Update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@changesets/changelog-github (source)	^0.6.0 → ^0.7.0			devDependencies	minor
@eslint/eslintrc	3.3.5 → 3.3.6			pnpm.catalog.eslint	patch
@next/mdx (source)	16.2.2 → 16.2.10			dependencies	patch
@turbo/gen (source)	2.9.3 → 2.10.5			devDependencies	minor
@types/mdx (source)	2.0.13 → 2.0.14			devDependencies	patch
@types/react (source)	19.2.14 → 19.2.17			devDependencies	patch
@vitest/coverage-v8 (source)	4.1.2 → 4.1.10			pnpm.catalog.default	patch
changesets/action	v1.5.3 → v1.9.0			action	minor
eslint-config-next (source)	16.1.2 → 16.2.10			pnpm.catalog.eslint	minor
eslint-config-next (source)	16.2.2 → 16.2.10			devDependencies	patch
eslint-config-turbo (source)	2.9.3 → 2.10.5			pnpm.catalog.eslint	minor
eslint-plugin-prettier	5.5.5 → 5.5.6			pnpm.catalog.eslint	patch
lucide-react (source)	1.7.0 → 1.24.0			dependencies	minor	1.25.0
next (source)	16.2.2 → 16.2.10			dependencies	patch
prettier (source)	3.8.1 → 3.9.5			devDependencies	minor
prettier-plugin-tailwindcss	0.7.2 → 0.8.1			devDependencies	minor
react (source)	19.2.4 → 19.2.7			dependencies	patch
react-dom (source)	19.2.4 → 19.2.7			dependencies	patch
rehype-pretty-code (source)	0.14.3 → 0.14.4			dependencies	patch
sharp (source, changelog)	^0.34.5 → ^0.35.0			dependencies	minor
styfle/cancel-workflow-action	0.13.0 → 0.13.1			action	patch
turbo (source)	2.9.3 → 2.10.5			devDependencies	minor
typescript-eslint (source)	8.58.0 → 8.64.0			pnpm.catalog.eslint	minor
vitest (source)	4.1.2 → 4.1.10			pnpm.catalog.default	patch
zod (source)	4.3.5 → 4.4.3			pnpm.catalog.default	minor

---

Release Notes

changesets/changesets (@​changesets/changelog-github)

v0.7.0

Compare Source

Minor Changes

• #​1255 94578cf Thanks @​Kauhsa! - Added disableThanks option

eslint/eslintrc (@​eslint/eslintrc)

v3.3.6

Compare Source

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#​235) (0c5de74)

vercel/next.js (@​next/mdx)

v16.2.10

Compare Source

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

v16.2.9

Compare Source

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Compare Source

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#​93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#​93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#​93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#​93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#​93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#​93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#​93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#​94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#​94050)
• [backport] Propagate adapter preferred regions (#​94200)
• [16.2.x] Don't drop FormData entries (#​94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#​94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

v16.2.6

Compare Source

[!NOTE]
This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#​92231)
• Fix fallback route params case in app-page handler (#​91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#​91541)
• Patch setHeader for direct route handlers (#​93101)
• Include deployment id in cacheHandlers keys (#​93453)
• Fix double-encoding of URL pathname parts in client param parsing (#​93491)

v16.2.5

Compare Source

[!NOTE]
This release contains security fixes and backported bug fixes. It does not include all pending features/changes on canary.

