Skip to content

build: bump the npm-minor-and-patch group with 19 updates - #1213

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-8cd84c42cc
Closed

build: bump the npm-minor-and-patch group with 19 updates#1213
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-8cd84c42cc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 19 updates:

Package From To
eslint 10.12.0 10.13.0
turbo 2.11.8 2.11.10
js-yaml 5.4.3 5.5.0
node-html-parser 9.0.4 9.0.5
markdown-it 15.0.2 15.0.3
@posit-dev/positron 0.2.11 0.2.12
ovsx 1.2.0 1.3.0
@fluentui/react-components 9.74.9 9.74.10
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
sass 1.105.1 1.106.0
react-window 2.3.4 2.4.1
transliteration 2.6.1 2.6.2
@codemirror/autocomplete 6.20.3 6.20.4
@codemirror/view 6.43.14 6.43.15
node-sqlite3-wasm 0.8.60 0.8.61
i18next 26.4.4 26.5.3
typo-js 1.3.2 1.4.0
typescript-eslint 8.71.2 8.72.0

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
  • e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)
Commits

Updates turbo from 2.11.8 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • e521641 publish 2.11.10 to registry
  • aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
  • 9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
  • af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
  • b42cc68 chore: Remove CODEOWNERS file (#14810)
  • 921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
  • 9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
  • 6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
  • 57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
  • d926d6a fix: Match package configuration files and directory inputs in task-level aff...
  • Additional commits viewable in compare view

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

  • Updated argparse to v3.
  • Updated development dependencies.

Fixed

  • Correct percent-encoding of shorthand and verbatim tags.
  • Reject ,, ], and } at the start of block plain scalars, #801.
  • Report the exact position of non-printable characters in errors, #801.
Commits
  • cb62b2d 5.5.0 released
  • 87aed90 Deps bump
  • 3aec511 Fix error positions for non-printable characters, #801
  • 11aa483 Reject flow indicators at the start of block plain scalars, #801
  • 339d8e0 Refactor tag encoder and decoder to match the YAML specification
  • See full diff in compare view

Updates node-html-parser from 9.0.4 to 9.0.5

Changelog

Sourced from node-html-parser's changelog.

9.0.5 (2026-10-19)

Bug Fixes

  • avoid repeated scans during unclosed-tag repair (01bd548)
  • close optional table tags at section boundaries (23fe6ab)
  • keep omitted table rows and sections as siblings (461a468)
Commits
  • 42afc81 chore(release): 9.0.5
  • faea2c0 Merge pull request #323 from raymondstudio/codex/fix-unclosed-tag-repair
  • 59f2542 Merge pull request #322 from DahanItamar/fix/implied-table-end-tags
  • 01bd548 fix: avoid repeated scans during unclosed-tag repair
  • 461a468 fix: keep omitted table rows and sections as siblings
  • 23fe6ab fix: close optional table tags at section boundaries
  • See full diff in compare view

Updates markdown-it from 15.0.2 to 15.0.3

Changelog

Sourced from markdown-it's changelog.

[15.0.3] - 2026-10-16

Changed

  • Updated dependencies.

Fixed

  • Enforce the 999 Unicode code point limit for reference definition labels, partially addressing #1213.
  • Require whitespace before multiline reference titles.

Security

  • Fixed quadratic complexity when parsing multiline reference definitions.
  • Fixed quadratic complexity when parsing unclosed inline HTML comments, processing instructions, declarations and CDATA sections.
Commits

Updates @posit-dev/positron from 0.2.11 to 0.2.12

Release notes

Sourced from @​posit-dev/positron's releases.

v0.2.12

@​posit-dev/positron v0.2.12

Built against Positron 2026.10.1

Installation

npm install @posit-dev/positron@0.2.12

What's Changed

Full Changelog: posit-dev/positron-api-pkg@v0.2.11...v0.2.12

Commits

Updates ovsx from 1.2.0 to 1.3.0

Release notes

Sourced from ovsx's releases.

