Skip to content

chore(deps): bump the all-packages group across 1 directory with 16 updates - #67

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-packages-464a757200
Open

chore(deps): bump the all-packages group across 1 directory with 16 updates#67
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/all-packages-464a757200

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-packages group with 16 updates in the / directory:

Package From To
eslint-plugin-conventions 4.1.0 4.2.9
eslint-plugin-import-next 2.3.7 2.3.18
eslint-plugin-maintainability 3.0.5 3.0.16
eslint-plugin-modernization 2.1.0 2.1.8
eslint-plugin-modularity 2.1.0 2.1.9
eslint-plugin-operability 3.0.7 3.0.16
eslint-plugin-react-a11y 2.1.6 2.2.0
eslint-plugin-react-features 1.2.1 1.3.0
eslint-plugin-reliability 3.1.4 3.1.13
oxlint 1.73.0 1.79.0
prettier 3.9.5 3.9.6
@supabase/supabase-js 2.110.2 2.112.3
mermaid 11.16.0 11.17.0
posthog-js 1.399.2 1.418.6
recharts 3.9.2 3.10.1
tsx 4.23.1 4.23.12

Updates eslint-plugin-conventions from 4.1.0 to 4.2.9

Release notes

Sourced from eslint-plugin-conventions's releases.

eslint-plugin-conventions@4.2.9

4.2.9

Patch Changes

  • #497 461f8a8 Thanks @​ofri-peretz! - Point meta.docs.url at the philosophies' new home

    utm-taxonomy, no-raw-cross-property-href, and analytics-event-naming shipped meta.docs.url values pointing at UTM_PHILOSOPHY.md and ANALYTICS_PHILOSOPHY.md at the root of this repo. Those documents moved to ofri-peretz/interlace docs/philosophies/, so the published URLs now 404 — the "read more" link on every one of these diagnostics is dead in 4.2.8.

    Nothing in CI caught it: check-links.ts only scans external URLs in MDX, so a meta.docs.url string in a rule's .ts is invisible to it. Worth a follow-up lock that resolves every rule's meta.docs.url.

    No rule behaviour changes — five string literals.

  • Updated dependencies [574b1ae]:

    • @​interlace/eslint-devkit@​1.12.0
Changelog

Sourced from eslint-plugin-conventions's changelog.

4.2.9

Patch Changes

  • #497 461f8a8 Thanks @​ofri-peretz! - Point meta.docs.url at the philosophies' new home

    utm-taxonomy, no-raw-cross-property-href, and analytics-event-naming shipped meta.docs.url values pointing at UTM_PHILOSOPHY.md and ANALYTICS_PHILOSOPHY.md at the root of this repo. Those documents moved to ofri-peretz/interlace docs/philosophies/, so the published URLs now 404 — the "read more" link on every one of these diagnostics is dead in 4.2.8.

    Nothing in CI caught it: check-links.ts only scans external URLs in MDX, so a meta.docs.url string in a rule's .ts is invisible to it. Worth a follow-up lock that resolves every rule's meta.docs.url.

    No rule behaviour changes — five string literals.

  • Updated dependencies [574b1ae]:

    • @​interlace/eslint-devkit@​1.12.0

4.2.8

Patch Changes

  • #407 5ecf4d1 Thanks @​ofri-peretz! - Correct the declared ESLint floor: ^8.0.0 → ^8.40.0.

    context.sourceCode landed in ESLint 8.40. The shared devkit reads it without a fallback and 20 plugins read it directly, so on ESLint 8.0–8.39 the install resolved cleanly and then every rule threw Cannot read properties of undefined (reading 'ast') at lint time — npm reported nothing, because the manifest claimed the version was supported.

    Measured on 8.0.0 / 8.39.0 (throw on load) versus 8.40.0 / 8.57.1 / 9.0.0 / 9.39.2 / 10.8.0 (all produce the expected finding). No runtime behaviour changes; this only makes the manifest match what the code can actually run.

  • #423 4794017 Thanks @​ofri-peretz! - Correct the ESLint peer range shown in the README Compatibility table.

    The manifest floor moved to 8.40.0, but every package README still advertised ^8.0.0 || ^9.0.0 || ^10.0.0. The README is what npm renders on the package page, so the requirement consumers actually read disagreed with the one npm enforced: an install on 8.39.x warns about a peer conflict while the README says that version is supported.

    The range was missed by the original sweep because a markdown table escapes the union as \|\|, so a grep for the plain shape matched none of the 29 files.

