Skip to content

chore: Update Web dependencies#2016

Merged
Aureliolo merged 1 commit into
mainfrom
renovate/web
May 19, 2026
Merged

chore: Update Web dependencies#2016
Aureliolo merged 1 commit into
mainfrom
renovate/web

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 19, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@base-ui/react (source) 1.4.1 → 1.5.0 age confidence
@eslint-react/eslint-plugin (source) 5.7.9 → 5.8.2 age confidence
@fontsource-variable/geist (source) 5.2.8 → 5.2.9 age confidence
@fontsource-variable/geist-mono (source) 5.2.7 → 5.2.8 age confidence
@tanstack/react-query (source) 5.100.10 → 5.100.11 age confidence
@types/node (source) 25.8.0 → 25.9.1 age confidence
@types/react (source) 19.2.14 → 19.2.15 age confidence
astro (source) 6.3.3 → 6.3.5 age confidence
motion 12.38.0 → 12.39.0 age confidence
typescript-eslint (source) 8.59.3 → 8.59.4 age confidence
wrangler (source) 4.92.0 → 4.93.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

mui/base-ui (@​base-ui/react)

v1.5.0

Compare Source

May 19, 2026

General changes
Alert Dialog
Autocomplete
Checkbox
Combobox
Dialog
Drawer
Field
Form
Menu
Navigation Menu
Number Field
OTP Field
Popover
Preview Card
Scroll Area
Select
Tabs
Toast
Tooltip

All contributors of this release in alphabetical order: @​aeterno-caspian, @​arturbien, @​atomiks, @​flaviendelangle, @​Janpot, @​lunaxislu, @​lyzno1, @​mattrothenberg, @​michaldudak, @​mj12albert, @​nami8824, @​sai6855, @​stefee, @​twillhorn

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.8.2

Compare Source

📝 Documentation
  • Added React 19 use hook guidance to error-boundaries, rules-of-hooks, and no-use-context docs.
  • Added migration examples and corrected rule descriptions for class-component-related rules.
  • Improved eslint-plugin-react-x rule documentation with scenario-based examples, Troubleshooting sections, and Further Reading links across 48 rule docs (#​1786).
  • Removed inline ESLint error annotations (^^^) from documentation examples for better readability (#​1785).
  • Updated migration guide for eslint-plugin-react with additional details.
🏗️ Internal
  • Set up textlint and fixed inappropriate wording in documentation (#​1787).
  • Bumped dependencies across workspace packages (#​1788).
  • Updated pnpm-lock.yaml: bumped nx to 22.7.2 and brace-expansion to 5.0.5.

Full Changelog: Rel1cx/eslint-react@v5.8.1...v5.8.2

v5.8.1

Compare Source

📝 Documentation
  • Restructured rule documentation across all plugins (eslint-plugin-react-x, eslint-plugin-react-dom, eslint-plugin-react-jsx, eslint-plugin-react-web-api, eslint-plugin-react-naming-convention, eslint-plugin-react-debug, eslint-plugin-react-rsc) from the Common Violations / Invalid / Valid format to the new Examples / scenario-based / Troubleshooting / Further Reading format (#​1784).
  • Updated README tagline and description, removed the Benchmark section, and fixed migration guide links (#​1783).
  • Updated website recipe docs, FAQ, and third-party plugins page (#​1783).
🏗️ Internal
  • Updated scripts/scaffold-rule.ts and the rule request issue template to match the new documentation structure (#​1782).

Full Changelog: Rel1cx/eslint-react@v5.8.0...v5.8.1

v5.8.0

Compare Source

🪄 Improvements
  • react-jsx/no-children-prop, react-jsx/no-children-prop-with-children: Added support for createElement calls in addition to JSX elements (#​1780).
📝 Documentation
  • Added eslint-plugin-perfectionist to the third-party plugins documentation page (#​1778).
🏗️ Internal
  • Bumped import-integrity-lint to 1.0.1.
  • Fixed multiple versions of typescript-eslint and import-integrity-lint in the workspace (#​1776).
  • Increased pnpm minimumReleaseAge to 3 days and updated lockfile (#​1779).
  • Removed .repos directory references from config files (#​1773).
  • Removed obsolete maintenance scripts (create-spec-alignment-issues.sh, migrate-labels.sh) (#​1777).
  • Replaced eslint-plugin-fast-import with import-integrity-lint (#​1774).
  • Simplified the publish CI workflow by skipping install scripts and removing the lint step (#​1775).

