Update dependency upgrades - non-major

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@testing-library/react	16.2.0 -> 16.3.0
@types/node (source)	22.13.17 -> 22.15.29
@types/react (source)	19.0.12 -> 19.1.6
@types/react-dom (source)	19.0.4 -> 19.1.5
eslint (source)	9.23.0 -> 9.28.0
pnpm (source)	10.7.1 -> 10.11.0
sass	1.86.1 -> 1.89.1
stylelint (source)	16.17.0 -> 16.20.0
typescript (source)	5.8.2 -> 5.8.3
web-vitals	5.0.0 -> 5.0.2

---

Release Notes

testing-library/react-testing-library (@​testing-library/react)

v16.3.0

Compare Source

eslint/eslint (eslint)

v9.28.0

Compare Source

v9.27.0

Compare Source

v9.26.0

Compare Source

v9.25.1

Compare Source

v9.25.0

Compare Source

v9.24.0

Compare Source

pnpm/pnpm (pnpm)

v10.11.0

Compare Source

Minor Changes

• A new setting added for pnpm init to create a package.json with type=module, when init-type is module. Works as a flag for the init command too #​9463.

• Added support for Nushell to pnpm setup #​6476.

• Added two new flags to the pnpm audit command, --ignore and --ignore-unfixable #​8474.

  Ignore all vulnerabilities that have no solution:

  > pnpm audit --ignore-unfixable

  Provide a list of CVE's to ignore those specifically, even if they have a resolution.

  > pnpm audit --ignore=CVE-2021-1234 --ignore=CVE-2021-5678

• Added support for recursively running pack in every project of a workspace #​4351.

  Now you can run pnpm -r pack to pack all packages in the workspace.

Patch Changes

• pnpm version management should work, when dangerouslyAllowAllBuilds is set to true #​9472.
• pnpm link should work from inside a workspace #​9506.
• Set the default workspaceConcurrency to Math.min(os.availableParallelism(), 4) #​9493.
• Installation should not exit with an error if strictPeerDependencies is true but all issues are ignored by peerDependencyRules #​9505.
• Read updateConfig from pnpm-workspace.yaml #​9500.
• Add support for recursive pack
• Remove url.parse usage to fix warning on Node.js 24 #​9492.
• pnpm run should be able to run commands from the workspace root, if ignoreScripts is set tot true #​4858.

v10.10.0

Compare Source

Minor Changes

• Allow loading the preResolution, importPackage, and fetchers hooks from local pnpmfile.

Patch Changes

• Fix cd command, when shellEmulator is true #​7838.
• Sort keys in pnpm-workspace.yaml #​9453.
• Pass the npm_package_json environment variable to the executed scripts #​9452.
• Fixed a mistake in the description of the --reporter=silent option.

v10.9.0

Compare Source

Minor Changes

• Added support for installing JSR packages. You can now install JSR packages using the following syntax:

  pnpm add jsr:<pkg_name>
  

  or with a version range:

  pnpm add jsr:<pkg_name>@&#8203;<range>
  

  For example, running:

  pnpm add jsr:@​foo/bar
  

  will add the following entry to your package.json:

  {
    "dependencies": {
      "@​foo/bar": "jsr:^0.1.2"
    }
  }

  When publishing, this entry will be transformed into a format compatible with npm, older versions of Yarn, and previous pnpm versions:

  {
    "dependencies": {
      "@​foo/bar": "npm:@​jsr/foo__bar@^0.1.2"
    }
  }

  Related issue: #​8941.

  Note: The @jsr scope defaults to https://npm.jsr.io/ if the @jsr:registry setting is not defined.

• Added a new setting, dangerouslyAllowAllBuilds, for automatically running any scripts of dependencies without the need to approve any builds. It was already possible to allow all builds by adding this to pnpm-workspace.yaml:

  neverBuiltDependencies: []

  dangerouslyAllowAllBuilds has the same effect but also allows to be set globally via:

  pnpm config set dangerouslyAllowAllBuilds true
  

  It can also be set when running a command:

  pnpm install --dangerously-allow-all-builds
  

Patch Changes

• Fix a false negative in verifyDepsBeforeRun when nodeLinker is hoisted and there is a workspace package without dependencies and node_modules directory #​9424.
• Explicitly drop verifyDepsBeforeRun support for nodeLinker: pnp. Combining verifyDepsBeforeRun and nodeLinker: pnp will now print a warning.

v10.8.1

Compare Source

Patch Changes

• Removed bright white highlighting, which didn't look good on some light themes #​9389.
• If there is no pnpm related configuration in package.json, onlyBuiltDependencies will be written to pnpm-workspace.yaml file #​9404.

v10.8.0

Compare Source

Minor Changes

• Experimental. A new hook is supported for updating configuration settings. The hook can be provided via .pnpmfile.cjs. For example:

  module.exports = {
    hooks: {
      updateConfig: (config) => ({
        ...config,
        nodeLinker: "hoisted",
      }),
    },
  };

• Now you can use the pnpm add command with the --config flag to install new configurational dependencies #​9377.

Patch Changes

• Do not hang indefinitely, when there is a glob that starts with !/ in pnpm-workspace.yaml. This fixes a regression introduced by #​9169.
• pnpm audit --fix should update the overrides in pnpm-workspace.yaml.
• pnpm link should update overrides in pnpm-workspace.yaml, not in package.json #​9365.

sass/dart-sass (sass)

v1.89.1

Compare Source

• No user-visible changes.

v1.89.0

Compare Source

• Allow the Node package importer to load files even when there are multiple
  potential resolutions, as long as those resolutions all point to the same
  file.

v1.88.0

Compare Source

• Allow custom properties with empty values (such as --var:;).

• Fix a bug when calculating source spans for interpolations.

Dart and JS APIs

• Potentially breaking bug fix: Throw an error when passing a function or
  mixin object from one compilation to another.

Dart API

• Deprecate passing a relative URL to compileString() and related functions.

v1.87.0

Compare Source

• Potentially breaking bug fix: When a plain CSS file with a top-level
  nesting selector & is loaded into a nested Sass context via
  meta.load-css() or @import, Sass now emits plain CSS nesting rather than
  incorrectly combining it with the parent selector using a descendant
  combinator.

v1.86.3

Compare Source

• Fix a bug introduced in 1.86.1 where Sass fails to resolve paths starting with
  a .. segment.

v1.86.2

Compare Source

• No user-visible changes.

stylelint/stylelint (stylelint)

v16.20.0

Compare Source

It fixes 2 bugs with the built-in rules.

• Fixed: function-url-no-scheme-relative false negatives for @import (#​8576) (@​pamelalozano16).
• Fixed: shorthand-property-no-redundant-values false negatives for additional radius (#​8539) (@​ryo-manba).

v16.19.1

Compare Source

• Fixed: no-empty-source false positives for non-standard syntaxes (#​8548) (@​ybiquitous).

v16.19.0

Compare Source

It adds 2 options to 2 rules and fixes 3 bugs.

• Added: exceptWithoutPropertyFallback: [] to function-allowed-list (#​8488) (@​ryo-manba).
• Added: ignore: ["four-into-three-edge-values"] to shorthand-property-no-redundant-values (#​8527) (@​ryo-manba).
• Fixed: compact formatter with pnpm to newline the exit code (#​8534) (@​konomae).
• Fixed: declaration-property-value-no-unknown range and message for invalid syntax within known functions (#​8528) (@​ryo-manba).
• Fixed: no-empty-source false positives for --report-needless-disables (#​8536) (@​romainmenke).

v16.18.0

Compare Source

It adds 2 new rules and fixes 2 bugs. We've turned on these rules, and the syntax-string-no-invalid and layer-name-pattern ones from recent releases, in our standard config.

• Added: color-function-alias-notation rule (#​8499) (@​EduardAkhmetshin).
• Added: container-name-pattern rule (#​8498) (@​nate10j).
• Fixed: declaration-property-value-no-unknown false positives for math of font-size (#​8495) (@​otomad).
• Fixed: font-family-no-missing-generic-family-keyword false positives for math (#​8489) (@​otomad).

microsoft/TypeScript (typescript)

v5.8.3

Compare Source

GoogleChrome/web-vitals (web-vitals)

v5.0.2

Compare Source

• Handle layout shifts with no sources (#​623)

v5.0.1

Compare Source

• Fix missing FCP and LCP for prerendered pages (#​621)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for preflight-test-project-react-passing ready!

Name	Link
🔨 Latest commit	33a8ae4
🔍 Latest deploy log	https://app.netlify.com/projects/preflight-test-project-react-passing/deploys/683a570ba110f20008f30a88
😎 Deploy Preview	https://deploy-preview-1047--preflight-test-project-react-passing.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.