... (truncated)

Commits
  • e31d626 chore(release): version packages (#467)
  • 0281e65 chore: move design-system doctrine to the interlace repo (#493)
  • 4e9db19 chore(release): version packages (#424)
  • 237a6b0 fix(workspace): reconcile meta.hasSuggestions with actual suggest: emission (...
  • 4794017 fix(docs): close every remaining ^8.0.0 surface #407 left behind (#423)
  • 5ecf4d1 fix(workspace): declared ESLint floor was 8.0, the code needs 8.40 (#407)
  • 72ce148 chore(release): version packages (#408)
  • 989ddba chore(release): version packages (#376)
  • 74bbf60 perf(workspace): load rule modules on demand, not at plugin load (#381)
  • 47cde07 feat(workspace): AI SDK security family + fix the broken oxlint export (#335)
  • Additional commits viewable in compare view

Updates eslint-plugin-import-next from 2.3.7 to 2.3.18

Release notes

Sourced from eslint-plugin-import-next's releases.

eslint-plugin-import-next@2.3.18

2.3.18

Patch Changes

  • #499 47070de Thanks @​ofri-peretz! - Bound the TypeScript peer range and declare the React peer

    maintainability, react-features and import-next shipped "typescript": ">=4.8.4", which claims support for every future major — including ones the repo has already pinned Dependabot away from. The range is now the majors actually tested: ^4.8.4 || ^5.0.0 || ^6.0.0.

    react-a11y and react-features lint JSXElement, JSXAttribute and JSXOpeningElement and named no React peer, so nothing recorded which React majors their rules were written against. Both now declare react: ^17 || ^18 || ^19, optional, so no adopter is forced to install it.

Changelog

Sourced from eslint-plugin-import-next's changelog.

2.3.18

Patch Changes

  • #499 47070de Thanks @​ofri-peretz! - Bound the TypeScript peer range and declare the React peer

    maintainability, react-features and import-next shipped "typescript": ">=4.8.4", which claims support for every future major — including ones the repo has already pinned Dependabot away from. The range is now the majors actually tested: ^4.8.4 || ^5.0.0 || ^6.0.0.

    react-a11y and react-features lint JSXElement, JSXAttribute and JSXOpeningElement and named no React peer, so nothing recorded which React majors their rules were written against. Both now declare react: ^17 || ^18 || ^19, optional, so no adopter is forced to install it.

2.3.17

Patch Changes

  • #407 5ecf4d1 Thanks @​ofri-peretz! - Correct the declared ESLint floor: ^8.0.0 → ^8.40.0.

    context.sourceCode landed in ESLint 8.40. The shared devkit reads it without a fallback and 20 plugins read it directly, so on ESLint 8.0–8.39 the install resolved cleanly and then every rule threw Cannot read properties of undefined (reading 'ast') at lint time — npm reported nothing, because the manifest claimed the version was supported.

    Measured on 8.0.0 / 8.39.0 (throw on load) versus 8.40.0 / 8.57.1 / 9.0.0 / 9.39.2 / 10.8.0 (all produce the expected finding). No runtime behaviour changes; this only makes the manifest match what the code can actually run.

  • #423 4794017 Thanks @​ofri-peretz! - Correct the ESLint peer range shown in the README Compatibility table.

    The manifest floor moved to 8.40.0, but every package README still advertised ^8.0.0 || ^9.0.0 || ^10.0.0. The README is what npm renders on the package page, so the requirement consumers actually read disagreed with the one npm enforced: an install on 8.39.x warns about a peer conflict while the README says that version is supported.

    The range was missed by the original sweep because a markdown table escapes the union as \|\|, so a grep for the plain shape matched none of the 29 files.

    Also updates .agent/rules/readme-structure.md and .agent/compatibility-matrix.md, which template this table for new packages, and adds a README-vs-manifest assertion to scripts/__tests__/eslint-peer-floor.test.ts so the two cannot drift again.

  • #309 237a6b0 Thanks @​ofri-peretz! - meta.hasSuggestions now matches what each rule actually emits.