Security Fixes

The following advisories have been addressed:

High:

• GHSA-8h8q-6873-q5fj: Denial of Service with Server Components
• GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
• GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components
• GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection
• GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades
• GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

• GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces
• GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input
• GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API
• GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

• GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting
• GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

Core Changes

• fix: preserve HTTP access fallbacks during prerender recovery (#​92231)
• Fix fallback route params case in app-page handler (#​91737)
• Fix invalid HTML response for route-level RSC requests in deployment adapter (#​91541)
• Patch setHeader for direct route handlers (#​93101)
• Include deployment id in cacheHandlers keys (#​93453)
• Fix double-encoding of URL pathname parts in client param parsing (#​93491)

v16.2.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• chore: Bump reqwest to 0.13.2 (Fixes Google Fonts with Turbopack for Windows on ARM64) (#​92713)
• Turbopack: fix filesystem watcher config not applying follow_symlinks(false) (#​92631)
• Scope Safari ?ts= cache-buster to CSS/font assets only (Pages Router) (#​92580)
• Compiler: Support boolean and number primtives in next.config defines (#​92731)
• turbo-tasks: Fix recomputation loop by allowing cell cleanup on error during recomputation (#​92725)
• Turbopack: shorter error for ChunkGroupInfo::get_index_of (#​92814)
• Turbopack: shorter error message for ModuleBatchesGraph::get_entry_index (#​92828)
• Adding more system info to the 'initialize project' trace (#​92427)

Credits

Huge thanks to @​Badbird5907, @​lukesandberg, @​andrewimm, @​sokra, and @​mischnic for helping!

v16.2.3

Compare Source

[!NOTE]
This release is backporting security and bug fixes. For more information about the fixed security vulnerability, please see https://vercel.com/changelog/summary-of-cve-2026-23869. The release does not include all pending features/changes on canary.

Core Changes

• Ensure app-page reports stale ISR revalidation errors via onRequestError (#​92282)
• Fix [Bug]: manifest.ts breaks HMR in Next.js 16.2 (#​91981 through #​92273)
• Deduplicate output assets and detect content conflicts on emit (#​92292)
• Fix styled-jsx race condition: styles lost due to concurrent rendering (#​92459)
• turbo-tasks-backend: stability fixes for task cancellation and error handling (#​92254)

Credits

Huge thanks to @​icyJoseph, @​sokra, @​wbinnssmith, @​eps1lon and @​ztanner for helping!

vercel/turborepo (@​turbo/gen)