CLI v1.3.0

Added

  • Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
  • Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
  • Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
  • Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
  • Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
  • publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
  • Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
  • Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

  • Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

  • A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

  • Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

  • Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

  • createNamespace, verifyPat, publish and delete now send the personal access token primarily via an Authorization: Bearer header (or, when OVSX_USERNAME/OVSX_PASSWORD are set, an X-OpenVSX-Token header, since Authorization is then already in use for Basic auth to a fronting proxy), moving away from a token query parameter that gets recorded in server and reverse-proxy access logs. The CLI checks the registry's reported version (/api/version) and only still sends the token as a query parameter, alongside the header, when talking to a registry older than 1.3.0, i.e. one that predates header support - including one whose version can't be determined at all, which is treated as too old rather than assumed to be caught up; on 1.3.0 and later the header is all it sends (#1344)
  • publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
  • publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
  • Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

  • Bump fast-uri from 3.1.5 to 3.1.7
  • Bump qs from 6.15.2 to 6.16.0
  • Bump @​humanfs/node from 0.16.6 to 0.16.8
  • Bump js-yaml from 4.3.1 to 4.3.2
  • Bump nanoid from 3.3.16 to 3.3.18

Frontend Library v1.3.0

Added

  • Add a /publish page and turn the navbar's Publish button into a drop target: a file drag anywhere in the app turns the button into a drop area, and every .vsix package dropped on it — or on the publish page's own drop area — is queued and uploaded straight away, with no confirmation dialog. The page shows the queue as a line of extension cards — a skeleton while a package uploads, the real card once the registry accepts it, labelled with whatever the registry did with it — and keeps polling anything left under review or still missing its icon
  • Export PublishButton, which carries the publish link, its p shortcut and the app's .vsix drop target in one component, so a deployment with its own menu content keeps drag-and-drop publishing
  • Add a "Data Consistency" page to the admin dashboard (#1622): a live overview of every registered consistency check's finding count, with actions to refresh it and to fix findings one at a time or all at once
  • Show a "Namespace not verified" state on an extension card when it can't be activated because its namespace already exists in a referenced external gallery and hasn't been verified, in both the "My Extensions" and namespace member extension lists. The card keeps its colour and takes a warning-toned frame and icon, since this is the publisher's to fix rather than an extension that is simply switched off
  • Show a warning notice with a claim action wherever an unverified namespace is holding something back — the extension settings page when the extension has a namespace ownership conflict, and the namespace settings page for any unverified namespace — making clear the namespace must be claimed (verified) first. The action is the deployment's configured elements.claimNamespace, falling back to the namespace access documentation when none is configured. The admin dashboard's extension and namespace views show the same explanation without the claim action, since claiming is the publisher's action to take, not an admin's on someone else's behalf
  • Add a "Search Index" page to the admin dashboard: which engine answers searches, how many extensions the index holds against how many it is built from, and a button to rebuild it where there is an index to rebuild. The two counts sit side by side because an index that has quietly lost entries answers searches perfectly well, just with nothing in them, which is indistinguishable from an empty registry unless both numbers are visible at once
  • Mark a version that was published through a trusted publishing workflow with an icon next to "Published by" on the extension detail page, linking to the deployment's trusted publishing documentation. The default deployment points that link at the Trusted Publishing wiki page
  • Add a Pill component — the clickable glass pill the category pills are built on, now usable on its own — and extract the MonoSlash, glassSurface and compactControl page primitives out of the search field, the pills and the search header
  • Add userLoading to MainContext, so custom pages can tell "not logged in" from "still resolving the user"
  • Add a userMenuContent slot to PageSettings.elements: extra entries for the logged-in account menu, rendered above the admin entry. The slot receives a MenuEntry component to build entries with, so each entry is styled by the menu it appears in — the desktop and mobile menus style theirs differently, and a consumer cannot match both on its own
  • Add an adminPages slot to PageSettings.elements: extra admin dashboard pages, each declaring a name, icon, optional description and optional category, and each appearing in the side panel, as a card on the dashboard overview and as a route. Contributions are additive — a category name matching a built-in group appends to it, and a page whose path would shadow a built-in one is ignored
  • Widen the published API for consumers building their own pages: the request layer (sendRequest, sendNonRetriableRequest, ErrorResponse, controllerFromSignal), MainContext, AppProviders, NotFound, createDefaultTheme with the MONO_FONT/NAVBAR_HEIGHT tokens, the createRoute/createAbsoluteURL/addQuery/formatCompactNumber/toRelativeTime utils, the useDebouncedCallback and useGridCursor hooks, the navbar-chrome, search-focus and page-search-bar hooks, the category icon helpers, ExtensionDetailRoutes, and the itemIcon/MenuItemText building blocks for userMenuContent entries

... (truncated)

Changelog

Sourced from ovsx's changelog.

[1.3.0] - 2026-10-16

Changed

  • publish checks a package against the size limit that applies to its own namespace, which a size override can raise above the registry default, and refuses an oversized upload before sending it. Against a registry older than 1.3.0, which cannot report that limit, it warns against the default and publishes anyway; if a registry that should be able to report it does not answer, it says the check did not happen rather than passing silently (#2129)

Fixed

  • --version reads the version from package.json at runtime instead of a generated src/version.ts, so it can no longer report a stale version (#2295)
  • publish now deletes the .vsix it packages into the temp directory once publishing finishes or fails, instead of leaving one behind per package and target (#2286)
  • Drop the X-OpenVSX-Token header, which carries the personal access token when --username/--password are set, on a redirect to another origin, as is done for Authorization (#2309)
  • A request with a body that is redirected with 301/302/303 now fails with an error naming the redirect target, instead of being resent as a GET without its body (#2309)
  • Trusted publishing's OIDC ID token request now uses the registry client's request handling: it follows redirects (dropping the runner token on a redirect to another origin) and reports the token service's error message instead of only its status (#2322)
  • An HTML page in a successful response (any <!doctype html> casing, or a text/html Content-Type) now fails with an error naming the status, instead of printing the raw HTML or a JSON SyntaxError (#2326)
  • An error response whose JSON body starts with whitespace now reports the server's message instead of only its status (#2326)

Dependencies

  • Bump commander from 6.2.1 to 14.0.3; a command given more arguments than it takes now fails instead of ignoring the extras (#2294)
  • Bump @​vscode/vsce from 3.7.1 to 4.0.0 (#2288)
  • Bump vitest from 4.1.11 to 5.0.3, adding vite as a direct dev dependency - vitest 5 no longer bundles it, only requires it as a peer (#2291)
  • Remove leven; the command-suggestion distance check now uses a vendored Levenshtein implementation, the same way @vscode/vsce itself replaced its own leven dependency in 4.0.0 (#2290)
  • Remove tmp; temporary file names are now generated with crypto.randomUUID (#2284)
  • Remove follow-redirects; requests use node:http/node:https and the registry client follows redirects itself (#2309)
  • Bump ip-address from 10.4.0 to 10.7.2 (#2264)
  • Bump brace-expansion to 1.1.21, 2.1.7, 5.0.12
  • Bump markdown-it from 14.2.0 to 14.3.2 (#2281)
Commits
  • e0b958f chore: prepare for cli 1.3.0 release
  • 106e81b docs: tidy the 1.3.0 release notes (#2344)
  • 5d26c73 docs: use Keep a Changelog headings in all change logs (#2343)
  • 5f2de6f fix(cli): handle HTML and whitespace-prefixed JSON responses (#2326)
  • fc539ff fix(cli): share registry request handling with OIDC (#2322)
  • 418cf1a chore(cli): use stream/consumers buffer() in readZip (#2319)
  • 729edb9 chore(cli): replace util fs callback wrappers with fs.promises (#2310)
  • bf689ad chore(cli): replace follow-redirects with node:http (#2309)
  • f8b2c5c chore(deps): bump commander from 6.2.1 to 14.0.3 in cli (#2294)
  • a81414a fix(cli): read the version from package.json at runtime (#2295)
  • Additional commits viewable in compare view
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @fluentui/react-components from 9.74.9 to 9.74.10

Commits

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates sass from 1.105.1 to 1.106.0

Release notes

Sourced from sass's releases.

Dart Sass 1.106.0

To install Sass 1.106.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Don't normalize CSS escapes in statement contexts that can contain interpolation. For example, @f\6Fo is now emitted as written rather than normalized to @foo.

  • Fix a bug where quotes would be removed from attribute selector values that contained backslashes.

  • Fix invalid source spans that could cause crashes when encountering a syntax error in selectors or media queries that also contain escape sequences.

  • Fix a bug where the indented syntax parser would crash when parsing a file where the first statement was indented and appeared after the first line.

  • Fix a bug that could cause crashes when encountering errors or warnings in interpolations that contain patterns like // */.

  • Potentially breaking compatibility fix: CSS escape codes whose values are 0, for Unicode surrogates, or greater than the maximum allowed code point are now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression contexts. Previously, in some cases these were instead normalized to the normalized form of the original escape sequence, which violates the principle that all escape sequences for identical values should be normalized the same way. In other cases, these would simply throw errors.

    As a special case, \0 on its own will continue to be normalized to \0 to support historical CSS hacks.

  • Potentially breaking bug fix: Throw an error for mixins and functions that have rest parameters which are the same as normal parameters. Previously, the positional parameters wouldn't be accessible and calling such a mixin or function with a named argument would crash the compiler.

  • Potentially breaking bug fix: Fix various cases where using a CSS escape code at the beginning of an identifier would change parsing behavior versus using the character directly.

  • Potentially breaking bug fix: When a number's unit is ambiguous with a numeric exponent, the unit is now serialized as an escape code rather than a literal e to avoid being interpreted as an exponent by CSS.

  • Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in @keyframes percentage selectors.

  • Potentially breaking bug fix: Properly normalize underscores written as CSS escape codes in variable, mixin, and function names.

See the full changelog for changes in earlier releases.

Dart Sass 1.105.2

To install Sass 1.105.2, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Node.js Embedded Host

  • Fix a deadlock when the async compiler fails to start.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.106.0

  • Don't normalize CSS escapes in statement contexts that can contain interpolation. For example, @f\6Fo is now emitted as written rather than normalized to @foo.

  • Fix a bug where quotes would be removed from attribute selector values that contained backslashes.

  • Fix invalid source spans that could cause crashes when encountering a syntax error in selectors or media queries that also contain escape sequences.

  • Fix a bug where the indented syntax parser would crash when parsing a file where the first statement was indented and appeared after the first line.

  • Fix a bug that could cause crashes when encountering errors or warnings in interpolations that contain patterns like // */.

  • Potentially breaking compatibility fix: CSS escape codes whose values are 0, for Unicode surrogates, or greater than the maximum allowed code point are now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression contexts. Previously, in some cases these were instead normalized to the normalized form of the original escape sequence, which violates the principle that all escape sequences for identical values should be normalized the same way. In other cases, these would simply throw errors.

    As a special case, \0 on its own will continue to be normalized to \0 to support historical CSS hacks.

  • Potentially breaking bug fix: Throw an error for mixins and functions that have rest parameters which are the same as normal parameters. Previously, the positional parameters wouldn't be accessible and calling such a mixin or function with a named argument would crash the compiler.

  • Potentially breaking bug fix: Fix various cases where using a CSS escape code at the beginning of an identifier would change parsing behavior versus using the character directly.

  • Potentially breaking bug fix: When a number's unit is ambiguous with a numeric exponent, the unit is now serialized as an escape code rather than a literal e to avoid being interpreted as an exponent by CSS.

  • Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in @keyframes percentage selectors.

  • Potentially breaking bug fix: Properly normalize underscores written as CSS escape codes in variable, mixin, and function names.

1.105.2

... (truncated)

Commits
  • 2ea4fc0 Merge pull request #2883 from sass/fuzz
  • a113995 Bump postcss from 8.5.28 to 8.5.30 in /pkg/sass-parser (#2886)
  • 2d2e76c Try using the SassBot GitHub token when auto-merging dependabot PRs (#2885)
  • 5660824 Improve the accuracy of FileSpan.trimLeft() and .trimRight()
  • 09e4024 Throw an error for duplicate rest and non-rest parameter names
  • 34c8e6b Fix check for an indented first statement
  • a05866c Make _expandInterpolationLeft resilient to commented-out comments
  • 91fd60b Only normalize escapes at the expression level (#2880)
  • 00a0d79 Add a changelog entry for sass/embedded-host-node#449 (#2882)
  • 83fdf35 Fix the git pr merge invocation in GitHUb actions (#2881)
  • Additional commits viewable in compare view

Updates react-window from 2.3.4 to 2.4.1

Release notes

Sourced from react-window's releases.

2.4.1

  • Fix performance issues for fixed-size rows or columns with a size of 0 (e.g. a percentage size before the container has been measured). Rendering no longer computes and caches bounds for every item, and only the first item is rendered (previously the last items were rendered, or every item if the scroll offset was negative). Invalid sizes (e.g. "abc%" or negative values) are treated as 0. - #923

2.4.0

Server rendering improvements:

Features

  • Add defaultScrollOffset prop to List and defaultScrollLeft/defaultScrollTop props to Grid for setting the initial scroll position. Server-rendered HTML can't be pre-scrolled, so server rendering starts at the first row and the default scroll offset is applied when the component hydrates (unless the browser has already restored a scroll position). For lists and grids that are initially empty (e.g. while data is loading), the offset is applied once they have rows.
  • Add initialRowHeights option to useDynamicRowHeight for providing row heights that are known or can be estimated ahead of time (e.g. during server rendering).
  • Add a server rendering page to the docs site.

