fix(deps): update minor updates (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint-react/eslint-plugin (source)	5.23.5 → 5.24.10
execa	^10.0.1 → ^10.1.0
oxfmt (source)	0.71.0 → 0.72.0

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.24.10

Compare Source

📝 Documentation

• Added a link to the Astryx no-react-introspection rule in the react-x/no-children-count and react-x/no-children-map rule documentation.

🏗️ Internal

• Disabled test isolation in the vitest config.
• Reordered react-web-api/no-leaked-event-listener test specs from typical cases to edge cases. (#​2015)
• Unified KNOWN_-prefixed constant names in react-x/no-array-index-key and react-x/no-missing-key. (#​2014)
• Bumped effect to 4.0.2, @effect/platform-node to 4.0.2, nx to 23.3.0, vite to 8.3.4, lucide-react to 1.53.0, and pnpm to 12.10.1.

Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10

v5.24.9

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: optional chaining in a setState argument (ex: setData(ref.current?.value), setWidth(el?.offsetWidth ?? 0) where el is ref-derived) no longer defeats the ref-value exemption; the ChainExpression wrapper is now unwrapped during ref-source detection. (#​2011)

📝 Documentation

• Aligned rule documentation with the current react.dev reference docs. (#​2013)

Full Changelog: Rel1cx/eslint-react@v5.24.8...v5.24.9

v5.24.8

Compare Source

🐞 Fixes

• react-x/rules-of-hooks: removed the incorrect FIX feature declaration; the rule does not provide an auto-fix and is no longer advertised as fixable. (#​2009)

🏗️ Internal

• Added edge-case test specs from the v5.24.7 change review covering react-x/immutability, react-x/set-state-in-render, react-web-api/no-leaked-event-listener, and the leaked-observer rules.
• Bumped next to 16.4.0, vite to 8.3.3, and related dependencies.

Full Changelog: Rel1cx/eslint-react@v5.24.7...v5.24.8

v5.24.7

Compare Source

🐞 Fixes

• react-x/immutability: no longer reports rebinding a plain local alias of props/state as a mutation; destructured props rebinding and member writes through aliases are still reported. (#​1995)
• react-x/set-state-in-render: setState calls after nested component or hook declarations are now attributed to the outer component again. (#​2004)
• react-x/set-state-in-render: anonymous callbacks passed directly to memo()/forwardRef() are now treated as component render functions. (#​1998)
• react-web-api/no-leaked-fetch: signal alias chains are now resolved recursively, so fetches with aliased signals correctly pair with their cleanup abort call. (#​1997)
• react-web-api/no-leaked-event-listener: bare global addEventListener(...) calls now pair with matching removeEventListener(...) cleanup calls. (#​1996)
• react-web-api/no-leaked-event-listener: a signal destructured from new AbortController() is now recognized. (#​2001)
• react-web-api/no-leaked-resize-observer / react-web-api/no-leaked-intersection-observer: disconnect() / unobserve(...) now only count as cleanup in the cleanup phase; useRef-held observer instances are tracked; unobserve(...) inside the observer callback no longer pairs with observe(...). (#​2002, #​2003)

🏗️ Internal

• Bumped typescript-eslint to 8.71.1 and postcss to 8.5.29.

Full Changelog: Rel1cx/eslint-react@v5.24.6...v5.24.7

v5.24.6

Compare Source

🐞 Fixes

• react-x/no-unused-props: computed member access and destructuring with an identifier key (ex: props[key], const { [key]: value } = props) no longer count as usage of a prop named after the key; the rule now bails out on such dynamic keys instead of reporting actually-used props as unused. (#​1994)
• react-x/set-state-in-effect: object-pattern destructuring of the useState tuple is now resolved by numeric key: a name bound at key 0 (ex: const { 0: value } = useState()) is no longer mistaken for the setter, while key 1 (ex: const { 1: setData } = useState()) is still recognized. (#​1994)
• react-x/set-state-in-render: same useState object-pattern destructuring fix as set-state-in-effect. (#​1994)

Full Changelog: Rel1cx/eslint-react@v5.24.5...v5.24.6

v5.24.5

Compare Source

🏗️ Internal

• Self-linted rule implementations with eslint-plugin-eslint-plugin, removing redundant empty defaultOptions declarations and enforcing meta.defaultOptions for rules with options. (#​1993) Thanks to @​rakleed and @​Rel1cx!
• Minor code cleanups in react-web-api/no-leaked-intersection-observer, react-x/no-create-ref, react-x/no-nested-lazy-component-declarations, and react-x/use-state. Thanks to @​Rel1cx!
• Bumped effect to 4.0.1, pnpm to 12.9.1, fumadocs-core and fumadocs-ui to 16.16.1, lucide-react to 1.52.0, tsl-dx to 0.14.0, and tinybench to 6.2.0. Thanks to @​Rel1cx!

Full Changelog: Rel1cx/eslint-react@v5.24.4...v5.24.5

v5.24.4

Compare Source

🏗️ Internal

• Enable dead-code elimination in tsdown config, producing smaller published packages.

Full Changelog: Rel1cx/eslint-react@v5.24.3...v5.24.4

v5.24.3

Compare Source

🏗️ Internal

• @local/eff: minor code optimizations.
• @eslint-react/shared: minor code optimizations.

Full Changelog: Rel1cx/eslint-react@v5.24.2...v5.24.3

v5.24.2

Compare Source

🏗️ Internal

• @eslint-react/core, @eslint-react/var, the react-dom plugin, and the react-x plugin: replaced in operator checks with the hasProperty helper from @local/eff.
• @eslint-react/shared: documented getNormalizedSettings.
• JSDoc comments are now stripped from the tsdown build output, producing smaller published packages.

Full Changelog: Rel1cx/eslint-react@v5.24.1...v5.24.2

v5.24.1

Compare Source

📝 Documentation

• Added a link to the Astryx no-react-introspection rule in the react-x/no-children-count and react-x/no-children-map rule documentation.

🏗️ Internal

• Disabled test isolation in the vitest config.
• Reordered react-web-api/no-leaked-event-listener test specs from typical cases to edge cases. (#​2015)
• Unified KNOWN_-prefixed constant names in react-x/no-array-index-key and react-x/no-missing-key. (#​2014)
• Bumped effect to 4.0.2, @effect/platform-node to 4.0.2, nx to 23.3.0, vite to 8.3.4, lucide-react to 1.53.0, and pnpm to 12.10.1.

Full Changelog: Rel1cx/eslint-react@v5.24.9...v5.24.10

v5.24.0

Compare Source

🐞 Fixes

• react-x/set-state-in-effect: more value shapes are recognized as ref-derived setState arguments: interpolations in template literals (ex: setData(`${ref.current}`)), tagged templates (both the quasi and a ref-derived tag), object and array literals (ex: setData({ value: ref.current })), and spreads (ex: setData({ ...ref.current })) — previously these fell through to the default case and were reported. (#​1988)

📝 Documentation

• Added eslint-config-xo-react to the website's community presets.

🏗️ Internal

• @local/eff: added predicate combinators and type guards synced with effect, and migrated call sites across the workspace to them. (#​1989)
• react-x/set-state-in-effect, react-x/set-state-in-render, and react-x/use-memo: reworked to the fact-based implementation pattern — fact collection (collect.ts), provenance resolution (origins.ts), and violation inference (effects.ts) are now separate modules, with lib.ts replaced by a pure-AST helpers.ts; set-state-in-effect again classifies a hook name configured as both additionalStateHooks and additionalEffectHooks as a state hook first. (#​1983, #​1985, #​1986)
• react-x/use-state: aligned the nested-expression collectors' visitor keys to callee-first order, matching eslint-visitor-keys; no behavior change. (#​1988)
• Migrated package unit tests to the shared @local/testkit helpers. (#​1987)
• Renamed message ids to kebab-case across all plugins. (#​1984)
• Bumped fumadocs-core and fumadocs-ui to 16.15.18, fumadocs-mdx to 15.4.6, lucide-react to 1.50.0, and @types/node to 26.6.4.

Full Changelog: Rel1cx/eslint-react@v5.23.5...v5.24.0

sindresorhus/execa (execa)

v10.1.0

Compare Source

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

• extendEnv: false without the env option no longer inherits process.env, per docs 67acf60
• Windows: Arguments of .cmd and .bat files are now escaped like Rust does, which fixes batch files reading %~1 (#​1261) 93bddc4
• Invalid stdio values, such as negative file descriptors, now throw c6bd387
• Using the same file as input and output now throws, even when the paths are written differently 587045a
• Synchronous methods now enforce per-file-descriptor maxBuffer values 9547e51
• Synchronous methods now throw on the signal option, like asynchronous methods 59de065
• Synchronous methods now write the raw output bytes to files, like asynchronous methods af6264a

Fixes

• Fix subprocess.kill() signaling the current process group when the subprocess failed to spawn 5464d43
• Fix crashes when spawning fails with EMFILE/ENFILE (#​1262), or when a file target cannot be opened 15c46cd 1cee524
• Fix error.stdout and error.stderr being undefined when synchronous methods fail to spawn (#​1263) bfe4633
• Fix the subprocess promise hanging until an output stream is read 004f3b3
• Fix subprocess.pipe() with the stdio option, and destination subprocesses left running 8d3f0a9 ecda56b
• Fix result.all when only some file descriptors are buffered or split into lines 758768f
• Fix the encoding option and line splitting in transforms 6adb3c3
• Fix input and output transforms with synchronous methods 516a5e2 e0b5dbc
• Fix template strings with emojis and line continuations b67f199
• Fix killDescendants signaling unrelated processes on Windows 9c5c71c
• Fix IPC with serialization: 'json', strict: true and the verbose option 9842f1a 698a1b8 b548d8b
• Fix the subprocess error being hidden when the current directory was deleted 91d9ded
• Fix shebang scripts on Windows when the file is small 7c1a631

---

oxc-project/oxc (oxfmt)

v0.72.0: oxfmt v0.72.0

Compare Source

💥 BREAKING CHANGES

• e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#​27256) (leaysgur)

🚀 Features

• b538e3c formatter_css: Parse embedded CSS as a block's contents (#​27284) (leaysgur)

🐛 Bug Fixes

• 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#​27334) (leaysgur)
• 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#​27331) (leaysgur)
• e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#​27326) (leaysgur)
• df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#​27325) (leaysgur)
• 7f65b75 formatter: Format assignment target property as assignment-like (#​27289) (leaysgur)
• 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#​27288) (leaysgur)
• 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#​27283) (leaysgur)
• 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#​27278) (leaysgur)
• dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#​27277) (leaysgur)
• 1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#​27275) (leaysgur)
• fd4ddce formatter_json: Flatten block comment only array|object (#​27274) (leaysgur)
• 267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#​27241) (leaysgur)
• 2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#​27237) (Nicolas Le Cam)
• c2de02b formatter: Decide embedded template layout from AST, not source shape (#​27218) (leaysgur)
• c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#​27216) (leaysgur)
• 36e14df formatter: Keep comments between callee and its opener on the callee side (#​27172) (leaysgur)
• 6da7657 oxfmt: Render diagnostics with source in Stdin mode (#​27130) (leaysgur)
• e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#​27129) (leaysgur)
• 30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#​27128) (leaysgur)

⚡ Performance

• 72f42a3 formatter_markdown: Pre-allocate the IR buffer (#​27333) (leaysgur)
• cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#​27211) (leaysgur)
• 0aba566 oxfmt: Do not resolve root js config from nested context (#​27147) (leaysgur)

📚 Documentation

• 51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#​27327) (leaysgur)
• 656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#​27279) (leaysgur)
• 66545bf formatter_markdown: Record setext heading wrap divergence (#​27221) (leaysgur)
• af4b269 oxfmt: Document why format() API does not take cwd (#​27131) (leaysgur)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2e1074e2-edfe-44c3-a544-0e2d4d98c114

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thank you for following the naming conventions! 🙏

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	execa@​10.1.0
	oxfmt@​0.71.0 ⏵ 0.72.0	+1		+1
	@​eslint-react/​eslint-plugin@​5.24.10

View full report