v2.10.5: Turborepo v2.10.5

Compare Source

What's Changed

Changelog

• perf: Evaluate simple include globs without wax compilation by @​anthonyshew in #​13285
• chore: Dogfood native Cargo support in this repository by @​anthonyshew in #​13283
• release(turborepo): 2.10.4 by @​github-actions[bot] in #​13286
• ci: Remove dead sccache configuration by @​anthonyshew in #​13289
• feat: Serve the Remote Cache as an sccache backend for Cargo tasks by @​anthonyshew in #​13288
• fix: Reject output path traversal by @​anthonyshew in #​13290
• fix: Disable the sccache proxy when remote cache use is off by @​anthonyshew in #​13291
• feat: Embed sccache so the Cargo compile cache needs no installation by @​anthonyshew in #​13293
• release(turborepo): 2.10.5-canary.1 by @​github-actions[bot] in #​13294
• fix: Pin a flag-aware turbo canary for the eve-agent deployment by @​anthonyshew in #​13295
• fix: Make the sccache compile cache actually cache by @​anthonyshew in #​13296
• release(turborepo): 2.10.5-canary.2 by @​github-actions[bot] in #​13297
• fix: Stop ambient CARGO_INCREMENTAL from suppressing compile cache injection by @​anthonyshew in #​13298
• fix: Never let compile cache storage failures fail the build by @​anthonyshew in #​13299
• test: Add outputs path-traversal negative-case regression tests by @​dnukumamras in #​13300
• release(turborepo): 2.10.5-canary.3 by @​github-actions[bot] in #​13302
• ci: Authenticate to Remote Cache via OIDC token exchange by @​anthonyshew in #​13303
• fix: Keep pnpm patches with version range keys during prune by @​anthonyshew in #​13307
• test: Scrub ambient turbo configuration from integration test children by @​anthonyshew in #​13306
• fix: Show toolchain tasks in the TUI and never run in silence by @​anthonyshew in #​13308
• ci: Fix change detection on push events by @​anthonyshew in #​13304
• refactor: Rename the Cargo toolchain id to rust by @​anthonyshew in #​13311
• fix: Remove extraneous bun.lock entries during prune by @​anthonyshew in #​13317
• feat: Require a user-declared name for the Cargo workspace package by @​anthonyshew in #​13312
• feat: Parse and validate the task command field by @​anthonyshew in #​13313
• chore: Harden turbo-vsc to invoke turbo without a shell by @​dnukumamras in #​13319
• feat: Resolve and execute task command overrides by @​anthonyshew in #​13315
• release(turborepo): 2.10.5-canary.4 by @​github-actions[bot] in #​13325
• feat: Run the Rust workspace tests through nextest via command override by @​anthonyshew in #​13316
• feat: Engage the Remote Cache and sccache compile cache for Rust CI by @​anthonyshew in #​13292
• ci: Pin GitHub Actions to full commit SHAs by @​XananasX7 in #​13143
• fix: Make npm prune rehoisting deterministic and complete by @​anthonyshew in #​13323
• feat: Report incremental cache reuse in the run summary by @​anthonyshew in #​13327
• chore: Remove planning docs by @​anthonyshew in #​13329
• docs: Migrate docs site to @​vercel/geistdocs package by @​molebox in #​13320
• ci: Update Remote Cache action by @​anthonyshew in #​13330
• release(turborepo): 2.10.5-canary.5 by @​github-actions[bot] in #​13331
• ci: Remove path-based workflow scheduling by @​anthonyshew in #​13332
• fix: Resolve EADDRINUSE in kitchen-sink api dev script by @​ashusnapx in #​13328
• ci: Disable telemetry messages in workflows by @​anthonyshew in #​13334
• fix: Prevent Cargo run tasks from being cached by @​anthonyshew in #​13335
• fix: Isolate Cargo cache by host platform by @​anthonyshew in #​13337
• fix: Continue TUI text selection beyond viewport by @​anthonyshew in #​13338
• ci: Dogfood Cargo target restoration by @​anthonyshew in #​13336
• fix: Require current Cargo lockfiles for caching by @​anthonyshew in #​13339
• fix: Reject unsupported Cargo local packages by @​anthonyshew in #​13340
• fix: Allow outputs outside package roots by @​anthonyshew in #​13342
• fix: Resolve Cargo lock dependencies by source by @​anthonyshew in #​13343
• docs: Update Cargo workspace support by @​anthonyshew in #​13349
• fix: Build Ghostty for baseline CPUs by @​anthonyshew in #​13352
• fix: Preserve watch rerun semantics for task inputs by @​anthonyshew in #​13351
• fix: Isolate Command Overrides From Toolchain Cache I/O by @​anthonyshew in #​13354
• release(turborepo): 2.10.5-canary.6 by @​github-actions[bot] in #​13355
• fix: Include patched Ghostty crate in Cargo workspace by @​anthonyshew in #​13357
• ci: Shard Rust tests across runners by @​anthonyshew in #​13356
• fix: Hash Cargo build environment inputs by @​anthonyshew in #​13348
• fix: Synchronize Cargo prune Docker lockfile by @​anthonyshew in #​13350
• chore: Update agents app Eve dependency by @​anthonyshew in #​13364
• fix: Preserve Yarn package extension ranges when pruning by @​anthonyshew in #​13363
• refactor: Add Toolchain output availability by @​anthonyshew in #​13360

New Contributors

• @​dnukumamras made their first contribution in #​13300
• @​XananasX7 made their first contribution in #​13143
• @​ashusnapx made their first contribution in #​13328