... (truncated)

Commits
  • 791ea2a chore(release): version packages (#503)
  • 47070de fix(deps): bound SDK peer ranges and declare the React peer (#499)
  • 4e9db19 chore(release): version packages (#424)
  • 237a6b0 fix(workspace): reconcile meta.hasSuggestions with actual suggest: emission (...
  • 394eb7a fix(workspace): stop devkit tests racing their own build, add hookTimeout flo...
  • 4794017 fix(docs): close every remaining ^8.0.0 surface #407 left behind (#423)
  • 5ecf4d1 fix(workspace): declared ESLint floor was 8.0, the code needs 8.40 (#407)
  • 72ce148 chore(release): version packages (#408)
  • 989ddba chore(release): version packages (#376)
  • 74bbf60 perf(workspace): load rule modules on demand, not at plugin load (#381)
  • Additional commits viewable in compare view

Updates eslint-plugin-maintainability from 3.0.5 to 3.0.16

Release notes

Sourced from eslint-plugin-maintainability's releases.

eslint-plugin-maintainability@3.0.16

3.0.16

Patch Changes

  • #499 47070de Thanks @​ofri-peretz! - Bound the TypeScript peer range and declare the React peer

    maintainability, react-features and import-next shipped "typescript": ">=4.8.4", which claims support for every future major — including ones the repo has already pinned Dependabot away from. The range is now the majors actually tested: ^4.8.4 || ^5.0.0 || ^6.0.0.

    react-a11y and react-features lint JSXElement, JSXAttribute and JSXOpeningElement and named no React peer, so nothing recorded which React majors their rules were written against. Both now declare react: ^17 || ^18 || ^19, optional, so no adopter is forced to install it.

Changelog

Sourced from eslint-plugin-maintainability's changelog.

3.0.16

Patch Changes

  • #499 47070de Thanks @​ofri-peretz! - Bound the TypeScript peer range and declare the React peer

    maintainability, react-features and import-next shipped "typescript": ">=4.8.4", which claims support for every future major — including ones the repo has already pinned Dependabot away from. The range is now the majors actually tested: ^4.8.4 || ^5.0.0 || ^6.0.0.

    react-a11y and react-features lint JSXElement, JSXAttribute and JSXOpeningElement and named no React peer, so nothing recorded which React majors their rules were written against. Both now declare react: ^17 || ^18 || ^19, optional, so no adopter is forced to install it.

3.0.15

Patch Changes

  • #407 5ecf4d1 Thanks @​ofri-peretz! - Correct the declared ESLint floor: ^8.0.0 → ^8.40.0.

    context.sourceCode landed in ESLint 8.40. The shared devkit reads it without a fallback and 20 plugins read it directly, so on ESLint 8.0–8.39 the install resolved cleanly and then every rule threw Cannot read properties of undefined (reading 'ast') at lint time — npm reported nothing, because the manifest claimed the version was supported.

    Measured on 8.0.0 / 8.39.0 (throw on load) versus 8.40.0 / 8.57.1 / 9.0.0 / 9.39.2 / 10.8.0 (all produce the expected finding). No runtime behaviour changes; this only makes the manifest match what the code can actually run.

  • #430 7a18db3 Thanks @​ofri-peretz! - Make identical-functions ~35x faster without changing a single finding.

    The rule compared every pair of functions in a file and built a full |a|x|b| Levenshtein matrix for each pair. Measured with TIMING over 60 files (~14.6k lines) with four plugins enabled, it accounted for 933 ms — 90.9% of all rule time, against 21.8 ms for the next-slowest rule. Cost grew quadratically: 4.3x the source took 8.3x the time.

    Two exact prunes now skip work that provably cannot produce a match:

    • Length bound — edit distance is at least the length difference, so similarity can never exceed shorter.length / longer.length. If that ceiling is already under the threshold, no matrix is built.
    • Distance budget — a match needs a distance no greater than longer.length * (1 - threshold); once an entire DP row exceeds it the walk stops, and the matrix is two rows rather than |a|+1 of them.

    Same corpus after: 26.2 ms, and the rule falls from 90.9% to 21.2% of rule

... (truncated)

Commits
  • 791ea2a chore(release): version packages (#503)
  • 47070de fix(deps): bound SDK peer ranges and declare the React peer (#499)
  • 4e9db19 chore(release): version packages (#424)
  • 237a6b0 fix(workspace): reconcile meta.hasSuggestions with actual suggest: emission (...
  • 394eb7a fix(workspace): stop devkit tests racing their own build, add hookTimeout flo...
  • 7a18db3 perf(maintainability): identical-functions was 90.9% of all rule time (#430)
  • 4794017 fix(docs): close every remaining ^8.0.0 surface #407 left behind (#423)
  • 5ecf4d1 fix(workspace): declared ESLint floor was 8.0, the code needs 8.40 (#407)
  • 72ce148 chore(release): version packages (#408)
  • 989ddba chore(release): version packages (#376)
  • Additional commits viewable in compare view

Updates eslint-plugin-modernization from 2.1.0 to 2.1.8

Changelog

Sourced from eslint-plugin-modernization's changelog.

