[dependabot]

Bumps the development-dependencies group with 6 updates in the / directory:

Package	From	To
@eslint/js	9.39.4	10.0.1
@vitejs/plugin-react	6.0.1	6.1.2
eslint	9.39.4	10.13.0
eslint-plugin-react-refresh	0.5.2	0.5.7
globals	17.5.0	17.13.0
vite	8.0.8	8.3.5

Updates @eslint/js from 9.39.4 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

• c87d5bd fix: update eslint (#20531) (renovate[bot])
• d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
• 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
• 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

• 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
• 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
• b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

• e5c281f chore: updates for v9.39.3 release (Jenkins)
• 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
• 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
• 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
• da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
• 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

• f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
• a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
• c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
• fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
• 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
• 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
• ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
• 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
• c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
• 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
• a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
• a89059d feat!: Program range span entire source text (#20133) (Pixel998)
• 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
• f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
• aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
• f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
• 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
• 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
• 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
• 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
• f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

• bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
• 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
• 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

• 84fb885 chore: package.json update for @​eslint/js release
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
• f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
• b4b3127 chore: package.json update for @​eslint/js release
• 0b14059 chore: package.json update for @​eslint/js release
• fa31a60 feat!: add name to configs (#20015)
• 1e2cad5 chore: package.json update for @​eslint/js release
• 454a292 feat!: update eslint:recommended configuration (#20210)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
• See full diff in compare view

Updates @vitejs/plugin-react from 6.0.1 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

... (truncated)

Commits

• ac47648 release: plugin-react@6.1.2 (#1491)
• 98277e7 fix(deps): update all non-major dependencies (#1486)
• 12eddea fix(hmr): better handle compound components (#1484)
• 3cfb1d1 fix(plugin-react): fix compiler.logDiagnostics (#1483)
• 6de9915 fix(plugin-react): disable refresh for non-jsx with compiler enabled (#1485)
• ee97d2f fix(deps): update all non-major dependencies (#1445)
• b0a014d chore: use Babel 8 for babel compiler playgrounds (#1460)
• 61b650f fix(deps): update react-related dependencies (#1452)
• 736efe2 chore(deps): update tsdown to v0.23 (#1451)
• 04cac50 release: plugin-react@6.1.1 (#1440)
• Additional commits viewable in compare view

Updates eslint from 9.39.4 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])

... (truncated)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Updates eslint-plugin-react-refresh from 0.5.2 to 0.5.7

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

v0.5.6

• Support re-exporting namespace components (fixes #116)

v0.5.5

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #114 (fixes #113)
• Add contentType and size to allowExportNames in Next config #115

v0.5.4

• Add instant to allowExportNames in Next config #112

v0.5.3

• Fix check for non component class exported via export { } #110 (fixes #109)

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

0.5.6

• Support re-exporting namespace components (fixes #116)

0.5.5

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #114 (fixes #113)
• Add contentType and size to allowExportNames in Next config #115

0.5.4

• Add instant to allowExportNames in Next config #112

0.5.3

• Fix check for non component class exported via export { } #110 (fixes #109)

Commits

• fd40d83 Add allowCompoundComponents option [publish] (#117)
• 620568a Support re-exporting namespace components (fixes #116) [publish]
• 65c3172 [publish] v0.5.5
• 8411020 Bump deps
• c28fa15 Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly ...
• 554c764 [publish] add contentType and size to allowExportNames in Next config (#115)
• e316617 [publish] Add instant to allowExportNames in Next config (#112)
• 00818e9 v0.5.3 [publish]
• 202fc4a Fix PascalCase class exported via export { Name } incorrectly treated as Re...
• See full diff in compare view

Updates globals from 17.5.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

• Update globals (2026-10-01) (#354) b007369

---

sindresorhus/globals@v17.12.0...v17.13.0

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

v17.11.0

• Add react-native globals (#337) 61eafbf

---

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

• Add GM_cookie to Greasemonkey globals (#349) f468407

---

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

• Update globals (2026-08-01) (#348) 5a958ed

---

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

• Update globals (2026-06-22) (#345) 33b75f9

---

sindresorhus/globals@v17.6.0...v17.7.0

... (truncated)

Commits

• ce512bc 17.13.0
• b007369 Update globals (2026-10-01) (#354)
• 16cb1fe Meta tweaks
• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• 8c59927 17.11.0
• 61eafbf Add react-native globals (#337)
• 7bed4af 17.10.0
• f468407 Add GM_cookie to Greasemonkey globals (#349)
• Additional commits viewable in compare view

Updates vite from 8.0.8 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transform...

  Description has been truncated