​boundaries/eslint-plugin v5.3.1

Fixed
  • fix(#​415): Fix elements selector validation error when selector is an empty array

@​boundaries/elements v1.1.2

Fixed
  • fix: Update HANDLEBARS_TEMPLATE_REGEX to fix vulnerability with regex denial of service (ReDoS) attacks.

chore

Changed
  • chore: Bump pnpm to 10. Set pnpm security options. Detect shai-hulud dependencies in workflow
  • chore: bump baseline-browser-mapping to supress warnings

v5.3.0: Documentation Website

Compare Source

Website

  • docs: Add documentation website

@​boundaries/eslint-plugin v5.3.0

Changed
  • docs: Update rule documentation URLs to point to the new JS Boundaries website instead of the GitHub repository. This change improves accessibility and user experience by directing users to a more user-friendly platform for documentation.
Fixed

@​boundaries/elements v1.1.1

Fixed
  • fix: Add missing typeof dependency kind

v5.2.0: Improve performance

Compare Source

eslint-plugin v5.2.0
Added
  • feat: Start supporting new template data and syntax, as described in #​370. Not added to the documentation yet, as it is still in beta testing phase.
  • feat: Add setting legacy-templates to enable/disable the old template data and syntax. By default, it is enabled for backward compatibility. Not added to the documentation yet, as the new template data and syntax is still in beta testing phase.
  • feat(#​371): Publish eslint-plugin both to @​boundaries/eslint-plugin and eslint-plugin-boundaries package names.
  • feat: Add cache setting to enable/disable the new cache mechanism used to boost performance. By default, it is enabled. We recommend to keep it enabled unless you experience issues. In such case, please, open an issue describing the problem.
Changed
  • feat: Improve performance in approximately 30% in large codebases by optimizing cache usage and reducing redundant computations when resolving elements and matching rules.
  • refactor(#​371): Extract element descriptors and matching logic to a separate module to improve code organization, readability and reusability.
  • refactor: Overall performance improvements and code optimizations.
  • feat: Add empty schema to rules without options to validate them correctly.
Fixed
  • fix: Assign internalPaths correctly when in elements setting the mode is 'file' but the pattern matches folders, not files. Now it returns the correct internalPaths instead of the matched folder name.
  • fix: Assign relationships correctly in dependencies. Now ancestor and nephew relationships are assigned correctly. Previously, all ancestors with a common parent were considered uncles.
elements v1.1.0
Added
  • feat: Implement cache for micromatch results, regex and captures to improve performance.
  • feat: Add cache option to allow disabling the cache.
Changed
  • refactor: Overall performance improvements and code optimizations.
Fixed
  • fix: Fix cache performance issues by implementing custom string generation for well-known objects, and removing caching for keys based on complex objects to avoid performance degradation.
  • fix: Legacy selectors being an array with only one element now correctly treated as a single string selector.

v5.1.0: Typings

Compare Source

Added
  • feat(#​346): Add complete TypeScript typings for all plugin settings and rules. Export the main Config type along with individual rule and option types. Support for custom plugin name prefixes.
  • feat: Export constants and type guards for settings keys, rule names, and other configuration-related values.
  • feat: Introduce createConfig helper — ensures valid types, automatically includes the plugin, adds default JS/TS file patterns, and supports custom plugin name prefixes.
  • feat: Add /config export path, exposing the createConfig helper along with related constants and types.
  • feat: Validate dependency nodes — display a warning when a node specified through the additional-dependency-nodes setting is not a valid Literal.
  • feat: Add internal consistency checks — show a diagnostic message with a link to the repository issues page when an unexpected situation occurs.
  • test: Add eslint-plugin-boundaries-e2e private package — runs ESLint programmatically with multiple configurations to ensure plugin reliability across real-world scenarios. Focuses on validating configuration paths, types, and utilities, guaranteeing that the public API behaves correctly post-publication. (Functional behavior remains fully covered by the plugin’s unit tests.)
ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)

v0.5.0

Compare Source

Breaking changes
  • The package now ships as ESM and requires ESLint 9 + node 20. Because legacy config doesn't support ESM, this requires to use flat config
  • A new reactRefresh export is available and prefered over the default export. It's an object with two properties:
    • plugin: The plugin object with the rules
    • configs: An object containing configuration presets, each exposed as a function. These functions accept your custom options, merge them with sensible defaults for that config, and return the final config object.
  • customHOCs option was renamed to extraHOCs
  • Validation of HOCs calls is now more strict, you may need to add some HOCs to the extraHOCs option

Config example:

import { defineConfig } from "eslint/config";
import { reactRefresh } from "eslint-plugin-react-refresh";

export default defineConfig(
  /* Main config */
  reactRefresh.configs.vite({ extraHOCs: ["someLibHOC"] }),
);

