fix(ci): land npm-dev updates on TypeScript 6

[ryota-murakami]

Dependabot's grouped npm-dev PR failed lint because typescript-eslint does not support TypeScript 7.0 (no compiler API until 7.1). Pin TypeScript to 6.0.3 and apply the rest of the toolchain bumps.

Silence tsup's injected baseUrl deprecation only in the DTS pass (egoist/tsup#1388). Keep react-hooks on rules-of-hooks; v7 recommended also enables compiler rules that flag intentional render-time ref writes.

Summary by CodeRabbit

• Chores
  • Updated development and testing tools to newer versions for improved compatibility and maintenance.
  • Updated website development tooling, including styling, Node.js type definitions, and TypeScript support.
  • Refined linting rules to enforce consistent React Hooks usage.
  • Adjusted package build settings to avoid deprecation warnings during type declaration generation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
react-flow-scrollbar-docs	Error		Sep 8, 2026 5:39pm UTC

[ryota-murakami]

@coderabbitai full review

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@​8.61.0 ⏵ 8.69.0			+1
	@​types/​react-dom@​19.2.7
	@​types/​react@​19.2.18
	vitest@​3.2.6 ⏵ 4.1.11	+1		+1	+2
	@​types/​node@​22.19.21 ⏵ 24.13.3	+1		+1	+1
	vite@​8.0.16 ⏵ 8.2.2			+1	+1
	tailwindcss@​4.3.1 ⏵ 4.3.3	+1		+1
	@​eslint/​js@​9.39.4 ⏵ 10.0.1
	typescript@​5.9.3 ⏵ 6.0.3	+1		+1
	@​testing-library/​react@​16.3.2 ⏵ 16.3.3	+1
	jsdom@​29.1.1 ⏵ 30.0.1			+1
	@​vitejs/​plugin-react@​6.0.2 ⏵ 6.1.1			+1
	prettier@​3.8.4 ⏵ 3.9.6			+1
	release-it@​20.2.0 ⏵ 21.0.2				+2
	eslint-plugin-react-hooks@​5.2.0 ⏵ 7.1.1
	eslint@​9.39.4 ⏵ 10.10.0	+1			+47
	@​tailwindcss/​postcss@​4.3.1 ⏵ 4.3.3	+1			-1
	@​playwright/​test@​1.60.0 ⏵ 1.63.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm jsdom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/jsdom@30.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/jsdom@30.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[coderabbitai]

Warning

Review limit reached

Next included review available in 55 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 95 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c892ad69-d094-405a-833b-bd57eda07ca5

📥 Commits

Reviewing files that changed from the base of the PR and between dbdbb25 and d662c7f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• eslint.config.mjs
• package.json
• tsup.config.ts
• website/package.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a1a2f721-eda6-45ec-a4ee-cdcee8737d27

📥 Commits

Reviewing files that changed from the base of the PR and between dbdbb25 and d662c7f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• eslint.config.mjs
• package.json
• tsup.config.ts
• website/package.json

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The pull request updates ESLint React Hooks rules, configures TypeScript declaration builds to ignore TypeScript 6 deprecations, and updates root and website development dependencies.

Changes

Tooling updates

Layer / File(s)	Summary
React Hooks lint configuration eslint.config.mjs	The configuration enables react-hooks/rules-of-hooks explicitly. React Compiler rules from the recommended preset are no longer enabled.
Type declaration build configuration tsup.config.ts	The DTS configuration ignores TypeScript 6 deprecations.
Development dependency updates package.json, website/package.json	Root and website development dependency versions are updated. Runtime and peer dependency versions remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to d662c

This updates development tooling, keeps the intended Hooks lint enforcement, and scopes the TypeScript deprecation suppression to declaration builds. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: applying npm development-tool updates required for TypeScript 6. It matches the dependency, ESLint, and tsup configuration changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/fix-npm-dev-ci-5cd5

---

_{A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. Your current included review allowance is based on your included PR review attempts over the past 7 days. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 55 minutes.