Update third-party minor and patch

[microbit-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@​codemirror/state	6.7.5 → 6.7.6
@​codemirror/view	6.43.12 → 6.43.13
@pandacss/dev (source)	1.12.0 → 1.12.1
@sentry/browser (source)	10.73.0 → 10.75.3
@types/node (source)	24.13.3 → 24.13.6
eslint (source)	10.9.1 → 10.11.0
lunr-languages	1.21.0 → 1.22.0
marked (source)	18.0.11 → 18.0.14
react-aria	3.52.0 → 3.52.1
react-aria-components	1.21.0 → 1.21.1
react-router (source)	7.18.3 → 7.18.4

---

Release Notes

chakra-ui/panda (@​pandacss/dev)

v1.12.1

Compare Source

Patch Changes

• Updated dependencies [8a71bff]
  • @​pandacss/types@1.12.1
  • @​pandacss/config@1.12.1
  • @​pandacss/logger@1.12.1
  • @​pandacss/node@1.12.1
  • @​pandacss/preset-base@1.12.1
  • @​pandacss/preset-panda@1.12.1
  • @​pandacss/token-dictionary@1.12.1
  • @​pandacss/postcss@1.12.1
  • @​pandacss/shared@1.12.1

getsentry/sentry-javascript (@​sentry/browser)

v10.75.3

Compare Source

• fix(v10/tanstackstart-react): Reject non-POST requests to the managed tunnel route (#​24617)

Internal Changes

• chore(v10/bundler-plugins): move traces sample rate from 1.0 to 0.3 (#​24646)
• chore(v10/publish): Tag all packages as v10 (#​24619)

Bundle size 📦

Path	Size
@​sentry/browser	27.56 KB
@​sentry/browser - with treeshaking flags	26.04 KB
@​sentry/browser (incl. Tracing)	46.02 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.77 KB
@​sentry/browser (incl. Tracing, Profiling)	50.67 KB
@​sentry/browser (incl. Tracing, Replay)	84.38 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	74.28 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	89 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	101.33 KB
@​sentry/browser (incl. Feedback)	44.33 KB
@​sentry/browser (incl. sendFeedback)	32.25 KB
@​sentry/browser (incl. FeedbackAsync)	37.27 KB
@​sentry/browser (incl. Metrics)	28.63 KB
@​sentry/browser (incl. Logs)	28.84 KB
@​sentry/browser (incl. Metrics & Logs)	29.52 KB
@​sentry/react	29.32 KB
@​sentry/react (incl. Tracing)	48.28 KB
@​sentry/vue	32.88 KB
@​sentry/vue (incl. Tracing)	47.98 KB
@​sentry/svelte	27.58 KB
CDN Bundle	29.87 KB
CDN Bundle (incl. Tracing)	47.92 KB
CDN Bundle (incl. Logs, Metrics)	31.41 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	49.21 KB
CDN Bundle (incl. Replay, Logs, Metrics)	69.82 KB
CDN Bundle (incl. Tracing, Replay)	84.64 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	85.87 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	90.31 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91.55 KB
CDN Bundle - uncompressed	88.83 KB
CDN Bundle (incl. Tracing) - uncompressed	144.49 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.43 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	148.38 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	215.46 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	261.12 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	264.99 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	274.5 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	278.36 KB
@​sentry/nextjs (client)	50.75 KB
@​sentry/sveltekit (client)	46.46 KB
@​sentry/core/server	79.23 KB
@​sentry/core/browser	65.7 KB
@​sentry/node-core	62.33 KB
@​sentry/node	123.57 KB
@​sentry/node (incl. diagnostics channel injection)	166.68 KB
@​sentry/node/import (ESM hook with diagnostics-channel injection)	166 B
@​sentry/node/light	50.72 KB
@​sentry/node - without tracing	73.83 KB
@​sentry/aws-serverless	82.79 KB
@​sentry/cloudflare (withSentry) - minified	199.86 KB
@​sentry/cloudflare (withSentry)	492.78 KB

v10.75.2

Compare Source

• fix(v10/cloudflare): Enforce flush timeout across Workflow lifecycle (#​24582)
• fix(v10/core): Apply dataCollection.urlQueryParams to collected URLs and query strings (#​24572)
• fix(v10/nextjs): Align tunnel request matching in middleware with tunnel rewrite (#​24565)
• fix(v10/node): Stop leaking unhandled rejections on aborted Vercel AI streams (#​24563)

v10.75.1

Compare Source

• fix(v10/cloudflare): Capture telemetry from untraced Durable Object RPC calls (#​24512)
• fix(v10/cloudflare): Instrument namespaces returned by jurisdiction() (#​24513)
• fix(v10/hono): Allow @​cloudflare/workers-types v5 as peer dependency (#​24500)
• fix(v10/nextjs): Resolve Next.js version relative to the SDK when cwd differs (#​24475)

v10.75.0

Compare Source

Important Changes

• feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#​24445)

  On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

• feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#​24339)
• fix(v10/browser): Release the XHR virtualError once the request completed (#​24307)
• fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#​24349)
• fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#​24332)
• fix(v10/core): Don't instrument the SDK's own envelope requests (#​24276)
• fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#​24295)
• fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#​24444)
• fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#​24353)
• fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#​24025)
• fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#​23588)

v10.74.0

Compare Source

• feat(v10): Streamline isolation scope handling & reset in isolation scopes (#​24152)
• fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#​23433)
• fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#​24226)
• fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#​24181)
• fix(v10/core): Guard loadModule default parameter against ESM scope (#​24154)
• fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#​23877)
• fix(v10/core): Resolve MCP capture policy per operation (#​23796)
• fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#​23906)
• fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#​24223)
• fix(v10/nextjs): Register Vercel AI span processors on Next.js (#​23773)
• fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#​24026)
• fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#​24238)
• fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#​23995)
• fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#​23994)
• fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#​23998)

Internal Changes

• test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#​23910)

Work in this release was contributed by @​halillusion and @​zkasuran. Thank you for your contributions!

eslint/eslint (eslint)

v10.11.0

Compare Source

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#​21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#​21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#​21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#​21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#​21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#​21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#​21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#​21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#​21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#​21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#​21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#​21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#​21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#​21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#​21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#​21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#​20395) (Nitin Kumar)

v10.10.0

Compare Source

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#​21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#​21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#​21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#​20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#​21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#​21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#​21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#​21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#​21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#​21286) (한국)
• 8724829 docs: update compat table links (#​21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#​21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#​21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#​21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#​21296) (renovate[bot])
• 3c753f1 chore: update eslint (#​21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#​21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#​21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#​21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#​21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#​21178) (crimsonjay0)

MihaiValentin/lunr-languages (lunr-languages)

v1.22.0

Compare Source

Remove additional build artefacts from the final published NPM

markedjs/marked (marked)

v18.0.14

Compare Source

Bug Fixes

• allow indented lines in setext heading text (#​4095) (7d05530)
• decode numeric character references in text (#​4076) (cead8de)
• keep text after empty nested blockquote (#​4101) (1b89557), closes #​4098
• preserve internal tabs in list item content (#​4086) (e136da7)
• strip whitespace when normalizing link reference labels (#​4091) (c7ee43a)
• support GFM protocol autolinks (#​4067) (7f7a496)

v18.0.13

Compare Source

Bug Fixes

• allow tabs in the thematic break that ends a list item (#​4087) (afbb27c)
• avoid O(n^2) scanning in reflinkSearch (#​4090) (c6a25bb)
• case fold reference link labels (#​4077) (aed9336)
• drop the leading whitespace after a hard line break (#​4075) (123ce04)
• match html block start conditions when ending a list item (#​4072) (c2facac)
• respect raw tokens when closing link labels (#​4066) (ef394f7)
• strip a tab that follows spaces in an indented code block (#​4080) (dbb393d)

v18.0.12

Compare Source

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#​4084) (4417582)
• allow one more level of nested brackets in a link label (#​4064) (37b28d8)
• do not add a newline to an empty code block (#​4073) (23b1706)
• escape character references in autolink destinations (#​4053) (8f432f0)
• reject GFM email autolink when the domain ends in _ or - (#​4063) (df57534)
• reject invalid characters in HTML tag names (#​4083) (300bb1d)
• remove up to the fence indentation from each content line (#​4074) (0244f08)

adobe/react-spectrum (react-aria)

v3.52.1

Compare Source

remix-run/react-router (react-router)

v7.18.4: v7.18.4

Compare Source

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7184

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Preview build will be at
https://review-python-editor-v3.microbit.org/renovate-third-party-minor-and-patch/