fix(deps): update misc npm packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@eslint-react/eslint-plugin (source)	5.24.10 → 5.27.2
@next/eslint-plugin-next (source)	16.4.0 → 16.4.1
@next/mdx (source)	16.4.0 → 16.4.1
cspell (source)	10.3.6 → 10.4.0
next (source)	16.4.0 → 16.4.1
postcss (source)	8.5.29 → 8.5.30
react (source)	19.3.0 → 19.3.1
react-dom (source)	19.3.0 → 19.3.1

---

Release Notes

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.27.2

Compare Source

🏗️ Internal

• Added the missing @tsconfig/node20 and @types/node dependencies to the workspace packages. (#​2040)
• Bumped effect and @effect/platform-node to 4.0.5, import-integrity-lint to 1.3.1, and sort-package-json to 4.1.0. (#​2040)

Full Changelog: Rel1cx/eslint-react@v5.27.1...v5.27.2

v5.27.1

Compare Source

🐞 Fixes

• Lifecycle methods defined as class properties (ex: componentDidMount = () => { this.setState(...) }, including type-expression-wrapped values) are now reported just like the method shorthand form. (#​2039) Affected rules:
  • react-x/no-set-state-in-component-did-mount
  • react-x/no-set-state-in-component-did-update
  • react-x/no-set-state-in-component-will-update
• Effect cleanups are now recognized when the useEffect call is nested in an outer return (ex: return useEffect(() => () => { ... })), so resources released there are no longer reported as leaked. (#​2039) Affected rules:
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
  • react-web-api/no-leaked-intersection-observer
  • react-web-api/no-leaked-interval
  • react-web-api/no-leaked-resize-observer
  • react-web-api/no-leaked-timeout

🏗️ Internal

• @eslint-react/ast: added the Check.isFunctionOrClass and Check.isTypeOrChainExpression helpers; parent lookups across ast, core, and the rules are now bounded at enclosing function/class boundaries. (#​2039)
• @eslint-react/core: isUseEffectSetupCallback and isUseEffectCleanupCallback reimplemented on bounded parent lookups. (#​2039)

Full Changelog: Rel1cx/eslint-react@v5.27.0...v5.27.1

v5.27.0

🐞 Fixes

• react-web-api/no-leaked-event-listener: cleanups returned through conditional expressions (ex: return cond ? () => window.removeEventListener(...) : null) are now recognized and no longer reported. (#​2038)
• react-web-api/no-leaked-fetch: effect setups wrapped in type expressions (ex: useEffect((() => { fetch(...) }) as any, [])) are now recognized. (#​2038)
• react-debug/function-component: computed string-literal displayName keys (ex: App["displayName"] = "...") are now recognized. (#​2038)

📝 Documentation

• Revised the rule implementation pattern guides and refined the core ideas and layer dependency model in the fact-based rule implementation docs. (#​2034, #​2035)

🏗️ Internal

• @eslint-react/core: accuracy and consistency fixes in detection helpers. (#​2038)
• react-x: the custom tsl config now enforces the fact-based layer dependency order. (#​2036)
• Bumped react and react-dom to 19.3.1, and next to 16.4.1.

Full Changelog: Rel1cx/eslint-react@v5.26.7...v5.27.0

v5.26.7

Compare Source

🏗️ Internal

• @eslint-react/core: collectors now use the node's source range start as the map key, replacing the shared counter, keys are stable across repeated lints, traceable to source positions when debugging, and slightly cheaper than stringified numbers. (#​2033)

Full Changelog: Rel1cx/eslint-react@v5.26.6...v5.26.7

v5.26.6

Compare Source

🏗️ Internal

• @eslint-react/core: component and hook collectors now use sequential integer keys instead of random randomBytes hex keys, removing node:crypto from the lint hot path. (#​2032) Thanks to @​kurtextrem!
• Bumped effect to 4.0.4, ts-pattern to 5.9.2, fumadocs-core and fumadocs-ui to 16.17.3, lucide-react to 1.57.0, oxlint to 1.88.0, typedoc-plugin-markdown to 4.14.0, and undici to 8.12.1.

