chore(deps): Update @eslint/js all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/js (source)	9.39.4 → 9.39.5
@formatjs/intl-localematcher	0.8.10 → 0.8.11
@types/node (source)	25.9.4 → 25.9.5
@vitest/coverage-v8 (source)	4.1.9 → 4.1.10
@xyflow/react (source)	12.11.1 → 12.11.2
bonjour-service	1.4.2 → 1.4.3
eslint (source)	9.39.4 → 9.39.5
lucide-react (source)	1.23.0 → 1.24.0
mqtt	5.15.1 → 5.15.2
pnpm (source)	10.34.4 → 10.34.5
recharts	3.9.1 → 3.9.2
semantic-release	25.0.5 → 25.0.6
typescript-eslint (source)	8.62.1 → 8.63.0
vitest (source)	4.1.9 → 4.1.10

---

Release Notes

eslint/eslint (@​eslint/js)

v9.39.5

Compare Source

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

xyflow/xyflow (@​xyflow/react)

v12.11.2

Compare Source

Patch Changes

• #​5825 5072914 - Only create an XYDrag instance for draggable nodes.

• #​5847 742860c - Stop the MiniMap from re-rendering on every store update.

• #​5846 17c64a1 - Apply the viewport pan/zoom transform imperatively so the Viewport component only renders once.

• Updated dependencies [c707267, 0c0cebc, 56cf3b0, a01bb6b, 9b3f390, cdfcbeb]:

  • @​xyflow/system@​0.0.79

onlxltd/bonjour-service (bonjour-service)

v1.4.3

Compare Source

Full Changelog: onlxltd/bonjour-service@1.4.2...1.4.3

Update for index.ts to fix imports #​79
Thanks to @​andersk & @​Nerivec for their work identifying this issue.

eslint/eslint (eslint)

v9.39.5

Compare Source

lucide-icons/lucide (lucide-react)

v1.24.0: Version 1.24.0

Compare Source

What's Changed

• fix(scripts): fix typo in renameIcon.function.mts by @​karsa-mistmere in #​4514
• chore(icons): remove toBeRemovedInVersion metadata and make it optional in schema by @​ericfennis with @​Copilot in #​4513
• feat(site): Add merch link by @​ericfennis in #​4524
• fix(packages/angular): move child rendering logic to template from effect by @​karsa-mistmere in #​4519
• docs(site): list @​gyeonghokim/lucide-lit as third-party package by @​GyeongHoKim in #​4421
• fix(icons): changed option icon by @​jamiemlaw in #​4326
• fix(lucide-react-native): restore the icons entry point in the JS bundles by @​pvinis in #​4528
• fix(vue): support kebab-case icon-node prop on Icon component by @​Sagargupta16 in #​4512
• fix(lucide-react-native): Add icon exports property to the package.json file by @​ericfennis in #​4522
• fix(icons): centered the dot icon by @​cnlancehu in #​4492
• feat(icons): added circle-euro-sign icon by @​Guido3000 in #​4353
• feat(icons): added server-plus icon by @​Turboman3000 in #​4232

New Contributors

• @​ericfennis with @​Copilot made their first contribution in #​4513
• @​GyeongHoKim made their first contribution in #​4421
• @​pvinis made their first contribution in #​4528
• @​Sagargupta16 made their first contribution in #​4512
• @​Guido3000 made their first contribution in #​4353
• @​Turboman3000 made their first contribution in #​4232

Full Changelog: lucide-icons/lucide@1.23.0...1.24.0

mqttjs/MQTT.js (mqtt)

v5.15.2

Compare Source

Bug Fixes

• connect/tls: don't overwrite an explicit servername (SNI) (#​2051) (cd1d780)
• support relative WebSocket URLs (#​2049) (c4be563), closes #​2035

pnpm/pnpm (pnpm)

v10.34.5

Compare Source

recharts/recharts (recharts)

v3.9.2

Compare Source

What's Changed

• docs: clarify custom labels and ticks need SVG elements by @​ishaanlabs-gg in #​7524
• chore(deps): bump immer from 11.1.8 to 11.1.9 by @​dependabot[bot] in #​7526
• fix(Sankey): avoid exponential depth traversal on dense graphs by @​dm-gthb in #​7479

New Contributors

• @​ishaanlabs-gg made their first contribution in #​7524
• @​dm-gthb made their first contribution in #​7479

Full Changelog: recharts/recharts@v3.9.1...v3.9.2

semantic-release/semantic-release (semantic-release)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.63.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

🛏️ Beam this PR onto a sleepypod ✨

Pick the snippet that matches your pod. Already-installed pods can't use the curl bootstraps below — sleepypod's egress firewall DROPs github.com, and the script that knows how to unblock WAN is the very file curl is trying to fetch. Use sp-update instead; it's on disk and opens WAN as its first step.

🔄 Already on a sleepypod (most common — review a PR on a running pod):

sudo sp-update renovate/all-minor-patch

🚀 Fresh pod / first install — bootstraps from GitHub, rebuilds every push:

curl -fsSL https://raw.githubusercontent.com/sleepypod/core/renovate/all-minor-patch/scripts/install \
  | sudo bash -s -- --branch renovate/all-minor-patch

🎯 Pin to this exact build (run 29301944338 · 3f1e4b4) — fresh-pod path, locked to one CI artifact for reproducible review:

curl -fsSL https://raw.githubusercontent.com/sleepypod/core/3f1e4b4e7b89ca6e107058578cff41dbf59da72d/scripts/install \
  | sudo bash -s -- \
      --branch renovate/all-minor-patch \
      --artifact-url 'https://nightly.link/sleepypod/core/actions/runs/29301944338/sleepypod-core.zip'

🧊 Artifact: sleepypod-core · self-destructs in 30 days 💥

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!