Full Changelog: vercel/turborepo@v2.10.4...v2.10.5

v2.10.4: Turborepo v2.10.4

Compare Source

What's Changed

Changelog

• release(turborepo): 2.10.3 by @​github-actions[bot] in #​13222
• ci: Retry Windows nextest aborts from transient 0xc0000142 spawn failures by @​anthonyshew in #​13240
• perf: Use mimalloc as the global allocator by @​anthonyshew in #​13237
• perf: Parse yarn v1 lockfiles in a single pass by @​anthonyshew in #​13241
• ci: Fix cache outputs for Eve app by @​anthonyshew in #​13243
• perf: Stop materializing spans for the disabled daemon log layer by @​anthonyshew in #​13244
• fix: Keep ancestor-scoped bun dependencies resolvable after prune renames by @​anthonyshew in #​13236
• perf: Overlap external dependency hashing with package file hashing by @​anthonyshew in #​13234
• perf: Build tracked repo index concurrently with package graph by @​anthonyshew in #​13232
• perf: Release tokio runtime at exit so background DNS lookups never stall the user by @​anthonyshew in #​13231
• perf: Overhaul pnpm lockfile parsing and dependency closure computation by @​anthonyshew in #​13228
• feat: Add futureFlags.experimentalCargoWorkspaces flag (no-op) by @​anthonyshew in #​13227
• feat: Introduce toolchain provider abstraction by @​anthonyshew in #​13235
• perf: Parse Berry lockfiles in a single pass by @​anthonyshew in #​13242
• fix: Apply input exclusion globs to the filesystem walk by @​anthonyshew in #​13224
• fix: Stop root-directory packages from claiming every file in change mapping by @​anthonyshew in #​13225
• chore: Rename turborepo-repository napi package to @​turbo/repository by @​anthonyshew in #​13226
• perf: Hash git blobs with hardware-accelerated SHA-1 by @​anthonyshew in #​13245
• release(turborepo): 2.10.4-canary.1 by @​github-actions[bot] in #​13247
• feat: Discover Cargo crates as packages by @​anthonyshew in #​13248
• perf: Reuse per-package external dependency hashes in run summaries by @​anthonyshew in #​13249
• perf: Stat workspace turbo.json files concurrently during discovery by @​anthonyshew in #​13251
• chore: Add tracing spans to workspace discovery and globwalk phases by @​anthonyshew in #​13252
• fix: Avoid non-reentrant libc calls in concurrent shutdown process scans by @​anthonyshew in #​13256
• perf: Memoize resolved task definitions during engine construction by @​anthonyshew in #​13257
• perf: Compute transitive closures and external dependency hashes concurrently with run setup by @​anthonyshew in #​13250
• perf: Probe microfrontends configs in parallel by @​anthonyshew in #​13262
• feat: Execute Cargo crate tasks via cargo by @​anthonyshew in #​13261
• perf: Pre-size engine task collections by @​anthonyshew in #​13265
• feat: Expose resolved experimentalCI task configuration in turbo query by @​anthonyshew in #​13264
• feat: Derive input and output globs for Cargo tasks by @​anthonyshew in #​13263
• perf: Parse large pnpm lockfile sections in parallel by @​anthonyshew in #​13266
• feat: Hash Cargo external dependencies per-crate by @​anthonyshew in #​13267
• ci: Install pnpm 10 in musl containers for Library Release by @​anthonyshew in #​13269
• ci: Force pnpm overwrite in Library Release musl containers by @​anthonyshew in #​13270
• perf: Defer the untracked-scan barrier to first file-hash use by @​anthonyshew in #​13268
• ci: Fetch API-created commit before updating local ref by @​anthonyshew in #​13271
• release(library): 0.0.1-canary.22 by @​github-actions[bot] in #​13272
• perf: Remove lock and dispatch overhead from task hash precomputation by @​anthonyshew in #​13273
• fix: Fall back to lockfile detection in @​turbo/repository when package manager is undeclared by @​anthonyshew in #​13275
• test: Add end-to-end coverage for Cargo workspaces by @​anthonyshew in #​13274
• release(library): 0.0.1-canary.23 by @​github-actions[bot] in #​13276
• release(turborepo): 2.10.4-canary.2 by @​github-actions[bot] in #​13278
• fix: Collapse nested package-manager fallback conditional by @​anthonyshew in #​13279
• feat: Make turbo watch Cargo-aware by @​anthonyshew in #​13280
• perf: Skip dependency-closure assembly for toolchains that derive nothing by @​anthonyshew in #​13277
• feat: Make turbo prune Cargo-aware by @​anthonyshew in #​13281
• fix: Raise the open-file soft limit at startup by @​anthonyshew in #​13282
• fix: Stop flagging relative imports that resolve into node_modules in boundaries by @​anthonyshew in #​13284

Full Changelog: vercel/turborepo@v2.10.3...v2.10.4

v2.10.3: Turborepo v2.10.3

Compare Source

What's Changed

Changelog

• feat: Add nub to create-turbo options by @​anthonyshew in #​13173
• release(turborepo): 2.10.2 by @​github-actions[bot] in #​13174
• release(turborepo): 2.10.3-canary.1 by @​github-actions[bot] in #​13176
• fix: Normalize package manager versions by @​anthonyshew in #​13177
• fix: Use singular workspace in package resolution error by @​anthonyshew in #​13178
• fix: Support nub native lockfiles by @​anthonyshew in #​13179
• perf(build): Enable thin LTO + codegen-units=1 for release builds by @​lukesandberg in #​13160
• release(turborepo): 2.10.3-canary.2 by @​github-actions[bot] in #​13181
• feat: Add aube package manager support by @​anthonyshew in #​13183
• release(turborepo): 2.10.3-canary.3 by @​github-actions[bot] in #​13184
• fix: Normalize package manager version output by @​anthonyshew in #​13185
• release(turborepo): 2.10.3-canary.4 by @​github-actions[bot] in #​13186
• refactor: Richer internal dependency data by @​anthonyshew in #​13188
• fix(repository): honor semver ranges in devEngines.packageManager.version by @​colinhacks in #​13189
• fix: Skip node_modules in boundaries checks by @​anthonyshew in #​13191
• fix: Add token exchange recovery guidance by @​anthonyshew in #​13192
• feat: Add --production flag to turbo prune by @​anthonyshew in #​13190
• release(turborepo): 2.10.3-canary.5 by @​github-actions[bot] in #​13193
• feat: Accept Bun lockfile version 2 by @​tsushanth in #​13119
• fix: Handle task executor join errors as internal errors by @​gwagjiug in #​13148
• fix: Tweaks for nub support by @​colinhacks in #​13187
• release(turborepo): 2.10.3-canary.6 by @​github-actions[bot] in #​13194
• release(turborepo): 2.10.3-canary.7 by @​github-actions[bot] in #​13195
• chore: Upgrade TypeScript to 7.0.1-rc by @​anthonyshew in #​13144
• docs: Add filtered installs to Vercel guide by @​anthonyshew in #​13196
• examples: add with-mcp-servers by @​Nishant-Chaudhary5338 in #​12997
• fix: Report malformed JSON parse errors instead of panicking by @​anthonyshew in #​13198
• fix: Improve error messaging when platform binary is missing by @​anthonyshew in #​13199
• release(turborepo): 2.10.3-canary.8 by @​github-actions[bot] in #​13200
• fix(watch): Recover from slow initial hash instead of timing out by @​lukesandberg in #​13159
• chore: Update vitest example to vitest 4 and use native test merging by @​abhiaagarwal in #​13202
• feat: Toggle between the TUI and streamed logs by @​anthonyshew in #​13203
• fix: Resolve Bun scoped package deps that share a name with a dependency by @​anthonyshew in #​13207
• feat: Select tasks by clicking rows in the TUI task list by @​anthonyshew in #​13206
• perf: Avoid deep-cloning dependency maps in lockfile closure cache by @​anthonyshew in #​13209
• perf: Cache root internal dependencies in package graph by @​anthonyshew in [#​13211](

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 98046ee

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ts-ghost-docs	Ready	Preview, Comment	Jul 18, 2026 12:40pm

[greptile-apps]

Required label not found on this PR.