2.1.8

Patch Changes

  • #407 5ecf4d1 Thanks @​ofri-peretz! - Correct the declared ESLint floor: ^8.0.0 → ^8.40.0.

    context.sourceCode landed in ESLint 8.40. The shared devkit reads it without a fallback and 20 plugins read it directly, so on ESLint 8.0–8.39 the install resolved cleanly and then every rule threw Cannot read properties of undefined (reading 'ast') at lint time — npm reported nothing, because the manifest claimed the version was supported.

    Measured on 8.0.0 / 8.39.0 (throw on load) versus 8.40.0 / 8.57.1 / 9.0.0 / 9.39.2 / 10.8.0 (all produce the expected finding). No runtime behaviour changes; this only makes the manifest match what the code can actually run.

  • #423 4794017 Thanks @​ofri-peretz! - Correct the ESLint peer range shown in the README Compatibility table.

    The manifest floor moved to 8.40.0, but every package README still advertised ^8.0.0 || ^9.0.0 || ^10.0.0. The README is what npm renders on the package page, so the requirement consumers actually read disagreed with the one npm enforced: an install on 8.39.x warns about a peer conflict while the README says that version is supported.

    The range was missed by the original sweep because a markdown table escapes the union as \|\|, so a grep for the plain shape matched none of the 29 files.

    Also updates .agent/rules/readme-structure.md and .agent/compatibility-matrix.md, which template this table for new packages, and adds a README-vs-manifest assertion to scripts/__tests__/eslint-peer-floor.test.ts so the two cannot drift again.

  • #309 237a6b0 Thanks @​ofri-peretz! - meta.hasSuggestions now matches what each rule actually emits.

    ILB-Remediation measured 27 rules where the declaration and the implementation disagreed: 22 declared hasSuggestions: true without ever passing suggest: to context.report() (IDE quick-fix menus advertising remediation that never arrives), and 5 emitted suggest: without the declaration (latent — ESLint throws on that combination as soon as one of those suggestions carries a real fixer).

    eslint-plugin-mongodb-security gains four real suggestions where the rewrite is mechanical:

    • require-lean-queries — appends .lean()
    • no-unbounded-find — appends .limit(100)
    • no-debug-mode-production — rewrites the flag to process.env.NODE_ENV !== 'production'
    • require-tls-connection — adds (or flips) tls: true in the connection options

... (truncated)

Commits
  • 4e9db19 chore(release): version packages (#424)
  • 237a6b0 fix(workspace): reconcile meta.hasSuggestions with actual suggest: emission (...
  • 4794017 fix(docs): close every remaining ^8.0.0 surface #407 left behind (#423)
  • 5ecf4d1 fix(workspace): declared ESLint floor was 8.0, the code needs 8.40 (#407)
  • 72ce148 chore(release): version packages (#408)
  • 989ddba chore(release): version packages (#376)
  • 74bbf60 perf(workspace): load rule modules on demand, not at plugin load (#381)
  • 47cde07 feat(workspace): AI SDK security family + fix the broken oxlint export (#335)
  • fa5e699 chore(release): version packages (#371)
  • 86baa02 docs(workspace): add ecosystem + oxlint logos to every plugin README (#364)
  • Additional commits viewable in compare view

Updates eslint-plugin-modularity from 2.1.0 to 2.1.9

Release notes

Sourced from eslint-plugin-modularity's releases.

eslint-plugin-modularity@2.1.9

2.1.9

Patch Changes

  • #530 776baaf Thanks @​ofri-peretz! - no-external-api-calls-in-utils no longer fires on Map, Set, Headers, URLSearchParams or Cache lookups.

    The rule matched on the method NAME alone, so store.get(key) in a utils file read exactly like axios.get(url). A dogfooding sweep over 123 files produced 45 findings across 17 files, and every sampled one was a cache lookup.

    A call is now reported only when its callee resolves to an HTTP client:

    • fetch / window.fetch
    • a binding imported or required from a module in the new httpModules option (axios, got, ky, node-fetch, undici, superagent, node:http(s), …)
    • an alias of one — const api = axios.create() — resolved on Program:exit, so the client may be declared after its use
    • an explicit object.method pair in networkMethods, the escape hatch for in-house clients the import tracking can't see

    Bare module names still seed the client set, so axios.get(...) is caught without a visible import — except request and got, which collide with Express's request object and ordinary English.