Full Changelog: Rel1cx/eslint-react@v5.7.10...v5.8.0

v5.7.10

🐞 Fixes
  • react-x/no-leaked-conditional-rendering, react-x/set-state-in-effect: Added cycle detection to prevent stack overflow in recursive function analysis (#​1769).
📝 Documentation
  • Added third-party-plugins.mdx documentation page.
  • Added spec diff and compiler test fixtures for react-x/globals rule.
  • Updated ESLint Stylistic link to rules anchor.
  • Updated community projects (added Obsidian Copilot).
  • Added redirects and simplified removed docs page.
🏗️ Internal
  • react-x/error-boundaries: Simplified getEnclosingTryBlock implementation.
  • Added minimumReleaseAge and minimumReleaseAgeExclude entries to pnpm-workspace.yaml.
  • Bumped fumadocs-core and fumadocs-ui to 16.8.11.
  • Pinned pnpm to v11 in CI and adjusted install hooks.
  • Fixed the git diff noise issue caused by a large number of external repository files introduced by "Vendored facebook/react as git subtree under .repos" in v5.7.9 (re-released as v5.7.10, closes #​1772).

Full Changelog: Rel1cx/eslint-react@v5.7.8...v5.7.10

fontsource/font-files (@​fontsource-variable/geist)

v5.2.9

Compare Source

fontsource/font-files (@​fontsource-variable/geist-mono)

v5.2.8

Compare Source

TanStack/query (@​tanstack/react-query)

v5.100.11

Patch Changes
withastro/astro (astro)

v6.3.5

Compare Source

Patch Changes

  • #​16771 07c8805 Thanks @​ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).

  • #​16593 50924ce Thanks @​yanthomasdev! - Improves error messages with more consistent and correct writing.

  • #​16757 5d661cd Thanks @​astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

    Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

    Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

v6.3.4

Compare Source

Patch Changes

  • #​16723 0f10bfe Thanks @​matthewp! - Adds fetchFile option to experimental.advancedRouting to customize or disable the entrypoint file

    export default defineConfig({
  experimental: {
    advancedRouting: {
      fetchFile: 'fetch.ts',
    },
  },
});

  • #​16723 0f10bfe Thanks @​matthewp! - Fixes Hono cache() middleware to follow the standard wrapper pattern

  • #​16723 0f10bfe Thanks @​matthewp! - Adds App.Providers interface for typing custom context providers on Astro and ctx

    declare namespace App {
  interface Providers {
    oauth: import('./lib/oauth').OAuthSession;
  }
}

  • #​16723 0f10bfe Thanks @​matthewp! - Adds FetchState.response property, set automatically after pages() or middleware() completes

    const response = await middleware(state, (s) => pages(s));
console.log(state.response === response); // true

  • #​16723 0f10bfe Thanks @​matthewp! - Adds Fetchable type export for typing the advanced routing entrypoint

    import type { Fetchable } from 'astro';

export default {
  async fetch(request) {
    return new Response('ok');
  },
} satisfies Fetchable;

  • #​16572 4a5a077 Thanks @​DORI2001! - Suppresses [WARN] Vite warning: unused imports from "@&#8203;astrojs/internal-helpers/remote" during prerender builds. The package is now bundled alongside astro in the prerender environment, matching how it is handled in the SSR environment.

  • #​16756 b6ee23d Thanks @​astrobot-houston! - Fixes styles from Markdoc/MDX custom components not being extracted to <head> in the dev server when using the Cloudflare adapter with prerenderEnvironment: 'node' and rendering content through a wrapper component.

  • #​16747 904d19a Thanks @​astrobot-houston! - Fixes Astro action requests failing in astro dev when using the Cloudflare adapter with prerenderEnvironment: 'node' alongside a prerendered catch-all route such as [...page].astro.

