fix(deps): update minor updates (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint-react/eslint-plugin (source)	2.7.4 → 2.12.4
astro-eslint-parser	^1.2.2 → ^1.3.0
globals	17.2.0 → 17.3.0
pnpm (source)	10.28.2 → 10.29.3
read-pkg	^10.0.0 → ^10.1.0

---

Release Notes

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v2.12.4

Compare Source

🐞 Fixes

• Fix preact and preact/compat support in no-implicit-key rule by @​Rel1cx in #​1494

🪄 Improvements

• Refactor dom/no-unknown-property rule to fix all ESLint and TypeScript issues by @​ulrichstark in #​1490

Full Changelog: Rel1cx/eslint-react@v2.12.2...v2.12.4

v2.12.2

Compare Source

🐞 Fixes

• Reduce the sensitivity of component detection to prevent false positives in certain rules, closes #​1488 by @​Rel1cx in #​1489

Full Changelog: Rel1cx/eslint-react@v2.12.1...v2.12.2

v2.12.1

Compare Source

🐞 Fixes

• Check all union constituents and allow all types under React namespace in no-implicit-key by @​Rel1cx in #​1487

Full Changelog: Rel1cx/eslint-react@v2.12.0...v2.12.1

v2.12.0

Compare Source

🪄 Improvements

• Upgrade ESLint to v10 across the repo by @​Rel1cx in #​1486

📝 Changes you should be aware of

ESLint v10 is now supported and used throughout the repository. The minimum required ESLint version remains v8.57.0, but the project now supports and is tested against ESLint v10.

Full Changelog: Rel1cx/eslint-react@v2.11.2...v2.12.0

v2.11.2

Compare Source

🐞 Fixes

• Implement a more robust check to handle cases that getFullyQualifiedName cannot handle in no-implicit-key, closes #​1476 by @​Rel1cx in #​1480

🪄 Improvements

• Bump esbuild, node types, jsdoc plugin

Full Changelog: Rel1cx/eslint-react@v2.11.1...v2.11.2

v2.11.1

Compare Source

🐞 Fixes

• Fix React internal key checks in no-implicit-key, closes #​1476 by @​Rel1cx in #​1479
• Add no-implicit-key rule to disable-type-checked config of eslint-plugin-react-x, closes #​1477 by @​Rel1cx in #​1478

Full Changelog: Rel1cx/eslint-react@v2.11.0...v2.11.1

v2.11.0

Compare Source

✨ New

• Add RSC rules to recommended presets by @​Rel1cx in #​1475

Full Changelog: Rel1cx/eslint-react@v2.10.1...v2.11.0

v2.10.1

Compare Source

🐞 Fixes

• Relax no-implicit-key rule for React internally defined keys, closes #​1472 by @​Rel1cx in #​1474

Full Changelog: Rel1cx/eslint-react@v2.10.0...v2.10.1

v2.10.0

Compare Source

• Refactor no-implicit-key rule to use type checking by @​Rel1cx in #​1466
• Move no-unnecessary-use-ref to removed rules, closes #​1417 by @​Rel1cx in #​1471

📝 Changes you should be aware of

1. The no-implicit-key rule has been updated to use type checking and moved from recommended to type-checked presets.
2. The no-unnecessary-use-ref rule has been moved to removed rules, because the rule is hard to get right.

Full Changelog: Rel1cx/eslint-react@v2.9.4...v2.10.0

v2.9.4

Compare Source

🐞 Fixes

• Fix sub-plugin's READMEs by @​Rel1cx in #​1465

Full Changelog: Rel1cx/eslint-react@v2.9.3...v2.9.4

v2.9.3

Compare Source

📝 Changes you should be aware of

The following rules have been deprecated and will be removed in the next major version:

• no-default-props
• no-prop-types
• no-string-refs

For legacy codebases, use no-restricted-syntax as an alternative:

{
    files: ['**/*.jsx', '**/*.tsx'],
    rules: {
        "no-restricted-syntax": [
            "error",
            {
                "selector": "AssignmentExpression[operator='='][left.property.name='defaultProps']",
                "message": "[Deprecated] Use ES6 default parameters instead."
            },
            {
                "selector": "AssignmentExpression[operator='='][left.property.name='propTypes']",
                "message": "[Deprecated] Use TypeScript or another type-checking solution instead."
            },
            {
                "selector": "JSXAttribute[name.name='ref'][value.type='Literal']",
                "message": "[Deprecated] Use callback refs instead."
            }
        ]
    }
}

Full Changelog: Rel1cx/eslint-react@v2.9.2...v2.9.3

v2.9.2

🐞 Fixes

• Fix directives checks by @​Rel1cx in #​1461
• Add missing rsc plugin to all config, closes #​1462 by @​Rel1cx in #​1463

🪄 Improvements

• Separate message ids for rsc/function-definition by @​SukkaW in #​1460

Full Changelog: Rel1cx/eslint-react@v2.9.0...v2.9.2

v2.9.0

Compare Source

✨ New

• Migrate no-non-async-server-functions rule to rsc/function-definition by @​Rel1cx in #​1457
• Add a new eslint-plugin-react-rsc sub-plugin for React Server Components (RSC) rules by @​Rel1cx in #​1457
• Add a new rsc preset to enable RSC rules by @​Rel1cx in #​1457
• Add a new disable-rsc preset to disable RSC rules by @​Rel1cx in #​1457

🪄 Improvements

• Move grouped docs from the global overview to per-plugin READMEs by @​Rel1cx in #​1449

📝 Changes you should be aware of

The no-non-async-server-functions rule has been migrated to rsc/function-definition. Please update your configuration accordingly if you are using it.