    Measured over 49 real utils/lib/helpers files: 47 findings → 13, every survivor a real fetch(...), every dropped one a collection lookup.

Changelog

Sourced from eslint-plugin-modularity's changelog.

2.1.9

Patch Changes

  • #530 776baaf Thanks @​ofri-peretz! - no-external-api-calls-in-utils no longer fires on Map, Set, Headers, URLSearchParams or Cache lookups.

    The rule matched on the method NAME alone, so store.get(key) in a utils file read exactly like axios.get(url). A dogfooding sweep over 123 files produced 45 findings across 17 files, and every sampled one was a cache lookup.

    A call is now reported only when its callee resolves to an HTTP client:

    • fetch / window.fetch
    • a binding imported or required from a module in the new httpModules option (axios, got, ky, node-fetch, undici, superagent, node:http(s), …)
    • an alias of one — const api = axios.create() — resolved on Program:exit, so the client may be declared after its use
    • an explicit object.method pair in networkMethods, the escape hatch for in-house clients the import tracking can't see

    Bare module names still seed the client set, so axios.get(...) is caught without a visible import — except request and got, which collide with Express's request object and ordinary English.

    Measured over 49 real utils/lib/helpers files: 47 findings → 13, every survivor a real fetch(...), every dropped one a collection lookup.

2.1.8

Patch Changes

  • #407 5ecf4d1 Thanks @​ofri-peretz! - Correct the declared ESLint floor: ^8.0.0 → ^8.40.0.

    context.sourceCode landed in ESLint 8.40. The shared devkit reads it without a fallback and 20 plugins read it directly, so on ESLint 8.0–8.39 the install resolved cleanly and then every rule threw Cannot read properties of undefined (reading 'ast') at lint time — npm reported nothing, because the manifest claimed the version was supported.

    Measured on 8.0.0 / 8.39.0 (throw on load) versus 8.40.0 / 8.57.1 / 9.0.0 / 9.39.2 / 10.8.0 (all produce the expected finding). No runtime behaviour changes; this only makes the manifest match what the code can actually run.

  • #423 4794017 Thanks @​ofri-peretz! - Correct the ESLint peer range shown in the README Compatibility table.

    The manifest floor moved to 8.40.0, but every package README still advertised ^8.0.0 || ^9.0.0 || ^10.0.0. The README is what npm renders on the package page, so the requirement consumers actually read disagreed with the one npm enforced: an install on 8.39.x warns about a peer conflict while the README

... (truncated)

Commits
  • 03b65cb chore(release): version packages (#535)
  • 776baaf fix(modularity): no-external-api-calls-in-utils requires a resolved HTTP clie...
  • 4e9db19 chore(release): version packages (#424)
  • 237a6b0 fix(workspace): reconcile meta.hasSuggestions with actual suggest: emission (...
  • 4794017 fix(docs): close every remaining ^8.0.0 surface #407 left behind (#423)
  • 5ecf4d1 fix(workspace): declared ESLint floor was 8.0, the code needs 8.40 (#407)
  • 72ce148 chore(release): version packages (#408)
  • 989ddba chore(release): version packages (#376)
  • 74bbf60 perf(workspace): load rule modules on demand, not at plugin load (#381)
  • 47cde07 feat(workspace): AI SDK security family + fix the broken oxlint export (#335)
  • Additional commits viewable in compare view

Updates eslint-plugin-operability from 3.0.7 to 3.0.16

Changelog

Sourced from eslint-plugin-operability's changelog.

3.0.16

Patch Changes

  • #407 5ecf4d1 Thanks @​ofri-peretz! - Correct the declared ESLint floor: ^8.0.0 → ^8.40.0.

    context.sourceCode landed in ESLint 8.40. The shared devkit reads it without a fallback and 20 plugins read it directly, so on ESLint 8.0–8.39 the install resolved cleanly and then every rule threw Cannot read properties of undefined (reading 'ast') at lint time — npm reported nothing, because the manifest claimed the version was supported.

    Measured on 8.0.0 / 8.39.0 (throw on load) versus 8.40.0 / 8.57.1 / 9.0.0 / 9.39.2 / 10.8.0 (all produce the expected finding). No runtime behaviour changes; this only makes the manifest match what the code can actually run.

  • #423 4794017 Thanks @​ofri-peretz! - Correct the ESLint peer range shown in the README Compatibility table.

    The manifest floor moved to 8.40.0, but every package README still advertised ^8.0.0 || ^9.0.0 || ^10.0.0. The README is what npm renders on the package page, so the requirement consumers actually read disagreed with the one npm enforced: an install on 8.39.x warns about a peer conflict while the README says that version is supported.

