fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@eslint/js (source)	9.38.0 -> 9.39.0			devDependencies	minor	9.39.1
@fastify/session	11.1.0 -> 11.1.1			dependencies	patch
@sentry/vite-plugin (source)	4.5.0 -> 4.6.0			dependencies	minor
@types/node (source)	24.9.1 -> 24.10.0			devDependencies	minor
@vitest/eslint-plugin	1.3.24 -> 1.4.0			devDependencies	minor	1.4.1
@xyflow/react (source)	12.9.0 -> 12.9.2			dependencies	patch
docker/setup-qemu-action	v3.6.0 -> v3.7.0			action	minor
globals	16.4.0 -> 16.5.0			devDependencies	minor
graphql	16.11.0 -> 16.12.0			dependencies	minor
jsdom	27.0.1 -> 27.1.0			devDependencies	minor
react-hook-form (source)	7.65.0 -> 7.66.0			dependencies	minor
react-i18next	16.2.0 -> 16.2.3			dependencies	patch	16.2.4
react-router-dom (source)	7.9.4 -> 7.9.5			dependencies	patch
vitest (source)	4.0.3 -> 4.0.6			devDependencies	patch	4.0.7

---

Release Notes

eslint/eslint (@​eslint/js)

v9.39.0

Compare Source

fastify/session (@​fastify/session)

v11.1.1

Compare Source

What's Changed

• docs(readme): spelling and grammar fixes by @​Fdawgs in #​290
• build(dependabot): reduce npm updates to monthly by @​Fdawgs in #​291
• chore: rename master to main by @​Fdawgs in #​294
• ci(ci): set job permissions by @​Fdawgs in #​295
• ci: set permissions at workflow level by @​Fdawgs in #​296
• ci: restore job level permissions by @​Fdawgs in #​297
• build(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @​dependabot[bot] in #​301
• build(deps-dev): bump cronometro from 4.0.3 to 5.3.0 by @​dependabot[bot] in #​302
• chore(license): update date ranges; standardise style by @​Fdawgs in #​306
• build(deps-dev): bump @​types/node from 22.15.34 to 24.0.8 by @​dependabot[bot] in #​308
• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in #​311
• chore(.npmrc): ignore scripts by @​Fdawgs in #​313
• build(deps-dev): remove @​fastify/pre-commit by @​Fdawgs in #​314
• ci(ci): add concurrency config by @​Fdawgs in #​315
• fix(tests): populate Set in idGenerator tests (#​266) by @​williamfds in #​304
• fix(types): add missing Session#isSaved() definition by @​inyourtime in #​316

New Contributors

• @​williamfds made their first contribution in #​304
• @​inyourtime made their first contribution in #​316

Full Changelog: fastify/session@v11.1.0...v11.1.1

getsentry/sentry-javascript-bundler-plugins (@​sentry/vite-plugin)

v4.6.0

Compare Source

• fix(core): Stop awaiting build start telemetry to avoid breaking module federation builds (#​818)
• feat(core): Bump @​sentry/cli from 2.51.0 to 2.57.0 (#​819)

vitest-dev/eslint-plugin-vitest (@​vitest/eslint-plugin)

v1.4.0

Compare Source

   🐞 Bug Fixes

• Add describe.for chains  -  by @​paescuj in #​808 (97702)
• Workaround for plugin type  -  by @​paescuj in #​811 (30053)
• Make .extend exclusive, add .scoped  -  by @​paescuj in #​809 (70708)
• no-done-callback: Remove rule from 'all' list  -  by @​paescuj in #​807 (20e53)

    View changes on GitHub

v1.3.26

Compare Source

   🐞 Bug Fixes

• Dynamically require typescript  -  by @​paescuj in #​803 (2ff2d)
• no-done-callback: False positive when using .for  -  by @​paescuj in #​804 (a3ab8)

    View changes on GitHub

v1.3.25

Compare Source

   🐞 Bug Fixes

• consistent-test-filename: Correct expected options type  -  by @​paescuj in #​801 (8a14d)

    View changes on GitHub

xyflow/xyflow (@​xyflow/react)

v12.9.2

Compare Source

Patch Changes

• #​5593 a8ee089d7 Thanks @​moklick! - Reset selection box when user selects a node

v12.9.1

Compare Source

Patch Changes

• #​5572 5ec0cac7f Thanks @​peterkogo! - Fix onPaneClick events being suppressed when selectionOnDrag=true

• Updated dependencies [5ec0cac7f]:

  • @​xyflow/system@​0.0.72

docker/setup-qemu-action (docker/setup-qemu-action)

v3.7.0

Compare Source

• Bump @​docker/actions-toolkit from 0.56.0 to 0.67.0 in #​217 #​230
• Bump brace-expansion from 1.1.11 to 1.1.12 in #​220
• Bump form-data from 2.5.1 to 2.5.5 in #​218
• Bump tmp from 0.2.3 to 0.2.4 in #​221
• Bump undici from 5.28.4 to 5.29.0 in #​219

Full Changelog: docker/setup-qemu-action@v3.6.0...v3.7.0

sindresorhus/globals (globals)

v16.5.0

Compare Source

• Update globals (2025-11-01) (#​316) 6d441ca
• Add Vue, Svelte, and Astro globals (#​314) ea31521

---

graphql/graphql-js (graphql)

v16.12.0: 16.12.0

Compare Source

v16.12.0 (2025-11-01)

New Feature 🚀

• #​4482 Implement changes for executable descriptions (@​JoviDeCroock)
• #​4493 Backport schema coordinates (@​JoviDeCroock)

Bug Fix 🐞

• #​4392 Catch unhandled exception in abstract resolution (@​JoviDeCroock)

Docs 📝

28 PRs were merged

• #​4374 docs: testing graphQL servers (@​sarahxsanders)
• #​4376 docs: type generation for graphql servers (@​sarahxsanders)
• #​4380 docs: add guides for custom scalars (@​sarahxsanders)
• #​4381 docs: anatomy of a resolver (@​sarahxsanders)
• #​4382 docs: understanding graphql errors (@​sarahxsanders)
• #​4383 docs: N+1 problem and DataLoader (@​sarahxsanders)
• #​4391 docs: cursor-based pagination guide (@​sarahxsanders)
• #​4393 docs: add page on abstract types (@​sarahxsanders)
• #​4394 docs: editorial on abstract types page (@​benjie)
• #​4395 docs: editorial for recent documentation updates (@​benjie)
• #​4396 docs: add page on authorization strategies (@​sarahxsanders)
• #​4398 docs: update "going to production" guide (@​sarahxsanders)
• #​4399 Update mutations-and-input-types.mdx (@​roman-lakhnov)
• #​4400 Remove CJS from docs (@​JoviDeCroock)
• #​4401 docs: add guide on directives (@​sarahxsanders)
• #​4402 docs: add guide for operation complexity controls (@​sarahxsanders)
• #​4405 docs: add guide on nullability (@​sarahxsanders)
• #​4406 docs: add guide on subscriptions (@​sarahxsanders)
• #​4411 docs: add guide on caching strategies (@​sarahxsanders)
• #​4414 docs: guide on scaling your API (@​sarahxsanders)
• #​4416 Editorial for #​4405 (nullability) (@​benjie)
• #​4417 Indicate that field arguments should always be preferred over directives (@​benjie)
• #​4418 docs: trusted documents (@​benjie)
• #​4419 docs: cleanup and fixes (@​sarahxsanders)
• #​4436 Suggestions for federation links (@​Urigo)
• #​4444 Fix navigation (@​JoviDeCroock)
• #​4452 fix(docs/mutations-and-input-types.mdx): root being inside of SDL (@​alesculek)
• #​4473 docs: remove fourth permutation of the visit API (@​janmeier)

Polish 💅

• #​4453 Remove oneof validation from values of correct type (@​JoviDeCroock)

Internal 🏠

3 PRs were merged

• #​4390 Add the version support policy (@​benjie)
• #​4412 internal: use empty merge commit to clean up git diff from 16.x.x (@​yaacovCR)
• #​4479 updated location of ModelSim gitignore file (@​magicmark)

Committers: 9

• Aleš Culek(@​alesculek)
• Benjie(@​benjie)
• Jan Aagaard Meier(@​janmeier)
• Jovi De Croock(@​JoviDeCroock)
• Mark Larah(@​magicmark)
• null(@​roman-lakhnov)
• Sarah Sanders(@​sarahxsanders)
• Uri Goldshtein(@​Urigo)
• Yaacov Rydzinski (@​yaacovCR)

jsdom/jsdom (jsdom)

v27.1.0

Compare Source

• Improved CSS parsing by switching to @acemir/cssom, including support for nested selectors, nested declarations, layer statements, and improved at-rule validation. (acemir)
• Fixed some selector cache invalidation issues where changes to attributes were not being picked up. (asamuzaK)
• Fixed package.json "engines" field to reflect the new minimum Node.js versions needed to run jsdom, as noted in the changelog for v27.0.1.

react-hook-form/react-hook-form (react-hook-form)

v7.66.0

Compare Source

i18next/react-i18next (react-i18next)

v16.2.3

Compare Source

• fix hyphened component break issue 1882

v16.2.2

Compare Source

• fix trans component break with less than sign 1880, closes 1734

v16.2.1

Compare Source

• fix regression in v16.2.0: bindI18nStore does not work correctly 1879

remix-run/react-router (react-router-dom)

v7.9.5

Compare Source

Patch Changes

• Updated dependencies:
  • react-router@7.9.5

vitest-dev/vitest (vitest)

v4.0.6

Compare Source

   🐞 Bug Fixes

• Don't merge errors with different diffs for reporting  -  by @​hi-ogawa in #​8871 (3e19f)
• Do not throw when importing a type from an external package  -  by @​sheremet-va in #​8875 (7e6c3)
• Improve spying types  -  by @​sheremet-va in #​8878 (ca041)
• Reuse the same environment when isolate and fileParallelism are false  -  by @​sheremet-va in #​8889 (31706)
• browser:
  • Support module tracking  -  by @​sheremet-va in #​8877 (9e24a)
  • Ensure setup files are re-evaluated on each test run  -  by @​yjaaidi in #​8883 and #​8884 (f50ea)
• coverage:
  • Prevent filtering out virtual files before remapping to sources  -  by @​AriPerkkio in #​8860 (e3b77)
• happy-dom:
  • Properly teardown additional keys  -  by @​sheremet-va in #​8888 (10a06)
• jsdom:
  • Pass down Node.js FormData to Request  -  by @​sheremet-va in #​8880 (197ca)

    View changes on GitHub

v4.0.5

Compare Source

   🐞 Bug Fixes

• Respect ssr.noExternal when externalizing dependencies  -  by @​sheremet-va in #​8862 (a4f86)
• Allow module in --config  -  by @​sheremet-va in #​8864 (b9521)
• browser: Allow Locator type in selectOptions element parameter  -  by @​rzzf and @​sheremet-va in #​8848 (7ee28)
• module-runner: Don't return node builtins for getBuiltins unconditionally  -  by @​sapphi-red in #​8863 (0e858)
• pool: Rename groupId to groupOrder in error message  -  by @​Yohannfra in #​8856 (b9aab)

   🏎 Performance

• Pass testfiles at once when --no-isolate --maxWorkers=1  -  by @​AriPerkkio in #​8835 (584aa)
• expect: Optimize checking the input type  -  by @​Connormiha in #​8840 (06968)

    View changes on GitHub

v4.0.4

Compare Source

   🐞 Bug Fixes

• browser:
  • Correct typo  -  by @​benmccann in #​8796 (ede1f)
  • Publish a missing context file for webdriverio  -  by @​sheremet-va in #​8824 (7c7b6)
• mocker:
  • Support mocking builtins without node: prefix  -  by @​sheremet-va in #​8829 (06208)
• pool:
  • Runner's error listener causing MaxListenersExceededWarning  -  by @​AriPerkkio in #​8820 (d1bff)
  • Capture workers stdio to logger  -  by @​AriPerkkio in #​8809 (fb95f)
• spy:
  • Allow classes in vi.mocked utility  -  by @​sheremet-va in #​8839 (f8756)
• worker:
  • Rpc listener leak when isolate: false  -  by @​AriPerkkio in #​8821 (573dc)

   🏎 Performance

• utils: Optimized reducer to avoid creating new objects  -  by @​Connormiha in #​8818 (d19ce)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.