New Contributors

• Jacob Groß (@​kurtextrem) made their first contribution in #​2032.

Full Changelog: Rel1cx/eslint-react@v5.26.5...v5.26.6

v5.26.5

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: a setState on the right side of a short-circuit operator (&&, ||, ??) is now exempt when the left operand is ref-derived (ex: ref.current && setData(1)), matching the existing ref-gated conditional exemption; a left-side setState still runs unconditionally and stays reported. (#​2031)
• react-x/set-state-in-effect: setup identifiers are now collected from the setup argument of the effect call only; the callee and the deps array are no longer scanned, so a function referenced only in the deps array (ex: useEffect(setup, [helper])) is no longer mistaken for the setup and its setState calls stay unattributed. (#​2031)
• react-x/set-state-in-effect: arrow function parameters are no longer collected as callback-body setter references (ex: the setState in useMemo((setState) => ..., [])); only actual callback bodies are collected (ex: useMemo(() => setState, [])). (#​2031)

Full Changelog: Rel1cx/eslint-react@v5.26.4...v5.26.5

v5.26.4

Compare Source

🐞 Fixes

• The name lookup now stops at function boundaries, so expression-bodied factory functions and custom hooks (ex: export const useAnchor = () => useRef(null)) are no longer misreported; calls inside JSX expressions, computed keys, or class static blocks no longer fall back to the outer variable. (#​2029) Closes #​2026. Affected rules:
  • react-naming-convention/context-name
  • react-naming-convention/id-name
  • react-naming-convention/ref-name
• The name lookup no longer crosses containers or derived values (ex: const refs = [useRef(null)], const n = useRef(0) + 1), so such calls are no longer reported on the enclosing variable; sequence expressions check only the last value, and unresolvable computed keys (ex: { [key]: useRef(null) }) no longer fall back to the outer variable. (#​2030) Affected rules:
  • react-naming-convention/context-name
  • react-naming-convention/id-name
  • react-naming-convention/ref-name

Full Changelog: Rel1cx/eslint-react@v5.26.3...v5.26.4

v5.26.3

Compare Source

🐞 Fixes

• An enclosing object literal property key now takes precedence over the outer assignment target when statically known (ex: const refs = { myRef: useRef(0) }); computed keys with string literals (ex: refs["value"] = useRef(null)) are now checked, and unresolvable computed keys are no longer reported. (#​2028) Affected rules:
  • react-naming-convention/context-name
  • react-naming-convention/id-name
  • react-naming-convention/ref-name
• react-naming-convention/ref-name: immediate dereferences of the useRef result through TypeScript type wrappers (ex: (useRef(null) as { current: null }).current, useRef(null)!.current) are no longer reported, extending the #​1375 fix. (#​2028)

Full Changelog: Rel1cx/eslint-react@v5.26.2...v5.26.3

v5.26.2

Compare Source

✨ New

• react-x/no-unused-props: improved prop usage detection. Props parameters with default values (ex: function Component(props: Props = defaultProps)) are now unwrapped and analyzed, props aliased to a local variable (ex: const alias = props) are tracked through the alias, and template literals without substitutions (ex: props[`foo`]) are recognized as static prop keys. (#​2021)

🐞 Fixes

• react-x/no-unused-props: a component whose used prop keys cannot be fully determined (ex: it passes the whole props object to another function) now marks all of its declared props as used, so a props declaration shared with another fully analyzable component is no longer reported as unused. (#​2021)
• react-x/set-state-in-effect: ref-derived values that reach the setState argument through assignment statements (rather than the declaration initializer) are now recognized; only writes that lexically precede the use and live in the use's own function or an ancestor count. (#​2027)
• react-x/set-state-in-effect: parameters of a helper invoked from the effect setup are now treated as ref-derived when the call-site argument is ref-derived, matched per call site by parameter definition. (#​2027)
• react-x/set-state-in-effect: a .current read rooted at a function parameter is now recognized as a ref read (ex: setReferenceElement(anchor?.current) where anchor is a RefObject prop); previously only parameters named ref or ending in Ref were recognized. (#​2027)
• react-x/no-unused-class-component-members: public methods (including function-valued properties) of an exported class component are no longer reported as unused, as they may be part of the component's imperative API invoked by consumers through refs. Data fields, private/protected members, and members of non-exported classes are still reported. (#​2024)

🏗️ Internal

• Ordered message ids by first usage and unified default/suggestion message id naming across react-dom, react-jsx, react-web-api, and react-x rules. (#​2022)

Full Changelog: Rel1cx/eslint-react@v5.26.1...v5.26.2

v5.26.1

Compare Source

🏗️ Internal

• Renamed the internal suggestion message id from "replace" to "suggest". Affected rules:
  • react-x/no-context-provider
  • react-x/no-forward-ref
  • react-x/no-use-context
• react-x/immutability: moved context-dependent helpers from helpers.ts into origins.ts and effects.ts to match the fact-based implementation pattern.
• react-x/globals: moved resolveToFunction from helpers.ts to origins.ts.
• Bumped effect to 4.0.3, tsl-dx to 0.14.1, @tsconfig/node20 to 20.1.10, and @types/node to 20.19.43.

📝 Documentation

• Refreshed spec diff verification dates and notes for react-x rules.

Full Changelog: Rel1cx/eslint-react@v5.26.0...v5.26.1

v5.26.0

Compare Source

✨ New

• Lowered the minimum required Node.js version from >=22.0.0 to >=20.19.0. (#​2020)

Full Changelog: Rel1cx/eslint-react@v5.25.0...v5.26.0

v5.25.0

Compare Source

✨ New

• react-dom/no-unsafe-target-blank: added an allowReferrer option (default: false). When enabled, rel="noopener" alone is accepted and the suggested fix adds rel="noopener" instead of rel="noreferrer noopener", preserving referrer information while still requiring an explicit token. (#​2019) Closes #​2012.

🏗️ Internal

• @eslint-react/ast: added hasParent and hasEnclosingTryBlock shortcuts to Traverse. (#​2016)
• @eslint-react/ast: renamed the types module to tree and narrowed the Extract.unwrap result type. (#​2017)
• @eslint-react/core: removed the unused REACT_BUILTIN_HOOK_NAMES constant.
• Bumped tsdown to 0.23.1, @effect/platform-node to 4.0.3, pnpm to 12.11.2, @types/node to 26.6.5, setup-uv to v10.3.0, and fumadocs and lucide-react in the website.

Full Changelog: Rel1cx/eslint-react@v5.24.10...v5.25.0

vercel/next.js (@​next/eslint-plugin-next)

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

streetsidesoftware/cspell (cspell)

v10.4.0

Compare Source

Features

feat: Add `--glob-symlinks` to follow symbolic links when matching globs (#​9342)

feat: Add --glob-symlinks to follow symbolic links when matching globs (#​9342)

postcss/postcss (postcss)

v8.5.30

Compare Source

• Fix broken map on </style> escaping (by @​Rufflet).

react/react (react)

v19.3.1: 19.3.1 (October 14th, 2026)

Compare Source

React Server Components

• Improve transport protocol (#​37845 by @​unstubbable and @​eps1lon)

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hjoshi123 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for cert-manager ready!

Name	Link
🔨 Latest commit	7fd88b5
🔍 Latest deploy log	https://app.netlify.com/projects/cert-manager/deploys/6ad4d7d935267ad3a78164b2
😎 Deploy Preview	https://deploy-preview-2330--cert-manager.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.