    The range was missed by the original sweep because a markdown table escapes the union as \|\|, so a grep for the plain shape matched none of the 29 files.

    Also updates .agent/rules/readme-structure.md and .agent/compatibility-matrix.md, which template this table for new packages, and adds a README-vs-manifest assertion to scripts/__tests__/eslint-peer-floor.test.ts so the two cannot drift again.

  • Updated dependencies [b59e984, 5ecf4d1, 4794017]:

    • @​interlace/eslint-devkit@​1.11.0

3.0.15

Patch Changes

  • #411 d0cc8b6 Thanks @​ofri-peretz! - Ship the JavaScript without tsc's layout.

    Every emitted .js is re-written through esbuild's minifyWhitespace, which removes indentation and line breaks. Across the ecosystem that is 3233 kB -> 2023 kB of shipped JavaScript, a 37% cut; on disk a package install drops about 28%. Indentation alone was ~32% of a compiled rule file.

    This is deliberately NOT minification. Identifiers keep their names, string contents are untouched, and the syntax tree is not rewritten — rule meta (messages, schema, docs URLs) stays byte-identical, which is what the docs site

... (truncated)

Commits
  • 4e9db19 chore(release): version packages (#424)
  • 4794017 fix(docs): close every remaining ^8.0.0 surface #407 left behind (#423)
  • 5ecf4d1 fix(workspace): declared ESLint floor was 8.0, the code needs 8.40 (#407)
  • 72ce148 chore(release): version packages (#408)
  • 989ddba chore(release): version packages (#376)
  • 74bbf60 perf(workspace): load rule modules on demand, not at plugin load (#381)
  • 47cde07 feat(workspace): AI SDK security family + fix the broken oxlint export (#335)
  • fa5e699 chore(release): version packages (#371)
  • 86baa02 docs(workspace): add ecosystem + oxlint logos to every plugin README (#364)
  • abdc93a perf(build): stop emitting JavaScript nobody keeps (#368)
  • Additional commits viewable in compare view

Updates eslint-plugin-react-a11y from 2.1.6 to 2.2.0

Changelog

Sourced from eslint-plugin-react-a11y's changelog.

2.2.0

Minor Changes

  • #565 4e26fd3 Thanks @​ofri-peretz! - Two React rules now judge evidence rather than names.

    display-name reported every component. hasDisplayNameInScope() returned a hardcoded false under a comment reading "For now, always require explicit displayName", so function Profile() {} and const Profile = () => {} were both findings — in a codebase where every component is named, that is every component. React reads the display name off Function.name / Class.name, so those are already named and there was nothing to fix.

    It now reports the three shapes React genuinely cannot name: an anonymous export default, an anonymous class component, and memo/forwardRef with no binding to take a name from. Wrapper calls are walked through, so const Row = memo(forwardRef(fn)) stays quiet. Measured at 4 of 67 files on the benchmark's safe corpus before the fix, all four this defect.

    If you were suppressing this rule because of the noise, it is worth re-enabling.

    alt-text now resolves next/image from its import rather than requiring { img: ['Image'] } — a default nobody sets, on the framework most likely to need it. A renamed default import (import Pic from 'next/image') is caught; next/legacy/image and next/future/image too. A same-named <Image> from an unrelated package is not, and neither is getImageProps aliased to Image, which returns props rather than rendering.

    This is new detection: expect findings on Next.js images that were previously invisible.

Patch Changes

  • Updated dependencies [20b22aa]:
    • @​interlace/eslint-devkit@​1.16.0

2.1.15

Patch Changes

  • #499 47070de Thanks @​ofri-peretz! - Bound the TypeScript peer range and declare the React peer

    maintainability, react-features and import-next shipped "typescript": ">=4.8.4", which claims support for every future major — including ones the repo has already pinned Dependabot away from. The range is now the majors actually tested: ^4.8.4 || ^5.0.0 || ^6.0.0.

    react-a11y and react-features lint JSXElement, JSXAttribute and JSXOpeningElement and named no React peer, so nothing recorded which React majors their rules were written against. Both now declare

... (truncated)

Commits
  • c7fed65 chore(release): version packages (#564)
  • 20b22aa fix(workspace): no-xpath-injection needs evidence, and every rule carries a C...
  • 0194137 docs(packages): add the OpenSSF Scorecard badge to every published README (#544)
  • 791ea2a chore(release): version packages (#503)
  • 47070de fix(deps): bound SDK peer ranges and declare the React peer (#499)
  • 4e9db19 chore(release): version packages (#424)
  • 394eb7a fix(workspace): stop devkit tests racing their own build, add hookTimeout flo...
  • 4794017 fix(docs): close every remaining ^8.0.0 surface #407 left behind (#423)
  • 5ecf4d1 fix(workspace): declared ESLint floor was 8.0, the code needs 8.40 (#407)
  • 72ce148 chore(release): version packages (#408)
  • Additional commits viewable in compare view

Updates eslint-plugin-react-features from 1.2.1 to 1.3.0

Release notes

Sourced from eslint-plugin-react-features's releases.

eslint-plugin-react-features@1.3.0

1.3.0

Minor Changes

  • #565 4e26fd3 Thanks @​ofri-peretz! - Two React rules now judge evidence rather than names.

    display-name reported every component. hasDisplayNameInScope() returned a hardcoded false under a comment reading "For now, always require explicit displayName", so function Profile() {} and const Profile = () => {} were both findings — in a codebase where every component is named, that is every component. React reads the display name off Function.name / Class.name, so those are already named and there was nothing to fix.

    It now reports the three shapes React genuinely cannot name: an anonymous export default, an anonymous class component, and memo/forwardRef with no binding to take a name from. Wrapper calls are walked through, so const Row = memo(forwardRef(fn)) stays quiet. Measured at 4 of 67 files on the benchmark's safe corpus before the fix, all four this defect.

    If you were suppressing this rule because of the noise, it is worth re-enabling.

    alt-text now resolves next/image from its import rather than requiring { img: ['Image'] } — a default nobody sets, on the framework most likely to need it. A renamed default import (import Pic from 'next/image') is caught; next/legacy/image and next/future/image too. A same-named <Image> from an unrelated package is not, and neither is getImageProps aliased to Image, which returns props rather than rendering.

    This is new detection: expect findings on Next.js images that were previously invisible.

Patch Changes

  • Updated dependencies [20b22aa]:
    • @​interlace/eslint-devkit@​1.16.0

eslint-plugin-react-features@1.2.12

1.2.12

Patch Changes

  • #499 47070de Thanks @​ofri-peretz! - Bound the TypeScript peer range and declare the React peer

    maintainability, react-features and import-next shipped "typescript": ">=4.8.4", which claims support for every future major — including ones the repo has already pinned Dependabot away from. The range is now the majors actually tested: ^4.8.4 || ^5.0.0 || ^6.0.0.

    react-a11y and react-features lint JSXElement, JSXAttribute and

... (truncated)

Changelog

Sourced from eslint-plugin-react-features's changelog.

1.3.0

Minor Changes

  • #565 4e26fd3 Thanks @​ofri-peretz! - Two React rules now judge evidence rather than names.

    display-name reported every component. hasDisplayNameInScope() returned a hardcoded false under a comment reading "For now, always require explicit displayName", so function Profile() {} and const Profile = () => {} were both findings — in a codebase where every component is named, that is every component. React reads the display name off Function.name / Class.name, so those are already named and there was nothing to fix.

    It now reports the three shapes React genuinely cannot name: an anonymous export default, an anonymous class component, and memo/forwardRef with no binding to take a name from. Wrapper calls are walked through, so const Row = memo(forwardRef(fn)) stays quiet. Measured at 4 of 67 files on the benchmark's safe corpus before the fix, all four this defect.

    If you were suppressing this rule because of the noise, it is worth re-enabling.

    alt-text now resolves next/image from its import rather than requiring { img: ['Image'] } — a default nobody sets, on the framework most likely to need it. A renamed default import (import Pic from 'next/image') is caught; next/legacy/image and next/future/image too. A same-named <Image> from an unrelated package is not, and neither is getImageProps aliased to Image, which returns props rather than rendering.

    This is new detection: expect findings on Next.js images that were previously invisible.

Patch Changes

  • Updated dependencies [20b22aa]:
    • @​interlace/eslint-devkit@​1.16.0
Commits

@dependabot
chore(deps): bump the all-packages group across 1 directory with 16 u…
f4d2e01 
…pdates

Bumps the all-packages group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [eslint-plugin-conventions](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-conventions) | `4.1.0` | `4.2.9` |
| [eslint-plugin-import-next](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-import-next) | `2.3.7` | `2.3.18` |
| [eslint-plugin-maintainability](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-maintainability) | `3.0.5` | `3.0.16` |
| [eslint-plugin-modernization](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-modernization) | `2.1.0` | `2.1.8` |
| [eslint-plugin-modularity](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-modularity) | `2.1.0` | `2.1.9` |
| [eslint-plugin-operability](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-operability) | `3.0.7` | `3.0.16` |
| [eslint-plugin-react-a11y](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-react-a11y) | `2.1.6` | `2.2.0` |
| [eslint-plugin-react-features](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-react-features) | `1.2.1` | `1.3.0` |
| [eslint-plugin-reliability](https://github.com/ofri-peretz/eslint/tree/HEAD/packages/eslint-plugin-reliability) | `3.1.4` | `3.1.13` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.73.0` | `1.79.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.5` | `3.9.6` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.110.2` | `2.112.3` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.0` | `11.17.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.399.2` | `1.418.6` |
| [recharts](https://github.com/recharts/recharts) | `3.9.2` | `3.10.1` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` |



Updates `eslint-plugin-conventions` from 4.1.0 to 4.2.9
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-conventions/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-conventions@4.2.9/packages/eslint-plugin-conventions)

Updates `eslint-plugin-import-next` from 2.3.7 to 2.3.18
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-import-next/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-import-next@2.3.18/packages/eslint-plugin-import-next)

Updates `eslint-plugin-maintainability` from 3.0.5 to 3.0.16
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-maintainability/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-maintainability@3.0.16/packages/eslint-plugin-maintainability)

Updates `eslint-plugin-modernization` from 2.1.0 to 2.1.8
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-modernization/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-modernization@2.1.8/packages/eslint-plugin-modernization)

Updates `eslint-plugin-modularity` from 2.1.0 to 2.1.9
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-modularity/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-modularity@2.1.9/packages/eslint-plugin-modularity)

Updates `eslint-plugin-operability` from 3.0.7 to 3.0.16
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-operability/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-operability@3.0.16/packages/eslint-plugin-operability)

Updates `eslint-plugin-react-a11y` from 2.1.6 to 2.2.0
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-react-a11y/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-react-a11y@2.2.0/packages/eslint-plugin-react-a11y)

Updates `eslint-plugin-react-features` from 1.2.1 to 1.3.0
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-react-features/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-react-features@1.3.0/packages/eslint-plugin-react-features)

Updates `eslint-plugin-reliability` from 3.1.4 to 3.1.13
- [Release notes](https://github.com/ofri-peretz/eslint/releases)
- [Changelog](https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-reliability/CHANGELOG.md)
- [Commits](https://github.com/ofri-peretz/eslint/commits/eslint-plugin-reliability@3.1.13/packages/eslint-plugin-reliability)

Updates `oxlint` from 1.73.0 to 1.79.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.79.0/npm/oxlint)

Updates `prettier` from 3.9.5 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.5...3.9.6)

Updates `@supabase/supabase-js` from 2.110.2 to 2.112.3
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.112.3/packages/core/supabase-js)

Updates `mermaid` from 11.16.0 to 11.17.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.17.0)

Updates `posthog-js` from 1.399.2 to 1.418.6
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.399.2...posthog-js@1.418.6)

Updates `recharts` from 3.9.2 to 3.10.1
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v3.9.2...v3.10.1)

Updates `tsx` from 4.23.1 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.12)

---
updated-dependencies:
- dependency-name: eslint-plugin-conventions
  dependency-version: 4.2.9
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-packages
- dependency-name: eslint-plugin-import-next
  dependency-version: 2.3.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-packages
- dependency-name: eslint-plugin-maintainability
  dependency-version: 3.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-packages
- dependency-name: eslint-plugin-modernization
  dependency-version: 2.1.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-packages
- dependency-name: eslint-plugin-modularity
  dependency-version: 2.1.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-packages
- dependency-name: eslint-plugin-operability
  dependency-version: 3.0.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-packages
- dependency-name: eslint-plugin-react-a11y
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-packages
- dependency-name: eslint-plugin-react-features
  dependency-version: 1.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-packages
- dependency-name: eslint-plugin-reliability
  dependency-version: 3.1.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-packages
- dependency-name: oxlint
  dependency-version: 1.79.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-packages
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-packages
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.112.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-packages
- dependency-name: mermaid
  dependency-version: 11.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-packages
- dependency-name: posthog-js
  dependency-version: 1.418.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-packages
- dependency-name: recharts
  dependency-version: 3.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-packages
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from ofri-peretz as a code owner August 24, 2026 09:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ofri-peretz ofri-peretz Awaiting requested review from ofri-peretz ofri-peretz is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants