fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@react-navigation/bottom-tabs (source)	^7.18.18 → ^7.20.0			dependencies	minor
@react-navigation/elements (source)	^2.9.40 → ^2.9.44			dependencies	patch
@react-navigation/native (source)	^7.3.18 → ^7.5.0			dependencies	minor
@react-navigation/native-stack (source)	^7.18.10 → ^7.20.0			dependencies	minor
@tanstack/react-query (source)	^5.102.8 → ^5.104.1			dependencies	minor
@types/node (source)	24.13.3 → 24.19.1			devDependencies	minor	24.19.2
dotenv	^18.0.0 → ^18.0.5			devDependencies	patch	18.0.7 (+1)
eas-cli (source)	^23.1.0 → ^23.2.0			devDependencies	minor
eslint (source)	^10.9.1 → ^10.12.0			devDependencies	minor
node (source)	24.20.0 → 24.21.0				minor
pg (source)	^8.23.0 → ^8.23.1			devDependencies	patch
pnpm (source)	12.1.0 → 12.9.1			packageManager	minor	12.10.1 (+1)
pnpm (source)	12.1.0 → 12.9.1				minor	12.10.1 (+1)
prettier (source)	3.9.6 → 3.9.9			devDependencies	patch
tsx (source)	^4.23.13 → ^4.23.15			dependencies	patch
zod (source)	^4.5.4 → ^4.6.5			dependencies	minor

---

Release Notes

react-navigation/react-navigation (@​react-navigation/bottom-tabs)

v7.20.0

Compare Source

Bug Fixes

• clear bottom tab animation state after transition (eee1ddc) - by @​satya164

Features

• add tabBarRepeatedPressBehavior to tabs (78bfeb9) - by @​satya164

v7.19.2

Compare Source

Bug Fixes

• measure frame size in layout effect (#​13251) (13ce183) - by @​satya164

v7.19.1

Compare Source

v7.19.0

Compare Source

Features

• use a render callback for custom navigators (#​13238) (0706d1a) - by @​

react-navigation/react-navigation (@​react-navigation/elements)

v2.9.44

Compare Source

v2.9.43

Compare Source

Bug Fixes

• measure frame size in layout effect (#​13251) (13ce183) - by @​satya164

v2.9.42

Compare Source

v2.9.41

Compare Source

TanStack/query (@​tanstack/react-query)

v5.104.1

Compare Source

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@5.104.1

v5.104.0

Compare Source

Minor Changes

• #​11650 5279b05 - Build projects with Vite 8

Patch Changes

• Updated dependencies [5279b05]:
  • @​tanstack/query-core@5.104.0

v5.103.3

Compare Source

Patch Changes

• #​11647 1c9693e - fix(codemods): avoid copying unnecessary files from codemods project
• Updated dependencies []:
  • @​tanstack/query-core@5.103.3

v5.103.2

Compare Source

Patch Changes

• Updated dependencies [8a28904]:
  • @​tanstack/query-core@5.103.2

v5.103.1

Compare Source

Patch Changes

• Updated dependencies [8330b2f, 3212966]:
  • @​tanstack/query-core@5.103.1

v5.103.0

Compare Source

Patch Changes

• Updated dependencies [e57f816, fdae2ce, a1119e5, cbf77bf]:
  • @​tanstack/query-core@5.103.0

motdotla/dotenv (dotenv)

v18.0.5

Compare Source

Changed

• Fix missing typescript module declaration (#​1068)
• Improve performance for large .env files (#​1066)

v18.0.4

Compare Source

Changed

• import dotenv/config should default quiet: true (#​1063)

v18.0.3

Compare Source

Changed

• Patch DOTENV_QUIET setting when inside .env file (#​1059)

v18.0.2

Compare Source

Changed

• Patch additional edge cases for the fast parser (#​1056)

v18.0.1

Compare Source

Changed

• Handle file urls in config logging (#​1054)

expo/eas-cli (eas-cli)

v23.2.0

Compare Source

🎉 New features

• [eas-cli] Add --tag to eas simulator and eas simulator:list to group and filter simulator sessions by app variant. (#​4318 by @​tchayen)
• [eas-cli] Update workflow run logs in real time, instead of every 10 seconds. (#​4228 by @​AHGIJMKLKKZNPJKQR)
• [build-tools] Add expo-device-hub web previews to Android web-preview-only, Agent Device, Argent, and Appium remote sessions. (#​4304 by @​krystofwoldrich)
• [eas-cli] Add eas workflow:ssh <workflow-job-id> [command...] to open an ssh session on the worker running a workflow job. (#​4032 by @​gwdp)
• [eas-cli] Add --ssh (and --ssh-idle-timeout) to eas workflow:run to enable ssh on the run's VM jobs. (#​4033 by @​gwdp)

🧹 Chores

• [eas-cli] Warn when starting Android EAS Simulator sessions that support is still in development and iOS parity is coming soon. (#​4320 by @​szdziedzic)

eslint/eslint (eslint)

v10.12.0

Compare Source

Features

• 4618052 feat: handle astral letters in new-cap (#​21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#​21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#​21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#​21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#​21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#​21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#​21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#​21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#​21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#​21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#​21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#​21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#​21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#​21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#​21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#​21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#​21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#​21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#​21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#​21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#​21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#​21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#​21342) (ESLint Bot)

v10.11.0

Compare Source

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#​21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#​21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#​21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#​21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#​21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#​21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#​21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#​21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#​21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#​21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#​21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#​21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#​21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#​21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#​21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#​21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#​20395) (Nitin Kumar)

v10.10.0

Compare Source

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#​21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#​21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#​21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#​20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#​21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#​21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#​21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#​21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#​21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#​21286) (한국)
• 8724829 docs: update compat table links (#​21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#​21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#​21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#​21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#​21296) (renovate[bot])
• 3c753f1 chore: update eslint (#​21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#​21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#​21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#​21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#​21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#​21178) (crimsonjay0)

nodejs/node (node)

v24.21.0: 2026-09-08, Version 24.21.0 'Krypton' (LTS), @​aduh95

Compare Source

Notable Changes

• [71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #​65495
• [afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #​63949
• [6274fccbd9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #​65542
• [53cba013c7] - deps: update Undici to 7.29.1 (Node.js GitHub Bot) #​65789
• [0529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #​65024
• [41c7062b81] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #​64974
• [5197b5a3c5] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #​65416
• [35c635b032] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #​64965

Commits

• [84d706cb9b] - assert: improve documentation wording (Kamal Rawal) #​64953
• [90d127db33] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #​65416
• [ad1d7884c3] - benchmark: add test-only and mock timers cases (Luan Muniz) #​64097
• [1d8f045914] - benchmark: apply highWaterMark in webstreams pipe-to (Matteo Collina) #​65138
• [ed7ba3c993] - benchmark: complete the sqlite is-transaction fix (Edy Silva) #​65218
• [c8837e1aa3] - benchmark: add test runner hooks and options (Luan Muniz) #​63754
• [2ba8661e23] - buffer: prevent string write offset overflow (Matteo Collina) #​65043
• [cc9ee6c2ae] - buffer: treat detached ArrayBuffers as empty (Archkon) #​64504
• [5a5d73e4c5] - build: pass target architecture to small-icu genccode (ulofiai) #​65095
• [273e72d1a5] - build: deprecate always enabled --enable-static (Chengzhong Wu) #​65103
• [89a67246e3] - build: check FIPS option value in node.gyp (Filip Skokan) #​64982
• [2d21f41cd5] - build: handle malformed OpenSSL macros (Filip Skokan) #​64982
• [f62bc0f862] - build,win: add PGO workload scripts (Stefan Stojanovic) #​63696
• [33d0c7dc12] - child_process: keep SIGWINCH from killing on Win (Kirill Saied) #​64510
• [71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #​65495
• [419af8b86d] - crypto: fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #​65200
• [8029383f3f] - crypto: use available BoringSSL APIs (Filip Skokan) #​65423
• [a9bd780e19] - crypto: remove obsolete BoringSSL shims (Filip Skokan) #​65423
• [7defefad3f] - crypto: read WebCrypto inputs through primordials (Filip Skokan) #​65115
• [6ed1e38627] - crypto: fix disabling FIPS mode (Filip Skokan) #​64982
• [afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #​63949
• [9b9dd6e9cf] - debugger: wait for target startup (Filip Skokan) #​65194
• [07faaeeffd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #​65653
• [53cba013c7] - deps: update undici to 7.29.1 (Node.js GitHub Bot) #​65789
• [0268ca547c] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #​65542
• [6274fccbd9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #​65542
• [6bdcd121fa] - deps: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #​65316
• [c2aa446b6d] - deps: update simdjson to 4.6.7 (Node.js GitHub Bot) #​65318
• [3e58e48ea8] - deps: update googletest to 49495ea (Node.js GitHub Bot) #​65317
• [670b3665c0] - deps: cherry-pick libuv/libuv@e640dc9 (ulofiai) #​65118
• [ca1c67b021] - deps: float ICU-23262 patch for icu78 (René) #​64678
• [4ad043b0aa] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #​65136
• [96b4af109b] - deps: update googletest to d89aac5 (Node.js GitHub Bot) #​65153
• [774f663c56] - dgram: don't swallow bind errors when callback is provided (armanmikoyan) #​62602
• [94b118d62e] - diagnostics_channel: validate before channel activation (Trivikram Kamat) #​65313
• [09788665bd] - dns: validate address type in lookupService (Lazizbek Ergashev) #​64878
• [15f95fc0e2] - dns: validate port range in setServers() (René) #​65021
• [37b9e9a154] - dns: fix crash on setServers with port 0 (Lazizbek Ergashev) #​65009
• [cd6205fa0d] - doc: update AHAFS reference link (Taeuk Ha) #​65481
• [0e6f9ae42e] - doc: fix property names in os.networkInterfaces() example (Jihwan) #​65469
• [034a827b41] - doc: fix broken links in cli.md (Donghoon Kang) #​65412
• [eb364621d4] - doc: remove outdated WASI version fallback (이혜미) #​65303
• [b13f425bf8] - doc: fix broken GYP link in n-api.md (Donghoon Kang) #​65413
• [45c4011067] - doc: document that an empty OPENSSL_CONF skips config loading (Orgad Shaneh) #​64949
• [fde6776c5f] - doc: fix broken TLS security level example (soreavis) #​65391
• [290c1fec04] - doc: clarify socket destroyed behavior (Dayun) #​65395
• [a7e8269947] - doc: update outdated nodejs.org guide links (Donghoon Kang) #​65394
• [7809f11249] - doc: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) #​62117
• [64cd3a6e95] - doc: clarify how fs.Dirent file types are determined (soreavis) #​64532
• [9b92fdce14] - doc: update security release prepare command (Rafael Gonzaga) #​64699
• [6f9b9df3c1] - doc: clarify copyFile symlink behavior (T) #​62941
• [2480acb550] - doc: document setRawMode write access on Windows (Erik Demaine) #​63856
• [a1e9c3a5db] - doc: add missing return types in fs.md (Chaseton Collins) #​65307
• [4533572040] - doc: add missing return types in buffer.md (Yuya Inoue) #​65308
• [39ecedbbd2] - doc: fix lint clean command (greenhead) #​65274
• [0b1fb8fcd8] - doc: fix typo in onboarding.md (서울민트초코) #​65295
• [3165b5d38a] - doc: add missing added: tags to fs.lchmod (Lazizbek Ergashev) #​65283
• [113b808e59] - doc: fix SQLite changeset constant descriptions (greenhead) #​65265
• [c3eb51d5a1] - doc: document open pull request limit (Matteo Collina) #​65250
• [d7accdcd52] - doc: document http2 header constants (Harjoth Khara) #​64548
• [f47111416f] - doc: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) #​62105
• [c3b120e737] - doc: update synopsis (Augustin Mauroy) #​65171
• [39f4c831fd] - doc: fix broken internal links (greenhead) #​64901
• [be25cdd69e] - doc: report proper return type on urlPattern.test (Brian Muenzenmeyer) #​64831
• [1bf7737810] - doc: fix permission documentation examples (greenhead) #​64897
• [b7932e68a1] - doc: document sqlite parameter binding (Guilherme Araújo) #​65089
• [5234a5169c] - doc: finalize statements in sqlite examples (Guilherme Araújo) #​65088
• [39ea929da7] - doc: document quic stopSending() and resetStream() (Issac) #​64888
• [2ba198db73] - doc: clarify sqlite bare parameter default (Sumit Kumar Das) #​62009
• [314f9b200f] - doc: remove usage of util.inherits (Augustin Mauroy) #​60817
• [d82a61662c] - doc: fix grammar in worker_threads.md (이혜미) #​64913
• [44c0c8ff5b] - doc: clarify OpenSSL FIPS configuration (Filip Skokan) #​64982
• [9b2ca70e0d] - doc: remove --expose-gc flag from CLI documentation (Dario Piotrowicz) #​58909
• [a0a12397b9] - doc: document ArrayBuffer support in pbkd2Sync (kyungrae2002) #​64976
• [b48699e077] - doc: correct default highWaterMark values (Yilong Li) #​64617
• [0312ee133c] - esm: avoid super-linear data URL MIME regex (Sumit Kumar Das) #​61951
• [cd84d55c81] - esm: only register text format when enabled (Efe Karasakal) #​64992
• [c0a8ef611e] - esm: fix wasm import name in error message (이혜미) #​64950
• [e6c34f90c2] - events: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) #​64473
• [6ee4b40c91] - events: inline createEvent hybrid dispatch closure (Szymon Łągiewka) #​64473
• [367549eed5] - fs: use sized reads for large files in readFileUtf8 (Shelley Vohr) #​65328
• [8a5b1ae4c2] - fs: fix realpath of namespaced drive paths (Jason Zhang) #​65378
• [c9233b950d] - fs: fix glob early return skipping sibling entries (Srinu desetti) #​64895
• [bc54dd8905] - fs: pass symlink type in cp when filter is provided (Jerry Zhao) #​62654
• [fcb4333aca] - fs: allocate FSReqPromise stat arrays lazily (Samuel Attard) #​63886
• [c35876154e] - fs: fix out-of-bounds write in mkdtemp for long prefixes (Hierax_Umbra) #​64770
• [b269616936] - fs: treat std::errc::permission_denied as EPERM error (Kirill Saied) #​64698
• [212fe77e76] - fs: add windowsHandle option to file streams (Kirill Saied) #​63851
• [75df6cb435] - http: improve performance with known-length calls to end() (Tim Perry) #​65466
• [48d9cd4a28] - http: cache maxHeaderPairs per header section (GetThatCookie) #​64988
• [04785c8f43] - http: fix keylog listener setup on existing agent sockets (Shani Singh) #​65066
• [4b90031534] - http: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) [#​64991](h

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.