⬆️ Update Node Dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@tanstack/react-virtual (source)	3.14.10 → 3.14.13
@types/node (source)	25.9.5 → 25.9.8
@types/react (source)	19.2.18 → 19.3.0
@types/react-dom (source)	19.2.4 → 19.3.0
@vitejs/plugin-react (source)	6.1.0 → 6.1.1
axios (source)	1.19.0 → 1.20.0
eslint-plugin-react-refresh	0.5.4 → 0.5.7
globals	17.11.0 → 17.12.0
react (source)	19.2.8 → 19.3.0
react-dom (source)	19.2.8 → 19.3.0
react-router-dom (source)	7.18.2 → 7.18.4
typescript-eslint (source)	8.67.0 → 8.70.0
vite (source)	8.2.2 → 8.3.0

---

Release Notes

TanStack/virtual (@​tanstack/react-virtual)

v3.14.13

Compare Source

Patch Changes

• #​1282 b48e3b0 - Skip flushSync for the synchronous notify raised from measureElement. React calls measureElement from a ref callback, i.e. while it is committing, and flushSync cannot flush there — it warns in development instead. The commit phase already runs at discrete (sync) priority, so the update lands in the same lane and the same frame without flushSync. Notifies from every other path (ResizeObserver re-measures, scroll adjustments) still flush synchronously.

• Updated dependencies [06d1b6b, 2c0a0ea]:

  • @​tanstack/virtual-core@3.17.11

v3.14.12

Compare Source

Patch Changes

• Updated dependencies [ab3278c]:
  • @​tanstack/virtual-core@3.17.10

v3.14.11

Compare Source

Patch Changes

• Updated dependencies [4a0adf3]:
  • @​tanstack/virtual-core@3.17.9

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.1.1

Compare Source

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#​1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

axios/axios (axios)

v1.20.0

Compare Source

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

• HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#​11082)

🔒 Security Fixes

• Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#​11141)

🐛 Bug Fixes

• Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#​11087, #​11118)
• Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#​11109)
• XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#​11094, #​11121)
• Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#​11091)
• Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#​11096)

🔧 Maintenance & Chores

• Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#​11092, #​11098, #​11099, #​11106, #​11107, #​11122, #​11123, #​11126, #​11127, #​11133, #​11140, #​11143, #​11144)
• Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#​11101, #​11113, #​11097, #​11119)
• Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#​11124, #​11136, #​11137)
• CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#​11128, #​11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​yens1 (#​11109)
• @​Sasireddy001 (#​11113)
• @​ari-token-security (#​11094)
• @​timothyokooboh (#​11097)
• @​gi9439041-png (#​11119)
• @​Hashim1999164 (#​11082)
• @​v-dev-cl (#​11091)
• @​r0h1tb (#​11118)
• @​ostapondo (#​11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)

v0.5.7

Compare Source

Add allowCompoundComponents option (#​117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

v0.5.6

Compare Source

• Support re-exporting namespace components (fixes #​116)

v0.5.5

Compare Source

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #​114 (fixes #​113)
• Add contentType and size to allowExportNames in Next config #​115

sindresorhus/globals (globals)

v17.12.0

Compare Source

• Update globals (2026-09-01) (#​353) 50a2119
• Add __webpack_layer__ global (#​351) 779a11a

---

react/react (react)

v19.3.0

Compare Source

react/react (react-dom)

v19.3.0

Compare Source

remix-run/react-router (react-router-dom)

v7.18.4

Compare Source

v7.18.3

Compare Source

typescript-eslint/typescript-eslint (typescript-eslint)

v8.70.0

Compare Source

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#​12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.68.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitejs/vite (vite)

v8.3.0

Compare Source

Features

• build: avoid settling seen preload dependencies for performance (#​23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#​23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #​17467) (#​23437) (ef0dc17)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#​23263) (8abf700)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.