chore(deps): update all non-major dependencies (v1)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	^25.5.0 → ^25.9.4
@vitest/coverage-v8 (source)	^4.1.2 → ^4.1.9
crossws (source)	^0.3.5 → ^0.4.7
defu	^6.1.6 → ^6.1.7
eslint (source)	^10.1.0 → ^10.6.0
h3 (source)	^1.15.10 → ^1.15.11
jiti	^2.6.1 → ^2.7.0
listhen	^1.9.0 → ^1.10.0
pnpm (source)	10.28.0 → 10.34.4
pnpm (source)	10.7.0 → 10.34.4
prettier (source)	^3.8.1 → ^3.9.4
react (source)	^19.2.4 → ^19.2.7
react-dom (source)	^19.2.4 → ^19.2.7
ufo	^1.6.3 → ^1.6.4
undici (source)	^7.24.7 → ^7.28.0
undocs	^0.2.30 → ^0.4.16
vitest (source)	^4.1.2 → ^4.1.9
zod (source)	^4.3.6 → ^4.4.3

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.9

Compare Source

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)

View changes on GitHub

v4.1.8

Compare Source

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in #​10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in #​10474 (675b4)

    View changes on GitHub

v4.1.7

Compare Source

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in #​10384 (4f0f2)

    View changes on GitHub

v4.1.6

Compare Source

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in #​10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in #​10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in #​10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in #​10276 (9f7b1)

    View changes on GitHub

v4.1.5

Compare Source

   🚀 Experimental Features

• coverage: Istanbul to support instrumenter option  -  by @​BartWaardenburg and @​AriPerkkio in #​10119 (0e0ff)

   🐞 Bug Fixes

• --project negation excludes browser instances  -  by @​felamaslen in #​10131 (9423d)
• Project color label on html reporter  -  by @​hi-ogawa in #​10142 (596f7)
• Fix vi.defineHelper called as object method  -  by @​hi-ogawa in #​10163 (122c2)
• Alias agent reporter to minimal  -  by @​sheremet-va in #​10157 (663b9)
• Respect diff config options in soft assertions  -  by @​Copilot, sheremet-va and @​sheremet-va in #​8696 (9787d)
• Respect diff config options in soft assertions "  -  by @​sheremet-va in #​8696 (7dc6d)
• ast-collect: Recognize _vi_import prefix in static test discovery  -  by @​Yejneshwar in #​10129 (32546)
• coverage: Descriptive error message when reports directory is removed during test run  -  by @​DaveT1991 and @​AriPerkkio in #​10117 (14133)
• snapshot: Increase default snapshot max output length  -  by @​hi-ogawa and Codex in #​10150 (21e66)
• ui: Fix jsx/tsx syntax highlight  -  by @​hi-ogawa in #​10152 (f1b1f)
• web-worker: Support MessagePort objects referenced inside postMessage data  -  by @​whitphx and Claude Opus 4.6 (1M context) in #​9927 and #​10124 (7ad7d)
• api: Make test-specification options writable  -  by @​sheremet-va in #​10154 (6abd5)

    View changes on GitHub

v4.1.4

Compare Source

   🚀 Features

• coverage:
  • Default to text reporter skipFull if agent detected  -  by @​hi-ogawa in #​10018 (53757)
• experimental:
  • Expose assertion as a public field  -  by @​sheremet-va in #​10095 (a120e)
  • Support aria snapshot  -  by @​hi-ogawa, Claude Opus 4.6 (1M context), @​AriPerkkio, Codex and @​sheremet-va in #​9668 (d4fbb)
• reporter:
  • Add filterMeta option to json reporter  -  by @​nami8824 and @​sheremet-va in #​10078 (b77de)

   🐞 Bug Fixes

• Use "black" foreground for labeled terminal message to ensure contrast  -  by @​hi-ogawa in #​10076 (203f0)
• Make expect(..., message) consistent as error message prefix  -  by @​hi-ogawa and Codex in #​10068 (a1b5f)
• Do not hoist imports whose names match class properties .  -  by @​SunsetFi in #​10093 and #​10094 (0fc4b)
• browser: Spread user server options into browser Vite server in project  -  by @​GoldStrikeArch in #​10049 (65c9d)

    View changes on GitHub

v4.1.3

Compare Source

   🚀 Experimental Features

• Add experimental.preParse flag  -  by @​sheremet-va in #​10070 (78273)
• Support browser.locators.exact option  -  by @​sheremet-va in #​10013 (48799)
• Add TestAttachment.bodyEncoding  -  by @​hi-ogawa in #​9969 (89ca0)
• Support custom snapshot matcher  -  by @​hi-ogawa, Claude Sonnet 4.6 and Codex in #​9973 (59b0e)

   🐞 Bug Fixes

• Advance fake timers with expect.poll interval  -  by @​hi-ogawa and Claude Sonnet 4.6 in #​10022 (3f5bf)
• Add @vitest/coverage-v8 and @vitest/coverage-istanbul as optional dependency  -  by @​alan-agius4 in #​10025 (146d4)
• Fix defineHelper for webkit async stack trace + update playwright 1.59.0  -  by @​hi-ogawa in #​10036 (5a5fa)
• Fix suite hook throwing errors for unused auto test-scoped fixture  -  by @​hi-ogawa and Claude Sonnet 4.6 in #​10035 (39865)
• expect:
  • Remove JestExtendError.context from verbose error reporting  -  by @​hi-ogawa in #​9983 (66751)
  • Don't leak "runner" types  -  by @​sheremet-va in #​10004 (ec204)
• snapshot:
  • Fix flagging obsolete snapshots for snapshot properties mismatch  -  by @​hi-ogawa and Claude Sonnet 4.6 in #​9986 (6b869)
  • Export custom snapshot matcher helper from vitest  -  by @​hi-ogawa and Codex in #​10042 (691d3)
• ui:
  • Don't leak vite types  -  by @​sheremet-va in #​10005 (fdff1)
• vm:
  • Fix external module resolve error with deps optimizer query  -  by @​hi-ogawa and Claude Sonnet 4.6 in #​10024 (9dbf4)

    View changes on GitHub

v4.1.2

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#​9975).

   🐞 Bug Fixes

• Don't resolve setupFiles from parent directory  -  by @​hi-ogawa in #​9960 (7aa93)
• Ensure sequential mock/unmock resolution  -  by @​hi-ogawa and Claude Opus 4.6 in #​9830 (7c065)
• browser: Take failure screenshot if toMatchScreenshot can't capture a stable screenshot  -  by @​macarie in #​9847 (faace)
• coverage: Correct coverageConfigDefaults values and types  -  by @​Arthie in #​9940 (b3c99)
• pretty-format: Fix output limit over counting  -  by @​hi-ogawa in #​9965 (d3b7a)
• Disable colors if agent is detected  -  by @​sheremet-va and @​AriPerkkio in #​9851 (6f97b)

    View changes on GitHub

v4.1.1

Compare Source

   🚀 Features

• experimental:
  • Expose matchesTagsFilter to test if the current filter matches tags  -  by @​sheremet-va in #​9913 (eec53)
  • Introduce experimental.vcsProvider  -  by @​sheremet-va in #​9928 (56115)

   🐞 Bug Fixes

• Mark TestProject.testFilesList internal properly  -  by @​sapphi-red in #​9867 (54f26)
• Detect fixture that returns without calling use  -  by @​oilater in #​9831 and #​9861 (633ae)
• Drop vite 8.beta support  -  by @​AriPerkkio in #​9862 (b78f5)
• Type regression in vi.mocked() static class methods  -  by @​purepear and @​hi-ogawa in #​9857 (90926)
• Properly re-evaluate actual modules of mocked external  -  by @​hi-ogawa in #​9898 (ae5ec)
• Preserve coverage report when html reporter overlaps  -  by @​hi-ogawa in #​9889 (2d81a)
• Provide vi.advanceTimers to the preview provider  -  by @​sheremet-va in #​9891 (1bc3e)
• Don't leak event listener in playwright provider  -  by @​sheremet-va in #​9910 (d9355)
• Open browser in --standalone mode without running tests  -  by @​sheremet-va in #​9911 (e78ad)
• Guard disposable and optional body  -  by @​sheremet-va in #​9912 (6fdb2)
• Resolve retry.condition RegExp serialization issue  -  by @​nstepien and @​hi-ogawa in #​9942 (7b605)
• collect:
  • Don't treat extra props on test return as tests  -  by @​sheremet-va in #​9871 (141e7)
• coverage:
  • Simplify provider types  -  by @​AriPerkkio in #​9931 (aaf9f)
  • Load built-in provider without module runner  -  by @​AriPerkkio in #​9939 (bf892)
• expect:
  • Soft assertions continue after .resolves/.rejects promise errors  -  by @​mixelburg, Maks Pikov, Claude Opus 4.6 (1M context) and @​hi-ogawa in #​9843 (6d74b)
  • Fix sinon-chai style API  -  by @​hi-ogawa in #​9943 (0f08d)
• pretty-format:
  • Limit output for large object  -  by @​hi-ogawa and Claude Opus 4.6 (1M context) in #​9949 (0d5f9)

    View changes on GitHub

h3js/crossws (crossws)

v0.4.7

Compare Source

compare changes

🚀 Enhancements

• proxy: Support async target resolver in createWebSocketProxy (#​196)
• peer: Backpressure support (#​195)
• pubsub: Sync backplane (#​192)

🩹 Fixes

• deno: Capture remoteAddress eagerly at upgrade time (29d8519)
• deno: Read remoteAddr before upgrading the request (af5fe64)
• deno: Snapshot request url and headers before upgrade (1499e60)
• node: Publish non-string payloads as text frames (#​193)

📖 Documentation

• Add auth and context (#​112)

🏡 Chore

• release: V0.4.6 (d1a1861)
• Update deps (efe777c)
• Avoid non-strippable ts syntax (3ab2fac)
• Add bench suite (3ae96eb)
• Update deps (7d11d0f)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Pi0x x@pi0.io
• Sandro Circi (@​sandros94)

v0.4.6

Compare Source

compare changes

🚀 Enhancements

• Add vercel adapter (internal testing) (#​191)
• proxy: Allow forwardProtocol to rewrite the upstream subprotocol (#​190)

🩹 Fixes

• cloudflare: Persist peer namespace in Durable Object attachment (#​188)

📦 Deps

• Bundled ws upgraded from 8.20.0 to 8.21.0

❤️ Contributors

• Pooya Parsa (@​pi0)
• David Marr (@​marr)
• Andrew Barba (@​AndrewBarba)

v0.4.5

Compare Source

compare changes

🚀 Enhancements

• Add createWebSocketProxy util (#​184)
• New bunny adapter (#​179)
• Add fromNodeUpgradeHandler util + socket.io example (#​185)

🩹 Fixes

• node: Do not url-encode upgrade response headers (ffbed40)

📦 Build

• Export ServerWithWSOptions and WSOptions types (#​180)

🏡 Chore

• Update deps (ae08ca9)
• Update deps (3d83ed0)
• Update undici in tests (6291e7c)
• Migrate to oxlint and oxfmt (6a1a257)
• Update docs (02427f9)

✅ Tests

• node: Add regression test for EADDRINUSE handling (#​183)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Neko (@​nekomeowww)
• Sandro Circi (@​sandros94)

v0.4.4

Compare Source

compare changes

🩹 Fixes

• Use AbortController for StubRequest.signal (#​175)

🏡 Chore

• Update deps (9f32424)

❤️ Contributors

• Alessandro De Blasis (@​deblasis)
• Pooya Parsa (@​pi0)

v0.4.3

Compare Source

compare changes

📦 Build

• Migrate to obuild (rolldown) (efdd087)

❤️ Contributors

• Pooya Parsa (@​pi0)

v0.4.2

Compare Source

compare changes

🩹 Fixes

• node server: Properly pass request to NodeRequest (28e5d64)
• cloudflare: Send close frame (#​177)

📖 Documentation

• Add new logo with cube style (#​171)
• Mention publish not broadcasting to sender (#​173)

🏡 Chore

• playground: Add start command (7ab898c)
• release: V0.4.1 (3a537a0)
• Update undocs (4f1e94b)
• Update undocs (8646f89)
• docs: Add missing backtick (#​169)
• Update undocs (440a088)
• Update srvx version & usage (#​178)
• Update dependencies (8761d2e)
• Lint (df7062b)
• Fix type issues (68841e6)
• Update uWebSockets.js (9ce4ce5)
• Fix lint issues (4b1b779)

❤️ Contributors

• Joseph Lee (@​jclab-joseph)
• Pooya Parsa (@​pi0)
• Nick Perez (@​nperez0111)
• Rijk Van Zanten (@​rijkvanzanten)
• Sébastien Chopin seb@nuxt.com
• Abeer0 (@​iiio2)

v0.4.1

Compare Source

compare changes

🩹 Fixes

• node server: Properly pass request to NodeRequest (28e5d64)

🏡 Chore

• playground: Add start command (7ab898c)

❤️ Contributors

• Pooya Parsa (@​pi0)

v0.4.0

Compare Source

compare changes

🚀 Enhancements

• Stub full request interface (#​156)
• Universal server for deno, node and bun using srvx (experimental) (#​158)
• Create PeerContext interface for type augmentation (#​159)
• ⚠️ Namespaced pub/sub peers (#​162)
• ⚠️ Support returning context from upgrade hook (#​163)
• cloudflare: Support global publish via rpc (#​166)
• Add cloudflare and default (sse) server entries (#​167)

🩹 Fixes

• ⚠️ Do not automatically accept first sec-webSocket-protocol (#​142)

💅 Refactors

• Remove uncrypto dependency (#​153)
• ⚠️ Always pass Request as first param to resolve (#​160)
• Simplify inspect values (aa49668)
• Throw error when running deno, bun and node adapters in an incompatible environment (b5fcf2a)
• Narrow down upgrade return type (d843cd0)
• ⚠️ Always terminate upgrade if Response is returned (#​164)
• ⚠️ Merge cloudflare and cloudflare-durable adapters (#​165)
• cloudflare: Show warning when pub/sub is not supported (#​144)

📖 Documentation

• Change to h3js from unjs (#​155)
• Add docs for augmenting PeerContext type (#​161)
• Prepare for v0.4 (#​168)

📦 Build

• Simplify and fix exports (0d2ceb0)
• Remove extra .d.ts files (1f389d6)

🏡 Chore

• Update deps (37889b0)
• Update deps (c6f6bd8)

⚠️ Breaking Changes

• ⚠️ Namespaced pub/sub peers (#​162)
• ⚠️ Support returning context from upgrade hook (#​163)
• ⚠️ Do not automatically accept first sec-webSocket-protocol (#​142)
• ⚠️ Always pass Request as first param to resolve (#​160)
• ⚠️ Always terminate upgrade if Response is returned (#​164)
• ⚠️ Merge cloudflare and cloudflare-durable adapters (#​165)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Tee Ming (@​eltigerchino)
• Luke Nelson luke@nelson.zone
• @​beer (@​iiio2)

unjs/defu (defu)

v6.1.7

Compare Source

compare changes

🩹 Fixes

• defu.d.cts: Export Defu types (#​157)

📦 Build

• Correct the types export entry (#​160)

❤️ Contributors

• Jakub Michálek (@​J-Michalek)
• Kricsleo (@​kricsleo)

v6.1.6

Compare Source

compare changes

📦 Build

• Fix mixed types (407b516)

❤️ Contributors

• Pooya Parsa (@​pi0)

v6.1.5

Compare Source

compare changes

🩹 Fixes

• Prevent prototype pollution via __proto__ in defaults (#​156)
• Ignore inherited enumerable properties (11ba022)

🏡 Chore

• Add tea.yaml (70cffe5)
• Update repo (23cc432)
• Fix typecheck (89df6bb)

✅ Tests

• Add more tests for plain objects (b65f603)

🤖 CI

• Bump node (9237d9c)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Kricsleo (@​kricsleo)

eslint/eslint (eslint)

v10.6.0

Compare Source

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#​20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#​20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#​20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#​21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#​21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#​21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#​21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#​21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#​21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#​21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#​20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#​20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#​20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#​20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#​20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#​20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#​20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#​21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#​21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#​21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#​21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#​20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#​20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#​20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#​20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#​20985) (ESLint Bot)

v10.5.0

Compare Source

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#​20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#​20971) (Pixel998)
• 2ce032f feat: report max-lines-per-function violations at function head (#​20966) (Pixel998)
• 732cb3e feat: report max-nested-callbacks violations at function head (#​20967) (Pixel998)
• f9c138a feat: report max-depth violations on keywords (#​20943) (Pixel998)
• bdb496c feat: correct max-depth handling for else-if chains (#​20944) (Pixel998)
• c296873 feat: update error loc in max-statements to function header (#​20907) (Taejin Kim)

Documentation

• 8ae1b5b docs: Update README (GitHub Actions Bot)
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#​20962) (Francesco Trotta)
• f99b47a docs: Update README (GitHub Actions Bot)

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	undocs@​0.4.16
	vitest@​4.1.9
	@​vitest/​coverage-v8@​4.1.9
	h3@​2.0.1-rc.22
	crossws@​0.4.9
	@​types/​node@​25.9.4
	listhen@​1.10.0
	defu@​6.1.7
	ufo@​1.6.4
	@​typescript/​native-preview@​7.0.0-dev.20260703.1
	react@​19.2.7
	jiti@​2.7.0
	h3@​1.15.11
	react-dom@​19.2.7
	zod@​4.4.3
	eslint@​10.6.0
	undici@​7.28.0
	prettier@​3.9.4

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/undocs@0.4.16 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @internationalized/date is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → npm/undocs@0.4.16 → npm/@internationalized/date@3.12.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@internationalized/date@3.12.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @tanstack/table-core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → npm/undocs@0.4.16 → npm/@tanstack/table-core@8.21.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@tanstack/table-core@8.21.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm embla-carousel is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → npm/undocs@0.4.16 → npm/embla-carousel@8.6.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/embla-carousel@8.6.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm mermaid is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → npm/undocs@0.4.16 → npm/mermaid@11.16.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.16.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm powershell-utils is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → npm/undocs@0.4.16 → npm/powershell-utils@0.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/powershell-utils@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm robust-predicates is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → npm/undocs@0.4.16 → npm/robust-predicates@3.0.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/robust-predicates@3.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm seroval is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → npm/undocs@0.4.16 → npm/seroval@1.5.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/seroval@1.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.