Full Changelog: Rel1cx/eslint-react@v2.8.4...v2.9.0

v2.8.4

Compare Source

🐞 Fixes

• Change status of jsx-shorthand-boolean rule in migration table by @​connorshea in #​1446
• Fix rule name in docs for debug/is-from-ref by @​amir-rahmanii in #​1445
• Fix rule name in docs for no-non-async-server-functions by @​Rel1cx in #​1447
• Mark no-non-async-server-functions as experimental by @​Rel1cx in #​1448

v2.8.3

Compare Source

✨ New

• feat(#​1435): implements no-non-async-server-functions by @​SukkaW in #​1443

Full Changelog: Rel1cx/eslint-react@v2.8.1...v2.8.3

v2.8.1

Compare Source

✨ New

• Function component detection now supports identifying components that don't return a ReactNode but have a 'use memo' or 'use no memo' directive by @​Rel1cx in #​1440
  The function in below example will be detected as a function component in relevant rules:

  function App() {
    "use memo";
  }
  
  function App() {
    "use no memo";
  }

🐞 Fixes

• Skip unstable value checks when 'use memo'; is present by @​Rel1cx in #​1441

Full Changelog: Rel1cx/eslint-react@v2.8.0...v2.8.1

v2.8.0

Compare Source

✨ New

• Function component detection now supports identifying components that don't return a ReactNode but call React Hooks by @​Rel1cx in #​1438
  The function in below example will be detected as a function component in relevant rules:

  function App() {
    useEffect(() => {}, []);
  }

🐞 Fixes

• Revert no-unnecessary-key to remove constant key checking, closes #​1436 by @​Rel1cx in #​1439

Full Changelog: Rel1cx/eslint-react@v2.7.4...v2.8.0

ota-meshi/astro-eslint-parser (astro-eslint-parser)

v1.3.0

Compare Source

Minor Changes

• #​395 5a0afb3 Thanks @​ota-meshi! - feat: improve compatibility with eslint v10

sindresorhus/globals (globals)

v17.3.0

Compare Source

• Update globals (2026-02-01) (#​336) 295fba9

---

pnpm/pnpm (pnpm)

v10.29.3

Compare Source

v10.29.2

Compare Source

v10.29.1: pnpm 10.29.1

Compare Source

Minor Changes

• The pnpm dlx / pnpx command now supports the catalog: protocol. Example: pnpm dlx shx@catalog:.
• Support configuring auditLevel in the pnpm-workspace.yaml file #​10540.
• Support bare workspace: protocol without version specifier. It is now treated as workspace:* and resolves to the concrete version during publish #​10436.

Patch Changes

• Fixed pnpm list --json returning incorrect paths when using global virtual store #​10187.

• Fix pnpm store path and pnpm store status using workspace root for path resolution when storeDir is relative #​10290.

• Fixed pnpm run -r failing with "No projects matched the filters" when an empty pnpm-workspace.yaml exists #​10497.

• Fixed a bug where catalogMode: strict would write the literal string "catalog:" to pnpm-workspace.yaml instead of the resolved version specifier when re-adding an existing catalog dependency #​10176.

• Fixed the documentation URL shown in pnpm completion --help to point to the correct page at https://pnpm.io/completion #​10281.

• Skip local file: protocol dependencies during pnpm fetch. This fixes an issue where pnpm fetch would fail in Docker builds when local directory dependencies were not available #​10460.

• Fixed pnpm audit --json to respect the --audit-level setting for both exit code and output filtering #​10540.

• update tar to version 7.5.7 to fix security issue

  Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842

• Fix pnpm audit --fix replacing reference overrides (e.g. $foo) with concrete versions #​10325.

• Fix shamefullyHoist set via updateConfig in .pnpmfile.cjs not being converted to publicHoistPattern #​10271.

• pnpm help should correctly report if the currently running pnpm CLI is bundled with Node.js #​10561.

• Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for node_modules/.bin, causing binaries to not be found when running commands like pnpm exec #​10457.

Platinum Sponsors

Gold Sponsors

sindresorhus/read-pkg (read-pkg)

v10.1.0

Compare Source

• Update dependencies 7906992

---

---

Configuration

📅 Schedule: Branch creation - "after 10:00 before 19:00 every weekday except after 13:00 before 14:00" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Thank you for following the naming conventions! 🙏

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	astro-eslint-parser@​1.2.2 ⏵ 1.3.0				+7
	@​eslint-react/​eslint-plugin@​2.12.4

View full report