    Actions and other SSR POST endpoints now continue to work in dev instead of returning an HTTP 500 error.

  • #​16701 3495ce4 Thanks @​demaisj! - Fix Map and Set instances saved in a content collection being broken when retrieving entries.

  • #​16614 fca1c32 Thanks @​Eptagone! - Fixes entry.data type inference when a live collection is configured without a schema.

  • #​16661 03b8f7f Thanks @​ocavue! - Updates typescript to v6. No changes are needed from users.

  • #​16681 c22770a Thanks @​dotnetCarpenter! - Fixes an issue where SVG images with width="0" or height="0" incorrectly threw a NoImageMetadata error instead of being treated as valid dimensions.

motiondivision/motion (motion)

v12.39.0

Compare Source

Added
  • Support for repeatType and repeatDelay in animation sequences.
Fixed
  • Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays.
  • Drag: Preserve in-flight motion value animations across React 19 reorder unmount/remount so dragSnapToOrigin no longer leaves the drag transform stranded after a layout swap.
  • LazyMotion: Share React contexts between the framer-motion and framer-motion/m (and therefore motion/react and motion/react-m) CJS bundles so that <m.div> from the /m subpath picks up features loaded by <LazyMotion> from the main entry point.
  • useScroll: Support hydrating target and container refs from anywhere in the tree.
  • Drag: Gesture no longer starts from incorrect start point when rendered inside <AnimatePresence initial={false} />.
  • Drag: dragConstraints, when set as viewport-relative ref, no longer break on scroll.§
  • Updated visualElement hydration order.
  • useAnimate: Now respects skipAnimations.
  • AnimatePresence: Fix object-form initial values not applied on re-entry after exit completes.
  • scroll: Fixed callback progress when tracking an element.
  • useScroll: Fix hardware acceleration when tracking an element.
typescript-eslint/typescript-eslint (typescript-eslint)

v8.59.4

Compare Source

🩹 Fixes
  • typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#​12340)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

cloudflare/workers-sdk (wrangler)

v4.93.0

Compare Source

Minor Changes

  • #​13901 aac7ca0 Thanks @​bghira! - Add wrangler ai models schema command for fetching model schemas

    You can now run wrangler ai models schema <model> to fetch the input and output schema for a Workers AI model from the public model catalog schema endpoint.

  • #​12656 ae047ee Thanks @​mikenomitch! - Add --containers-rollout=none

    This allows you to skip deploying a container. This is useful if you know that your container is not going to be updated or you don't have Docker locally, but still want to make changes to your Worker.

  • #​13901 aac7ca0 Thanks @​bghira! - Add wrangler ai models list command for querying the Workers AI model catalog

    wrangler ai models list accepts --search, --task, --author, --source, and --hide-experimental, matching the public model catalog search endpoint.

Patch Changes

  • #​13948 b25dc0d Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260515.1 1.20260518.1

  • #​13882 a4f22bc Thanks @​matingathani! - Throw a clear error when a D1 migration is cancelled instead of silently returning

  • #​13950 f78d435 Thanks @​dario-piotrowicz! - Improve the Docker CLI error message to be more actionable.

    Include a link to Docker installation docs, platform-specific instructions for starting the daemon, and guidance for alternative Docker-compatible CLIs.

  • #​11896 c5c9e20 Thanks @​staticpayload! - Surface remote proxy session errors

    When remote bindings fail to start, include the controller reason and root cause in the error message to make failures like missing cloudflared clearer.

  • #​13932 ebf4b24 Thanks @​zebp! - Fix local Workflow startup when compatibility flags include experimental

    Miniflare now deduplicates compatibility flags for the internal Workflow engine service. This prevents wrangler dev from failing with Compatibility flag specified multiple times: experimental when the user's Worker already enables that flag.

  • #​13929 895baf5 Thanks @​Caio-Nogueira! - Prompt to provision a workers.dev subdomain before deploying Workflows

    Wrangler now checks for the account-level workers.dev subdomain when deploying Workflows, even if the Worker is not being published to workers.dev. If the subdomain has not been registered yet, Wrangler prompts to create one before calling the Workflows deploy API so users avoid an opaque server-side deployment failure.

  • #​13930 7bcdf45 Thanks @​shiminshen! - Sweep stale .wrangler/tmp/* dirs left behind by abnormal exits

    A wrangler dev session creates .wrangler/tmp/bundle-* and .wrangler/tmp/dev-* directories at startup and removes them via a signal-exit hook on graceful shutdown. When the process exited abnormally (SIGKILL, OOM, host crash) those directories were left behind and accumulated across sessions, slowing down dependency-walking tools that follow the bundle-emitted absolute-path imports.

    wrangler now sweeps entries in .wrangler/tmp/ older than 24 hours when a new temporary directory is requested, bounding the leak regardless of how prior sessions exited.

  • Updated dependencies [b25dc0d, ebf4b24, b27eb18]:

    • miniflare@​4.20260518.0

Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • Between 12:00 AM and 06:59 AM, only on Saturday (* 0-6 * * 6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from Aureliolo as a code owner May 19, 2026 18:51
@renovate renovate Bot added dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates labels May 19, 2026
@renovate renovate Bot temporarily deployed to lighthouse May 19, 2026 18:52 Inactive
@renovate renovate Bot temporarily deployed to lighthouse May 19, 2026 18:52 Inactive
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 19, 2026 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 6 package(s) with unknown licenses.
See the Details below.

License Issues

.github/package-lock.json

PackageVersionLicenseIssue Type
miniflare4.20260518.0NullUnknown License
wrangler4.93.0NullUnknown License

site/package-lock.json

PackageVersionLicenseIssue Type
@types/react19.2.15NullUnknown License

web/package-lock.json

PackageVersionLicenseIssue Type
@base-ui/react1.5.0NullUnknown License
@base-ui/utils0.2.9NullUnknown License

web/package.json

PackageVersionLicenseIssue Type
@base-ui/react1.5.0NullUnknown License
Allowed Licenses: MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, PSF-2.0, Unlicense, 0BSD, CC0-1.0, CC-BY-3.0, CC-BY-4.0, Python-2.0, Python-2.0.1, LicenseRef-scancode-free-unknown, LicenseRef-scancode-protobuf, LicenseRef-scancode-google-patent-license-golang, ZPL-2.1, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, BlueOak-1.0.0, OFL-1.1
Excluded from license check: pkg:pypi/mem0ai@2.0.1, pkg:pypi/numpy@2.4.4, pkg:pypi/qdrant-client@1.17.1, pkg:pypi/posthog@7.9.12, pkg:pypi/aiohttp@3.13.5, pkg:pypi/cyclonedx-python-lib@11.7.0, pkg:pypi/fsspec@2026.3.0, pkg:pypi/griffelib@2.0.2, pkg:pypi/grpcio@1.80.0, pkg:pypi/charset-normalizer@3.4.6, pkg:pypi/wrapt@2.1.2, pkg:pypi/pytest-codspeed@4.5.0, pkg:pypi/hypothesis@6.152.4, pkg:pypi/litellm@1.83.14, pkg:pypi/openai@2.33.0, pkg:pypi/pyngrok@8.1.2, pkg:pypi/tokenizers@0.23.1, pkg:pypi/typer@0.25.0, pkg:npm/@img/sharp-wasm32@0.33.5, pkg:npm/@img/sharp-win32-ia32@0.33.5, pkg:npm/@img/sharp-win32-x64@0.33.5, pkg:npm/json-schema-typed@8.0.2, pkg:npm/victory-vendor@37.3.6, pkg:pypi/scikit-learn@1.8.0, pkg:pypi/torch@2.11.0, pkg:pypi/cuda-bindings@13.2.0, pkg:pypi/cuda-pathfinder@1.5.0, pkg:pypi/cuda-toolkit@13.0.2, pkg:pypi/nvidia-cublas@13.1.0.3, pkg:pypi/nvidia-cuda-cupti@13.0.85, pkg:pypi/nvidia-cuda-nvrtc@13.0.88, pkg:pypi/nvidia-cuda-runtime@13.0.96, pkg:pypi/nvidia-cudnn-cu13@9.19.0.56, pkg:pypi/nvidia-cufft@12.0.0.61, pkg:pypi/nvidia-cufile@1.15.1.6, pkg:pypi/nvidia-curand@10.4.0.35, pkg:pypi/nvidia-cusolver@12.0.4.66, pkg:pypi/nvidia-cusparse@12.6.3.3, pkg:pypi/nvidia-cusparselt-cu13@0.8.0, pkg:pypi/nvidia-nccl-cu13@2.28.9, pkg:pypi/nvidia-nvjitlink@13.0.88, pkg:pypi/nvidia-nvshmem-cu13@3.4.5, pkg:pypi/nvidia-nvtx@13.0.85

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@cloudflare/workerd-darwin-64 1.20260518.1 UnknownUnknown
npm/@cloudflare/workerd-darwin-arm64 1.20260518.1 UnknownUnknown
npm/@cloudflare/workerd-linux-64 1.20260518.1 UnknownUnknown
npm/@cloudflare/workerd-linux-arm64 1.20260518.1 UnknownUnknown
npm/@cloudflare/workerd-windows-64 1.20260518.1 UnknownUnknown
npm/miniflare 4.20260518.0 UnknownUnknown
npm/workerd 1.20260518.1 UnknownUnknown
npm/wrangler 4.93.0 UnknownUnknown
npm/@types/react 19.2.15 UnknownUnknown
npm/astro 6.3.5 UnknownUnknown
npm/@base-ui/react 1.5.0 UnknownUnknown
npm/@base-ui/utils 0.2.9 UnknownUnknown
npm/@eslint-react/ast 5.8.2 UnknownUnknown
npm/@eslint-react/core 5.8.2 UnknownUnknown
npm/@eslint-react/eslint 5.8.2 UnknownUnknown
npm/@eslint-react/eslint-plugin 5.8.2 UnknownUnknown
npm/@eslint-react/jsx 5.8.2 UnknownUnknown
npm/@eslint-react/shared 5.8.2 UnknownUnknown
npm/@eslint-react/var 5.8.2 UnknownUnknown
npm/@fontsource-variable/geist 5.2.9 UnknownUnknown
npm/@fontsource-variable/geist-mono 5.2.8 UnknownUnknown
npm/@tanstack/query-core 5.100.11 UnknownUnknown
npm/@tanstack/react-query 5.100.11 UnknownUnknown
npm/@types/node 25.9.1 UnknownUnknown
npm/@types/react 19.2.15 UnknownUnknown
npm/@typescript-eslint/eslint-plugin 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/parser 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/project-service 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/scope-manager 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/tsconfig-utils 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/type-utils 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/types 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/typescript-estree 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/utils 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@typescript-eslint/visitor-keys 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/eslint-plugin-react-dom 5.8.2 UnknownUnknown
npm/eslint-plugin-react-jsx 5.8.2 UnknownUnknown
npm/eslint-plugin-react-naming-convention 5.8.2 UnknownUnknown
npm/eslint-plugin-react-rsc 5.8.2 UnknownUnknown
npm/eslint-plugin-react-web-api 5.8.2 UnknownUnknown
npm/eslint-plugin-react-x 5.8.2 UnknownUnknown
npm/framer-motion 12.39.0 UnknownUnknown
npm/motion 12.39.0 UnknownUnknown
npm/motion-dom 12.39.0 UnknownUnknown
npm/motion-utils 12.39.0 UnknownUnknown
npm/typescript-eslint 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@base-ui/react 1.5.0 UnknownUnknown
npm/@eslint-react/eslint-plugin 5.8.2 UnknownUnknown
npm/@fontsource-variable/geist 5.2.9 UnknownUnknown
npm/@fontsource-variable/geist-mono 5.2.8 UnknownUnknown
npm/@tanstack/react-query 5.100.11 UnknownUnknown
npm/@types/node 25.9.1 UnknownUnknown
npm/@types/react 19.2.15 UnknownUnknown
npm/motion 12.39.0 UnknownUnknown
npm/typescript-eslint 8.59.4 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 8Found 24/27 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • .github/package-lock.json
  • site/package-lock.json
  • web/package-lock.json
  • web/package.json

