[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@anolilab/multi-semantic-release (source)	4.4.24 → 4.4.25
@anolilab/prettier-config (source)	10.0.3 → 10.0.4
@eslint-react/eslint-plugin (source)	5.28.2 → 5.28.3
browserslist@<=4.28.6	>=4.29.3 → >=4.29.4
fast-uri@>=3.0.0 <3.1.3	[^4.2.2 → ^4.2.3](https://renovatebot.com/diffs/npm/fast-uri@>=3.0.0 <3.1.3/4.2.2/4.2.3)
fast-uri@>=4.0.0 <4.1.5	[^4.2.2 → ^4.2.3](https://renovatebot.com/diffs/npm/fast-uri@>=4.0.0 <4.1.5/4.2.2/4.2.3)
undici@<8.10.2 (source)	>=8.12.2 → >=8.12.3

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

anolilab/semantic-release (@​anolilab/multi-semantic-release)

v4.4.25

Compare Source

Dependencies

• @​anolilab/semantic-release-pnpm: upgraded to 8.1.34
• execa: ^10.1.0 → ^10.1.1

anolilab/javascript-style-guide (@​anolilab/prettier-config)

v10.0.4

Compare Source

Dependencies

• prettier: 3.9.6 → 3.9.10

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.28.3

Compare Source

✨ New

• Identifier resolution is now bounded by the enclosing component scope, so render-scoped values referenced from nested callbacks (ex: items.map((item) => <Context.Provider value={foo}>)) are now detected, values declared outside the component (ex: module-level constants) are treated as stable, and nested components report each value only once, attributed to the innermost component. (#​2060)

  Affected rules:

  • react-x/no-unstable-context-value
  • react-x/no-unstable-default-props

• Class declarations (ex: class Foo {} in a component body) are now recognized as per-render constructions, so using one as a context value or default prop is now reported. (#​2060)

  Affected rules:

  • react-x/no-unstable-context-value
  • react-x/no-unstable-default-props

🏗️ Internal

• @eslint-react/var: resolve and resolveObjectType now accept a boundary option that bounds scope-chain traversal to an enclosing component or hook; resolveObjectType also resolves ClassDeclaration nodes. (#​2060)
• Bumped typescript-eslint to 8.72.0, fumadocs-core and fumadocs-ui to 16.17.7, fumadocs-mdx to 15.4.8, lucide-react to 1.60.0, and typedoc-plugin-markdown to 4.14.1.

Full Changelog: Rel1cx/eslint-react@v5.28.2...v5.28.3

browserslist/browserslist (browserslist@<=4.28.6)

v4.29.4

Compare Source

• Fixed joined version bounds in version ray and range queries (by @​ybai08).
• Fixed whitespaces processing (by @​abhu85).

fastify/fast-uri (fast-uri@>=3.0.0 <3.1.3)

v4.2.3

Compare Source

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@4.2.3

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: allow prerelease bump types in the release workflow by @​mcollina in #​230

Full Changelog: fastify/fast-uri@v4.2.2...v4.2.3

nodejs/undici (undici@<8.10.2)

v8.12.3

Compare Source

What's Changed

• ci: use Python 3.14 for the WPT server on macOS by @​mrityunjay-pandey in #​6029
• build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @​dependabot[bot] in #​6006
• build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @​dependabot[bot] in #​5967
• docs: document the options of interceptors.cache() by @​qodelicious in #​6050
• fix(h2): replace a connection that stops responding after a stream timeout by @​mcollina in #​6052
• fix(pool): keep caller async context for queued requests by @​mcollina in #​5982

New Contributors

• @​qodelicious made their first contribution in #​6050

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "after 10:00 before 19:00 every weekday except after 13:00 before 14:00"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 33f38e00-9c22-482f-8759-9d1ef204d9b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thank you for following the naming conventions! 🙏

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​eslint-react/​eslint-plugin@​5.28.3

View full report