chore(deps): bump the all-packages group across 1 directory with 14 updates

[dependabot]

Bumps the all-packages group with 14 updates in the / directory:

Package	From	To
eslint-plugin-import-next	2.3.7	2.6.0
eslint-plugin-maintainability	3.0.5	3.1.1
eslint-plugin-modularity	2.1.0	2.3.0
eslint-plugin-operability	3.0.7	3.1.1
eslint-plugin-react-a11y	2.1.6	2.4.0
eslint-plugin-react-features	1.2.1	1.4.0
oxlint	1.73.0	1.80.0
prettier	3.9.5	3.9.6
@supabase/supabase-js	2.110.2	2.112.4
mermaid	11.16.0	11.17.2
posthog-js	1.399.2	1.422.1
recharts	3.9.2	3.10.1
@posthog/nextjs-config	1.9.70	1.10.0
tsx	4.23.1	4.23.12

Updates eslint-plugin-import-next from 2.3.7 to 2.6.0

Release notes

Sourced from eslint-plugin-import-next's releases.

eslint-plugin-import-next@2.6.0

Minor Changes

• 🐛 Fix — no-cycle no longer reports a cycle whose edge is erased before emit

  A stratified sample of this rule's findings on the pinned corpus (n=24, four repos) came back 16 type-only against 8 runtime — two thirds of what it reported could not happen. All sixteen were plain import { SomeInterface } from './x' where every binding is an export interface or export type. TypeScript erases those, so the bundle bloat and initialization hazard this rule's own message describes cannot occur through that edge.

  The rule already conceded the principle — it skipped import type under the comment "erased at compile time — no runtime cycle risk". It could not see an implicitly type-only named import, and on real TypeScript that was most of what it found.

  Biased to report. This rule is error in recommended, so a missed runtime cycle is a shipped initialization bug. Every ambiguity resolves to "runtime": declaration merging (export interface Foo beside export const Foo), a re-export, a default or namespace import, or a target that cannot be read.

  Measured against that sample: 8/8 runtime cycles still reported, 16/16 type-only silenced.

  Compiler settings

  Under verbatimModuleSyntax, a plain named import of a type is already a compile error, so such projects write import type and are unaffected.

  One exception, stated rather than handled. With importsNotUsedAsValues: "preserve" (TypeScript 4.8–5.4) the import statement is kept, so the target module is executed and the runtime edge genuinely exists — this change will not report it. A lint rule cannot see that setting without reading tsconfig.json, which this one does not do. The exception is narrow and shrinking: the flag is deprecated in TypeScript 5.0 and removed in 5.5, superseded by verbatimModuleSyntax. If you are on preserve and rely on this rule, pin to the previous minor until you migrate.

Patch Changes

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.3

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-import-next@2.6.0
</tr></table> 

... (truncated)

Changelog

Sourced from eslint-plugin-import-next's changelog.

2.6.0

Minor Changes

• 🐛 Fix — no-cycle no longer reports a cycle whose edge is erased before emit

  A stratified sample of this rule's findings on the pinned corpus (n=24, four repos) came back 16 type-only against 8 runtime — two thirds of what it reported could not happen. All sixteen were plain import { SomeInterface } from './x' where every binding is an export interface or export type. TypeScript erases those, so the bundle bloat and initialization hazard this rule's own message describes cannot occur through that edge.

  The rule already conceded the principle — it skipped import type under the comment "erased at compile time — no runtime cycle risk". It could not see an implicitly type-only named import, and on real TypeScript that was most of what it found.

  Biased to report. This rule is error in recommended, so a missed runtime cycle is a shipped initialization bug. Every ambiguity resolves to "runtime": declaration merging (export interface Foo beside export const Foo), a re-export, a default or namespace import, or a target that cannot be read.

  Measured against that sample: 8/8 runtime cycles still reported, 16/16 type-only silenced.

  Compiler settings

  Under verbatimModuleSyntax, a plain named import of a type is already a compile error, so such projects write import type and are unaffected.

  One exception, stated rather than handled. With importsNotUsedAsValues: "preserve" (TypeScript 4.8–5.4) the import statement is kept, so the target module is executed and the runtime edge genuinely exists — this change will not report it. A lint rule cannot see that setting without reading tsconfig.json, which this one does not do. The exception is narrow and shrinking: the flag is deprecated in TypeScript 5.0 and removed in 5.5, superseded by verbatimModuleSyntax. If you are on preserve and rely on this rule, pin to the previous minor until you migrate.

Patch Changes

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.3

2.5.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

... (truncated)

Commits

• 127421c chore(release): version packages (#735)
• 80fda28 chore(release): version packages (#695)
• b9f7f40 fix(import-next): no-cycle ignores an edge that is erased before emit (#705)
• 0c3904b fix(workspace): point meta.docs.url at documentation that exists (#683)
• 6e92b26 chore(release): version packages (#681)
• e7ba575 fix(import-next): no-cycle does not report inside generated files (#686)
• 2de66bb feat(release): categorised changelogs, cross-package rollup, versioned apps (...
• 3d101b8 chore(release): version packages (#600)
• 4466e2e fix(import-next): ., .. and #subpath are not packages (#636)
• 1b836b2 fix(import-next): export — a namespace member is not a module export (#622)
• Additional commits viewable in compare view

Updates eslint-plugin-maintainability from 3.0.5 to 3.1.1

Release notes

Sourced from eslint-plugin-maintainability's releases.

eslint-plugin-maintainability@3.1.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

  meta.docs.url is what ESLint hands to editors, CLI output and SARIF, so a wrong value is a dead "see docs" link in every consumer's IDE. It was wrong for 319 of 478 rules, all pointing at packages/eslint-plugin/ — a package that does not exist in this repo.

  withCanonicalDocsUrls already existed to fix this, but docsUrlFor hardcoded the /docs/security/ path segment, so it could not express the nine quality plugins and rollout had stalled at three of twenty-six. The category is now derived per plugin, and every documented plugin stamps its rules on export.

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.2

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-maintainability@3.1.1

Pull requests since 3.1.0

• fix(workspace): point meta.docs.url at documentation that exists — ofri-peretz/eslint#683
• feat(release): categorised changelogs, cross-package rollup, versioned apps — ofri-peretz/eslint#660

eslint-plugin-maintainability@3.1.0

3.1.0

Minor Changes

• #609 a22fd9b Thanks @​ofri-peretz! - identical-functions stops reporting on code nobody edits.

  On the pinned 8-repository corpus the rule produced 3,707 findings. Two classes accounted for nine tenths of them, both correct detections of real duplication and neither actionable — which under the effective-FP standard costs the rule exactly what a wrong finding would.

  Test files (52.9%). ignoreTestFiles already defaulted to true, but its predicate was /\.(test|spec)\.[jt]sx?$/ — a basename test. okta-auth-js keeps its whole suite under test/spec/** with plain names (test/spec/TokenManager/browser.ts), so the option did nothing there. It now uses the devkit's shared isTestFilePath, which decides the directory case by exact path segment — never filename.includes('test'), which would make a verdict depend on where the repo is checked out.

... (truncated)

Changelog

Sourced from eslint-plugin-maintainability's changelog.

3.1.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

  meta.docs.url is what ESLint hands to editors, CLI output and SARIF, so a wrong value is a dead "see docs" link in every consumer's IDE. It was wrong for 319 of 478 rules, all pointing at packages/eslint-plugin/ — a package that does not exist in this repo.

  withCanonicalDocsUrls already existed to fix this, but docsUrlFor hardcoded the /docs/security/ path segment, so it could not express the nine quality plugins and rollout had stalled at three of twenty-six. The category is now derived per plugin, and every documented plugin stamps its rules on export.

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.2

3.1.0

Minor Changes

• #609 a22fd9b Thanks @​ofri-peretz! - identical-functions stops reporting on code nobody edits.

  On the pinned 8-repository corpus the rule produced 3,707 findings. Two classes accounted for nine tenths of them, both correct detections of real duplication and neither actionable — which under the effective-FP standard costs the rule exactly what a wrong finding would.

  Test files (52.9%). ignoreTestFiles already defaulted to true, but its predicate was /\.(test|spec)\.[jt]sx?$/ — a basename test. okta-auth-js keeps its whole suite under test/spec/** with plain names (test/spec/TokenManager/browser.ts), so the option did nothing there. It now uses the devkit's shared isTestFilePath, which decides the directory case by exact path segment — never filename.includes('test'), which would make a verdict depend on where the repo is checked out.

  A repeated it() block is not a maintenance defect. The repetition is the test: each case restates its setup so it reads independently when it fails.

  Generated files (35.6%). New ignoreGeneratedFiles option, default true. twilio-node's src/rest/** is emitted by OpenAPI Generator; every resource gets the same fetch, remove and page. You cannot DRY it, and the next generator run rewrites it wholesale.

  Decided by the file's own declaration — an @generated docblock or a "this code was generated by" banner in the leading comments — not by whether the path contains the word. src/generated-reports/summary.ts is a name, and still reports. The banner must be a header: a generation phrase below the first statement does not silence the module.

... (truncated)

Commits

• 80fda28 chore(release): version packages (#695)
• 0c3904b fix(workspace): point meta.docs.url at documentation that exists (#683)
• 2de66bb feat(release): categorised changelogs, cross-package rollup, versioned apps (...
• 3d101b8 chore(release): version packages (#600)
• a22fd9b fix(maintainability): identical-functions stops reporting on code nobody edit...
• 43db150 feat(reliability): start the seal, and let the adversarial wave do its job (#...
• 026fae6 chore(release): version packages (#592)
• 05c2267 fix(maintainability): stop normalising away what distinguishes two functions ...
• 20b22aa fix(workspace): no-xpath-injection needs evidence, and every rule carries a C...
• 0194137 docs(packages): add the OpenSSF Scorecard badge to every published README (#544)
• Additional commits viewable in compare view

Updates eslint-plugin-modularity from 2.1.0 to 2.3.0

Release notes

Sourced from eslint-plugin-modularity's releases.

eslint-plugin-modularity@2.3.0

Minor Changes

• 🐛 Fix — ddd-value-object-immutability matches the naming convention by suffix, and skips generated files

  A census of all 11 findings this rule produced on the pinned 8-repository corpus found 11 out of 11 unactionable. Every one was in twilio's auto-generated OpenAPI SDK — header: "Do not edit the class manually" — and none was a value object.

  Two independent causes, either of which alone still produced findings:

  Substring matching. className.includes(pattern) over ['Value', 'VO', 'ValueObject'] matched anything containing the marker: CountyCarrierValueCarriers, CreateConfigurationRequestChannelSettingsValueCaptureRules. A DDD value object convention names the type MoneyValue or EmailVO — the marker ends the name — so the check is now endsWith. VO was the sharper hazard, since it sits inside ConVOy and PiVOt.

  No generated-file opt-out. The remedy this rule gives is "add readonly", which the next generator run erases.

  If you relied on substring matching, set valueObjectPatterns explicitly — the option is unchanged, only the comparison is anchored.

Patch Changes

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.3

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-modularity@2.3.0

Pull requests since 2.2.1

• fix(modularity): ddd-value-object matches by suffix and skips generated files — ofri-peretz/eslint#715

eslint-plugin-modularity@2.2.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

  meta.docs.url is what ESLint hands to editors, CLI output and SARIF, so a wrong value is a dead "see docs" link in every consumer's IDE. It was wrong for 319 of 478 rules, all pointing at packages/eslint-plugin/ — a package that does not exist in this repo.

... (truncated)

Changelog

Sourced from eslint-plugin-modularity's changelog.

2.3.0

Minor Changes

• 🐛 Fix — ddd-value-object-immutability matches the naming convention by suffix, and skips generated files

  A census of all 11 findings this rule produced on the pinned 8-repository corpus found 11 out of 11 unactionable. Every one was in twilio's auto-generated OpenAPI SDK — header: "Do not edit the class manually" — and none was a value object.

  Two independent causes, either of which alone still produced findings:

  Substring matching. className.includes(pattern) over ['Value', 'VO', 'ValueObject'] matched anything containing the marker: CountyCarrierValueCarriers, CreateConfigurationRequestChannelSettingsValueCaptureRules. A DDD value object convention names the type MoneyValue or EmailVO — the marker ends the name — so the check is now endsWith. VO was the sharper hazard, since it sits inside ConVOy and PiVOt.

  No generated-file opt-out. The remedy this rule gives is "add readonly", which the next generator run erases.

  If you relied on substring matching, set valueObjectPatterns explicitly — the option is unchanged, only the comparison is anchored.

Patch Changes

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.3

2.2.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

  meta.docs.url is what ESLint hands to editors, CLI output and SARIF, so a wrong value is a dead "see docs" link in every consumer's IDE. It was wrong for 319 of 478 rules, all pointing at packages/eslint-plugin/ — a package that does not exist in this repo.

  withCanonicalDocsUrls already existed to fix this, but docsUrlFor hardcoded the /docs/security/ path segment, so it could not express the nine quality plugins and rollout had stalled at three of twenty-six. The category is now derived per plugin, and every documented plugin stamps its rules on export.

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.2

2.2.0

... (truncated)

Commits

• 127421c chore(release): version packages (#735)
• fb03496 fix(modularity): ddd-value-object matches by suffix and skips generated files...
• 80fda28 chore(release): version packages (#695)
• 0c3904b fix(workspace): point meta.docs.url at documentation that exists (#683)
• 2de66bb feat(release): categorised changelogs, cross-package rollup, versioned apps (...
• 3d101b8 chore(release): version packages (#600)
• 087ce59 fix(modularity): DDD is an opinion about a domain layer (#608)
• 20b22aa fix(workspace): no-xpath-injection needs evidence, and every rule carries a C...
• 0194137 docs(packages): add the OpenSSF Scorecard badge to every published README (#544)
• 03b65cb chore(release): version packages (#535)
• Additional commits viewable in compare view

Updates eslint-plugin-operability from 3.0.7 to 3.1.1

Release notes

Sourced from eslint-plugin-operability's releases.

eslint-plugin-operability@3.1.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

  meta.docs.url is what ESLint hands to editors, CLI output and SARIF, so a wrong value is a dead "see docs" link in every consumer's IDE. It was wrong for 319 of 478 rules, all pointing at packages/eslint-plugin/ — a package that does not exist in this repo.

  withCanonicalDocsUrls already existed to fix this, but docsUrlFor hardcoded the /docs/security/ path segment, so it could not express the nine quality plugins and rollout had stalled at three of twenty-six. The category is now derived per plugin, and every documented plugin stamps its rules on export.

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.2

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-operability@3.1.1

Pull requests since 3.1.0

• fix(workspace): point meta.docs.url at documentation that exists — ofri-peretz/eslint#683
• feat(release): categorised changelogs, cross-package rollup, versioned apps — ofri-peretz/eslint#660

eslint-plugin-operability@3.1.0

3.1.0

Minor Changes

• #607 b77623a Thanks @​ofri-peretz! - no-console-log and no-debug-code-in-production no longer report code that never ships.

  Both rules gain ignoreNonProductionPaths (default true), skipping scripts/, bin/, tools/, env/, benchmarks/, examples and demos, plus top-level build config (*.config.js, Gruntfile).

  // scripts/build.js
  console.log('building…'); // no longer reported by either rule

  A console.log in a build script is a deliberate build-time message, not debug output left in an application — and the rule's own name is the argument for it: a build script is not production.

... (truncated)

Changelog

Sourced from eslint-plugin-operability's changelog.

3.1.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

  meta.docs.url is what ESLint hands to editors, CLI output and SARIF, so a wrong value is a dead "see docs" link in every consumer's IDE. It was wrong for 319 of 478 rules, all pointing at packages/eslint-plugin/ — a package that does not exist in this repo.

  withCanonicalDocsUrls already existed to fix this, but docsUrlFor hardcoded the /docs/security/ path segment, so it could not express the nine quality plugins and rollout had stalled at three of twenty-six. The category is now derived per plugin, and every documented plugin stamps its rules on export.

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.2

3.1.0

Minor Changes

• #607 b77623a Thanks @​ofri-peretz! - no-console-log and no-debug-code-in-production no longer report code that never ships.

  Both rules gain ignoreNonProductionPaths (default true), skipping scripts/, bin/, tools/, env/, benchmarks/, examples and demos, plus top-level build config (*.config.js, Gruntfile).

  // scripts/build.js
  console.log('building…'); // no longer reported by either rule

  A console.log in a build script is a deliberate build-time message, not debug output left in an application — and the rule's own name is the argument for it: a build script is not production.

  107 → 24 and 120 → 30 on the pinned corpus.

  Matched by path segment, not prefix: a repository is linted from an absolute path, so /repo/scripts/build.js does not start with scripts/ and a prefix test would silently never fire.

Patch Changes

• Updated dependencies [3854526, 16bae7b, 5e0e029, d81469f, a22fd9b, 6f9124e]:
  • @​interlace/eslint-devkit@​1.17.0

3.0.16

... (truncated)

Commits

• 80fda28 chore(release): version packages (#695)
• 0c3904b fix(workspace): point meta.docs.url at documentation that exists (#683)
• 2de66bb feat(release): categorised changelogs, cross-package rollup, versioned apps (...
• 3d101b8 chore(release): version packages (#600)
• b77623a fix(operability): a build script is not production (#607)
• 20b22aa fix(workspace): no-xpath-injection needs evidence, and every rule carries a C...
• 0194137 docs(packages): add the OpenSSF Scorecard badge to every published README (#544)
• 4e9db19 chore(release): version packages (#424)
• 4794017 fix(docs): close every remaining ^8.0.0 surface #407 left behind (#423)
• 5ecf4d1 fix(workspace): declared ESLint floor was 8.0, the code needs 8.40 (#407)
• Additional commits viewable in compare view

Updates eslint-plugin-react-a11y from 2.1.6 to 2.4.0

Changelog

Sourced from eslint-plugin-react-a11y's changelog.

2.4.0

Minor Changes

• 🐛 Fix — prefer-tag-over-role stops reporting on <svg role="img"> and on components

  A census of all 31 findings on the pinned corpus found 31 false positives and no true ones.

  23 were <svg role="img"> — the recommended pattern, not a violation. An inline SVG needs an explicit role="img" and an accessible name for assistive technology to announce it as a single graphic rather than walking its shapes, and it cannot become <img> without moving to an external file and giving up currentColor, styling and animation.

  8 were custom components — MUI <Box>, <MuiLink>, <LinkMui>. The rule cannot know what DOM element a component renders; in MUI that intent is expressed as component="img", which is invisible here. Advising <img> instead of someone's component is advice about a name, not about the DOM that ships.

  The rule keeps its actual job: <div role="img"> and <span role="link"> still report, and the svg exemption is specific to role="img" — <svg role="link"> still reports.

Patch Changes

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.3

2.3.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

  meta.docs.url is what ESLint hands to editors, CLI output and SARIF, so a wrong value is a dead "see docs" link in every consumer's IDE. It was wrong for 319 of 478 rules, all pointing at packages/eslint-plugin/ — a package that does not exist in this repo.

  withCanonicalDocsUrls already existed to fix this, but docsUrlFor hardcoded the /docs/security/ path segment, so it could not express the nine quality plugins and rollout had stalled at three of twenty-six. The category is now derived per plugin, and every documented plugin stamps its rules on export.

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.2

2.3.0

Minor Changes

... (truncated)

Commits

• 127421c chore(release): version packages (#735)
• 38d8904 fix(react-a11y): prefer-tag-over-role reports on host elements only (#721)
• 80fda28 chore(release): version packages (#695)
• 0c3904b fix(workspace): point meta.docs.url at documentation that exists (#683)
• 2de66bb feat(release): categorised changelogs, cross-package rollup, versioned apps (...
• 3d101b8 chore(release): version packages (#600)
• 3854526 fix(react-a11y): accessibility rules cite WCAG, not CWE-252 (#610)
• c7fed65 chore(release): version packages (#564)
• 20b22aa fix(workspace): no-xpath-injection needs evidence, and every rule carries a C...
• 0194137 docs(packages): add the OpenSSF Scorecard badge to every published README (#544)
• Additional commits viewable in compare view

Updates eslint-plugin-react-features from 1.2.1 to 1.4.0

Release notes

Sourced from eslint-plugin-react-features's releases.

eslint-plugin-react-features@1.4.0

Minor Changes

• 🐛 Fix — no-unknown-property stops reporting on custom elements and xmlns

  A census of all 65 findings on the pinned corpus found 65 false positives in two classes.

  Custom elements. The rule skipped custom components by their capital letter, but a web component is lowercase — <altcha-widget> — so it looked like a host element and every one of its attributes was reported. React passes attributes to custom elements through verbatim, and the HTML spec requires a hyphen in the name, which is the signal that was missing.

  XML namespace attributes. xmlns and xmlnsXlink on <svg> are valid React attributes and are emitted by every icon exporter.

  The message also read "Unknown DOM property detected" without naming the property, which is unactionable even when the finding is right. It now reads `flooble` is not a DOM property of `<div>`.

  The rule keeps its job: class instead of className, and unknown attributes on ordinary tags, still report.

Patch Changes

• 🐛 Fix — no-unknown-property reported loading, decoding, and fetchPriority — three standard React DOM props for <img> (and <iframe>/<link>/<script> where applicable). loading and decoding have been valid React props for years; fetchPriority is the React 19 camelCase form. All three are in upstream eslint-plugin-react's known-property list; ours was missing them, so every lazy-loaded image in a consumer codebase produced three false positives.

  The lowercase HTML form fetchpriority still reports (positive-control test locks both directions).

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.3

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-react-features@1.4.0

Pull requests since 1.3.1

• fix(react-features): img loading/decoding/fetchPriority FPs + widen ui lint gate — ofri-peretz/eslint#725
• fix(react-features): no-unknown-property skips custom elements and xmlns — ofri-peretz/eslint#723

eslint-plugin-react-features@1.3.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

... (truncated)

Changelog

Sourced from eslint-plugin-react-features's changelog.

1.4.0

Minor Changes

• 🐛 Fix — no-unknown-property stops reporting on custom elements and xmlns

  A census of all 65 findings on the pinned corpus found 65 false positives in two classes.

  Custom elements. The rule skipped custom components by their capital letter, but a web component is lowercase — <altcha-widget> — so it looked like a host element and every one of its attributes was reported. React passes attributes to custom elements through verbatim, and the HTML spec requires a hyphen in the name, which is the signal that was missing.

  XML namespace attributes. xmlns and xmlnsXlink on <svg> are valid React attributes and are emitted by every icon exporter.

  The message also read "Unknown DOM property detected" without naming the property, which is unactionable even when the finding is right. It now reads `flooble` is not a DOM property of `<div>`.

  The rule keeps its job: class instead of className, and unknown attributes on ordinary tags, still report.

Patch Changes

• 🐛 Fix — no-unknown-property reported loading, decoding, and fetchPriority — three standard React DOM props for <img> (and <iframe>/<link>/<script> where applicable). loading and decoding have been valid React props for years; fetchPriority is the React 19 camelCase form. All three are in upstream eslint-plugin-react's known-property list; ours was missing them, so every lazy-loaded image in a consumer codebase produced three false positives.

  The lowercase HTML form fetchpriority still reports (positive-control test locks both directions).

• 🔗 Dependencies — updated workspace dependencies: @interlace/eslint-devkit@1.17.3

1.3.1

Patch Changes

• 🐛 Fix — point meta.docs.url at documentation that exists (#683)

  meta.docs.url is what ESLint hands to editors, CLI output and SARIF, so a wrong value is a dead "see docs" link in every consumer's IDE. It was wrong for 319 of 478 rules, all pointing at packages/eslint-plugin/ — a package that does not exist in this repo.

  withCanonicalDocsUrls already existed to fix this, but docsUrlFor hardcoded the /docs/security/ path segment, so it could not express the nine quality plugins and rollout had stalled at three of twenty-six. The category is now derived per plugin, and every documented plugin stamps its rules on export.

... (truncated)

Commits

• 127421c chore(release): version packages (#735)
• 9908ed2 fix(react-features): no-unknown-property skips custom elements and xmlns (#723)
• 4dc6332 fix(react-features): img loading/decoding/fetchPriority FPs + widen ui lint g...
• 80fda28 chore(release): version packages (#695)
• 0c3904b fix(workspace): point meta.docs.url at documentation that exists (#683)
• 2de66bb feat(release): categorised changelogs, cross-package rollup, versioned apps (...
• c7fed65 chore(release): version packages (#564)
• 20b22aa fix(workspace): no-xpath-injection needs evidence, and every rule carries a C...
• 0194137 docs(packages): add the OpenSSF Scorecard badge to every published README (#544)
• 791ea2a chore(release): version packages (#503)
• Additional commits viewable in compare view

Updates oxlint from 1.73.0 to 1.80.0

Release notes

Sourced from oxlint's releases.

oxlint v1.80.0 & oxfmt v0.65.0

Table of Contents

• Oxlint v1.80.0
• Oxfmt v0.65.0

Oxlint v1.80.0

🚀 Features

• 70c3e35 linter/typescript/no-confusing-non-null-assertion: Implement suggestion (#26012) (Mikhail Baev)

🐛 Bug Fixes

• 17ae11c linter/oxc/double-comparisons: Handle grouped logical expressions (#26044) (camc314)
• 8a353a7 linter/eslint/no-control-regex: Refine help message text (#25996) (Rahul Mishra)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 8d94cd1 linter/eslint/no-useless-rename: Preserve type modifiers (#26020) (Cameron)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 51d36d7 linter/vue: Resolve vue imports via shared import helpers (#25903) (Connor Shea)
• 83a68d2 linter/react/no-react-children: Resolve react imports by symbol (#25901) (Connor Shea)
• 124e196 linter: Resolve globals by reference, not by name (#25905) (Connor Shea)
• a701bcc linter: Remove invalid React compiler doc links (#25900) (Boshen)

📚 Documentation

• 9b7e153 linter: Set version to 1.79.0 for rules shipped in 1.79.0 (#25902) (connorshea)

Oxfmt v0.65.0

🐛 Bug Fixes

• bf37dd5 formatter: Preserve class decorators before export when the statement is suppressed (#26034) (leaysgur)

oxlint v1.79.0 & oxfmt v0.64.0

Table of Contents

• Oxlint v1.79.0
• Oxfmt v0.64.0

Oxlint v1.79.0

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

See React Compiler Support for details.

🚀 Features

• 9b7394e linter/typescript/no-empty-object-type: Implement suggestion (#25833) (Mikhail Baev)

🐛 Bug Fixes

... (truncated)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

• 5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

• 9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

[1.76.0] - 2026-07-27

🚀 Features

• 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)
• 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)

... (truncated)

Commits

• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
• aa49d86 fix(linter): allow spread rule options in config types (#25675)
• 8922381 refactor(linter): remove inactive react config rule (#25740)
• 8c4552d feat(linter)!: split react/react-compiler into per-category rules (#25500)
• 36f8451 fix(linter/eslint/no-eval): align indirect default with ESLint (#25656)
• beb724d fix(linter/eslint/no-unused-vars): report bare underscore parameters (#25663)
• 4004c10 fix(linter/eslint/no-irregular-whitespace): check comments by default (#25660)
• 285820e fix(linter/no-large-snapshots): precompile and document allowed snapshot matc...
• Additional commits viewable...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.