[dependabot]

Bumps the npm-version-updates group with 19 updates in the / directory:

Package	From	To
@solidjs/router	0.15.4	1.0.1
@solidjs/start	1.3.2	2.2.0
@zitadel/solidstart-auth	1.1.5	1.1.6
openid-client	6.8.4	6.8.9
solid-js	1.9.13	1.9.18
@commitlint/config-conventional	20.5.3	21.2.4
@eslint/js	9.39.4	10.0.1
@playwright/test	1.60.0	1.64.1
@types/node	22.19.19	26.6.6
eslint	9.39.4	10.14.0
eslint-plugin-solid	0.14.5	0.18.1
globals	16.5.0	17.14.0
knip	5.88.1	6.44.1
prettier	3.8.3	3.9.10
prettier-plugin-tailwindcss	0.8.0	0.8.1
tailwindcss	4.3.0	4.3.4
typescript	5.9.3	7.0.2
typescript-eslint	8.60.0	8.72.1
vite	8.0.16	8.3.5

Updates @solidjs/router from 0.15.4 to 1.0.1

Release notes

Sourced from @​solidjs/router's releases.

v1.0.1

Patch Changes

• eaafba6: Stamp history depth from the current entry instead of history.length, so useBeforeLeave and scroll restoration keep working on Back once the browser's session history is full (#694)

• c3cbd67: Throw a descriptive error in development when an action is called directly instead of through useAction.

• 473c270: Anchor click handling no longer intercepts links with a non-http(s) scheme (blob:, mailto:, tel:, data:, …). Previously blob: links could be wrongly routed because they inherit the page origin and bypassed the same-origin check.

• 5a46ba1: Speed up <A> server rendering by roughly 5x

  <A> spent most of its server render time in mergeProps and splitProps, which build accessor-backed prop objects that can never be observed during a one shot renderToString. The default activeClass / inactiveClass merge is gone, the location.pathname normalization is shared instead of repeated per link, JSON.stringify is skipped when there is no state, and on the server a link that passes nothing beyond the props <A> consumes itself now skips splitProps and the JSX spread entirely.

  Rendered output is unchanged on the client, and unchanged on the server apart from the link marker serializing as link rather than link="true" on that fast path. Client bundles get slightly smaller, since the server branch is constant folded away.

• 65f9ee7: Fixes browser history navigation when Forward is pressed while a Back transition is waiting on route data.

Changelog

Sourced from @​solidjs/router's changelog.

1.0.1

Patch Changes

• eaafba6: Stamp history depth from the current entry instead of history.length, so useBeforeLeave and scroll restoration keep working on Back once the browser's session history is full (#694)

• c3cbd67: Throw a descriptive error in development when an action is called directly instead of through useAction.

• 473c270: Anchor click handling no longer intercepts links with a non-http(s) scheme (blob:, mailto:, tel:, data:, …). Previously blob: links could be wrongly routed because they inherit the page origin and bypassed the same-origin check.

• 5a46ba1: Speed up <A> server rendering by roughly 5x

  <A> spent most of its server render time in mergeProps and splitProps, which build accessor-backed prop objects that can never be observed during a one shot renderToString. The default activeClass / inactiveClass merge is gone, the location.pathname normalization is shared instead of repeated per link, JSON.stringify is skipped when there is no state, and on the server a link that passes nothing beyond the props <A> consumes itself now skips splitProps and the JSX spread entirely.

  Rendered output is unchanged on the client, and unchanged on the server apart from the link marker serializing as link rather than link="true" on that fast path. Client bundles get slightly smaller, since the server branch is constant folded away.

• 65f9ee7: Fixes browser history navigation when Forward is pressed while a Back transition is waiting on route data.

1.0.0

Major Changes

• Declare the router stable as 1.0.0. This is a version realignment, not a breaking change: the code is functionally identical to the 0.16 line, which has held API-stable for years, and ^1.0.0 finally gets normal caret semantics instead of the pinned-minor treatment resolvers give 0.x releases. It also aligns major numbers across the ecosystem — router 1.x pairs with Solid 1.x (and SolidStart 2.0), while the in-progress Solid 2 router moves from 1.0.0-next.* to 2.0.0-next.* prereleases under the next tag.

Patch Changes

• 1211a89: Restore scroll with a single scroll once routing settles, dropping the ResizeObserver that re-asserted the offset while the document was still growing (<Router scrollRestoration>, added in 0.16.3). Settling after the navigation commits is what makes the offset reachable, and it is the strategy every peer router ships (SvelteKit, TanStack Router, React Router, Next); TanStack's equivalent MutationObserver sits commented out in their source. The chase carried real downside for a case none of them try to cover: with no bound, a target that is never reachable (a list that is genuinely shorter now) left the observer connected for the life of the page, re-clamping the viewport to the bottom on every subsequent resize, and scroll-induced layout changes can feed it back into itself. It was also untestable in jsdom, which has no ResizeObserver, so the branch had no coverage. Content committing after the navigation settles — an image without reserved space, a boundary below the fold — now keeps whatever offset the document can hold.

0.16.3

Patch Changes

• 31501fd: Add opt-in explicit scroll restoration for back/forward navigation: <Router scrollRestoration> (#577). The browser's native same-document heuristic loses the saved offset when the destination route forces a layout while the document is still short — any component that measures itself on mount is enough to trigger it. When enabled the router sets history.scrollRestoration = "manual", captures positions continuously keyed by the history entry depth it already tracks, persists them across reloads, and restores after the navigation settles — retrying as the document grows if the target offset isn't reachable yet, cancelled by the first user scroll. Off by default on 0.x; no behavior changes unless enabled.

0.16.2

Patch Changes

• 676db85: fix #451 - dispose per-route roots when the route tree unmounts; leaked roots stayed subscribed to route matches and crashed with TypeError: ... (evaluating 'match().path') on a later navigation (e.g. when a <Show> in the root component hid the outlet during login/logout flows)

• cae1d15: Fix a batch of long-standing bugs:

  • useSubmission().retry was always a no-op due to an operator-precedence bug (#504)
  • disposing an older owner no longer unregisters a newer action bound to the same URL, which caused forms to fall through to native submission after revalidation (#542)
  • useBeforeLeave listeners now observe defaultPrevented set by other listeners (#530)
  • <A> active state now ignores trailing slashes on href (#532)
  • useCurrentMatches returns a copy so user mutation can't corrupt router state (#516)

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​solidjs/router since your current version.

Updates @solidjs/start from 1.3.2 to 2.2.0

Release notes

Sourced from @​solidjs/start's releases.

@​solidjs/start@​2.2.0

Minor Changes

• 876881b: Add serverFunctions.skewProtection. When it is on, a page loaded before a deploy can no longer call the new server's functions with an outdated client. The server answers such a call with 409 instead of running the function, and the page reloads once to load the new version. Each build gets a random ID, or pass { buildId } (such as a commit hash) when several machines build the same deploy. Only applies to production builds, and is off by default.
• d329369: Let server functions take files and blobs anywhere in their arguments, not only as the only argument. A call like upload(file, { tags }), or one with files in arrays, objects, maps, sets or form data, sends them as parts of multipart form data next to the serialized arguments, and the server function gets them as File values. Calls without files are sent as before.

Patch Changes

• 6a7a496: Bump seroval and seroval-plugins to 1.7.0.
• ecc390b: Keep the API route matcher out of the client bundle. It is only used on the server, but the client loaded it with the page routes, which added about 2.5 KB of unused code. Routes that only export an OPTIONS handler are now matched as API routes.
• e8bd8c0: Keep Vite's default resolve conditions ("module", "browser") in the client environment: since 2.1.0, packages exposing a "browser" export condition (e.g. @sentry/solidstart) resolved to their Node build in the browser. The dev overlay's @jridgewell/trace-mapping is now pre-bundled, as the "browser" condition makes it import a UMD build.
• 6280546: Resolve the server function filter and the ids of lazily loaded modules against Vite's root instead of the working directory. On Windows a working directory entered through a junction or symlink keeps that path, while Vite (8.2 and later) resolves the root and every module id to the real path. The filter then matched no module, so no "use server" function was compiled: its body shipped in the client bundle, and the build failed with Attempt to import 'server-only' in a client module once one of them imported server-only code such as @solidjs/start/http. The ids of lazily loaded route components matched no client manifest entry either, so their CSS was missing from the server-rendered HTML. Relative patterns in the serverFunctions.filter option now resolve against Vite's root too.

@​solidjs/start@​2.1.0

Minor Changes

• ad92979: Add ssr: "data-only". The app renders on the client without hydration, as with ssr: false, but the server runs the requested page's route preloads and streams their query results with the HTML shell, so the client doesn't fetch that data again.

Patch Changes

• 5de5afd: Bump seroval and seroval-plugins to 1.6.11.

• c30a825: Support a full URL in Vite's base so assets can be served from a CDN, completing the base URL prefixing from 2.0.3. Entry, stylesheet, modulepreload and serialized manifest paths no longer collapse https:// into https:/, and server functions post to the path the app is mounted at (server.baseURL, else Vite's base when it is a plain path, else /) instead of the asset base. There is no CDN in development: Vite serves the assets itself, including the public directory, under the URL's path, while the app stays at the root. Root-relative links to public files therefore differ between dev and a build; setting the CDN base for production builds only avoids that.

• 2ff5882: Let a clientOnly loader resolve to the component itself, so a named export works without wrapping it in { default }:

  const Chart = clientOnly(() => import("./chart").then(({ Chart }) => Chart));

  Destructuring the export inside the loader also lets the bundler leave the module's other exports out of the chunk.

• 45bacdb: Stop the dev toolbar's CSS from shipping in production builds. The error boundary statically imports the dev toolbar, whose module imports its stylesheet as a side effect. The toolbar is dead code in production, but the stylesheet survived because the package declared no sideEffects, so its styles were bundled into the client CSS. The package now marks only CSS files as having side effects, letting the bundler drop the toolbar and its styles from production output.

• 9ce2a5d: Add an earlyHints option that sends the page's assets as 103 Early Hints, so the browser can start downloading them while the server is still rendering. It covers the app's entry assets and the assets of the routes being rendered. On runtimes other than Node, the same hints are added as Link headers on the response. Off by default, and only applies to production builds.

• 6c9b0c9: Fall back to client rendering when the browser's path or query changes before hydration starts, preventing hydration mismatches and stale server data after early navigation.

• a235891: Speed up the server function and lazy transforms.

  • Modules without "use server" are no longer parsed by the server function transform.
  • The server build no longer parses a module with Babel only to add its lazy id.
  • Modules with many server functions compile about 4 times faster.
  • A module with a server function no longer fails to compile when it has an unused for...of or for...in loop variable, or a chain of unused declarations.

• 017001e: Keep the result of a form submitted without JavaScript when its form data is too large for the flash cookie. Browsers silently drop cookies over 4096 bytes, so a large textarea used to make useSubmission() come back empty on the page the action redirected to. The form data is now left out of the cookie when it would not fit, the result and error still come through, and a warning is logged on the server.

• e0e6f6d: Reload the browser when entry-server or the middleware changes in dev. Both are server-only, so Vite had nothing to send the browser and the page kept showing the previously rendered output until it was refreshed by hand.

• 6a9fb75: Reload the page once when a route's code fails to load during client-side navigation, such as when a deploy replaced it while the page was open. Before, the navigation ended on an error page until the user refreshed by hand. The page now reloads at the destination and loads the new version. A route that still fails right after the reload shows the error instead of reloading again. This only applies to production builds, and can be turned off with reloadOnRouteChunkError: false.

• 207cfd2: Make solid-js a peer dependency instead of a regular one. When an app's solid-js version was outside the range SolidStart asked for, package managers installed a second copy just for SolidStart. The two copies did not share reactive context, so client-side navigation broke with TypeError: Cannot read properties of null (reading 'push'). SolidStart now uses the app's solid-js, and a version outside the supported range shows up as a peer dependency warning at install time.

• eb50f39: Serve pages in SPA mode (ssr: false) when a route file exports both a page and an API handler, such as a [...404].tsx with a GET. The server treated those routes as API-only, so a GET that returned nothing gave a 404 for every URL the route matched.

• ad92979: Export getServerFunctionMeta, decorateHandler and decorateMiddleware from @solidjs/start/server in SPA mode (ssr: false), so apps using them build.

@​solidjs/start@​1.4.0

Minor Changes

... (truncated)

Changelog

Sourced from @​solidjs/start's changelog.

2.2.0

Minor Changes

• 876881b: Add serverFunctions.skewProtection. When it is on, a page loaded before a deploy can no longer call the new server's functions with an outdated client. The server answers such a call with 409 instead of running the function, and the page reloads once to load the new version. Each build gets a random ID, or pass { buildId } (such as a commit hash) when several machines build the same deploy. Only applies to production builds, and is off by default.
• d329369: Let server functions take files and blobs anywhere in their arguments, not only as the only argument. A call like upload(file, { tags }), or one with files in arrays, objects, maps, sets or form data, sends them as parts of multipart form data next to the serialized arguments, and the server function gets them as File values. Calls without files are sent as before.

Patch Changes

• 6a7a496: Bump seroval and seroval-plugins to 1.7.0.
• ecc390b: Keep the API route matcher out of the client bundle. It is only used on the server, but the client loaded it with the page routes, which added about 2.5 KB of unused code. Routes that only export an OPTIONS handler are now matched as API routes.
• e8bd8c0: Keep Vite's default resolve conditions ("module", "browser") in the client environment: since 2.1.0, packages exposing a "browser" export condition (e.g. @sentry/solidstart) resolved to their Node build in the browser. The dev overlay's @jridgewell/trace-mapping is now pre-bundled, as the "browser" condition makes it import a UMD build.
• 6280546: Resolve the server function filter and the ids of lazily loaded modules against Vite's root instead of the working directory. On Windows a working directory entered through a junction or symlink keeps that path, while Vite (8.2 and later) resolves the root and every module id to the real path. The filter then matched no module, so no "use server" function was compiled: its body shipped in the client bundle, and the build failed with Attempt to import 'server-only' in a client module once one of them imported server-only code such as @solidjs/start/http. The ids of lazily loaded route components matched no client manifest entry either, so their CSS was missing from the server-rendered HTML. Relative patterns in the serverFunctions.filter option now resolve against Vite's root too.

2.1.0

Minor Changes

• ad92979: Add ssr: "data-only". The app renders on the client without hydration, as with ssr: false, but the server runs the requested page's route preloads and streams their query results with the HTML shell, so the client doesn't fetch that data again.

Patch Changes

• 5de5afd: Bump seroval and seroval-plugins to 1.6.11.

• c30a825: Support a full URL in Vite's base so assets can be served from a CDN, completing the base URL prefixing from 2.0.3. Entry, stylesheet, modulepreload and serialized manifest paths no longer collapse https:// into https:/, and server functions post to the path the app is mounted at (server.baseURL, else Vite's base when it is a plain path, else /) instead of the asset base. There is no CDN in development: Vite serves the assets itself, including the public directory, under the URL's path, while the app stays at the root. Root-relative links to public files therefore differ between dev and a build; setting the CDN base for production builds only avoids that.

• 2ff5882: Let a clientOnly loader resolve to the component itself, so a named export works without wrapping it in { default }:

  const Chart = clientOnly(() => import("./chart").then(({ Chart }) => Chart));

  Destructuring the export inside the loader also lets the bundler leave the module's other exports out of the chunk.

• 45bacdb: Stop the dev toolbar's CSS from shipping in production builds. The error boundary statically imports the dev toolbar, whose module imports its stylesheet as a side effect. The toolbar is dead code in production, but the stylesheet survived because the package declared no sideEffects, so its styles were bundled into the client CSS. The package now marks only CSS files as having side effects, letting the bundler drop the toolbar and its styles from production output.

• 9ce2a5d: Add an earlyHints option that sends the page's assets as 103 Early Hints, so the browser can start downloading them while the server is still rendering. It covers the app's entry assets and the assets of the routes being rendered. On runtimes other than Node, the same hints are added as Link headers on the response. Off by default, and only applies to production builds.

• 6c9b0c9: Fall back to client rendering when the browser's path or query changes before hydration starts, preventing hydration mismatches and stale server data after early navigation.

• a235891: Speed up the server function and lazy transforms.

  • Modules without "use server" are no longer parsed by the server function transform.
  • The server build no longer parses a module with Babel only to add its lazy id.
  • Modules with many server functions compile about 4 times faster.
  • A module with a server function no longer fails to compile when it has an unused for...of or for...in loop variable, or a chain of unused declarations.

• 017001e: Keep the result of a form submitted without JavaScript when its form data is too large for the flash cookie. Browsers silently drop cookies over 4096 bytes, so a large textarea used to make useSubmission() come back empty on the page the action redirected to. The form data is now left out of the cookie when it would not fit, the result and error still come through, and a warning is logged on the server.

• e0e6f6d: Reload the browser when entry-server or the middleware changes in dev. Both are server-only, so Vite had nothing to send the browser and the page kept showing the previously rendered output until it was refreshed by hand.

• 6a9fb75: Reload the page once when a route's code fails to load during client-side navigation, such as when a deploy replaced it while the page was open. Before, the navigation ended on an error page until the user refreshed by hand. The page now reloads at the destination and loads the new version. A route that still fails right after the reload shows the error instead of reloading again. This only applies to production builds, and can be turned off with reloadOnRouteChunkError: false.

• 207cfd2: Make solid-js a peer dependency instead of a regular one. When an app's solid-js version was outside the range SolidStart asked for, package managers installed a second copy just for SolidStart. The two copies did not share reactive context, so client-side navigation broke with TypeError: Cannot read properties of null (reading 'push'). SolidStart now uses the app's solid-js, and a version outside the supported range shows up as a peer dependency warning at install time.

• eb50f39: Serve pages in SPA mode (ssr: false) when a route file exports both a page and an API handler, such as a [...404].tsx with a GET. The server treated those routes as API-only, so a GET that returned nothing gave a 404 for every URL the route matched.

• ad92979: Export getServerFunctionMeta, decorateHandler and decorateMiddleware from @solidjs/start/server in SPA mode (ssr: false), so apps using them build.

2.0.6

... (truncated)

Commits

• 998ff3a chore: release (#2366)
• 876881b feat(start): add skew protection for server functions (#2363)
• ecc390b fix(server): keep the API route matcher out of the client bundle (#2362)
• 6a7a496 chore(start): bump seroval to 1.7.0 (#2368)
• e8bd8c0 fix(config): keep Vite's default client resolve conditions (#2365)
• d329369 feat: send files anywhere in server function arguments (#2359)
• 6280546 fix(start): resolve the server function filter and lazy ids against Vite's ro...
• fbf559d chore: release (#2337)
• 5de5afd chore(start): bump seroval to 1.6.11 (#2358)
• 207cfd2 fix(start): make solid-js a peer dependency (#2343)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​solidjs/start since your current version.

Updates @zitadel/solidstart-auth from 1.1.5 to 1.1.6

Release notes

Sourced from @​zitadel/solidstart-auth's releases.

v1.1.6

1.1.6 (2026-09-10)

Bug Fixes

• deps: resolve npm audit vulnerabilities (8fe2b35)

Commits

• 227d7b3 chore(release): 1.1.6 [skip ci]
• 8fe2b35 fix(deps): resolve npm audit vulnerabilities
• See full diff in compare view

Updates openid-client from 6.8.4 to 6.8.9

Release notes

Sourced from openid-client's releases.

v6.8.9

Fixes

• types: support exactOptionalPropertyTypes (91f3005), closes #903

v6.8.8

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

v6.8.7

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

v6.8.6

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

v6.8.5

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

Changelog

Sourced from openid-client's changelog.

6.8.9 (2026-11-02)

Fixes

• types: support exactOptionalPropertyTypes (91f3005), closes #903

6.8.8 (2026-09-05)

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

6.8.7 (2026-08-20)

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

6.8.6 (2026-08-18)

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

6.8.5 (2026-08-11)

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

Commits

• 0f4fcb6 chore(release): 6.8.9
• 501102a chore: bump packages
• 91f3005 fix(types): support exactOptionalPropertyTypes
• 63b2fac ci: add trigger-ci pushes
• bf05393 build(deps-dev): bump workerd in /tap/workerd
• 81d30e2 build(deps-dev): bump electron from 44.9.1 to 45.1.0 in /tap/electron
• bd81b1b build(deps): bump the actions group with 4 updates
• 43d3022 build(deps-dev): bump @​playwright/test from 1.63.0 to 1.64.1
• ca1ceb7 build(deps-dev): bump electron
• f396c7f test: address conformance suite v5.3.2 failures
• Additional commits viewable in compare view

Updates solid-js from 1.9.13 to 1.9.18

Commits

• See full diff in compare view

Updates @commitlint/config-conventional from 20.5.3 to 21.2.4

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

• fix(load): replace config file arrays with seed arrays by @​escapedcat in conventional-changelog/commitlint#5056
• fix: update dependency jsonc to v3 by @​renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

• perf(load): load typescript configs with jiti directly by @​escapedcat in conventional-changelog/commitlint#5052

Docs, etc

• docs: add AGENTS.md with commit type guidance by @​escapedcat in conventional-changelog/commitlint#5053
• test(ensure): pin case conversion of digits, punctuation and accents by @​escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

v21.2.3

21.2.3 (2026-09-19)

Bug Fixes

• fix(types): correct breaking-change-exclamation-mark rule config type by @​lazerg in conventional-changelog/commitlint#4954
• fix(config-nx-scopes): read scopes from the nx project graph by @​dylanpulver in conventional-changelog/commitlint#4957
• fix(lint): trim trailing whitespace off the message handed to ignore matchers by @​dylanpulver in conventional-changelog/commitlint#4960
• fix(load): detect dynamic await support on node majors above 20 by @​dylanpulver in conventional-changelog/commitlint#4961
• fix(rules): report the case that matched in case rule failure messages by @​dylanpulver in conventional-changelog/commitlint#4962
• fix(load): run the parser factory of scoped conventional-changelog presets by @​maximilliangrand in conventional-changelog/commitlint#4968

Refactor

• refactor(load): drop the node version check gating cosmiconfig loaders by @​dylanpulver in conventional-changelog/commitlint#4972

Chore, ci, build, etc.

• build: install pnpm via npm instead of corepack by @​escapedcat in conventional-changelog/commitlint#4948
• build: retire the docker compose dev environment by @​escapedcat in conventional-changelog/commitlint#4949
• build: verify pnpm tarball against the packageManager sha512 pin by @​escapedcat in conventional-changelog/commitlint#4952
• ci: stabilize Windows CI by raising Vitest default timeout by @​escapedcat with @​Copilot in conventional-changelog/commitlint#4959
• docs: drop the Node 24 config-loading workaround note by @​escapedcat in conventional-changelog/commitlint#4976
• chore: move pnpm settings from .npmrc to pnpm-workspace.yaml by @​escapedcat in conventional-changelog/commitlint#4977
• chore: swap pnpm resolutionMode time-based for minimumReleaseAge by @​escapedcat in conventional-changelog/commitlint#4984

... (truncated)

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @​commitlint/config-conventional

21.2.3 (2026-09-19)

Bug Fixes

• rules: report the case that matched in case rule failure messages (#4962) (9f5f7bc)

21.2.2 (2026-08-13)

Note: Version bump only for package @​commitlint/config-conventional

21.2.0 (2026-06-30)

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

21.1.0 (2026-06-23)

Note: Version bump only for package @​commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @​commitlint/config-conventional

... (truncated)

Commits

• d8e3656 v21.2.4
• 95d4056 v21.2.3
• 9f5f7bc fix(rules): report the case that matched in case rule failure messages (#4962)
• d00d190 v21.2.2
• 3146d04 docs(config-conventional): document rules that go beyond the spec (#4910)
• f2e8dae chore: update dependency typescript to v7 (#4886)
• 1b4e5bc v21.2.0
• fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
• 6f1c0af v21.1.0
• 8069048 v21.0.2
• Additional commits viewable in compare view

Updates @eslint/js from 9.39.4 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

• c87d5bd fix: update eslint (#20531) (renovate[bot])
• d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
• 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
• 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

• 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
• 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
• b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

• e5c281f chore: updates for v9.39.3 release (Jenkins)
• 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
• 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
• 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
• da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
• 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

• f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
• a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
• c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
• fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
• 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
• 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
• ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
• 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
• c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
• 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
• a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
• a89059d feat!: Program range span entire source text (#20133) (Pixel998)
• 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
• f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
• aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
• f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
• 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
• 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
• 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
• 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
• f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

• bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
• 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
• 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

• 84fb885 chore: package.json update for @​eslint/js release
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
...

Description has been truncated