Config example without config:

import { defineConfig } from "eslint/config";
import { reactRefresh } from "eslint-plugin-react-refresh";

export default defineConfig({
  files: ["**/*.ts", "**/*.tsx"],
  plugins: {
    // other plugins
    "react-refresh": reactRefresh.plugin,
  },
  rules: {
    // other rules
    "react-refresh/only-export-components": [
      "warn",
      { extraHOCs: ["someLibHOC"] },
    ],
  },
});
Why

This version follows a revamp of the internal logic to better make the difference between random call expressions like export const Enum = Object.keys(Record) and actual React HOC calls like export const MemoComponent = memo(Component). (fixes #​93)

The rule now handles ternaries and patterns like export default customHOC(props)(Component) which makes it able to correctly support files like this one given this config:

{
  "react-refresh/only-export-components": [
    "warn",
    { "extraHOCs": ["createRootRouteWithContext"] }
  ]
}

[!NOTE]
Actually createRoute functions from TanStack Router are not React HOCs, they return route objects that fake to be a memoized component but are not. When only doing createRootRoute({ component: Foo }), HMR will work fine, but as soon as you add a prop to the options that is not a React component, HMR will not work. I would recommend to avoid adding any TanStack function to extraHOCs it you want to preserve good HMR in the long term. Bluesky thread.

Because I'm not 100% sure this new logic doesn't introduce any false positive, this is done in a major-like version. This also give me the occasion to remove the hardcoded connect from the rule. If you are using connect from react-redux, you should now add it to extraHOCs like this:

{
  "react-refresh/only-export-components": ["warn", { "extraHOCs": ["connect"] }]
}

v0.4.26

Compare Source

v0.4.25

Compare Source

  • Report cases like export const ENUM = Object.keys(TABLE) as EnumType[]; (fixes #​93)
  • Allow _ in component names (#​94)

v0.4.24

Compare Source

  • Add "generateImageMetadata", "generateSitemaps" & "generateStaticParams" to allowExportNames in Next config
storybookjs/storybook (eslint-plugin-storybook)

v10.2.7

Compare Source

v10.2.6

Compare Source

v10.2.5

Compare Source

v10.2.4

Compare Source

v10.2.3

Compare Source

v10.2.2

Compare Source

v10.2.1

Compare Source

v10.2.0

Compare Source

Improved UI and story authoring ergonomics

Storybook 10.2 contains hundreds of fixes and improvement including:

  • 💅 New Viewports and Zoom UI
  • 🏭 Typesafe CSF factories for Vue, Angular, Web Components (preview)
  • 📄 MDX support for Storybook MCP (experimental)
List of all updates

Configuration

📅 Schedule: Branch creation - "before 3am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

@vercel
Copy link

vercel bot commented Nov 3, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sanity-ui-storybook Ready Ready Preview, Comment Feb 8, 2026 6:52pm
sanity-ui-workshop Error Error Feb 8, 2026 6:52pm

Request Review

@renovate renovate bot force-pushed the renovate/v4-linters branch from 96ab646 to 6af5e95 Compare November 3, 2025 20:48
@renovate renovate bot force-pushed the renovate/v4-linters branch from 6af5e95 to eb1a131 Compare November 6, 2025 22:01
@renovate renovate bot force-pushed the renovate/v4-linters branch from eb1a131 to ee705eb Compare November 10, 2025 22:55
@renovate renovate bot force-pushed the renovate/v4-linters branch from ee705eb to 6e9ff9a Compare November 13, 2025 23:17
@renovate renovate bot force-pushed the renovate/v4-linters branch from 6e9ff9a to 355c1f9 Compare November 18, 2025 23:10
@renovate renovate bot force-pushed the renovate/v4-linters branch from 355c1f9 to 8b395ca Compare November 20, 2025 18:50
@renovate renovate bot force-pushed the renovate/v4-linters branch from 8b395ca to 1b199b0 Compare November 26, 2025 10:44
@renovate renovate bot force-pushed the renovate/v4-linters branch from 1b199b0 to ce52aac Compare November 27, 2025 17:43
@renovate renovate bot force-pushed the renovate/v4-linters branch from cde6794 to a3b5bf7 Compare February 2, 2026 11:36
@renovate renovate bot force-pushed the renovate/v4-linters branch from a3b5bf7 to 102621d Compare February 2, 2026 15:56
@renovate renovate bot force-pushed the renovate/v4-linters branch from 102621d to 3a7b474 Compare February 4, 2026 11:49
@renovate renovate bot force-pushed the renovate/v4-linters branch from 3a7b474 to 2277e80 Compare February 5, 2026 16:00
@renovate renovate bot force-pushed the renovate/v4-linters branch from 2277e80 to 731bdd9 Compare February 6, 2026 06:24
@socket-security
Copy link

socket-security bot commented Feb 6, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm eslint-plugin-boundaries is 98.0% likely obfuscated

Confidence: 0.98

Location: Package overview

From: package.jsonnpm/eslint-plugin-boundaries@5.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-boundaries@5.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants