[dependabot]

Bumps the workspace group with 48 updates:

Package	From	To
convex	1.45.0	1.46.0
zod	4.6.2	4.6.5
@biomejs/biome	2.5.12	2.5.14
@types/node	26.4.1	26.6.3
fallow	3.22.0	3.30.0
lint-staged	17.5.0	17.6.0
react-doctor	0.9.13	0.9.14
turbo	2.10.12	2.11.5
vite	8.2.2	8.3.1
@tauri-apps/cli	2.11.4	2.12.0
@convex-dev/agent	0.7.1	0.7.3
@tanstack/react-router	1.170.33	1.170.40
@tauri-apps/api	2.11.1	2.12.0
lucide-react	1.41.0	1.48.0
maplibre-gl	6.9.0	6.11.2
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.7	19.3.0
@tanstack/router-cli	1.167.34	1.167.39
@tanstack/router-plugin	1.168.36	1.168.41
@vitest/coverage-istanbul	5.0.0	5.0.2
jsdom	30.0.1	30.1.1
vitest	5.0.0	5.0.2
@json-render/core	0.20.0	0.21.0
@json-render/react	0.20.0	0.21.0
@json-render/shadcn	0.20.0	0.21.0
@better-auth/passkey	1.6.26	1.7.6
@better-fetch/fetch	1.3.1	1.3.2
better-auth	1.6.26	1.7.6
@ai-sdk/anthropic	4.0.49	4.0.68
@ai-sdk/google	4.0.64	4.0.85
@ai-sdk/openai	4.0.60	4.0.80
@ai-sdk/provider	4.0.10	4.0.19
@convex-dev/rate-limiter	0.3.2	0.4.0
ai	7.0.93	7.0.122
isomorphic-git	1.41.9	1.42.3
memfs	4.71.0	4.79.0
convex-test	0.0.56	0.0.60
@fontsource/google-sans-code	5.3.0	5.3.1
@tanstack/react-table	8.21.2	9.2.4
@tanstack/table-core	8.21.2	9.2.4
react-day-picker	9.14.0	10.0.1
tailwind-merge	3.6.0	3.7.0
@remotion/bundler	4.0.523	4.0.529
@remotion/cli	4.0.523	4.0.529
@remotion/renderer	4.0.523	4.0.529
remotion	4.0.523	4.0.529

Updates convex from 1.45.0 to 1.46.0

Changelog

Sourced from convex's changelog.

1.46.0

• Added .optional() to all validators. For example, v.string().optional() is equivalent to v.optional(v.string()). This changes TypeScript compatibility between validators from different Convex versions; projects sharing validators across packages may need to align their convex dependency versions.
• npx convex deploy --dry-run now warns when a schema change requires checking every document in large tables against the new schema, since these deploys can take a long time. The warning lists the affected tables along with their document counts and sizes.
• Fixed a bug where npx convex deploy could fail with a deployment:data:view permission error when deleting indexes with a deploy key that only has deployment:deploy. The CLI now reuses the schema evaluation response to size the affected tables instead of reading them directly, so deployment:data:view is no longer required.
• convex/server exports FunctionReference_future, a reference type whose arguments are checked similar to the way Convex checks them at runtime. Use it instead of FunctionReference when you accept someone else's Convex function as a callback and know which arguments you will pass it. Behavior summary: it rejects a function requiring arguments you never pass, rejects a function that does not declare a top-level argument you do pass, and accepts a function taking broader values than you pass. A plain FunctionReference gets the first and third backwards. The surplus-key check stops at the top level: a surplus key inside a nested object, array element, or union arm is not detected. A value of the type is usable with ctx.runMutation, ctx.scheduler.runAfter, createFunctionHandle, and every other API in this package that takes a reference, all of which now accept FunctionReference | FunctionReference_future. It is deliberately not assignable to a plain FunctionReference, so forwarding one into code typed that way is a compile error rather than a silent loss of argument checking. Library code that wants to accept either kind of reference should take that same union and read arguments and return types through FunctionArgs and FunctionReturnType, which accept either kind.
• As a part of the FunctionReference_future work, the _args and _returnType slots on FunctionReference are deprecated. They'll be removed in a future version. FunctionReference gains an optional _fn slot that enables the checked comparison of args.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by ayushdewanconvex, a new releaser for convex since your current version.

Updates zod from 4.6.2 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.12 to 2.5.14

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.14

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

• #11790 17d0ff0 Thanks @​ematipico! - Fixed #10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.

... (truncated)

Commits

• af4365d ci: release (#11711)
• 7ee3a6c fix(useExhaustiveSwitchCases): add option requireExplicitCase (#11777)
• 02ea438 feat(json_analyze): implement noJsonUnsafeValues (#9758)
• 64fd314 feat(json_analyze): implement useConsistentObjectKeys (#9797)
• a9c4aa0 feat(html): detect undeclared custom Vue directives (#11651)
• 1fc17e3 feat: expand useIncludes (#11739)
• 71eaa0d feat(lint/html/svelte): add noSvelteAtDebugTags (#11754)
• 9bd70c7 fix: various bug fixes (#11735)
• c7c4e2b fix(analyzer): various bugs (#11720)
• 5eb5f09 feat(biome_js_analyze): implement useValidTestTitle rule (#9176) (#11725)
• Additional commits viewable in compare view

Updates @types/node from 26.4.1 to 26.6.3

Commits

• See full diff in compare view

Updates fallow from 3.22.0 to 3.30.0

Release notes

Sourced from fallow's releases.

v3.30.0: flag retirement report, startup import weight, faster language server, Oxc 0.151

Features

• fallow flags --retirement reports the flags that you can retire. Each row groups every site of one flag and lists the reasons to remove it. The reasons are single-read-site, test-only, literal-constant, identical-branches, empty-branch, guards-dead-code and defined-never-read. The literal-constant reason adds the new kind constant for a flag-prefixed module-level const with a literal value, such as const FEATURE_NEW_UI = true. A guard in the same module must test the flag. These flags are in the retirement report only, not in feature_flags[]. The defined-never-read reason also covers a Vercel flag() definition with an unused export, and an unused member of a flag registry enum. The reasons come from the code only, so they do not show the production state of the flag.
• The retirement report works in every fallow flags format and gives each flag an age from git. JSON adds a top-level retirement object, and human and markdown output add a "Retirement candidates" section. Compact adds flag-retire: lines, SARIF adds the rule fallow/flag-retirement-candidate at level note, and CodeClimate adds fallow/flag-retirement issues. --flag-age blame (the default), --flag-age pickaxe and --flag-age off set how Fallow measures the age. --reason, --min-age, --sort age|sites|name and --top filter and order the rows. Fallow removes no code. Every action has auto_fixable: false. fallow explain flag-retirement describes the rule.
• fallow flags --retirement --flag-state <FILE> compares the code with a vendor flag export. The file is a local JSON file with one vendor-neutral schema, and Fallow reads it offline without credentials or network calls. The export adds the reasons fully-rolled-out, archived-in-vendor, missing-in-vendor and vendor-only. The vendor-only rows do not count in summary.distinct_flags. The new flags.vendorKeyPrefix config key removes a prefix from each vendor key before the match. An invalid file, or a file larger than 16 MiB, exits with code 2 and the error code FALLOW_FLAG_STATE_INVALID.
• fallow flags --retirement can gate CI on flag counts and flag age. --save-regression-baseline <PATH> writes a baseline with a new flags section. --fail-on-regression --regression-baseline <PATH> exits with code 1 when distinct_flags grows more than --tolerance. --max-flag-age <DAYS> exits with code 1 when a flag in scope is older than that limit. Each gate reports a status of pass, exceeded or skipped, and prints the result to stderr in every format. A run with --changed-since or --workspace skips the regression gate and saves no baseline. Without --retirement, the regression options have no effect on fallow flags, and the command prints a warning.
• The MCP feature_flags tool and the Rust API can return the retirement report. The MCP tool adds the retirement, flag_state and flag_age parameters. FeatureFlagsOptions adds a retirement field. The CLI and the API build the report with the same engine function, so the retirement block is the same on both. The regression gates stay CLI only.
• fallow flags finds more flag reads. The scan now reports import.meta.env.X reads, and SDK calls with a registry member as the name, such as useFlag(FLAGS.NewCheckout). It also finds flag reads inside a larger if or ternary test, such as if (process.env.FEATURE_X === 'true'). Flags in .js files with JSX now match custom sdkPatterns and envPrefixes. More flag reads now have a guard, so dead_code_overlap can find more unused exports.
• fallow list --entry-weight reports the startup import weight of each runtime entry point. The report counts the project modules and the source bytes that load before the entry runs. It splits the modules into eager, deferred and out of thread, and lists the packages on the startup path. The unit is source bytes on disk, so the value is not a bundle size. The output is human or JSON (entry_weight in fallow list --format json). The health score does not change.
• An opt-in regression gate for the startup import weight. fallow list --entry-weight --save-regression-baseline <PATH> writes the eager bytes, modules and packages of each entry into the baseline file. A later run with --regression-baseline <PATH> reports the change of each entry and the new eager packages. Add --fail-on-regression to exit 1 when an entry grows more than --tolerance. A new entry never fails the gate. fallow dead-code --save-regression-baseline <PATH> now keeps the entry weights in the same file.
• fallow trace --path and fallow viz show dynamic imports. Each hop in the trace JSON has a new dynamic field, and the human output tags such a hop [dynamic]. With --eager-only, the trace follows static value imports only. A new edge flag bit (2) marks a lazy edge. The focus view draws it with a short dash.
• Built-in Waku plugin. The waku plugin activates from the waku dependency and follows the managed-mode file router. Every module under <srcDir>/pages is an entry, except modules in _components, _hooks and _actions folders. The plugin reads srcDir from waku.config.*, with src as the default. Thanks @​aheissenberger for the contribution (#2921).
• The language server can parse the project before the first open. Set the initialization option prewarm to true. At initialized, the server then loads the project session and parses the files, but analyzes and publishes nothing. The option is off by default and needs kept project sessions and a workspace root with a package.json.
• --performance reports exact work counts, the time outside the pipeline and a span tree. The dead-code timings gain a counters object with counts that do not change with the thread count or the machine. A standalone dead-code run adds a process object and a Process section with a WALL row. The new spans array gives the parent of each stage and marks concurrent spans. Health --performance adds git_log_bytes, and the parse cache load gets its own parse_cache_load_ms field.
• Runtime hot paths show where speed work gives the largest gain. Each entry in runtime_coverage.hot_paths now has an optimization_target block. The block holds cost_score, cost_basis, inner_iterations_per_call, cognitive, cyclomatic and line_count. Compare cost_score only between hot paths with the same cost_basis. The human output, --explain and the MCP get_hot_paths tool show the same fields.

Performance

• Import resolution, stylesheet scans and coverage remaps do less work. Each specifier in a file now resolves once, not once for each imported binding. A stylesheet is masked for comments one time, and the health --css token scans count lines in one pass. Runtime coverage indexes each source-mapped script one time and finds each offset with a binary search. The findings do not change.
• The language server keeps its project session between saves. A save now parses only the files that changed, and the other modules come from memory. A change to a config input, such as package.json, a lockfile, a tsconfig file or a rule pack, loads the session again. On a platform without a file change time, such as Windows, each run reads the persisted parse cache as before. The server keeps sessions while their estimated memory is at most 512 MB in total. Set FALLOW_LSP_REUSE_SESSION=0 to load a new session on each run.
• The language server does less work for each analysis run. It publishes only the diagnostics that changed, and converts diagnostic columns in linear time. It reads an open file only when the buffer can differ from disk. Under autosave, a newer event cancels the run in flight, and the run after a cancelled one always finishes and publishes.
• Typed MCP tool calls share parsed modules. A later call on the same unchanged files takes the modules from memory. For the sequence analyze, find_dupes, check_health, trace_file, run two times, the parse passes go from 6 to 1. The answers do not change. The store keeps at most 4 file lists and about 512 MiB of parsed modules. It does not keep a project with more than about 40 MiB of source. To stop the reuse, set FALLOW_MCP_WARM_SESSION=0.
• fallow flags parses each file once with a custom flags config. Before, sdkPatterns, envPrefixes or configObjectHeuristics made the command parse every file a second time. The command also matches guarded flags to unused exports by file and line. The dead_code_overlap output does not change.
• Fallow starts fewer git processes. A run without --diff-file, --diff-stdin or FALLOW_DIFF_FILE no longer calls git rev-parse for the diff base directories. The Impact project identity reads the git common directory and the toplevel with one call in a work tree.
• The VS Code extension no longer searches the workspace for manifests at startup. It starts when the workspace root has a package.json or a Fallow config file. It also starts when a JavaScript, TypeScript, Vue, Svelte, Astro or MDX file opens. A monorepo folder with no root package.json now starts the extension when the first source file opens.
• fallow viz pages load and respond faster. The page parses only the file list, the edges and the summary at start. On the Fallow repository, the data parsed at start drops from 2.49 MB to 64 KB. The HTML file drops from 2.8 MB to 1.9 MB. A hover on the treemap now makes 3 draw calls, not one call per tile. The page shows its frame before the script runs, so the layout does not shift.

Changed

• fallow flags gives medium confidence to generic SDK names without a flag import. The names isEnabled, getValue and useFeature also occur in libraries that are not flag SDKs. A call to one of these names now has confidence: "medium" when its file imports no flag SDK and no flag module. Other SDK names, such as useFlag and checkGate, keep high confidence.
• fallow flags reports config.features.x as one read. With flags.configObjectHeuristics on, the scan reported the full access and also the object config.features. Now it reports only the full access.
• Oxc 0.151. The parser and AST crates move from Oxc 0.126 to 0.151, and oxc_coverage_instrument moves to 0.13. The dead-code, duplication and health output of public projects is the same as with 3.29.0.
• fallow similar-code inspect and fallow audit use the shared test-code definition. Both now treat files under __test__/, spec/, specs/ and e2e/, and files named *.e2e.* and *.e2e-spec.*, as tests. similar-code inspect also adds *.cy.* files, and no longer lists files under __mocks__/. In fallow audit, a mock or a fixture that imports a changed file does not count as a test.

Bug fixes

• Health hotspots tag more test files. The [test] tag and the JSON field is_test_path now use the shared test-path definition. A test/, tests/, __tests__/ or __mocks__/ directory at the project root now matches. A .test. or .spec. marker now matches only in the file name.
• Test-path checks now classify paths relative to the project root. Before, a project inside a test-like directory lost three results. The split line with test files and source files did not show under test, tests or fixtures. The start with <file> hint of the bare fallow command named no file under tests or examples. The CVA checks lost every finding under test or tests. The split line now says M in test files, not M in test directories.
• .cy. files and spec/ directories need more evidence to be tests. A .cy. file is now a test only in a Cypress context, so a locale file such as src/i18n/strings.cy.ts is production code. A spec or specs directory now holds tests only at a test root.
• A plain fallow list ignores the --tolerance value. Before, an invalid value exited 2 for a plain listing. Now fallow list parses the value only for --entry-weight.
• pnpm overrides in a two-document lockfile are no longer reported as unused. pnpm 12 writes pnpm-lock.yaml as two YAML documents when package.json sets packageManager. Fallow now reads each project document of the lockfile. Thanks @​sgaabdu4 for the report (#2909).
• On Windows, plugin path rules skip the directories they exclude. A plugin can exclude files by a path segment, such as the TanStack Router routeFileIgnorePattern. Before, the check did not split paths on the native Windows separator, so an excluded route file was still an entry point.

Upgrade notes

• Building fallow from source now needs Rust 1.96 or later (it was 1.92).
• The parse, extract, graph and duplication caches rebuild once, so the first run after the upgrade parses and resolves the project again.
• isEnabled, getValue and useFeature calls without a flag import change from high to medium confidence. To keep high confidence for your own function, add its name to flags.sdkPatterns.
• With flags.configObjectHeuristics on, object entries such as process.features no longer show in the output.

... (truncated)

Commits

• 2b0f0b7 chore: release v3.30.0
• 6eef5eb test: add whole-binary instruction counts and a realistic allocation guard (#...
• 19dbc20 perf: resolve each specifier once and scan CSS and source maps in linear time...
• 35f17b1 fix: review follow-ups for the test-path predicate, entry weight and optimiza...
• 68889aa fix(flags): give medium confidence to generic SDK names without a flag import...
• dc159e9 fix: pass release validation on Windows (#2929)
• 630b1dd feat(flags): add vendor state, gates and every format to the retirement repor...
• affac83 feat(flags): add a per-flag retirement report (#2928)
• 0350e6e fix(lsp): reload a kept session when a plugin file or rule pack changes (#2926)
• ae37ae5 feat(plugins): add built-in Waku plugin (#2921)
• Additional commits viewable in compare view

Updates lint-staged from 17.5.0 to 17.6.0

Release notes

Sourced from lint-staged's releases.

v17.6.0

Minor Changes

• #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*': {
  title: 'Fail if PDF files are committed',
  task: async (filepaths, { log }) => {
  const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
  if (pdfFiles.length > 0) {
  log('PDF files should not be committed: %s', pdfFiles)
  throw new Error('Failed')
  }
  },
  },
  })

• #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

  If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

• #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

• #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
  })

• #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

• #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

v17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

Changelog

Sourced from lint-staged's changelog.

17.6.0

Minor Changes

• #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*': {
  title: 'Fail if PDF files are committed',
  task: async (filepaths, { log }) => {
  const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
  if (pdfFiles.length > 0) {
  log('PDF files should not be committed: %s', pdfFiles)
  throw new Error('Failed')
  }
  },
  },
  })

• #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

  If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

• #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

• #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
  })

• #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

• #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

... (truncated)

Commits

• 48f9f4e Merge pull request #1857 from lint-staged/changeset-release/main
• 16b2e21 chore(changeset): release
• 195f156 docs: improve changeset
• 0ba6261 fix: create hidden directory only when required
• 66ac2de docs: fixes to changesets
• 80af8d7 Merge pull request #1863 from lint-staged/fix-issues
• e433488 fix: handle task editing a symlinked file to a regular file, and --fail-on-ch...
• e5019b3 fix: handle trailing newlines when detecting changed files
• 74efec8 ci: run Cygwin and MSYS2 tests on Node.js 26
• 655b7dc fix: use TypeScript types instead of JSDoc
• Additional commits viewable in compare view

Updates react-doctor from 0.9.13 to 0.9.14

Release notes

Sourced from react-doctor's releases.

react-doctor@0.9.14

Patch Changes

• #1783 1239043 Thanks @​aidenybai! - Upgrade oxlint to 1.81 and oxc-parser to 0.148.

• #1777 52ab4f5 Thanks @​aidenybai! - Detect React Compiler when @vitejs/plugin-react is called with an enabled compiler option (react({ compiler: true }) or react({ compiler: { ... } })), including aliased, namespace, and CommonJS forms of the default export. compiler: false and unrelated objects with a compiler property stay undetected, so rules disabled under React Compiler now switch off for these Vite projects.

• #1778 1279996 Thanks @​aidenybai! - Skip source files that Git still tracks but that no longer exist in the working tree (for example a deleted root index.html in a TanStack Start app) instead of failing the scan with ENOENT while preparing lint sources.

• #1780 7c31dc7 Thanks @​aidenybai! - Exclude every discovered nested workspace project from an ancestor scan, whether or not it was selected. Scanning only the root of a monorepo previously pulled a nested app's files into the root scan and judged them against the root's framework and React Compiler settings, so a compiler-enabled Expo app inside a Vite workspace reported compiler-gated rules like prefer-module-scope-pure-function that its own config suppresses. A nested project's files are now only checked by that project's scan, matching what selecting both projects already did.

• #1779 9b1fbf4 Thanks @​aidenybai! - Keep --scope changed in baseline mode when the change set deletes a source file. A deleted file that cannot be read or linted at the base commit no longer degrades the whole comparison to a plain diff; only an unreadable or unlinted base file that still exists at head does, since that is the only gap that could surface a pre-existing finding as new.

• #1781 dfcde10 Thanks @​aidenybai! - Speed up large-repository scans: reuse warm oxlint worker processes across projects, overlap project discovery with linting, and trim rule hot paths (2.4–5.5x faster wall-clock on the large-repo corpus).

• #1801 fd64d26 Thanks @​aidenybai! - Stop reporting local service .use() methods as React hooks. Preserve diagnostics for React namespace calls, including aliases and CommonJS imports.

  Only recommend setAnimationLoop when a recursive animation frame callback renders through a known Three.js renderer. Leave independent 2D canvas and DOM loops alone, including files that also import Three.js.

• #1802 c9e3e15 Thanks @​aidenybai! - Retire 33 low-value rule IDs while keeping them registered as silent compatibility entries. Make 26 cleanup, migration, performance, and security-review rules opt-in. Existing rule configurations still load; default scans no longer report these recommendations as defects.

• #1776 8956a92 Thanks @​aidenybai! - Skip TypeScript files without JSX support (.ts, Description has been truncated

[nicksan222]

Fixed the audit failure without suppressing advisories. Removed the runtime shadcn CLI dependency, preserved the used scroll-mask CSS, and pinned patched transitive packages. Deferred incompatible Better Auth 1.7 / TanStack Table 9 updates and aligned Better Fetch with the supported auth version. Full just check, format check, and desktop web build pass locally; audit reports zero vulnerabilities.