build(deps-dev): Bump @eslint-react/eslint-plugin from 5.18.6 to 5.19.0

[dependabot]

Bumps @eslint-react/eslint-plugin from 5.18.6 to 5.19.0.

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.19.0 (2026-09-07)

What's Changed

✨ New

• react-x/immutability: direct mutations of props and state are now reported — member assignments, updates, deletions, and mutating method calls are flagged when the mutated value resolves (through variable-declarator aliases) to a component's props, a useState/useReducer state value, or a custom hook matching the additionalStateHooks setting, independent of whether the mutation happens inside a function that reaches a freeze sink. (#1948, closes #1941)
• react-x/immutability: added shallow-copy awareness — nested mutations through an object/array literal built by spreading a props or state value (e.g. const copy = { ...state } / const copy = [...state]) are reported, since the nested values are still shared with the original; writes to the copy's own top-level slots are not reported. (#1948)

Full Changelog: Rel1cx/eslint-react@v5.18.10...v5.19.0

Attestation

https://github.com/Rel1cx/eslint-react/attestations/45585492

v5.18.10 (2026-09-06)

What's Changed

🐞 Fixes

• The remaining disable-* preset configs in react-x and react-rsc now also register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when combining them with a manually registered plugin. (follow-up to #1947, see #1946)

🏗️ Internal

• Website: removed fumadocs-twoslash from serverExternalPackages to fix a prerender error.

Full Changelog: Rel1cx/eslint-react@v5.18.9...v5.18.10

Attestation

https://github.com/Rel1cx/eslint-react/attestations/45547760

v5.18.9 (2026-09-06)

What's Changed

🏗️ Internal

• Bumped eslint to 10.10.0, vitest to 5.0.0, tsdown to 0.23.0, nx to 23.2.0, dprint to 0.57.4, @types/react-dom to 19.2.7, @eslint/compat to 2.1.1, and @nubjs/nub to 0.8.3.

Full Changelog: Rel1cx/eslint-react@v5.18.8...v5.18.9

Attestation

https://github.com/Rel1cx/eslint-react/attestations/45544496

... (truncated)

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.19.0 (2026-09-07)

✨ New

• react-x/immutability: direct mutations of props and state are now reported — member assignments, updates, deletions, and mutating method calls are flagged when the mutated value resolves (through variable-declarator aliases) to a component's props, a useState/useReducer state value, or a custom hook matching the additionalStateHooks setting, independent of whether the mutation happens inside a function that reaches a freeze sink. (#1948, closes #1941)
• react-x/immutability: added shallow-copy awareness — nested mutations through an object/array literal built by spreading a props or state value (e.g. const copy = { ...state } / const copy = [...state]) are reported, since the nested values are still shared with the original; writes to the copy's own top-level slots are not reported. (#1948)

Full Changelog: Rel1cx/eslint-react@v5.18.10...v5.19.0

v5.18.10 (2026-09-06)

🐞 Fixes

• The remaining disable-* preset configs in react-x and react-rsc now also register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when combining them with a manually registered plugin. (follow-up to #1947, see #1946)

🏗️ Internal

• Website: removed fumadocs-twoslash from serverExternalPackages to fix a prerender error.

Full Changelog: Rel1cx/eslint-react@v5.18.9...v5.18.10

v5.18.9 (2026-09-06)

🏗️ Internal

• Bumped eslint to 10.10.0, vitest to 5.0.0, tsdown to 0.23.0, nx to 23.2.0, dprint to 0.57.4, @types/react-dom to 19.2.7, @eslint/compat to 2.1.1, and @nubjs/nub to 0.8.3.

Full Changelog: Rel1cx/eslint-react@v5.18.8...v5.18.9

v5.18.8 (2026-09-05)

🐞 Fixes

• Preset configs (recommended, strict, etc.) now register the same plugin object as the package's default export, so ESLint no longer reports a "Cannot redefine plugin" error when the plugin is registered manually and a preset is extended at the same time. (#1947, closes #1946)

🏗️ Internal

• Re-enabled the import-integrity-lint plugin and patched its path prefix check so sibling directories like examples/preact and examples/preact-compat no longer collide.
• Pinned fast-uri to ^3.1.5 to fix CVE-2026-18446 (GHSA-7p8r-x3mc-p8w7).
• Bumped @effect/language-service to 0.87.2, @effect/platform to 0.97.1, @effect/platform-node to 0.108.1, @nubjs/nub to 0.8.2, @types/node to 26.4.1, dprint to 0.57.0, and lucide-react to 1.39.0.

Full Changelog: Rel1cx/eslint-react@v5.18.7...v5.18.8

v5.18.7 (2026-09-02)

🐞 Fixes

• react-x/set-state-in-effect: no longer misattributes render-phase setState calls to effects when the state updater is passed through a prop function. (#1945)

🏗️ Internal

... (truncated)

Commits

• 6eee240 release: 5.19.0
• 3613135 release: 5.18.10
• 662e99a release: 5.18.9
• f9eeb3e chore(deps): update eslint to 10.10.0, vitest to 5.0.0, tsdown to 0.23.0 and ...
• 5a58608 release: 5.18.8
• 4eb8b48 fix: register the same plugin object in preset configs as the default… (#1947)
• 466ff59 chore(deps): pin fast-uri to ^3.1.5 to fix CVE-2026-18446 (GHSA-7p8r-x3mc-p8w7)
• 1943f39 chore(deps): update typescript to 7.0.2 and other deps
• e43350f release: 5.18.7
• 15a429a chore(deps): update typescript-eslint to 8.69.0 and other deps
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
github-stats-extended-backend	Ready	Preview	Sep 16, 2026 12:53am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
github-stats-extended-frontend	Ignored		Sep 16, 2026 12:53am UTC