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 19, 2026 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addednpm/​@​types/​grecaptcha@​3.0.91001007180100
Updatednpm/​@​types/​react@​19.2.14 ⏵ 19.2.151001007988 +1100
Addednpm/​vitest@​4.1.6961007999100
Updatednpm/​@​types/​node@​25.8.0 ⏵ 25.9.110010081 +196 +1100
Addednpm/​@​astrojs/​sitemap@​3.7.21001008289100
Addednpm/​@​astrojs/​react@​5.0.5991008296100
Updatednpm/​@​fontsource-variable/​geist@​5.2.8 ⏵ 5.2.999 +110083 +289 +690
Updatednpm/​@​fontsource-variable/​geist-mono@​5.2.7 ⏵ 5.2.897 +110083 +28890
Addednpm/​tailwindcss@​4.3.01001008498100
Updatednpm/​@​tanstack/​react-query@​5.100.10 ⏵ 5.100.11991008899 +1100
Addednpm/​astro@​6.3.5971008898100
Updatednpm/​@​base-ui/​react@​1.4.1 ⏵ 1.5.09010089 +196100
Updatednpm/​@​eslint-react/​eslint-plugin@​5.7.9 ⏵ 5.8.29910010096100

View full report

@renovate renovate Bot temporarily deployed to cloudflare-preview May 19, 2026 18:53 Inactive
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented May 19, 2026 •
edited
Loading

Merging this PR will not alter performance

✅ 21 untouched benchmarks
⏩ 33 skipped benchmarks1

Comparing renovate/web (14abe56) with main (29b64e3)

Open in CodSpeed

Footnotes

  1. 33 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@renovate renovate Bot force-pushed the renovate/web branch from 1a36e41 to 14abe56 Compare May 19, 2026 19:25
@renovate renovate Bot temporarily deployed to lighthouse May 19, 2026 19:26 Inactive
@renovate renovate Bot temporarily deployed to lighthouse May 19, 2026 19:26 Inactive
@renovate renovate Bot temporarily deployed to cloudflare-preview May 19, 2026 19:27 Inactive
Aureliolo
Aureliolo approved these changes May 19, 2026
View reviewed changes
Copy link
Copy Markdown
Owner

@Aureliolo Aureliolo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Decision: Minor/patch-only web dependency bump (11 packages, no major); CI fully green (Dashboard Test/Lint/Type-Check/Storybook/Lighthouse/visual-e2e all SUCCESS); the single BREAKING changelog item is confirmed unused; no actionable items.

Changelog digest:

  • Covered: @base-ui/react 1.4.1->1.5.0, @eslint-react/eslint-plugin 5.7.9->5.8.2, @fontsource-variable/geist 5.2.8->5.2.9, geist-mono 5.2.7->5.2.8, @tanstack/react-query 5.100.10->5.100.11, @types/node 25.8.0->25.9.1, @types/react 19.2.14->19.2.15, astro 6.3.3->6.3.5, motion 12.38.0->12.39.0, typescript-eslint 8.59.3->8.59.4, wrangler 4.92.0->4.93.0.
  • Relevant (improvements/bugfixes, no action): base-ui 1.5.0 improves mount perf (interaction splitting), fixes focus-steal and RTL behaviour for Popover/Select/ScrollArea/NavMenu (used across 24+ component files) - pure benefit; motion 12.39.0 fixes React 19 reorder-drag and LazyMotion CJS context sharing; astro 6.3.5 fixes the position-prop CSP break + dev-server stale content (site/).
  • Reviewed but not relevant: base-ui 1.5.0 BREAKING renames OTP Field sanitizeValue()->normalizeValue() - grep confirms zero OTP-field usage in web/src; the Tabs onValueChange auto-selection fire is benign for our only base-ui Tabs.Root (controlled value={activeTab}, idempotent react-router navigate); wrangler 4.93.0 new ai models / --containers-rollout=none commands unused (static Pages deploy, no Workers AI/containers); react-query patch is a dep-bump-only; @types/* + typescript-eslint + eslint-react (docs-only) + fontsource are trivial.

Follow-ups: none.

@Aureliolo Aureliolo merged commit 7a7fe76 into main May 19, 2026
79 checks passed
@Aureliolo Aureliolo deleted the renovate/web branch May 19, 2026 20:10
@Aureliolo Aureliolo temporarily deployed to cloudflare-preview May 19, 2026 20:10 — with GitHub Actions Inactive
@synthorg-repo-bot synthorg-repo-bot Bot mentioned this pull request May 19, 2026
Merged
Aureliolo pushed a commit that referenced this pull request May 19, 2026
@synthorg-repo-bot @github-actions
chore(main): release 0.8.6 (#2002)
f60e9ed 
<!-- HIGHLIGHTS_START -->
## Highlights

> _AI-generated summary (model: `openai/gpt-4.1-mini` via GitHub
Models). Commit-based changelog below._

### What you'll notice
- Multi-agent coordination is now active immediately on startup for
smoother operation.
- Governance rules are fully enforced during use, ensuring compliance at
all times.
- Coordination metrics update live, giving real-time insights into
system activity.
- Review agents are now reliably processed, preventing silent drops in
tasks.
- Sandbox containers can be reused for agents and tasks, speeding up
execution and reducing overhead.

### What's new
- Agents support online runtime with a minimal safety framework to
improve stability.
- Recorded LLM interactions can be deterministically replayed at the
provider interface.
- Distributed path validation has been enhanced for more robust data
routing.
- A client-simulation runtime was added for end-to-end testing of the
IntakeEngine.
- A new work pipeline spine architecture has been introduced to
streamline task processing.

### Under the hood
- Infrastructure, Python, and web dependencies have all been updated to
latest versions.
- Updated apko lockfiles in the CI/CD pipeline improve build
consistency.

<!-- HIGHLIGHTS_END -->

:robot: I have created a release *beep* *boop*
---


##
[0.8.6](v0.8.5...v0.8.6)
(2026-05-19)


### Features

* agent runtime online + minimal safety spine (runtime root)
([#2003](#2003))
([e5eef1a](e5eef1a)),
closes [#1956](#1956)
* deterministic recorded-LLM cassette replay at the provider chokepoint
([#2010](#2010))
([cabf55d](cabf55d))
* distributed path validation + hardening
([#2011](#2011))
([a382e4a](a382e4a)),
closes [#1966](#1966)
* wire IntakeEngine via boot client-simulation runtime (e2e test
harness) ([#2006](#2006))
([6a9c0aa](6a9c0aa)),
closes [#1961](#1961)
* work pipeline spine
([#1960](#1960))
([#2013](#2013))
([29b64e3](29b64e3))


### Bug Fixes

* bring the multi-agent coordinator online at boot
([#2007](#2007))
([180b38a](180b38a)),
closes [#1958](#1958)
* full governance enforcement online
([#1957](#1957))
([#2005](#2005))
([4140fc5](4140fc5))
* harden anti-ghost-wiring gate and fix silently-dropped review agents
([#2000](#2000))
([89b57ce](89b57ce))
* make coordination metrics live
([#1959](#1959))
([#2012](#2012))
([c4775e2](c4775e2))
* sandbox lifecycle dispatch (per-agent / per-task container reuse)
([#2008](#2008))
([03d2587](03d2587)),
closes [#1965](#1965)


### Documentation

* add GitButler concept-only concurrency research
([#1978](#1978))
([#2009](#2009))
([9e4f5c1](9e4f5c1))
* honest-hybrid refresh of README, site, and design specs
([#2001](#2001))
([f485bea](f485bea))


### CI/CD

* update apko lockfiles
([#2004](#2004))
([e2b9eee](e2b9eee))


### Maintenance

* Update Infrastructure dependencies
([#2014](#2014))
([0b16bdf](0b16bdf))
* Update Python dependencies
([#2015](#2015))
([a7224bb](a7224bb))
* Update Web dependencies
([#2016](#2016))
([7a7fe76](7a7fe76))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: synthorg-repo-bot[bot] <279117679+synthorg-repo-bot[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aureliolo Aureliolo Aureliolo approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file scope:web Vue 3 dashboard type:chore Maintenance, cleanup, dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Aureliolo