Update Routine updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@types/node (source)	24.12.4 → 24.13.2			devDependencies	minor	24.13.3
@types/react (source)	19.2.15 → 19.2.17			devDependencies	patch
@vitejs/plugin-react (source)	6.0.2 → 6.0.3			devDependencies	patch
actions/checkout (changelog)	de0fac2 → df4cb1c			action	digest
convex (source)	1.39.1 → 1.42.1			devDependencies	minor
convex-test (source)	0.0.53 → 0.0.54			devDependencies	patch
eslint (source)	10.4.1 → 10.6.0			devDependencies	minor
eslint-plugin-react-refresh	0.5.2 → 0.5.3			devDependencies	patch
globals	17.6.0 → 17.7.0			devDependencies	minor
prettier (source)	3.8.3 → 3.9.4			devDependencies	minor
react (source)	19.2.6 → 19.2.7			devDependencies	patch
react-dom (source)	19.2.6 → 19.2.7			devDependencies	patch
typescript-eslint (source)	8.60.0 → 8.62.1			devDependencies	minor	8.63.0
vite (source)	8.0.16 → 8.1.3			devDependencies	minor	8.1.4
vitest (source)	4.1.7 → 4.1.9			devDependencies	patch	4.1.10
zizmorcore/zizmor-action	v0.5.6 → v0.5.7			action	patch

---

Release Notes

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.3

Compare Source

get-convex/convex-backend (convex)

v1.42.1

• Fixed an issue where the CLI would be unable to find the tsgo binary in
  newer versions of @typescript/native-preview.
• Added a new initialAuthTokenReuse option to ConvexReactClient that
  prevents extra function calls when users re-authenticate.

v1.42.0

• Added a new npx convex project create command that can be used
  to create new projects programmatically.
• Added a new --names-only flag to npx convex env list
  (and npx convex env default list). This flag shows the names of
  the env vars that are set, without the values. It can be useful
  to let AI coding agents know the variables that are set on a deployment,
  without giving them the actual values.
• Added a new useStaleSnapshot option to the arguments for runQuery.
  This is an advanced feature that can be used to allow mutations
  to avoid optimistic concurrency control (OCC) conflicts in some cases
  where they can commit even though they depend on conflicting reads.
  This change allows us to improve the performance of some of the
  official Convex components, including Workpool.
• Improved the documentation of db.* methods to more clearly explain
  the difference between the old APIs without table names
  (e.g. db.get(userId)) and the new APIs with table names
  (e.g. db.get("users", userId)).
• Fixed an issue where the CLI would not surface permission errors
  correctly when the user or token doesn’t have permission to do something.
• Exposes the current scheduled function's ID as scheduledFunctionId in
  ctx.meta.getRequestMetadata().
• npx convex insights has a new --json flag that makes the command
  output easier to parse programmatically.
• File storage: marked a few TypeScript types in convex/server as @deprecated
  (FileMetadata, FileStorageId, StorageId). These types are used
  only by file storage APIs that were deprecated in convex@1.6.0,
  so we also marked them as @deprecated for clarity.
• Bumps the ws peer dependency to avoid a vulnerable range.

v1.41.0

• It is now possible to set limits on nested queries and mutations
  with the new transactionLimits option in runQuery/runMutation.
• npx convex ai-files now installs skills with separate copies of
  each skill for each coding agent instead of using symlinks.
  We made this change to avoid known issues with symlinks on Windows.
• When using Convex in anonymous mode (without a Convex account),
  npx convex dev now starts a different dashboard server for each
  deployment. This ensures the dashboard always connects to the
  right deployment when multiple deployments are running at the same time.

v1.40.0

• You can now create a local deployment in a specific Convex cloud project with
  npx convex deployment create team-slug:project-slug:local.
• You can now move a local deployment to another cloud project
  using npx convex deployment select team-slug:project-slug:local. This command warns
  when it moves the deployment to another project.
• The CLI now shows more clearly which deployment is targeted when running commands
  such as npx convex dev and npx convex deploy.
• Added a new <AuthRefreshing /> helper component, used to show indicators when
  function calls are paused because the authentication token is refreshing.
• Removed --local and --cloud flags from npx convex dev. The behavior of these flags
  was misleading when a deployment was already selected. Instead, use
  npx convex deployment select local to use a local deployment, and
  npx convex deployment select dev to use your personal cloud dev deployment.
• The CLI now provides guidance when TypeScript type checking is taking too long.
• Improved the CLI command documentation to include more details and examples.
• npx convex logs: --tail is now accepted as an alias for the --history flag.
• When creating a local deployment, the CLI now skips importing the default environment variables
  from the Convex cloud project if you don’t have permission to view the default environment
  variables instead of crashing.

get-convex/convex-test (convex-test)

v0.0.54

Compare Source

• Support the transactionLimits option on nested ctx.runQuery /
  ctx.runMutation calls (Convex 1.41). The nested call is enforced against
  its own limits, capped at the global transaction limits so they can only be
  lowered, never raised.
• Bandwidth tracking now mirrors the database's nested-transaction layers: a
  nested call's usage folds into its parent only when it commits, so the writes
  of a rolled-back nested ctx.runMutation no longer count against the
  transaction's limits.
• Enforce the Convex runtime rule that a single function execution may only
  run one paginated query (.paginate()). Calling it more than once now
  throws, catching a production-only failure that previously passed silently
  in tests.

eslint/eslint (eslint)

v10.6.0

Compare Source

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#​20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#​20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#​20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#​21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#​21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#​21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#​21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#​21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#​21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#​21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#​20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#​20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#​20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#​20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#​20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#​20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#​20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#​21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#​21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#​21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#​21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#​20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#​20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#​20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#​20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#​20985) (ESLint Bot)

v10.5.0

Compare Source

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#​20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#​20971) (Pixel998)
• 2ce032f feat: report max-lines-per-function violations at function head (#​20966) (Pixel998)
• 732cb3e feat: report max-nested-callbacks violations at function head (#​20967) (Pixel998)
• f9c138a feat: report max-depth violations on keywords (#​20943) (Pixel998)
• bdb496c feat: correct max-depth handling for else-if chains (#​20944) (Pixel998)
• c296873 feat: update error loc in max-statements to function header (#​20907) (Taejin Kim)

Documentation

• 8ae1b5b docs: Update README (GitHub Actions Bot)
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#​20962) (Francesco Trotta)
• f99b47a docs: Update README (GitHub Actions Bot)
• acf03d4 docs: clarify precedence of parserOptions over languageOptions (#​20926) (sethamus)

Chores

• b18bf58 chore: update ecosystem plugins (#​20959) (ESLint Bot)
• c2d1444 refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#​20951) (Taejin Kim)
• 243b8c5 chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#​20788) (kuldeep kumar)
• 217b2a9 test: add unit tests for ParserService (#​20949) (Taejin Kim)
• 72003e7 test: add location information to error messages in max-statements (#​20945) (lumir)
• 7797c26 refactor: deduplicate isAnySegmentReachable across rules (#​20890) (Taejin Kim)
• 67c46fa chore: update ecosystem plugins (#​20938) (ESLint Bot)
• 95d8c7a chore: update dependency @​eslint/json to v2 (#​20934) (renovate[bot])
• cf9e496 chore: update @​arethetypeswrong/cli to 0.18.3 (#​20933) (Pixel998)
• fb6d396 test: run type tests with TypeScript 7 (#​20868) (sethamus)

ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)

v0.5.3

Compare Source

• Fix check for non component class exported via export { } #​110 (fixes #​109)

sindresorhus/globals (globals)

v17.7.0

Compare Source

prettier/prettier (prettier)

v3.9.4

Compare Source

v3.9.3

Compare Source

v3.9.2

Compare Source

v3.9.1

Compare Source

v3.9.0

Compare Source

diff

🔗 Release Notes

v3.8.5

Compare Source

v3.8.4

Compare Source

diff

Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#​17746 by @​byplayer)

Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.

<!-- Input -->
- a

  - b

- c

  - d

<!-- Prettier 3.8.3 -->
- a
  - b
- c
  - d

<!-- Prettier 3.8.4 -->
- a

  - b

- c

  - d

facebook/react (react)

v19.2.7: 19.2.7 (June 1st, 2026)

Compare Source

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6
  (#​36566 by @​unstubbable)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.62.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

Compare Source

🚀 Features

• remove redundant package.json "files" (#​12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitejs/vite (vite)

v8.1.3

Compare Source

Bug Fixes

• css: inject inlined CSS after the shebang line (#​22717) (1534d36)
• deps: bump es-module-lexer to 2.3.0 (#​22838) (7103c3a)
• preload css for nested dynamic imports (#​22759) (2c53054)
• ssr: correct stacktrace column position for first line (#​22828) (c4acd69)

v8.1.2

Compare Source

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#​22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757)" (#​22825) (efb98cc)
• revert, "fix: escape ids with multiple null bytes (#​22687)" (cccef55)
• revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757)" (cf97711)

v8.1.1

Compare Source

Features

• update dynamic import warning to link to Vite docs (#​22823) (62bd7af)

Bug Fixes

• bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#​22797) (709eb8e)
• bundled-dev: serve assets emitted during HMR/lazy compile (#​22745) (5876b2c)
• bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#​22778) (8f925e2)
• css: preserve dollar signs in external @import urls with lightningcss (#​22718) (9fa7ab4)
• css: resolve tsconfig paths in CSS and Sass @​import (#​22775) (ef0b891)
• deps: update all non-major dependencies (#​22734) (e635f49)
• deps: update all non-major dependencies (#​22804) (8837400)
• deps: update rolldown-related dependencies (#​22591) (2ce6677)
• escape ids with multiple null bytes (#​22687) (833fc30)
• hide console window when running 'net use' on Windows (#​22698) (92b63f2)
• ignore bundled config temp dir (#​22800) (043a810)
• invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#​22809) (33895ba)
• optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#​22784) (085a0ab)
• optimizer: scanner should resolve input from root (#​22769) (9722b07)
• resolve pnpm .modules.yaml from workspace root instead of cwd (#​22757) (2531ac7)
• return sourcemap field from some plugins that were lacking (#​22782) (7e18bf8)
• server: handle malformed URI in indexHtmlMiddleware (#​22781) (84f5ccc)

Miscellaneous Chores

• improve dependency optimizer messages (#​22549) (092cb3b)

Code Refactoring

• css: remove lightningcss null byte bug workaround (#​22822) (2dafd3b)
• use pre-defined environments variable to avoid duplicate Object.values calls (#​22790) (1113acf)

Tests

• enable "manual chunk path" test and remove "worker.format error" test (#​22824) (c088511)

v8.1.0

Compare Source

Features

• extend server.fs.deny list with common files (#​22707) (61ba8fd)
• update rolldown to 1.1.2 (#​22695) (4f008a6)
• use ~ for Rolldown (#​22693) (9928722)

Bug Fixes

• bundled-dev: errors should be kept when incremental build fails (#​22617) (9a0dd48)
• cache falsy values in perEnvironmentState (#​22715) (0e91e79)
• glob: respect caseSensitive option in hmr matcher (#​22711) (65f525e)
• html: omit nonce on import map when cspNonce is unset (#​22713) (8340bb5)
• optimizer: skip null-valued exports in expandGlobIds glob resolution (#​22611) (8b9f5cd)
• resolved build options should be kept as a getter (#​22691) (3527191)
• server: handle malformed URI in memory files middleware (#​22714) (df9e0a5)
• use literal envPrefix queries for Vite Task (#​22706) (da72733)
• warn on deprecated envFile (#​22555) (ed7b283)

Code Refactoring

• client: inline dev-id value in CSS selector (#​22736) (57f59bc)
• remove unused removeRawQuery util (#​22724) (403cc60)
• use rolldownOptions property for chunkImportMap (#​22692) (8e8816c)

vitest-dev/vitest (vitest)

v4.1.9

Compare Source

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)

View changes on GitHub

v4.1.8

Compare Source

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in #​10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in #​10474 (675b4)

    View changes on GitHub

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.5.7

Compare Source

1.26.1 is now available via the action
1.26.1 is now the default version of zizmor used by the action

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Monday through Friday (* * * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@convex-dev/action-cache@79

commit: 4dfede5