-You can look at a preview for [all available themes](../backend/themes/README.md) or checkout the [theme config file](../backend/themes/index.js). Please note that we paused the addition of new themes to decrease maintenance efforts; all pull requests related to new themes will be closed.
+You can look at a preview for [all available themes](../packages/core/src/themes/README.md) or checkout the [theme config file](../packages/core/src/themes/index.js). Please note that we paused the addition of new themes to decrease maintenance efforts; all pull requests related to new themes will be closed.
#### Responsive Card Theme
@@ -102,7 +102,7 @@ We have included a `transparent` theme that has a transparent background. This t
##### Add transparent alpha channel to a themes bg\_color
-You can use the `bg_color` parameter to make any of [the available themes](../backend/themes/README.md) transparent. This is done by setting the `bg_color` to a color with a transparent alpha channel (i.e. `bg_color=00000000`):
+You can use the `bg_color` parameter to make any of [the available themes](../packages/core/src/themes/README.md) transparent. This is done by setting the `bg_color` to a color with a transparent alpha channel (i.e. `bg_color=00000000`):
```md
@@ -181,7 +181,7 @@ You can customize the appearance of all your cards however you wish with URL par
| `border_color` | Card's border color. Does not apply when `hide_border` is enabled. | string (hex color) | `e4e2e2` |
| `bg_color` | Card's background color. | string (hex color or a gradient in the form of *angle,start,end*) | `fffefe` |
| `hide_border` | Hides the card's border. | boolean | `false` |
-| `theme` | Name of the theme, choose from [all available themes](../backend/themes/README.md). | enum | `default` |
+| `theme` | Name of the theme, choose from [all available themes](../packages/core/src/themes/README.md). | enum | `default` |
| `cache_seconds` | Sets the cache header manually (min: 21600, max: 86400). | integer | `21600` |
| `locale` | Sets the language in the card, you can check full list of available locales [here](#available-locales). | enum | `en` |
| `border_radius` | Corner rounding on the card. | number | `4.5` |
diff --git a/docs/deploy.md b/docs/deploy.md
index a837d1ec..637cb46a 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -123,6 +123,7 @@ Click on the deploy button to get started!
13. optional: add an SQL database; by using e.g. the ["Nile" integration](https://vercel.com/marketplace/nile) or by manually setting the environment variable `POSTGRES_URL`
14. optional: [create your own OAuth App](https://github.com/settings/developers) and set environment variables `OAUTH_REDIRECT_URI`, `OAUTH_CLIENT_ID` and `OAUTH_CLIENT_SECRET` on Vercel accordingly
15. optional: in addition to the Vercel project based on the `apps/backend` folder, create a second project based on the `apps/frontend` folder. No environment variables needed.
+16. optional: set the environment variable `TURBO_PLATFORM_ENV_DISABLED` to `true` to disable the build-time warning from [turbo](https://turborepo.dev/) about environment variables missing from "turbo.json" - This warning is not relevant in our project.
diff --git a/eslint.config.js b/eslint.config.js
index b1b9de20..270d6cbb 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -3,6 +3,7 @@ import { fileURLToPath } from "node:url";
import { includeIgnoreFile } from "@eslint/compat";
import js from "@eslint/js";
import { defineConfig } from "eslint/config";
+import { createTypeScriptImportResolver } from "eslint-import-resolver-typescript";
import { importX } from "eslint-plugin-import-x";
import { default as jsdoc } from "eslint-plugin-jsdoc";
import react from "eslint-plugin-react";
@@ -18,6 +19,25 @@ export default defineConfig(
{
extends: [importX.flatConfigs.recommended, importX.flatConfigs.typescript],
+ settings: {
+ "import-x/resolver-next": [
+ createTypeScriptImportResolver({
+ conditionNames: [
+ /** Keep in sync with `tsconfig.base.json#customConditions` */
+ "@stats/source",
+
+ "types",
+ "import",
+
+ "require",
+ "node",
+ "node-addons",
+ "browser",
+ "default",
+ ],
+ }),
+ ],
+ },
rules: {
"import-x/consistent-type-specifier-style": ["error", "prefer-top-level"],
"import-x/order": [
diff --git a/knip.jsonc b/knip.jsonc
index 5de96712..1980b45b 100644
--- a/knip.jsonc
+++ b/knip.jsonc
@@ -2,21 +2,10 @@
"$schema": "./node_modules/knip/schema.json",
"workspaces": {
"apps/backend": {
- "entry": ["api-renamed/*.js", "express.js", "tests/bench/*.bench.js"],
- "ignoreFiles": [
- "_dot_vercel_copy/**/*" // Hopefully by using a npm package this file will be removed
- ]
+ "entry": ["api-renamed/*.js", "express.js", "tests/bench/*.bench.js"]
},
"apps/frontend": {
- "entry": ["src/wakatime-override.ts"],
-
- "ignoreDependencies": [
- // below dependencies are added because backend folder is copied inside frontend folder,
- // so some of his dependencies must be present here
- "github-username-regex",
- "emoji-name-map",
- "word-wrap"
- ]
+ "entry": ["src/wakatime-override.ts"]
}
}
}
diff --git a/package.json b/package.json
index b0ed2b1c..53e0d770 100644
--- a/package.json
+++ b/package.json
@@ -1,35 +1,44 @@
{
- "name": "root",
+ "name": "@stats-organization/root",
"private": true,
"type": "module",
- "packageManager": "pnpm@10.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017",
+ "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
"devDependencies": {
- "@eslint/compat": "2.0.2",
- "@eslint/js": "9.39.3",
- "@playwright/test": "1.58.2",
- "@types/node": "24.10.13",
- "eslint": "9.39.2",
+ "@eslint/compat": "2.0.3",
+ "@eslint/js": "10.0.1",
+ "@playwright/test": "1.59.1",
+ "@types/node": "24.12.0",
+ "@vitest/coverage-v8": "catalog:default",
+ "eslint": "10.1.0",
"eslint-import-resolver-typescript": "4.4.4",
- "eslint-plugin-import-x": "4.16.1",
- "eslint-plugin-jsdoc": "62.7.1",
+ "eslint-plugin-import-x": "4.16.2",
+ "eslint-plugin-jsdoc": "62.9.0",
"eslint-plugin-react": "7.37.5",
"eslint-plugin-react-hooks": "7.0.1",
- "globals": "17.3.0",
+ "globals": "17.4.0",
"husky": "9.1.7",
- "knip": "5.85.0",
- "lint-staged": "16.2.7",
+ "knip": "6.2.0",
+ "lint-staged": "16.4.0",
"prettier": "3.8.1",
+ "turbo": "2.9.3",
"typescript": "5.9.3",
- "typescript-eslint": "8.56.1"
+ "typescript-eslint": "8.58.0",
+ "vitest": "catalog:default"
},
"scripts": {
"prepare": "husky",
+ "build:packages": "turbo run build --filter=./packages/*",
+ "build:frontend": "turbo run build --filter=./apps/frontend",
+ "dev:frontend": "pnpm run --filter=./apps/frontend dev",
+ "test": "vitest",
+ "test:coverage": "vitest --config vitest.config.coverage.ts",
"format": "prettier --write .",
"format:check": "prettier --check .",
- "lint": "eslint",
- "lint:fix": "eslint --fix",
+ "lint": "turbo run lint",
+ "lint:eslint": "eslint",
+ "lint:eslint:fix": "eslint --fix",
"lint:knip": "knip",
- "typecheck": "tsc --build --noEmit"
+ "typecheck": "turbo run typecheck"
},
"lint-staged": {
"*.{js,jsx,ts,tsx,css,json,jsonc,yaml,yml}": "prettier --write"
diff --git a/apps/backend/codecov.yml b/packages/core/codecov.yml
similarity index 100%
rename from apps/backend/codecov.yml
rename to packages/core/codecov.yml
diff --git a/packages/core/package.json b/packages/core/package.json
new file mode 100644
index 00000000..e9e10e70
--- /dev/null
+++ b/packages/core/package.json
@@ -0,0 +1,94 @@
+{
+ "name": "@stats-organization/github-readme-stats-core",
+ "version": "2.0.0",
+ "type": "module",
+ "homepage": "https://github-stats-extended.vercel.app/frontend",
+ "bugs": {
+ "url": "https://github.com/stats-organization/github-stats-extended/issues"
+ },
+ "repository": {
+ "type": "git",
+ "url": "https://github.com/stats-organization/github-stats-extended.git",
+ "directory": "packages/core"
+ },
+ "author": {
+ "name": "Anurag Hazra",
+ "url": "https://github.com/anuraghazra/"
+ },
+ "contributors": [
+ {
+ "name": "Rick Staa",
+ "url": "https://github.com/rickstaa"
+ },
+ {
+ "name": "Alexandr Garbuzov",
+ "url": "https://github.com/qwerty541"
+ },
+ {
+ "name": "Abhijit Gupta",
+ "url": "https://github.com/avgupta456"
+ },
+ {
+ "name": "Marco Pasqualetti",
+ "url": "https://github.com/marcalexiei"
+ },
+ {
+ "name": "martin-mfg",
+ "url": "https://github.com/martin-mfg"
+ }
+ ],
+ "license": "MIT",
+ "engines": {
+ "node": "24.x"
+ },
+ "description": "Dynamically generate stats for your GitHub readme",
+ "keywords": [
+ "github-readme-stats",
+ "readme-stats",
+ "cards",
+ "card-generator",
+ "github-stats",
+ "github-stats-extended",
+ "github-readme-stats-extended"
+ ],
+ "main": "./build/index.js",
+ "exports": {
+ ".": {
+ "@stats/source": "./src/index.ts",
+ "default": "./build/index.js"
+ }
+ },
+ "files": [
+ "build",
+ "src"
+ ],
+ "publishConfig": {
+ "access": "public"
+ },
+ "scripts": {
+ "build": "tsc -p tsconfig.build.json",
+ "test": "vitest",
+ "test:update:snapshot": "vitest -u",
+ "test:e2e": "vitest --config vitest.config.e2e.ts",
+ "bench": "vitest bench --run --config vitest.config.bench.ts",
+ "lint": "eslint",
+ "typecheck": "tsc -p tsconfig.typecheck.json",
+ "theme-readme-gen": "node scripts/generate-theme-doc",
+ "generate-langs-json": "node scripts/generate-langs-json"
+ },
+ "devDependencies": {
+ "@testing-library/dom": "10.4.1",
+ "@testing-library/jest-dom": "6.9.1",
+ "@uppercod/css-to-object": "1.1.1",
+ "axios-mock-adapter": "2.1.0",
+ "js-yaml": "4.1.1",
+ "jsdom": "28.1.0",
+ "vitest": "catalog:default"
+ },
+ "dependencies": {
+ "axios": "^1.13.5",
+ "emoji-name-map": "^2.0.3",
+ "github-username-regex": "^1.0.0",
+ "word-wrap": "^1.2.5"
+ }
+}
diff --git a/apps/backend/scripts/generate-langs-json.js b/packages/core/scripts/generate-langs-json.js
similarity index 100%
rename from apps/backend/scripts/generate-langs-json.js
rename to packages/core/scripts/generate-langs-json.js
diff --git a/apps/backend/scripts/generate-theme-doc.js b/packages/core/scripts/generate-theme-doc.js
similarity index 96%
rename from apps/backend/scripts/generate-theme-doc.js
rename to packages/core/scripts/generate-theme-doc.js
index 93c8e6a7..afd4b1b3 100644
--- a/apps/backend/scripts/generate-theme-doc.js
+++ b/packages/core/scripts/generate-theme-doc.js
@@ -1,8 +1,8 @@
import fs from "fs";
-import { themes } from "../themes/index.js";
+import { themes } from "../src/themes/index.js";
-const TARGET_FILE = "./themes/README.md";
+const TARGET_FILE = "./src/themes/README.md";
const REPO_CARD_LINKS_FLAG = "";
const STAT_CARD_LINKS_FLAG = "";
diff --git a/packages/core/src/api/gist.js b/packages/core/src/api/gist.js
new file mode 100644
index 00000000..ebce051e
--- /dev/null
+++ b/packages/core/src/api/gist.js
@@ -0,0 +1,97 @@
+// @ts-check
+
+import { renderGistCard } from "../cards/gist.js";
+import {
+ MissingParamError,
+ retrieveSecondaryMessage,
+} from "../common/error.js";
+import { parseBoolean } from "../common/ops.js";
+import { renderError } from "../common/render.js";
+import { fetchGist } from "../fetchers/gist.js";
+import { isLocaleAvailable } from "../translations.js";
+
+// @ts-ignore
+export default async (
+ {
+ id,
+ title_color,
+ icon_color,
+ text_color,
+ bg_color,
+ theme,
+ locale,
+ border_radius,
+ border_color,
+ show_owner,
+ hide_border,
+ },
+ pat = null,
+) => {
+ if (locale && !isLocaleAvailable(locale)) {
+ return {
+ status: "error - permanent",
+ content: renderError({
+ message: "Something went wrong",
+ secondaryMessage: "Language not found",
+ renderOptions: {
+ title_color,
+ text_color,
+ bg_color,
+ border_color,
+ theme,
+ },
+ }),
+ };
+ }
+
+ try {
+ const gistData = await fetchGist(id, pat);
+
+ return {
+ status: "success",
+ content: renderGistCard(gistData, {
+ title_color,
+ icon_color,
+ text_color,
+ bg_color,
+ theme,
+ border_radius,
+ border_color,
+ locale: locale ? locale.toLowerCase() : null,
+ show_owner: parseBoolean(show_owner),
+ hide_border: parseBoolean(hide_border),
+ }),
+ };
+ } catch (err) {
+ if (err instanceof Error) {
+ return {
+ status: "error - temporary",
+ content: renderError({
+ message: err.message,
+ secondaryMessage: retrieveSecondaryMessage(err),
+ renderOptions: {
+ title_color,
+ text_color,
+ bg_color,
+ border_color,
+ theme,
+ show_repo_link: !(err instanceof MissingParamError),
+ },
+ }),
+ };
+ }
+ return {
+ status: "error - temporary",
+ content: renderError({
+ message: "An unknown error occurred",
+ renderOptions: {
+ title_color,
+ text_color,
+ bg_color,
+ border_color,
+ theme,
+ },
+ }),
+ };
+ }
+};
diff --git a/apps/backend/api-renamed/index.js b/packages/core/src/api/index.js
similarity index 71%
rename from apps/backend/api-renamed/index.js
rename to packages/core/src/api/index.js
index 55ac2e72..5709e30a 100644
--- a/apps/backend/api-renamed/index.js
+++ b/packages/core/src/api/index.js
@@ -1,26 +1,18 @@
// @ts-check
-import { renderStatsCard } from "../src/cards/stats.js";
-import { guardAccess } from "../src/common/access.js";
-import {
- CACHE_TTL,
- resolveCacheSeconds,
- setCacheHeaders,
- setErrorCacheHeaders,
-} from "../src/common/cache.js";
-import { storeRequest } from "../src/common/database.js";
+import { renderStatsCard } from "../cards/stats.js";
import {
MissingParamError,
retrieveSecondaryMessage,
-} from "../src/common/error.js";
-import { parseArray, parseBoolean } from "../src/common/ops.js";
-import { renderError } from "../src/common/render.js";
-import { fetchStats } from "../src/fetchers/stats.js";
-import { isLocaleAvailable } from "../src/translations.js";
+} from "../common/error.js";
+import { parseArray, parseBoolean } from "../common/ops.js";
+import { renderError } from "../common/render.js";
+import { fetchStats } from "../fetchers/stats.js";
+import { isLocaleAvailable } from "../translations.js";
// @ts-ignore
-export default async (req, res) => {
- const {
+export default async (
+ {
username,
repo,
owner,
@@ -40,7 +32,6 @@ export default async (req, res) => {
text_bold,
bg_color,
theme,
- cache_seconds,
exclude_repo,
custom_title,
locale,
@@ -52,28 +43,13 @@ export default async (req, res) => {
border_color,
rank_icon,
show,
- } = req.query;
- res.setHeader("Content-Type", "image/svg+xml");
-
- const access = guardAccess({
- res,
- id: username,
- type: "username",
- colors: {
- title_color,
- text_color,
- bg_color,
- border_color,
- theme,
- },
- });
- if (!access.isPassed) {
- return access.result;
- }
-
+ },
+ pat = null,
+) => {
if (locale && !isLocaleAvailable(locale)) {
- return res.send(
- renderError({
+ return {
+ status: "error - permanent",
+ content: renderError({
message: "Something went wrong",
secondaryMessage: "Language not found",
renderOptions: {
@@ -84,7 +60,7 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
const safePattern = /^[-\w/.,]+$/;
@@ -93,8 +69,9 @@ export default async (req, res) => {
(repo && !safePattern.test(repo)) ||
(owner && !safePattern.test(owner))
) {
- return res.send(
- renderError({
+ return {
+ status: "error - permanent",
+ content: renderError({
message: "Something went wrong",
secondaryMessage:
"Username, repository or owner contains unsafe characters",
@@ -106,11 +83,10 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
try {
- await storeRequest(req);
const showStats = parseArray(show);
const repoOwner = parseArray(owner);
let repository = parseArray(repo);
@@ -135,18 +111,12 @@ export default async (req, res) => {
showStats.includes("issues_authored"),
showStats.includes("issues_commented"),
parseArray(role),
+ pat,
);
- const cacheSeconds = resolveCacheSeconds({
- requested: parseInt(cache_seconds, 10),
- def: CACHE_TTL.STATS_CARD.DEFAULT,
- min: CACHE_TTL.STATS_CARD.MIN,
- max: CACHE_TTL.STATS_CARD.MAX,
- });
- setCacheHeaders(res, cacheSeconds);
-
- return res.send(
- renderStatsCard(
+ return {
+ status: "success",
+ content: renderStatsCard(
stats,
{
hide: parseArray(hide),
@@ -179,12 +149,12 @@ export default async (req, res) => {
repository,
repoOwner,
),
- );
+ };
} catch (err) {
- setErrorCacheHeaders(res);
if (err instanceof Error) {
- return res.send(
- renderError({
+ return {
+ status: "error - temporary",
+ content: renderError({
message: err.message,
secondaryMessage: retrieveSecondaryMessage(err),
renderOptions: {
@@ -196,10 +166,11 @@ export default async (req, res) => {
show_repo_link: !(err instanceof MissingParamError),
},
}),
- );
+ };
}
- return res.send(
- renderError({
+ return {
+ status: "error - temporary",
+ content: renderError({
message: "An unknown error occurred",
renderOptions: {
title_color,
@@ -209,6 +180,6 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
};
diff --git a/apps/backend/api-renamed/pin.js b/packages/core/src/api/pin.js
similarity index 63%
rename from apps/backend/api-renamed/pin.js
rename to packages/core/src/api/pin.js
index b79a74f6..77107373 100644
--- a/apps/backend/api-renamed/pin.js
+++ b/packages/core/src/api/pin.js
@@ -1,26 +1,18 @@
// @ts-check
-import { renderRepoCard } from "../src/cards/repo.js";
-import { guardAccess } from "../src/common/access.js";
-import {
- CACHE_TTL,
- resolveCacheSeconds,
- setCacheHeaders,
- setErrorCacheHeaders,
-} from "../src/common/cache.js";
-import { storeRequest } from "../src/common/database.js";
+import { renderRepoCard } from "../cards/repo.js";
import {
MissingParamError,
retrieveSecondaryMessage,
-} from "../src/common/error.js";
-import { parseArray, parseBoolean } from "../src/common/ops.js";
-import { renderError } from "../src/common/render.js";
-import { fetchRepo } from "../src/fetchers/repo.js";
-import { isLocaleAvailable } from "../src/translations.js";
+} from "../common/error.js";
+import { parseArray, parseBoolean } from "../common/ops.js";
+import { renderError } from "../common/render.js";
+import { fetchRepo } from "../fetchers/repo.js";
+import { isLocaleAvailable } from "../translations.js";
// @ts-ignore
-export default async (req, res) => {
- const {
+export default async (
+ {
username,
repo,
hide_border,
@@ -36,34 +28,17 @@ export default async (req, res) => {
number_format,
text_bold,
line_height,
- cache_seconds,
locale,
border_radius,
border_color,
description_lines_count,
- } = req.query;
-
- res.setHeader("Content-Type", "image/svg+xml");
-
- const access = guardAccess({
- res,
- id: username,
- type: "username",
- colors: {
- title_color,
- text_color,
- bg_color,
- border_color,
- theme,
- },
- });
- if (!access.isPassed) {
- return access.result;
- }
-
+ },
+ pat = null,
+) => {
if (locale && !isLocaleAvailable(locale)) {
- return res.send(
- renderError({
+ return {
+ status: "error - permanent",
+ content: renderError({
message: "Something went wrong",
secondaryMessage: "Language not found",
renderOptions: {
@@ -74,7 +49,7 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
const safePattern = /^[-\w/.,]+$/;
@@ -82,8 +57,9 @@ export default async (req, res) => {
(username && !safePattern.test(username)) ||
(repo && !safePattern.test(repo))
) {
- return res.send(
- renderError({
+ return {
+ status: "error - permanent",
+ content: renderError({
message: "Something went wrong",
secondaryMessage: "Username or repository contains unsafe characters",
renderOptions: {
@@ -94,11 +70,10 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
try {
- await storeRequest(req);
const showStats = parseArray(show);
const repoData = await fetchRepo(
username,
@@ -108,19 +83,12 @@ export default async (req, res) => {
showStats.includes("prs_reviewed"),
showStats.includes("issues_authored"),
showStats.includes("issues_commented"),
+ pat,
);
- const cacheSeconds = resolveCacheSeconds({
- requested: parseInt(cache_seconds, 10),
- def: CACHE_TTL.PIN_CARD.DEFAULT,
- min: CACHE_TTL.PIN_CARD.MIN,
- max: CACHE_TTL.PIN_CARD.MAX,
- });
-
- setCacheHeaders(res, cacheSeconds);
-
- return res.send(
- renderRepoCard(repoData, {
+ return {
+ status: "success",
+ content: renderRepoCard(repoData, {
hide_border: parseBoolean(hide_border),
title_color,
icon_color,
@@ -140,12 +108,12 @@ export default async (req, res) => {
locale: locale ? locale.toLowerCase() : null,
description_lines_count,
}),
- );
+ };
} catch (err) {
- setErrorCacheHeaders(res);
if (err instanceof Error) {
- return res.send(
- renderError({
+ return {
+ status: "error - temporary",
+ content: renderError({
message: err.message,
secondaryMessage: retrieveSecondaryMessage(err),
renderOptions: {
@@ -157,10 +125,11 @@ export default async (req, res) => {
show_repo_link: !(err instanceof MissingParamError),
},
}),
- );
+ };
}
- return res.send(
- renderError({
+ return {
+ status: "error - temporary",
+ content: renderError({
message: "An unknown error occurred",
renderOptions: {
title_color,
@@ -170,6 +139,6 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
};
diff --git a/apps/backend/api-renamed/top-langs.js b/packages/core/src/api/top-langs.js
similarity index 64%
rename from apps/backend/api-renamed/top-langs.js
rename to packages/core/src/api/top-langs.js
index 056193c8..4972b6fd 100644
--- a/apps/backend/api-renamed/top-langs.js
+++ b/packages/core/src/api/top-langs.js
@@ -1,26 +1,18 @@
// @ts-check
-import { renderTopLanguages } from "../src/cards/top-languages.js";
-import { guardAccess } from "../src/common/access.js";
-import {
- CACHE_TTL,
- resolveCacheSeconds,
- setCacheHeaders,
- setErrorCacheHeaders,
-} from "../src/common/cache.js";
-import { storeRequest } from "../src/common/database.js";
+import { renderTopLanguages } from "../cards/top-languages.js";
import {
MissingParamError,
retrieveSecondaryMessage,
-} from "../src/common/error.js";
-import { parseArray, parseBoolean } from "../src/common/ops.js";
-import { renderError } from "../src/common/render.js";
-import { fetchTopLanguages } from "../src/fetchers/top-languages.js";
-import { isLocaleAvailable } from "../src/translations.js";
+} from "../common/error.js";
+import { parseArray, parseBoolean } from "../common/ops.js";
+import { renderError } from "../common/render.js";
+import { fetchTopLanguages } from "../fetchers/top-languages.js";
+import { isLocaleAvailable } from "../translations.js";
// @ts-ignore
-export default async (req, res) => {
- const {
+export default async (
+ {
username,
hide,
hide_title,
@@ -31,7 +23,6 @@ export default async (req, res) => {
bg_color,
prog_bar_bg_color,
theme,
- cache_seconds,
layout,
langs_count,
exclude_repo,
@@ -45,28 +36,13 @@ export default async (req, res) => {
disable_animations,
hide_progress,
stats_format,
- } = req.query;
- res.setHeader("Content-Type", "image/svg+xml");
-
- const access = guardAccess({
- res,
- id: username,
- type: "username",
- colors: {
- title_color,
- text_color,
- bg_color,
- border_color,
- theme,
- },
- });
- if (!access.isPassed) {
- return access.result;
- }
-
+ },
+ pat = null,
+) => {
if (locale && !isLocaleAvailable(locale)) {
- return res.send(
- renderError({
+ return {
+ status: "error - permanent",
+ content: renderError({
message: "Something went wrong",
secondaryMessage: "Locale not found",
renderOptions: {
@@ -77,7 +53,7 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
if (
@@ -85,8 +61,9 @@ export default async (req, res) => {
(typeof layout !== "string" ||
!["compact", "normal", "donut", "donut-vertical", "pie"].includes(layout))
) {
- return res.send(
- renderError({
+ return {
+ status: "error - permanent",
+ content: renderError({
message: "Something went wrong",
secondaryMessage: "Incorrect layout input",
renderOptions: {
@@ -97,7 +74,7 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
if (
@@ -105,8 +82,9 @@ export default async (req, res) => {
(typeof stats_format !== "string" ||
!["bytes", "percentages"].includes(stats_format))
) {
- return res.send(
- renderError({
+ return {
+ status: "error - permanent",
+ content: renderError({
message: "Something went wrong",
secondaryMessage: "Incorrect stats_format input",
renderOptions: {
@@ -117,29 +95,22 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
try {
- await storeRequest(req);
const topLangs = await fetchTopLanguages(
username,
parseArray(exclude_repo),
size_weight,
count_weight,
parseArray(role),
+ pat,
);
- const cacheSeconds = resolveCacheSeconds({
- requested: parseInt(cache_seconds, 10),
- def: CACHE_TTL.TOP_LANGS_CARD.DEFAULT,
- min: CACHE_TTL.TOP_LANGS_CARD.MIN,
- max: CACHE_TTL.TOP_LANGS_CARD.MAX,
- });
- setCacheHeaders(res, cacheSeconds);
-
- return res.send(
- renderTopLanguages(topLangs, {
+ return {
+ status: "success",
+ content: renderTopLanguages(topLangs, {
custom_title,
hide_title: parseBoolean(hide_title),
hide_border: parseBoolean(hide_border),
@@ -159,12 +130,12 @@ export default async (req, res) => {
hide_progress: parseBoolean(hide_progress),
stats_format,
}),
- );
+ };
} catch (err) {
- setErrorCacheHeaders(res);
if (err instanceof Error) {
- return res.send(
- renderError({
+ return {
+ status: "error - temporary",
+ content: renderError({
message: err.message,
secondaryMessage: retrieveSecondaryMessage(err),
renderOptions: {
@@ -176,10 +147,11 @@ export default async (req, res) => {
show_repo_link: !(err instanceof MissingParamError),
},
}),
- );
+ };
}
- return res.send(
- renderError({
+ return {
+ status: "error - temporary",
+ content: renderError({
message: "An unknown error occurred",
renderOptions: {
title_color,
@@ -189,6 +161,6 @@ export default async (req, res) => {
theme,
},
}),
- );
+ };
}
};
diff --git a/packages/core/src/api/wakatime.js b/packages/core/src/api/wakatime.js
new file mode 100644
index 00000000..eaf02daf
--- /dev/null
+++ b/packages/core/src/api/wakatime.js
@@ -0,0 +1,113 @@
+// @ts-check
+
+import { renderWakatimeCard } from "../cards/wakatime.js";
+import {
+ MissingParamError,
+ retrieveSecondaryMessage,
+} from "../common/error.js";
+import { parseArray, parseBoolean } from "../common/ops.js";
+import { renderError } from "../common/render.js";
+import { fetchWakatimeStats } from "../fetchers/wakatime.js";
+import { isLocaleAvailable } from "../translations.js";
+
+// @ts-ignore
+export default async ({
+ username,
+ title_color,
+ icon_color,
+ hide_border,
+ card_width,
+ line_height,
+ text_color,
+ bg_color,
+ theme,
+ hide_title,
+ hide_progress,
+ custom_title,
+ locale,
+ layout,
+ langs_count,
+ hide,
+ api_domain,
+ border_radius,
+ border_color,
+ display_format,
+ disable_animations,
+}) => {
+ if (locale && !isLocaleAvailable(locale)) {
+ return {
+ status: "error - permanent",
+ content: renderError({
+ message: "Something went wrong",
+ secondaryMessage: "Language not found",
+ renderOptions: {
+ title_color,
+ text_color,
+ bg_color,
+ border_color,
+ theme,
+ },
+ }),
+ };
+ }
+
+ try {
+ const stats = await fetchWakatimeStats({ username, api_domain });
+
+ return {
+ status: "success",
+ content: renderWakatimeCard(stats, {
+ custom_title,
+ hide_title: parseBoolean(hide_title),
+ hide_border: parseBoolean(hide_border),
+ card_width: parseInt(card_width, 10),
+ hide: parseArray(hide),
+ line_height,
+ title_color,
+ icon_color,
+ text_color,
+ bg_color,
+ theme,
+ hide_progress,
+ border_radius,
+ border_color,
+ locale: locale ? locale.toLowerCase() : null,
+ layout,
+ langs_count,
+ display_format,
+ disable_animations: parseBoolean(disable_animations),
+ }),
+ };
+ } catch (err) {
+ if (err instanceof Error) {
+ return {
+ status: "error - temporary",
+ content: renderError({
+ message: err.message,
+ secondaryMessage: retrieveSecondaryMessage(err),
+ renderOptions: {
+ title_color,
+ text_color,
+ bg_color,
+ border_color,
+ theme,
+ show_repo_link: !(err instanceof MissingParamError),
+ },
+ }),
+ };
+ }
+ return {
+ status: "error - temporary",
+ content: renderError({
+ message: "An unknown error occurred",
+ renderOptions: {
+ title_color,
+ text_color,
+ bg_color,
+ border_color,
+ theme,
+ },
+ }),
+ };
+ }
+};
diff --git a/apps/backend/src/calculateRank.js b/packages/core/src/calculateRank.js
similarity index 100%
rename from apps/backend/src/calculateRank.js
rename to packages/core/src/calculateRank.js
diff --git a/apps/backend/src/cards/gist.js b/packages/core/src/cards/gist.js
similarity index 100%
rename from apps/backend/src/cards/gist.js
rename to packages/core/src/cards/gist.js
diff --git a/apps/backend/src/cards/repo.js b/packages/core/src/cards/repo.js
similarity index 100%
rename from apps/backend/src/cards/repo.js
rename to packages/core/src/cards/repo.js
diff --git a/apps/backend/src/cards/stats.js b/packages/core/src/cards/stats.js
similarity index 99%
rename from apps/backend/src/cards/stats.js
rename to packages/core/src/cards/stats.js
index 09aef286..940271a3 100644
--- a/apps/backend/src/cards/stats.js
+++ b/packages/core/src/cards/stats.js
@@ -233,7 +233,7 @@ const getStyles = ({
transform: rotate(-90deg);
animation: rankAnimation 1s forwards ease-in-out;
}
- ${process.env.NODE_ENV === "test" ? "" : getProgressAnimation({ progress })}
+ ${getProgressAnimation({ progress })}
`;
};
diff --git a/apps/backend/src/cards/top-languages.js b/packages/core/src/cards/top-languages.js
similarity index 99%
rename from apps/backend/src/cards/top-languages.js
rename to packages/core/src/cards/top-languages.js
index 85739c46..4b91a739 100644
--- a/apps/backend/src/cards/top-languages.js
+++ b/packages/core/src/cards/top-languages.js
@@ -647,7 +647,7 @@ const renderPieLayout = (langs, totalLanguageSize, statsFormat) => {
const createDonutPaths = (cx, cy, radius, percentages) => {
const paths = [];
let startAngle = 0;
- let endAngle = 0;
+ let endAngle;
const totalPercent = percentages.reduce((acc, curr) => acc + curr, 0);
for (let i = 0; i < percentages.length; i++) {
@@ -840,7 +840,7 @@ const renderTopLanguages = (topLangs, options = {}) => {
theme,
});
- let finalLayout = "";
+ let finalLayout;
if (langs.length === 0) {
height = COMPACT_LAYOUT_BASE_HEIGHT;
finalLayout = noLanguagesDataNode({
diff --git a/apps/backend/src/cards/types.d.ts b/packages/core/src/cards/types.d.ts
similarity index 88%
rename from apps/backend/src/cards/types.d.ts
rename to packages/core/src/cards/types.d.ts
index 27e04c2a..1d72262e 100644
--- a/apps/backend/src/cards/types.d.ts
+++ b/packages/core/src/cards/types.d.ts
@@ -1,7 +1,7 @@
-type ThemeNames = keyof typeof import("../../themes/index.js");
+type ThemeNames = keyof typeof import("../themes/index.ts");
type RankIcon = "default" | "github" | "percentile";
-type CommonOptions = {
+interface CommonOptions {
title_color: string;
icon_color: string;
text_color: string;
@@ -11,10 +11,10 @@ type CommonOptions = {
border_color: string;
locale: string;
hide_border: boolean;
-};
+}
export type StatCardOptions = CommonOptions & {
- hide: string[];
+ hide: ArrayRelease notes
Sourced from globals's releases.
v17.5.0
- Update globals (2026-04-12) (#342) 5d84602
https://github.com/sindresorhus/globals/compare/v17.4.0...v17.5.0
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Release notes
Sourced from knip's releases.
Release 6.4.1
- license (2d3d8d86ea51f18224c3558a38c28df00113f683)
- Handle file path arguments in Bun plugin (resolve #1678) (cdbe298efcb226ae4baec6567a0cbb6fdf001ee8)
Release 6.4.0
- chore: change license file to have more conventional casing (#1664) (ed97e6a37) - thanks
@Zamiell!- fix: whitelist spelling error (#1666) (bcad12012) - thanks
@Zamiell!- Add Panda CSS plugin (#1671) (7ab0d4d88) - thanks
@Faithfinder!- fix(rspack): detect plugins from swc-loader (#1675) (1431ff3d5) - thanks
@TkDodo!- docs: fix broken anchor link in DEVELOPMENT.md (#1677) (e78c7f609) - thanks
@vincent067!- Fix
@jest-environmentpragma resolution and limit pragma scope (3832364e2)- Track Object enumeration to skip enum-member checks in nsTypes mode (a47aff535)
- Cache module resolution by directory + specifier (cefed38c2)
- Skip read+parse in walkAndAnalyze when the file cache will hit (25a7982c1)
- Collapse double statSync in FileEntryCache.reconcile (b63fbd9f2)
- Refactor walkAndAnalyze: dedupe cached/uncached paths (573df54ba)
- Cache glob results across
--cacheruns (6ab8de805)- Mark namespace members used when enumerated via Object.* (dabf8ce77)
- Add config hints for redundant/unregistered extensions (close #1672, close #1673) (050689575)
- Enable Tailwind CSS compiler for
@tailwindcssintegrations (close #1674) (f3ed14d0e)- Resolve scss path aliases (resolve #1676) (00ae83be9)
- Re-gen plugins.md (35d8fabaa)
- Resolve path.join(__dirname, ...) in Worker/child_process calls (#1660) (40a917e3f)
- license (608f0ed76)
Release 6.3.1
- Fix peer dependency resolution (#1645) (0a6e93d16f89bde270a5458c0e76e1c6a996012f) - thanks
@controversial!- Support absolute file paths in react-router routes (#1659) (97bb283e31eb72da8c60fcede607b22da2929103) - thanks
@mpalmer685!- Track namespace imports used as object property values (resolve #1669) (c4d6b28df5955abbe9dde40d245ceb5a6e0bc669)
- Split plugins/util smoke globs to fit Windows cmd.exe limit (33ef87d15770d0ee9dc248a640538ce2f0d75a46)
Release 6.3.0
- Re-gen sponsorships chart (83ee4895f36d934bf9f2efaaaf3e141c33c889f8)
- Add testimonial (be16c54d379698899e3f10646bb23b280024b989)
- Add deferred resolve entries as direct entry paths to avoid ws exclusion (91a183539fb63528f900b187328c3bba1b161e88)
- Add rolldown plugin (resolve #1661) (44bfd6273375384dc0b01b2cf673b6ad1b6783f0)
- Housekeep plugins a bit (dc6986821bde185185b730e119d2c528048f9976)
- Improve
module.registerhandling (b9e36ea42d0b2b35d6080aafc94b292a3d7fd711)- Housekeep release script (f81bd0f5f6630c2cac9934c3b96ace0d42bd2353)
Commits
ea70d72Release knip@6.4.1cdbe298Handle file path arguments in Bun plugin (resolve #1678)baa8ef4Release knip@6.4.0608f0edlicense40a917eResolve path.join(__dirname, ...) in Worker/child_process calls (#1660)00ae83bResolve scss path aliases (resolve #1676)f3ed14dEnable Tailwind CSS compiler for@tailwindcssintegrations (close #1674)0506895Add config hints for redundant/unregistered extensions (close #1672, close #1...dabf8ceMark namespace members used when enumerated via Object.*6ab8de8Cache glob results across--cacheruns- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from tailwindcss's releases.
v4.2.2
Added
- Support Vite 8 in
@tailwindcss/vite(#19790)Fixed
- Don't crash when candidates contain prototype properties like
row-constructor(#19725)- Canonicalize
calc(var(--spacing)*…)expressions into--spacing(…)(#19769)- Fix crash in canonicalization step when handling utilities containing
@propertyat-rules (e.g.shadow-sm border) (#19727)- Skip full reload for server only modules scanned by client CSS when using
@tailwindcss/vite(#19745)- Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g.
w-1234 h-1234→size-1234) (#19809)- Fix canonicalization resulting in empty list (e.g.
w-5 h-5 size-5→''instead ofsize-5) (#19812)
Changelog
Sourced from tailwindcss's changelog.
[4.2.2] - 2026-03-18
Fixed
- Don't crash when candidates contain prototype properties like
row-constructor(#19725)- Canonicalize
calc(var(--spacing)*…)expressions into--spacing(…)(#19769)- Fix crash in canonicalization step when handling utilities containing
@propertyat-rules (e.g.shadow-sm border) (#19727)- Skip full reload for server only modules scanned by client CSS when using
@tailwindcss/vite(#19745)- Add support for Vite 8 in
@tailwindcss/vite(#19790)- Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g.
w-1234 h-1234→size-1234) (#19809)- Fix canonicalization resulting in empty list (e.g.
w-5 h-5 size-5→''instead ofsize-5) (#19812)- Resolve tsconfig paths to allow for
@import '@/path/to/file';when using@tailwindcss/vite(#19803)
Commits
d596b0c4.2.2 (#19821)2228a57Bump Lightning CSS (#19771)f302fceFix canonicalization resulting in empty list (#19812)bb2f170Improve canonicalization for bare values exceeding default spacing scale sugg...faa5e88Cleanup inconsistencies related to (regex) escapes (#19804)d5717f2run prettier51aa9d7fix(canonicalize): handle utilities with empty property maps in collapse (#19...c586bd6Canonicalizecalc(var(--spacing)*…)expressions into--spacing(…)(#19769)9ded4a2Guard object lookups against inherited prototype properties (#19725)- See full diff in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from react-icons's releases.
v5.6.0
What's Changed
- Bump prismjs from 1.29.0 to 1.30.0 by
@dependabot[bot] in react-icons/react-icons#1033- Bump
@babel/helpersfrom 7.23.2 to 7.26.10 by@dependabot[bot] in react-icons/react-icons#1036- Bump http-proxy-middleware from 2.0.7 to 2.0.9 by
@dependabot[bot] in react-icons/react-icons#1041- Bump form-data from 3.0.1 to 3.0.4 by
@dependabot[bot] in react-icons/react-icons#1058- Bump vite from 5.4.14 to 5.4.20 by
@dependabot[bot] in react-icons/react-icons#1071- upgrade packages by
@kamijin-fantain react-icons/react-icons#1075- Bump tar from 6.2.0 to 6.2.1 by
@dependabot[bot] in react-icons/react-icons#1078- Bump vite from 6.3.6 to 6.4.1 by
@dependabot[bot] in react-icons/react-icons#1081- Bump tmp from 0.2.3 to 0.2.5 by
@dependabot[bot] in react-icons/react-icons#1077- Bump glob from 11.0.3 to 11.1.0 by
@dependabot[bot] in react-icons/react-icons#1089- Bump
@babel/runtimefrom 7.23.2 to 7.28.4 by@dependabot[bot] in react-icons/react-icons#1073- Bump node-forge from 1.3.1 to 1.3.2 by
@dependabot[bot] in react-icons/react-icons#1092- Bump mdast-util-to-hast from 13.0.2 to 13.2.1 by
@dependabot[bot] in react-icons/react-icons#1094- Bump undici from 7.16.0 to 7.18.2 by
@dependabot[bot] in react-icons/react-icons#1103- Bump devalue from 5.3.2 to 5.6.2 by
@dependabot[bot] in react-icons/react-icons#1104- Bump h3 from 1.15.4 to 1.15.5 by
@dependabot[bot] in react-icons/react-icons#1105- Bump diff from 5.2.0 to 5.2.2 by
@dependabot[bot] in react-icons/react-icons#1107- Bump webpack from 5.94.0 to 5.104.1 by
@dependabot[bot] in react-icons/react-icons#1110- Bump jsonpath from 1.1.1 to 1.2.1 by
@dependabot[bot] in react-icons/react-icons#1113- Bump devalue from 5.6.2 to 5.6.3 by
@dependabot[bot] in react-icons/react-icons#1115- Bump astro from 5.14.1 to 5.15.9 by
@dependabot[bot] in react-icons/react-icons#1091- Bump ajv from 6.12.6 to 6.14.0 by
@dependabot[bot] in react-icons/react-icons#1116Full Changelog: https://github.com/react-icons/react-icons/compare/v5.5.0...v5.6.0
Icon Library License Version Count Circum Icons MPL-2.0 license 1.0.0 288 Font Awesome 5 CC BY 4.0 License 5.15.4-3-gafecf2a 1612 Font Awesome 6 CC BY 4.0 License 6.7.2-1-g840c215 2060 Ionicons 4 MIT 4.6.3 696 Ionicons 5 MIT 5.5.4 1332 Material Design icons Apache License Version 2.0 4.0.0-142-gbb04090f93 4341 Typicons CC BY-SA 3.0 2.1.2 336 Github Octicons icons MIT 18.3.0 264 Feather MIT 4.29.2 287 Lucide ISC 0.462.0 1541 Game Icons CC BY 3.0 12920d6565588f0512542a3cb0cdfd36a497f910 4040 Weather Icons SIL OFL 1.1 2.0.12 219 Devicons MIT 1.8.0 192 Ant Design Icons MIT 4.4.2 831 Bootstrap Icons MIT 1.13.1 2754 Remix Icon Apache License Version 2.0 4.6.0 3058 Flat Color Icons MIT 1.0.2 329 Grommet-Icons Apache License Version 2.0 4.14.0 637 Heroicons MIT 1.0.6 460 Heroicons 2 MIT 2.2.0 972
... (truncated)
Commits
6501a41v5.6.0387e780update iconsfb057e75.5.1-snapshot.06f74755update eslint73c281fBump ajv from 6.12.6 to 6.14.0 (#1116)3f2b264Bump astro from 5.14.1 to 5.15.9 (#1091)04adc76Bump devalue from 5.6.2 to 5.6.3 (#1115)44a5e85Bump jsonpath from 1.1.1 to 1.2.1 (#1113)e2c1d6cBump webpack from 5.94.0 to 5.104.1 (#1110)f3dca02Bump diff from 5.2.0 to 5.2.2 (#1107)- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from turbo's releases.
Turborepo v2.9.6
What's Changed
create-turbo
- chore: Update dependencies found in audits by
@anthonyshewin vercel/turborepo#12586Examples
- fix: Add missing
@types/nodetowith-svelteexample apps by@anthonyshewin vercel/turborepo#12585Changelog
- docs: Add Bun equivalent for updating dependencies by
@anthonyshewin vercel/turborepo#12580- fix: Mention
turbo.jsonin concurrency error message by@anthonyshewin vercel/turborepo#12582- fix: Surface actionable message when remote cache is requested but not linked by
@anthonyshewin vercel/turborepo#12584- chore: Delete agents app by
@anthonyshewin vercel/turborepo#12587- fix: Load custom CA certificates in fast webpki-only HTTP client by
@anthonyshewin vercel/turborepo#12591- docs: Remove pre-release badges by
@anthonyshewin vercel/turborepo#12592Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.5...v2.9.6
Turborepo v2.9.6-canary.3
What's Changed
Changelog
- chore: Delete agents app by
@anthonyshewin vercel/turborepo#12587- fix: Load custom CA certificates in fast webpki-only HTTP client by
@anthonyshewin vercel/turborepo#12591Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.6-canary.2...v2.9.6-canary.3
Turborepo v2.9.6-canary.2
What's Changed
create-turbo
- chore: Update dependencies found in audits by
@anthonyshewin vercel/turborepo#12586Examples
- fix: Add missing
@types/nodetowith-svelteexample apps by@anthonyshewin vercel/turborepo#12585Changelog
- fix: Surface actionable message when remote cache is requested but not linked by
@anthonyshewin vercel/turborepo#12584Full Changelog: https://github.com/vercel/turborepo/compare/v2.9.6-canary.1...v2.9.6-canary.2
Turborepo v2.9.6-canary.1
What's Changed
@turbo/telemetry
- fix: Suppress telemetry alert when running on Vercel by
@anthonyshewin vercel/turborepo#12576
... (truncated)
Commits
77bca2bpublish 2.9.6 to registry5a8f2e8release(turborepo): 2.9.6-canary.3 (#12593)861efa8docs: Remove pre-release badges (#12592)28db7d0fix: Load custom CA certificates in fast webpki-only HTTP client (#12591)b412177release(turborepo): 2.9.6-canary.2 (#12588)9018c65chore: Delete agents app (#12587)5d19186chore: Update dependencies found in audits (#12586)8338f42fix: Add missing@types/nodetowith-svelteexample apps (#12585)219b602fix: Surface actionable message when remote cache is requested but not linked...aba98afrelease(turborepo): 2.9.6-canary.1 (#12583)- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from @eslint/compat's
releases.
migrate-config: v2.0.5
2.0.5 (2026-04-03)
Dependencies
- The following workspace dependencies were updated
- dependencies
@eslint/compatbumped from ^2.0.3 to ^2.0.4- devDependencies
@eslint/corebumped from ^1.1.1 to ^1.2.0compat: v2.0.5
2.0.5 (2026-04-08)
Dependencies
- The following workspace dependencies were updated
- dependencies
@eslint/corebumped from ^1.2.0 to ^1.2.1migrate-config: v2.0.4
2.0.4 (2026-03-20)
Bug Fixes
compat: v2.0.4
2.0.4 (2026-04-03)
Dependencies
- The following workspace dependencies were updated
- dependencies
@eslint/corebumped from ^1.1.1 to ^1.2.0
Changelog
Sourced from @eslint/compat's
changelog.
2.0.5 (2026-04-08)
Dependencies
- The following workspace dependencies were updated
- dependencies
@eslint/corebumped from ^1.2.0 to ^1.2.12.0.4 (2026-04-03)
Dependencies
- The following workspace dependencies were updated
- dependencies
@eslint/corebumped from ^1.1.1 to ^1.2.0
Commits
d2dbf7bchore: release main (#424)fe114eechore: release main (#413)8863791docs: Update README sponsors835ddf9docs: Update README sponsors8cd3676docs: Update README sponsors4d73459docs: Update README sponsorsa6c7a26chore: updateeslintandeslint-config-eslint(#401)- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Changelog
Sourced from prettier's changelog.
3.8.2
Angular: Support Angular v21.2 (#18722, #19034 by
@fisker)Exhaustive typechecking with
@default never;<!-- Input --> @switch (foo) { @case (1) {} @default never; }<!-- Prettier 3.8.1 --> SyntaxError: Incomplete block "default never". If you meant to write the @ character, you should use the "@" HTML entity instead. (3:3)
<!-- Prettier 3.8.2 -->
@switch(foo) {@case(1) {}@defaultnever; }
arrow functionandinstanceofexpressions.<!-- Input --> @let fn = (a) => a? 1:2;{{ fn ( a instanceof b)}}
<!-- Prettier 3.8.1 -->
@letfn = (a) => a? 1:2;{{ fn ( a instanceof b)}}
<!-- Prettier 3.8.2 -->
@letfn = (a) => (a ? 1 : 2);{{ fn(a instanceof b) }}
Commits
Signed-off-by: dependabot[bot]
Release notes
Sourced from peter-evans/create-pull-request's releases.
Create Pull Request v8.1.1
What's Changed
- build(deps-dev): bump the npm group with 2 updates by
@dependabot[bot] in peter-evans/create-pull-request#4305- build(deps): bump minimatch by
@dependabot[bot] in peter-evans/create-pull-request#4311- build(deps): bump the github-actions group with 2 updates by
@dependabot[bot] in peter-evans/create-pull-request#4316- build(deps): bump
@tootallnate/onceand jest-environment-jsdom by@dependabot[bot] in peter-evans/create-pull-request#4323- build(deps-dev): bump undici from 6.23.0 to 6.24.0 by
@dependabot[bot] in peter-evans/create-pull-request#4328- build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by
@dependabot[bot] in peter-evans/create-pull-request#4334- build(deps): bump picomatch by
@dependabot[bot] in peter-evans/create-pull-request#4339- build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by
@dependabot[bot] in peter-evans/create-pull-request#4344- build(deps-dev): bump the npm group with 3 updates by
@dependabot[bot] in peter-evans/create-pull-request#4349- fix: retry post-creation API calls on 422 eventual consistency errors by
@peter-evansin peter-evans/create-pull-request#4356Full Changelog: https://github.com/peter-evans/create-pull-request/compare/v8.1.0...v8.1.1
Commits
5f6978ffix: retry post-creation API calls on 422 eventual consistency errors (#4356)d32e88dbuild(deps-dev): bump the npm group with 3 updates (#4349)8170bccbuild(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)0041819build(deps): bump picomatch (#4339)b993918build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)36d7c84build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)a45d1fbbuild(deps): bump@tootallnate/onceand jest-environment-jsdom (#4323)3499eb6build(deps): bump the github-actions group with 2 updates (#4316)3f3b473build(deps): bump minimatch (#4311)6699836build(deps-dev): bump the npm group with 2 updates (#4305)- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Release notes
Sourced from axios-cache-interceptor's releases.
v1.12.0
What's Changed
- build(deps-dev): bump tsdown from 0.19.0 to 0.20.1 by
@dependabot[bot] in arthurfiorette/axios-cache-interceptor#1173- build(deps-dev): bump
@biomejs/biomefrom 2.3.11 to 2.3.12 by@dependabot[bot] in arthurfiorette/axios-cache-interceptor#1175- build(deps-dev): bump
@biomejs/biomefrom 2.3.12 to 2.3.13 by@dependabot[bot] in arthurfiorette/axios-cache-interceptor#1177- build(deps-dev): bump
@types/nodefrom 24.10.9 to 24.10.10 by@dependabot[bot] in arthurfiorette/axios-cache-interceptor#1180- Move tests to TS native by
@arthurfiorettein arthurfiorette/axios-cache-interceptor#1197- fix: log debug message when non-Axios adapter errors leave deferred unsettled by
@Copilotin arthurfiorette/axios-cache-interceptor#1196- build(deps): bump rollup from 4.46.2 to 4.59.0 by
@dependabot[bot] in arthurfiorette/axios-cache-interceptor#1194- feat: add optional manual interceptor registration by
@arthurfiorettein arthurfiorette/axios-cache-interceptor#1199Full Changelog: https://github.com/arthurfiorette/axios-cache-interceptor/compare/v1.11.4...v1.12.0
Changelog
Sourced from axios-cache-interceptor's changelog.
v1.12.0
Merged
- build(deps): bump rollup from 4.46.2 to 4.59.0
[#1194](https://github.com/arthurfiorette/axios-cache-interceptor/issues/1194)- fix: log debug message when non-Axios adapter errors leave deferred unsettled
[#1196](https://github.com/arthurfiorette/axios-cache-interceptor/issues/1196)- Move tests to TS native
[#1197](https://github.com/arthurfiorette/axios-cache-interceptor/issues/1197)- build(deps-dev): bump
@types/nodefrom 24.10.9 to 24.10.10[#1180](https://github.com/arthurfiorette/axios-cache-interceptor/issues/1180)- build(deps-dev): bump
@biomejs/biomefrom 2.3.12 to 2.3.13[#1177](https://github.com/arthurfiorette/axios-cache-interceptor/issues/1177)- build(deps-dev): bump
@biomejs/biomefrom 2.3.11 to 2.3.12[#1175](https://github.com/arthurfiorette/axios-cache-interceptor/issues/1175)- build(deps-dev): bump tsdown from 0.19.0 to 0.20.1
[#1173](https://github.com/arthurfiorette/axios-cache-interceptor/issues/1173)Commits
Commits
8ab3e8c1.12.071c5ebafeat: add optional manual interceptor registration (#1199)4636cebbuild(deps): bump rollup from 4.46.2 to 4.59.0 (#1194)2c2268ffix: log debug message when non-Axios adapter errors leave deferred unsettled...9a57583Update changelog86b0f56Move tests to TS native (#1197)bda5670Pin nodejs version to 24.13f826f2fcode9a29650build(deps-dev): bump@types/nodefrom 24.10.9 to 24.10.10 (#1180)8deb45aImprovements to documentation- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Release notes
Sourced from @tailwindcss/vite's
releases.
v4.2.2
Added
- Support Vite 8 in
@tailwindcss/vite(#19790)Fixed
- Don't crash when candidates contain prototype properties like
row-constructor(#19725)- Canonicalize
calc(var(--spacing)*…)expressions into--spacing(…)(#19769)- Fix crash in canonicalization step when handling utilities containing
@propertyat-rules (e.g.shadow-sm border) (#19727)- Skip full reload for server only modules scanned by client CSS when using
@tailwindcss/vite(#19745)- Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g.
w-1234 h-1234→size-1234) (#19809)- Fix canonicalization resulting in empty list (e.g.
w-5 h-5 size-5→''instead ofsize-5) (#19812)
Changelog
Sourced from @tailwindcss/vite's
changelog.
[4.2.2] - 2026-03-18
Fixed
- Don't crash when candidates contain prototype properties like
row-constructor(#19725)- Canonicalize
calc(var(--spacing)*…)expressions into--spacing(…)(#19769)- Fix crash in canonicalization step when handling utilities containing
@propertyat-rules (e.g.shadow-sm border) (#19727)- Skip full reload for server only modules scanned by client CSS when using
@tailwindcss/vite(#19745)- Add support for Vite 8 in
@tailwindcss/vite(#19790)- Improve canonicalization for bare values exceeding default spacing scale suggestions (e.g.
w-1234 h-1234→size-1234) (#19809)- Fix canonicalization resulting in empty list (e.g.
w-5 h-5 size-5→''instead ofsize-5) (#19812)- Resolve tsconfig paths to allow for
@import '@/path/to/file';when using@tailwindcss/vite(#19803)
Commits
Signed-off-by: dependabot[bot]
Release notes
Sourced from typescript-eslint's releases.
v8.58.1
8.58.1 (2026-04-08)
🩹 Fixes
- eslint-plugin: [no-unused-vars] fix false negative for type predicate parameter (#12004)
❤️ Thank You
- MinJae
@Ju-MINJAESee GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
Changelog
Sourced from typescript-eslint's changelog.
8.58.1 (2026-04-08)
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
Commits
5311ed3chore(release): publish 8.58.1- See full diff in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from jsdom's releases.
v29.0.2
- Significantly improved and sped up
getComputedStyle(). Computed value rules are now applied across a broader set of properties, and include fixes related to inheritance, defaulting keywords, custom properties, and color-related values such ascurrentcolorand system colors. (@asamuzaK)- Fixed CSS
'background' and'border'shorthand parsing. (@asamuzaK)v29.0.1
- Fixed CSS parsing of
'border','background', and their sub-shorthands containing keywords orvar(). (@asamuzaK)- Fixed
getComputedStyle()to return a more functionalCSSStyleDeclarationobject, including indexed access support, which regressed in v29.0.0.v29.0.0
Breaking changes:
- Node.js v22.13.0+ is now the minimum supported v22 version (was v22.12.0+).
Other changes:
- Overhauled the CSSOM implementation, replacing the
@acemir/cssomandcssstyledependencies with fresh internal implementations built on webidl2js wrappers and thecss-treeparser. Serialization, parsing, and API behavior is improved in various ways, especially around edge cases.- Added
CSSCounterStyleRuleandCSSNamespaceRuleto jsdomWindows.- Added
cssMediaRule.matchesandcssSupportsRule.matchesgetters.- Added proper media query parsing in
MediaList, usingcss-treeinstead of naive comma-splitting. Invalid queries become"not all"per spec.- Added
cssKeyframeRule.keyTextgetter/setter validation.- Added
cssStyleRule.selectorTextsetter validation: invalid selectors are now rejected.- Added
styleSheet.ownerNode,styleSheet.href, andstyleSheet.title.- Added bad port blocking per the fetch specification, preventing fetches to commonly-abused ports.
- Improved
Documentinitialization performance by lazily initializing the CSS selector engine, avoiding ~0.5 ms of overhead perDocument. (@thypon)- Fixed a memory leak when stylesheets were removed from the document.
- Fixed
CSSStyleDeclarationmodifications to properly trigger custom element reactions.- Fixed nested
@mediarule parsing.- Fixed
CSSStyleSheet's "disallow modification" flag not being checked in all mutation methods.- Fixed
XMLHttpRequest'sresponsegetter returning parsed JSON during theLOADINGstate instead ofnull.- Fixed
getComputedStyle()crashing in XHTML documents when stylesheets contained at-rules such as@pageor@font-face.- Fixed a potential hang in synchronous
XMLHttpRequestcaused by a race condition with the worker thread's idle timeout.
Commits
2a1e2cd29.0.24097d66Resolve computed CSS values lazily in CSSStyleDeclarationcf5523fAdd more test cases for nested color-mix with currentColorb33b616Add test that getComputedStyle() works with !important6bf559cAdd test for custom property inheritance in computed styles6817657Fix border shorthand handling470f5c5Consolidate color helpers3db53cbFix background shorthand handlers678e840Remove some longhand property filesd526a07Add regression test for getComputedStyle() liveness- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for jsdom since your current version.
Install script changes
This version modifies prepare script that runs during
installation. Review the package contents before updating.
Signed-off-by: dependabot[bot]
Release notes
Sourced from @vitejs/plugin-react-swc's
releases.
plugin-react-swc@4.3.0
Add Vite 8 to peerDependencies range #1142
This plugin is compatible with Vite 8.
Changelog
Sourced from @vitejs/plugin-react-swc's
changelog.
4.3.0 (2026-03-12)
Add Vite 8 to peerDependencies range #1142
This plugin is compatible with Vite 8.
Commits
- See full diff in compare view
Signed-off-by: dependabot[bot]
Commits
- See full diff in compare view
Signed-off-by: dependabot[bot]
Changelog
Sourced from pg's changelog.
pg@8.20.0
- Add onConnect callback to pg.Pool constructor options allowing for async initialization of newly created & connected pooled clients.
pg@8.19.0
- Deprecate interal query queue.
- Pass connection parameters to password callback.
Commits
c9070ccPublishad36e3cfix: typo in deprecation notice forclient.query()(#3618)f2d7d11Publish5a4bafcDeprecate Client's internal query queue (#3603)a215bfbTypo fix in PgPass deprecation (funciton) (#3605)01e0556fix(pg-query-stream): invokethis.callbackon cursor end/error (#2810)e6e3692Pass connection parameters to password callback (#3602)d80d883test: Fix TLS connection test ending too earlyf332f28fix: Connection timeout handling for native clients in connected state (#3512)b2e9cb1Remove testAsync - its redundant (#3588)- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from eslint's releases.
v10.2.0
Features
586ec2ffeat: Addmeta.languagessupport to rules (#20571) (Copilot)14207defeat: addTemporaltono-obj-calls(#20675) (Pixel998)bbb2c93feat: add Temporal to ES2026 globals (#20672) (Pixel998)Bug Fixes
Documentation
a2af743docs: addlanguageto configuration objects (#20712) (Francesco Trotta)845f23fdocs: Update README (GitHub Actions Bot)5fbcf59docs: removesourceTypefrom ts playground link (#20477) (Tanuj Kanti)8702a47docs: Update README (GitHub Actions Bot)ddeadeddocs: Update README (GitHub Actions Bot)2b44966docs: add Major Releases section to Manage Releases (#20269) (Milos Djermanovic)eab65c7docs: updateeslintversions in examples (#20664) (루밀LuMir)3e4a299docs: update ESM Dependencies policies with note for own-usage packages (#20660) (Milos Djermanovic)Chores
8120e30refactor: extract no unmodified loop condition (#20679) (kuldeep kumar)46e8469chore: update dependency markdownlint-cli2 to ^0.22.0 (#20697) (renovate[bot])01ed3aatest: add unit tests for unicode utilities (#20622) (Manish chaudhary)811f493ci: remove--legacy-peer-depsfrom types integration tests (#20667) (Milos Djermanovic)6b86fcfchore: update dependency npm-run-all2 to v8 (#20663) (renovate[bot])632c4f8chore: addprettierupdate commit to.git-blame-ignore-revs(#20662) (루밀LuMir)b0b0f21chore: update dependency eslint-plugin-regexp to ^3.1.0 (#20659) (Milos Djermanovic)228a2ddchore: update dependency eslint-plugin-eslint-plugin to ^7.3.2 (#20661) (Milos Djermanovic)3ab4d7etest: Add tests for eslintrc-style keys (#20645) (kuldeep kumar)
Commits
000128c10.2.01988fadBuild: changelog update for 10.2.0542cb3efix: update first-party dependencies (#20714)a2af743docs: addlanguageto configuration objects (#20712)845f23fdocs: Update README5fbcf59docs: removesourceTypefrom ts playground link (#20477)8702a47docs: Update READMEddeadeddocs: Update README8120e30refactor: extract no unmodified loop condition (#20679)46e8469chore: update dependency markdownlint-cli2 to ^0.22.0 (#20697)- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from axios's releases.
v1.15.0
This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.
⚠️ Important Changes
- Deprecation:
url.parse()usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (#10625)🔒 Security Fixes
- Proxy Handling: Fixed a
no_proxyhostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (#10661)- Header Injection: Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (#10660)
🚀 New Features
- Runtime Support: Added compatibility checks and documentation for Deno and Bun environments. (#10652, #10653)
🔧 Maintenance & Chores
- CI Security: Hardened workflow permissions to least privilege, added the
zizmorsecurity scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (#10618, #10619, #10627, #10637, #10666)- Dependencies: Bumped
serialize-javascript,handlebars,picomatch,vite, anddenoland/setup-denoto latest versions. Added a 7-day Dependabot cooldown period. (#10574, #10572, #10568, #10663, #10664, #10665, #10669, #10670, #10616)- Documentation: Unified docs, improved
beforeRedirectcredential leakage example, clarifiedwithCredentials/withXSRFTokenbehaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (#10649, #10624, #7452, #7471, #10654, #10644, #10589)- Housekeeping: Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (#10584, #10650, #10582, #10640, #10659, #10668)
- Tests: Added regression coverage for urlencoded
Content-Typecasing. (#10573)🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve Axios:
@raashish1601(#10573)@Kilros0817(#10625)@ashstrc(#10624)@Abhi3975(#10589)@theamodhshetty(#7452)v1.14.0
This release focuses on compatibility fixes, adapter stability improvements, and test/tooling modernisation.
⚠️ Important Changes
- Breaking Changes: None identified in this release.
- Action Required: If you rely on env-based proxy behaviour or CJS resolution edge-cases, validate your integration after upgrade (notably
proxy-from-envv2 alignment andmainentry compatibility fix).🚀 New Features
- Runtime Features: No new end-user features were introduced in this release.
- Test Coverage Expansion: Added broader smoke/module test coverage for CJS and ESM package usage. (#7510)
🐛 Bug Fixes
- Headers: Trim trailing CRLF in normalised header values. (#7456)
- HTTP/2: Close detached HTTP/2 sessions on timeout to avoid lingering sessions. (#7457)
- Fetch Adapter: Cancel
ReadableStreamcreated during request-stream capability probing to prevent async resource leaks. (#7515)- Proxy Handling: Fixed env proxy behavior with
proxy-from-envv2 usage. (#7499)
... (truncated)
Changelog
Sourced from axios's changelog.
v1.15.0 — April 7, 2026
This release delivers two critical security patches targeting header injection and SSRF via proxy bypass, adds official runtime support for Deno and Bun, and includes significant CI security hardening.
🔒 Security Fixes
Header Injection (CRLF): Rejects any header value containing
\ror\ncharacters to block CRLF injection chains that could be used to exfiltrate cloud metadata (IMDS). Behavior change: headers with CR/LF now throw"Invalid character in header content". (#10660)SSRF via
no_proxyBypass: Introduces ashouldBypassProxyhelper that normalises hostnames (strips trailing dots, handles bracketed IPv6) before evaluatingno_proxy/NO_PROXYrules, closing a gap that could cause loopback or internal hosts to be inadvertently proxied. (#10661)🚀 New Features
- Deno & Bun Runtime Support: Added full smoke test suites for Deno and Bun, with CI workflows that run both runtimes before any release is cut. (#10652)
🐛 Bug Fixes
- Node.js v22 Compatibility: Replaced deprecated
url.parse()calls with the WHATWGURL/URLSearchParamsAPI across examples, sandbox, and tests, eliminatingDEP0169deprecation warnings on Node.js v22+. (#10625)🔧 Maintenance & Chores
CI Security Hardening: Added zizmor GitHub Actions security scanner; switched npm publish to OIDC Trusted Publishing (removing the long-lived
NODE_AUTH_TOKEN); pinned all action references to full commit SHAs; narrowed workflow permissions to least privilege; gated the publish step behind a dedicatednpm-publishenvironment; and blocked the sponsor-block workflow from running on forks. (#10618, #10619, #10627, #10637, #10641, #10666)Docs: Clarified HTTP/2 support and the unsupported
httpVersionoption; added documentation for header case preservation; improved thebeforeRedirectexample to prevent accidental credential leakage. (#10644, #10654, #10624)Dependencies: Bumped
picomatch,handlebars,serialize-javascript,vite(×3),denoland/setup-deno, and 4 additional dev dependencies to latest versions. (#10564, #10565, #10567, #10568, #10572, #10574, #10663, #10664, #10665, #10669, #10670)🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
@Kilros0817(#10625)@shaanmajid(#10616, #10617, #10618, #10619, #10637, #10641, #10666)@ashstrc(#10624, #10644)@Abhi3975(#10589)@raashish1601(#10573)
v1.14.0 — March 27, 2026
This release fixes a security vulnerability in the
formidabledependency, resolves a CommonJS compatibility regression, hardens proxy and HTTP/2 handling, and modernises the build and test toolchain.🔒 Security Fixes
- Formidable Vulnerability: Upgraded
formidablefrom v2 to v3 to address a reported arbitrary-file vulnerability. Updated test server and assertions to align with the v3 API. (#7533)🐛 Bug Fixes
... (truncated)
Commits
772a4e5chore(release): prepare release 1.15.0 (#10671)4b07137chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (#10663)51e57b3chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (#10664)fba1a77chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (#10665)0bf6e28chore(deps): bump denoland/setup-deno in the github-actions group (#10669)8107157chore(deps-dev): bump the development_dependencies group with 4 updates (#10670)e66530eci: require npm-publish environment for releases (#10666)49f23cbchore(sponsor): update sponsor block (#10668)3631854fix: unrestricted cloud metadata exfiltration via header injection chain (#10...fb3befbfix: no_proxy hostname normalization bypass leads to ssrf (#10661)- Additional commits viewable in compare view
Install script changes
This version modifies prepare script that runs during
installation. Review the package contents before updating.
Signed-off-by: dependabot[bot]
Release notes
Sourced from vite's releases.
v8.0.8
Please refer to CHANGELOG.md for details.
v8.0.7
Please refer to CHANGELOG.md for details.
v8.0.6
Please refer to CHANGELOG.md for details.
v8.0.5
Please refer to CHANGELOG.md for details.
v8.0.4
Please refer to CHANGELOG.md for details.
create-vite@8.0.3
Please refer to CHANGELOG.md for details.
v8.0.3
Please refer to CHANGELOG.md for details.
create-vite@8.0.2
Please refer to CHANGELOG.md for details.
v8.0.2
Please refer to CHANGELOG.md for details.
create-vite@8.0.1
Please refer to CHANGELOG.md for details.
v8.0.1
Please refer to CHANGELOG.md for details.
plugin-legacy@8.0.1
Please refer to CHANGELOG.md for details.
create-vite@8.0.0
Please refer to CHANGELOG.md for details.
plugin-legacy@8.0.0
Please refer to CHANGELOG.md for details.
v8.0.0
Please refer to CHANGELOG.md for details.
v8.0.0-beta.18
Please refer to CHANGELOG.md for details.
v8.0.0-beta.17
Please refer to CHANGELOG.md for details.
... (truncated)
Changelog
Sourced from vite's changelog.
8.0.8 (2026-04-09)
Features
Bug Fixes
- avoid
dns.getDefaultResultOrdertemporary (#22202) (15f1c15)- ssr: class property keys hoisting matching imports (#22199) (e137601)
8.0.7 (2026-04-07)
Bug Fixes
8.0.6 (2026-04-07)
Features
Bug Fixes
- css: avoid mutating sass error multiple times (#22115) (d5081c2)
- optimize-deps: hoist CJS interop assignment (#22156) (17a8f9e)
Performance Improvements
Miscellaneous Chores
- create-vite: remove unnecessary DOM.Iterable (#22168) (bdc53ab)
- replace remaining prettier script (#22179) (af71fb2)
8.0.5 (2026-04-06)
Bug Fixes
- apply server.fs check to env transport (#22159) (f02d9fd)
- avoid path traversal with optimize deps sourcemap handler (#22161) (79f002f)
- check
server.fsafter stripping query as well (#22160) (a9a3df2)- disallow referencing files outside the package from sourcemap (#22158) (f05f501)
8.0.4 (2026-04-06)
Features
- allow esbuild 0.28 as peer deps (#22155) (b0da973)
- hmr: truncate list of files on hmr update (#21535) (d00e806)
- optimizer: log when dependency scanning or bundling takes over 1s (#21797) (f61a1ab)
Bug Fixes
... (truncated)
Commits
6e585dcrelease: v8.0.8e137601fix(ssr): class property keys hoisting matching imports (#22199)15f1c15fix: avoiddns.getDefaultResultOrdertemporary (#22202)6baf587feat: update rolldown to 1.0.0-rc.15 (#22201)fdb2e6frelease: v8.0.75c05b04fix: use sync dns.getDefaultResultOrder instead of dns.promises (#22185)7b3086frelease: v8.0.6af71fb2chore: replace remaining prettier script (#22179)51d3e48feat: update rolldown to 1.0.0-rc.13 (#22097)17a8f9efix(optimize-deps): hoist CJS interop assignment (#22156)- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from typescript-eslint's releases.
v8.58.2
8.58.2 (2026-04-13)
🩹 Fixes
- remove tsbuildinfo cache file from published packages (#12187)
- eslint-plugin: [no-unnecessary-condition] use assignability checks in checkTypePredicates (#12147)
❤️ Thank You
- Abhijeet Singh
@cseas- 송재욱
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
Changelog
Sourced from typescript-eslint's changelog.
8.58.2 (2026-04-13)
🩹 Fixes
- remove tsbuildinfo cache file from published packages (#12187)
❤️ Thank You
- Abhijeet Singh
@cseasSee GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
Commits
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Release notes
Sourced from prettier's releases.
3.8.3
- SCSS: Prevent trailing comma in
if()function (prettier/prettier#18471 by@kovsu)
Changelog
Sourced from prettier's changelog.
3.8.3
SCSS: Prevent trailing comma in
if()function (#18471 by@kovsu)// Input $value: if(sass(false): 1; else: -1);// Prettier 3.8.2
$value: if(
sass(false): 1; else: -1,
);// Prettier 3.8.3
$value: if(sass(false): 1; else: -1);
Commits
d7108a7Release 3.8.3177f908Prevent trailing comma in SCSSif()function (#18471)1cd4066Release@prettier/plugin-oxc@0.1.4a8700e2Update oxc-parser to v0.125.0752157cFix tests053fd41Bump Prettier dependency to 3.8.2904c636Clean changelog_unreleaseddc1f7fcUpdate dependents count- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Release notes
Sourced from typescript's releases.
TypeScript 6.0.3
For release notes, check out the release announcement blog post.
- fixed issues query for TypeScript 6.0.0 (Beta).
- fixed issues query for TypeScript 6.0.1 (RC).
- fixed issues query for TypeScript 6.0.2 (Stable).
- fixed issues query for TypeScript 6.0.3 (Stable).
Downloads are available on:
Commits
050880cBump version to 6.0.3 and LKGeeae9dd🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...ad1c695🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)0725fb4🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Release notes
Sourced from eslint-plugin-react-hooks's releases.
eslint-plugin-react-hooks@7.1.0 (April 16, 2026)
This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better
set-state-in-effectdetection, improved ref validation, and more helpful error reporting.
- Add ESLint v10 support. (
@azat-ioin #35720)- Skip compilation for non-React files to improve performance. (
@josephsavonain #35589)- Fix exhaustive deps bug with Flow type casting. (
@jorge-cabin #35691)- Fix
useEffectEventchecks in component syntax. (@jbrown215in #35041)- Improved
set-state-in-effectvalidation with fewer false negatives. (@jorge-cabin #35134,@josephsavonain #35147,@jackpopein #35214,@chesnokov-tonyin #35419,@jsleitorin #36107)- Improved ref validation for non-mutating functions and event handler props. (
@josephsavonain #35893,@kolvianin #35062)- Compiler now reports all errors instead of stopping at the first. (
@josephsavonain #35873–#35884)- Improved source locations and error display in compiler diagnostics. (
@nathanmarksin #35348,@josephsavonain #34963)
Changelog
Sourced from eslint-plugin-react-hooks's changelog.
7.1.0
This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better
set-state-in-effectdetection, improved ref validation, and more helpful error reporting.
- Add ESLint v10 support. (
@azat-ioin #35720)- Skip compilation for non-React files to improve performance. (
@josephsavonain #35589)- Fix exhaustive deps bug with Flow type casting. (
@jorge-cabin #35691)- Fix
useEffectEventchecks in component syntax. (@jbrown215in #35041)- Improved
set-state-in-effectvalidation with fewer false negatives. (@jorge-cabin #35134,@josephsavonain #35147,@jackpopein #35214,@chesnokov-tonyin #35419,@jsleitorin #36107)- Improved ref validation for non-mutating functions and event handler props. (
@josephsavonain #35893,@kolvianin #35062)- Compiler now reports all errors instead of stopping at the first. (
@josephsavonain #35873–#35884)- Improved source locations and error display in compiler diagnostics. (
@nathanmarksin #35348,@josephsavonain #34963)
Commits
- See full diff in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Release notes
Sourced from uuid's releases.
v14.0.0
14.0.0 (2026-04-19)
⚠ BREAKING CHANGES
Features
Bug Fixes
Changelog
Sourced from uuid's changelog.
14.0.0 (2026-04-19)
Security
- Fixes GHSA-w5hq-g745-h8pq:
v3(),v5(), andv6()did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalidoffsetwas provided. ARangeErroris now thrown ifoffset < 0oroffset + 16 > buf.length.⚠ BREAKING CHANGES
Commits
7c1ea08chore(main): release 14.0.0 (#926)3d2c5b0Merge commit from forkf2c235ffix!: expectcryptoto be global everywhere (requires node@20+) (#935)529ef08chore: upgrade TypeScript and fixup types (#927)086fd79chore: update dependencies (#933)dc4ddb8feat!: drop node@18 support (#934)0f1f9c9chore: switch to Biome for parsing and linting (#932)e2879e6chore: use maintained version of npm-run-all (#930)ffa3138fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)0423d49docs: remove obsolete v1 option notes (#915)- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Changelog
Sourced from vite's changelog.
8.0.9 (2026-04-20)
Features
Bug Fixes
- allow binding when strictPort is set but wildcard port is in use (#22150) (dfc8aa5)
- build: emptyOutDir should happen for watch rebuilds (#22207) (ee52267)
- bundled-dev: reject requests to HMR patch files in non potentially trustworthy origins (#22269) (868f141)
- css: use unique key for cssEntriesMap to prevent same-basename collision (#22039) (374bb5d)
- deps: update all non-major dependencies (#22219) (4cd0d67)
- deps: update all non-major dependencies (#22268) (c28e9c1)
- detect Deno workspace root (fix #22237) (#22238) (1b793c0)
- dev: handle errors in
watchChangehook (#22188) (fc08bda)- optimizer: handle more chars that will be sanitized (#22208) (3f24533)
- skip fallback sourcemap generation for
?rawimports (#22148) (3ec9cda)Documentation
- align the descriptions in READMEs (#22231) (44c42b9)
- fix reuses wording in dev environment comment (#22173) (9163412)
- fix wording in sass error comment (#22214) (bc5c6a7)
- update build CLI defaults (#22261) (605bb97)
Miscellaneous Chores
Commits
ce729f5release: v8.0.9605bb97docs: update build CLI defaults (#22261)c28e9c1fix(deps): update all non-major dependencies (#22268)0a3887dchore(deps): update dependency dotenv-expand to v13 (#22271)868f141fix(bundled-dev): reject requests to HMR patch files in non potentially trust...3ec9cdafix: skip fallback sourcemap generation for?rawimports (#22148)3f24533fix(optimizer): handle more chars that will be sanitized (#22208)1b793c0fix: detect Deno workspace root (fix #22237) (#22238)fc08bdafix(dev): handle errors inwatchChangehook (#22188)374bb5dfix(css): use unique key for cssEntriesMap to prevent same-basename collision...- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show
Release notes
Sourced from axios's releases.
v1.15.1
This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.
🔒 Security Fixes
- Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
- CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
- Prototype Pollution / Auth Bypass: Replaced unsafe
inchecks withhasOwnPropertyto prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)withXSRFTokenTruthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)maxBodyLengthWith Zero Redirects: EnforcesmaxBodyLengtheven whenmaxRedirectsis set to0, closing a bypass path for oversized request bodies. (#10753)- Streamed Response
maxContentLengthBypass: AppliesmaxContentLengthto streamed responses that previously bypassed the cap. (#10754)- Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)
🚀 New Features
- AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
LocationRequest Header Type: AddsLocationtoCommonRequestHeadersListfor accurate typing of redirect-aware requests. (#7528)🐛 Bug Fixes
- FormData Handling: Removes
Content-Typewhen no boundary is present onFormDatafetch requests, supports multi-select fields, cancelsrequest.bodyinstead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)- HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
- Progress Events: Clamps
loadedtototalfor computable upload/download progress events. (#7458)- Types: Aligns
runWhentype with the runtime behaviour inInterceptorManagerand makes response header keys case-insensitive. (#7529, #10677)buildFullPath: Uses strict equality in the base/relative URL check. (#7252)AxiosURLSearchParamsRegex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)- Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)
- Docs Artefact Cleanup: Removes the docs content that was incorrectly committed. (#10727)
🔧 Maintenance & Chores
- Threat Model & Security Docs: Ongoing refinement of
THREATMODEL.md, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (#10672, #10715, #10718, #10722, #10763, #10765)- Test Coverage & Migration: Expanded
shouldBypassProxycoverage for wildcard/IPv6/edge cases, documented and testedAxiosError.status, and migratedprogressEventReducertests to Vitest. (#10723, #10725, #10741)- Type Refactor: Uses TypeScript utility types to deduplicate literal unions. (#7520)
- Repo & CI: Adds
CODEOWNERS, switches v1.x releases to an ephemeral release branch, and removes orphaned Bower support. (#10739, #10738, #10746)- Changelog Backfill: Added missing version entries to the changelog. (#10704)
- Dependencies: Bumped
follow-redirects(1.15.11→1.16.0) in root and docs,axios(1.14.0→1.15.0) in docs, and a group of 5 development dependencies. (#10717, #10716, #10684, #10709)🌟 New Contributors
We are thrilled to welcome our new contributors. Thank you for helping improve axios:
Changelog
Sourced from axios's changelog.
v1.15.1 - April 19, 2026
This release ships a coordinated set of security hardening fixes across headers, body/redirect limits, multipart handling, and XSRF/prototype-pollution vectors, alongside a broad sweep of bug fixes, test migrations, and threat-model documentation updates.
🔒 Security Fixes
Header Injection Hardening: Tightened validation and sanitisation across request header construction to close the header-injection attack surface. (#10749)
CRLF Stripping in Multipart Headers: Correctly strips CR/LF from multipart header values to prevent injection via field names and filenames. (#10758)
Prototype Pollution / Auth Bypass: Replaced unsafe
inchecks withhasOwnPropertyto prevent authentication bypass via prototype pollution on config objects, with additional regression tests. (#10761, #10760)
withXSRFTokenTruthy Bypass: Short-circuits on any truthy non-boolean value, so an ambiguous config no longer silently leaks the XSRF token cross-origin. (#10762)
maxBodyLengthWith Zero Redirects: EnforcesmaxBodyLengtheven whenmaxRedirectsis set to0, closing a bypass path for oversized request bodies. (#10753)Streamed Response
maxContentLengthBypass: AppliesmaxContentLengthto streamed responses that previously bypassed the cap. (#10754)Follow-up CVE Completion: Completes an earlier incomplete CVE fix to fully close the regression window. (#10755)
🚀 New Features
AI-Based Docs Translations: Initial scaffold for AI-assisted translations of the documentation site. (#10705)
LocationRequest Header Type: AddsLocationtoCommonRequestHeadersListfor accurate typing of redirect-aware requests. (#7528)🐛 Bug Fixes
FormData Handling: Removes
Content-Typewhen no boundary is present onFormDatafetch requests, supports multi-select fields, cancelsrequest.bodyinstead of the source stream on fetch abort, and fixes a recursion bug in form-data serialisation. (#7314, #10676, #10702, #10726)HTTP Adapter: Handles socket-only request errors without leaking keep-alive listeners. (#10576)
Progress Events: Clamps
loadedtototalfor computable upload/download progress events. (#7458)Types: Aligns
runWhentype with the runtime behaviour inInterceptorManagerand makes response header keys case-insensitive. (#7529, #10677)
buildFullPath: Uses strict equality in the base/relative URL check. (#7252)
AxiosURLSearchParamsRegex: Improves the regex used for param serialisation to avoid edge-case mismatches. (#10736)Resilient Value Parsing: Parses out header/config values instead of throwing on malformed input. (#10687)
Docs Artefact Cleanup: Removes the docs content that was incorrectly committed. (#10727)
🔧 Maintenance & Chores
Threat Model & Security Docs: Ongoing refinement of
THREATMODEL.md, including Hopper security update, TLS and tag-replay wording, mitigation descriptions, decompression-bomb guidance, and further cleanup. (#10672, #10715, #10718, #10722, #10763, #10765)Test Coverage & Migration: Expanded
shouldBypassProxycoverage for wildcard/IPv6/edge cases, documented and testedAxiosError.status, and migratedprogressEventReducertests to Vitest. (#10723, #10725, #10741)
... (truncated)
Commits
ac42446chore(release): prepare release 1.15.1 (#10767)908f220docs: update threatmodel (#10765)f93f815docs: added docs around potential decompressions bomb (#10763)1728aa1fix: short-circuits on any truthy non-boolean in withXSRFToken (#10762)42eb721fix: replace in with has own prop util (#10761)7587327fix: strip crlf correctly (#10758)f0b9867chore: added additional testing for this issue (#10760)e033f24fix: incomplete fix for cve (#10755)e8904affix: stream response bypassed max content length (#10754)1c7f6d7fix: enforce max body length when max redirects is 0 (#10753)- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from react-toastify's releases.
v11.1.0
Release Notes
Features
- CSP nonce support.
<ToastContainer nonce={...}>applies the nonce to the injected<style>tag. Closes #1209.Fixes
onChangefiresstatus: 'removed'synchronously ontoast.dismiss()instead of after the exit animation — observers (incl.useNotificationCenter) now see correctly ordered events. Also guards against double-onClose. Closes #1275.- Touch drag no longer re-pauses the toast on release — the old check compared a PointerEvent against
'touchend', which never matched. Closes #1217.- Vertical drag now visually moves the toast (
--ygets a unit). Thanks@janpaepke, #1277.- Stacked scale is clamped at 0.5, preventing zero/negative scale in deep stacks. Closes #1171, #1174.
- Stacked container respects mobile
100vwagain. Closes #1234.Accessibility
role="progressbar"now includesaria-valuenow,aria-valuemin,aria-valuemax. Thanks@singhankit001, #1283. Closes #1259.Internal
- Migrated to a pnpm workspace (
pnpm link .no longer required for contributors). Publish layout unchanged — addon still ships inside the main package.- CSS now injected at mount via
useStyleSheet(prerequisite fornonce).- Dep bumps: TypeScript 6, Vite 8, Cypress 15, React 19.2, plus the rest.
- CI:
upload-artifactv3 → v4.Thanks to
@janpaepke,@singhankit001, and reporters of the fixed issues.
Commits
769ce8211.1.0de21958remove year from licensec800992fix: add unit to --y CSS variable to fix vertical drage4ab712fix chicken and egg issueb3bbab5bump artifact action6d58ce4fix: stacked toast invert size, when used as stacked50e8e42fix: stacked container on mobile not 100vw1b2ee17fix: dispatch 'removed' onChange event synchronously on dismissa2d376bfeat: add ARIA accessibility attributes to ProgressBar8375acefix: touch bug in onDragTransitionEnd, closes #1217- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from eslint's releases.
v10.2.1
Bug Fixes
14be92bfix: model generator yield resumption paths in code path analysis (#20665) (sethamus)84a19d2fix: no-async-promise-executor false positives for shadowed Promise (#20740) (xbinaryx)af764affix: clarify language and processor validation errors (#20729) (Pixel998)e251b89fix: update eslint (#20715) (renovate[bot])Documentation
ca92ca0docs: reuse markdown-it instance for markdown filter (#20768) (Amaresh S M)57d2ee2docs: Enable Eleventy incremental mode for watch (#20767) (Amaresh S M)c1621b9docs: fix typos in code-path-analyzer.js (#20700) (Ayush Shukla)1418d52docs: Update README (GitHub Actions Bot)39771e6docs: Update README (GitHub Actions Bot)71e0469docs: fix incomplete JSDoc param description in no-shadow rule (#20728) (kuldeep kumar)22119cedocs: clarify scope of for-direction rule with dead code examples (#20723) (Amaresh S M)8f3fb77docs: documentmeta.docs.dialects(#20718) (Pixel998)Chores
7ddfea9chore: update dependency prettier to v3.8.2 (#20770) (renovate[bot])fac40e1ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763) (dependabot[bot])7246f92test: add tests for SuppressionsService.load() error handling (#20734) (kuldeep kumar)4f34b1echore: update pnpm/action-setup action to v5 (#20762) (renovate[bot])51080ebtest: processor service (#20731) (kuldeep kumar)e7e1889chore: remove stale babel-eslint10 fixture and test (#20727) (kuldeep kumar)4e1a87ctest: remove redundant async/await in flat config array tests (#20722) (Pixel998)066eabbtest: add rule metadata coverage forlanguagesanddocs.dialects(#20717) (Pixel998)
Commits
4d1d8f910.2.13e33105Build: changelog update for 10.2.1ca92ca0docs: reuse markdown-it instance for markdown filter (#20768)7ddfea9chore: update dependency prettier to v3.8.2 (#20770)57d2ee2docs: Enable Eleventy incremental mode for watch (#20767)c1621b9docs: fix typos in code-path-analyzer.js (#20700)fac40e1ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 (#20763)7246f92test: add tests for SuppressionsService.load() error handling (#20734)4f34b1echore: update pnpm/action-setup action to v5 (#20762)1418d52docs: Update README- Additional commits viewable in compare view
Updates `eslint-plugin-react-hooks` from 7.1.0 to 7.1.1
Release notes
Sourced from eslint-plugin-react-hooks's releases.
eslint-plugin-react-hooks@7.1.1 (April 17, 2026)
Note: 7.1.0 accidentally removed the
component-hook-factoriesrule, causing errors for users who referenced it in their ESLint config. This is now fixed.
Changelog
Sourced from eslint-plugin-react-hooks's changelog.
7.1.1
Note: 7.1.0 accidentally removed the
component-hook-factoriesrule, causing errors for users who referenced it in their ESLint config. This is now fixed.
Commits
d1727fb[eprh] Update changelog for 7.1.1 (#36308)bc24980[eprh] Add back a no-op for removed component-hook-factories rule (#36307)- See full diff in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from knip's releases.
Release 6.5.0
- Drop project-extension-redundant config hint (resolve #1683) (f86092949d6dbd041fd621876da674fd3eac7534)
- Add instructions to .agents/PLUGINS.md (e2943ed8fb6d2c0ab4cf12ff04d10bd5ab9fd5f7)
- Add a plugin for react-email (#1684) (d8ae4d3ccb810b9a9211fd43e9d1e7d7b704fcaf) - thanks
@xaqrox!- Replace
fast-globwithtinyglobby(#1462) (9f6b4c8aa6857fea40e66d008c905c948af10939) - thanks@gameroman!- Added plugin for Serverless framework (#1478) (f885f1ded52427d984c67e7172e3141eb4e5ee29) - thanks
@BenCrinion-IW!- Add args to Prettier plugin to resolve --config CLI flag (#1685) (f4658c84e714afd8a2233b72be6169da1ac3723e) - thanks
@xaqrox!- fix(util): tolerate JSONC and array extends in findRootDirsBase (#1681) (f7e5464a6f70e9024a341fdb923766b5ff53a831) - thanks
@Hoffs!- Format (15bd7e7a56b470096cfee1690263d5d13ddb8fb6)
- Inherit outDir/rootDir from tsconfig project references (resolve #1680) (b89b4f716f4c117b0106e9a212e9e5c46aa85035)
- tsc → tsgo (a6e09ca1b65936b3790a6c3628a4646f030d18b8)
- Update dependencies (4cb05c96a2ae7c790d29ee76ff13288c5bbb97a2)
- Housekeep (28c56cb8bf68031b1c8e9bee75b18ee7274ec981)
- Test test test (7eb4ab3a8a6635dcaf756bb2b4a88e1298615994)
- Add pino plugin with
transportCallvisitor (resolve #1480) (53a033e4ddc5036c6a4a0e55c0abc42c5c64e4f5)- Add signal to projects using knip (dbedd665c1f8d735030600d3f68ef1825d9a2668)
- Tune logos (3148f4d0485875370634b9b53c1b3aa7f6eafcc3)
- Tweak
knip-runtool response (42940381a947c46996ae4055e8789f6ea39cfca4)- Add
workspaceoption toknip-runtool (64c4aaea89e3abb41d8695ebffc5538878520b21)- Remove old lingering
experimentalTags(e503d108e5535800ac6467f4d92c7dd6a9e90037)- Fix compiler type (resolve #1689) (e7a69adb5e584eb6e5af9b4007820afcbcf27a08)
Commits
5b5cda5Release knip@6.5.0e7a69adFix compiler type (resolve #1689)e503d10Remove old lingeringexperimentalTags53a033eAdd pino plugin withtransportCallvisitor (resolve #1480)7eb4ab3Test test test28c56cbHousekeep4cb05c9Update dependenciesa6e09catsc → tsgob89b4f7Inherit outDir/rootDir from tsconfig project references (resolve #1680)15bd7e7Format- Additional commits viewable in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from axios's releases.
v1.15.2
This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in
allowedSocketPathsallowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.🔒 Security Fixes
- Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and
resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing pollutedauth,baseURL,socketPath,beforeRedirect, andinsecureHTTPParserfrom influencing requests. (#10779)- SSRF via
socketPath: Rejects non-stringsocketPathvalues and adds an opt-inallowedSocketPathsconfig option to restrict permitted Unix domain socket paths, returningAxiosErrorERR_BAD_OPTION_VALUEon mismatch. (#10777)- Supply-chain Hardening: Added
.npmrcwithignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expandedSECURITY.md/THREATMODEL.mdwith provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)🚀 New Features
allowedSocketPathsConfig Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)🐛 Bug Fixes
- Keep-alive Socket Memory Leak: Installs a single per-socket
errorlistener tracking the active request viakAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation,MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)🔧 Maintenance & Chores
- Changelog: Updated
CHANGELOG.mdwith v1.15.1 release notes. (#10781)
Changelog
Sourced from axios's changelog.
v1.15.2 - April 21, 2026
This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in
allowedSocketPathsallowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.🔒 Security Fixes
- Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and
resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing pollutedauth,baseURL,socketPath,beforeRedirect, andinsecureHTTPParserfrom influencing requests. (#10779)- SSRF via
socketPath: Rejects non-stringsocketPathvalues and adds an opt-inallowedSocketPathsconfig option to restrict permitted Unix domain socket paths, returningAxiosErrorERR_BAD_OPTION_VALUEon mismatch. (#10777)- Supply-chain Hardening: Added
.npmrcwithignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expandedSECURITY.md/THREATMODEL.mdwith provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#10776)🚀 New Features
allowedSocketPathsConfig Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#10777)🐛 Bug Fixes
- Keep-alive Socket Memory Leak: Installs a single per-socket
errorlistener tracking the active request viakAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation,MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #10780). (#10788)🔧 Maintenance & Chores
- Changelog: Updated
CHANGELOG.mdwith v1.15.1 release notes. (#10781)
Commits
5829343chore(release): prepare release 1.15.2 (#10789)4709a48fix: added fix for memory leak in sockets (#10788)be33360chore: update changelog (#10781)4791514fix: more header pollutions (#10779)6feafcffix: socket issue (#10777)302e273docs: update docs, add a couple actions etc (#10776)- See full diff in compare view
Signed-off-by: dependabot[bot]
Release notes
Sourced from knip's releases.
Release 6.7.0
- Fix markdown reporter column width (resolve #1700) (4713108de98bcfe76eb606036b9f968abe3e89a0)
- Handle Vitest agent and minimal reporters (#1701) (a71ead11b99aaa67f31eed7b35628907b2dddd06) - thanks
@dskwrite!- Add e2e tests w/ tsgo defs + lib consumption (98113e61d913e47631748b58c25d1042c8dd387e)
- Fix pkg name inconsistencies (544c3e68d72dd754b20f8e0b0bf8ed107c05d677)
- Add
export {}to maintain module shape (27d8a0230c10f2827ba1e1a8b2c65020554f61f8)- Strip leading UTF-8 BOM before parsing package.json (47e4029c39ff95043cd495681e4c7558970b0ed9)
- Skip workspace with invalid JSON manifest (bfb48670966387a3cd26005b9fb9d8769b2a1213)
- Preserve out-of-bound writes to stdout/err (95faad8d6219ba456a3700df697273eb154c1dd9)
- Consistent prefix in logError/logWarning (2c6d8a049d1c20d9427425b4abae3b76ac7a5720)
- Don't exit on config file load error (0914bd3832b1851e4d34137577c0d08efaf8aef6)
- Fix tsgo resolution in e2e tests (a68950131e33214ef2a4f13d11fab1a78c16bad6)
Release 6.6.3
- Use venz chart svg directly from CDN (ba7e9073d1770e4a21ec18435bcb61f394db0d1c)
- Bump that plugin counter (abae75bbd3030e006fe67d3f63641a31a65e671c)
- Fix plugin title (f2b8fcfc94bb78fb70dfe2be3f48ef8f254066f7)
- Work Table util class: fix bugs, tighten API, water-fill widths (2eb4045e0f34c2638875504b9b64e881e9a74db5)
- Questionable.. (970a0dbdfc7b59df2fd0a3064a4bd6be4e5a59bc)
- Fmt (14538ec1fe94cdf3c45798515160609f3ffbec9d)
- Ensure output is flushed on exit (#1699) (9533365115d4704e9b057b7ba8d5f43fd553d1a1) - thanks
@joshkel!- Use currentColor to support light/dark themes (7ea055aa68b86ccc6cb302a3092c2da9e56cdde6)
- Tighten type-chain alignment + gate via ignoreExportsUsedInFile (resolve #1698) (0910b33fc6c07867a751af2e26989a61c8a6c548)
- Eating our own dog food ↻ (d5aa1f6b007a2dfef1a8326000dc1802510d64ab)
Commits
ca5545eRelease knip@6.7.0a689501Fix tsgo resolution in e2e tests0914bd3Don't exit on config file load error2c6d8a0Consistent prefix in logError/logWarning95faad8Preserve out-of-bound writes to stdout/errbfb4867Skip workspace with invalid JSON manifest47e4029Strip leading UTF-8 BOM before parsing package.json27d8a02Addexport {}to maintain module shape544c3e6Fix pkg name inconsistencies98113e6Add e2e tests w/ tsgo defs + lib consumption- Additional commits viewable in compare view
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show