Bug fixes

  • Server-rendered rows with dynamic heights are now displayed in normal document flow until they have been measured, rather than being positioned using estimated heights (which caused rows to overlap or leave gaps until after hydration).
  • Fix List and Grid logging useLayoutEffect warnings when server rendered with React 18.
  • Fix getScrollbarSize throwing when called during server rendering; it now returns 0.
Changelog

Sourced from react-window's changelog.

2.4.1

  • Fix performance issues for fixed-size rows or columns with a size of 0 (e.g. a percentage size before the container has been measured). Rendering no longer computes and caches bounds for every item, and only the first item is rendered (previously the last items were rendered, or every item if the scroll offset was negative). Invalid sizes (e.g. "abc%" or negative values) are treated as 0. - #923

2.4.0

Server rendering improvements:

Features

  • Add defaultScrollOffset prop to List and defaultScrollLeft/defaultScrollTop props to Grid for setting the initial scroll position. Server-rendered HTML can't be pre-scrolled, so server rendering starts at the first row and the default scroll offset is applied when the component hydrates (unless the browser has already restored a scroll position). For lists and grids that are initially empty (e.g. while data is loading), the offset is applied once they have rows.
  • Add initialRowHeights option to useDynamicRowHeight for providing row heights that are known or can be estimated ahead of time (e.g. during server rendering).
  • Add a server rendering page to the docs site.

Bug fixes

  • Server-rendered rows with dynamic heights are now displayed in normal document flow until they have been measured, rather than being positioned using estimated heights (which caused rows to overlap or leave gaps until after hydration).
  • Fix List and Grid logging useLayoutEffect warnings when server rendered with React 18.
  • Fix getScrollbarSize throwing when called during server rendering; it now returns 0.
Commits

@dependabot
build: bump the npm-minor-and-patch group with 19 updates
6249479 
Bumps the npm-minor-and-patch group with 19 updates:

| Package | From | To |
| --- | --- | --- |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.8` | `2.11.10` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `5.4.3` | `5.5.0` |
| [node-html-parser](https://github.com/taoqf/node-fast-html-parser) | `9.0.4` | `9.0.5` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `15.0.2` | `15.0.3` |
| [@posit-dev/positron](https://github.com/posit-dev/positron-api-pkg/tree/HEAD/positron-api-pkg) | `0.2.11` | `0.2.12` |
| [ovsx](https://github.com/eclipse-openvsx/openvsx/tree/HEAD/cli) | `1.2.0` | `1.3.0` |
| [@fluentui/react-components](https://github.com/microsoft/fluentui) | `9.74.9` | `9.74.10` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [sass](https://github.com/sass/dart-sass) | `1.105.1` | `1.106.0` |
| [react-window](https://github.com/bvaughn/react-window) | `2.3.4` | `2.4.1` |
| [transliteration](https://github.com/yf-hk/transliteration) | `2.6.1` | `2.6.2` |
| [@codemirror/autocomplete](https://github.com/codemirror/autocomplete) | `6.20.3` | `6.20.4` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.14` | `6.43.15` |
| [node-sqlite3-wasm](https://github.com/tndrle/node-sqlite3-wasm) | `0.8.60` | `0.8.61` |
| [i18next](https://github.com/i18next/i18next) | `26.4.4` | `26.5.3` |
| [typo-js](https://github.com/cfinke/Typo.js) | `1.3.2` | `1.4.0` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.2` | `8.72.0` |


Updates `eslint` from 10.12.0 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.13.0)

Updates `turbo` from 2.11.8 to 2.11.10
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.8...v2.11.10)

Updates `js-yaml` from 5.4.3 to 5.5.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.4.3...5.5.0)

Updates `node-html-parser` from 9.0.4 to 9.0.5
- [Release notes](https://github.com/taoqf/node-fast-html-parser/releases)
- [Changelog](https://github.com/taoqf/node-html-parser/blob/main/CHANGELOG.md)
- [Commits](taoqf/node-html-parser@v9.0.4...v9.0.5)

Updates `markdown-it` from 15.0.2 to 15.0.3
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@15.0.2...15.0.3)

Updates `@posit-dev/positron` from 0.2.11 to 0.2.12
- [Release notes](https://github.com/posit-dev/positron-api-pkg/releases)
- [Commits](https://github.com/posit-dev/positron-api-pkg/commits/v0.2.12/positron-api-pkg)

Updates `ovsx` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/eclipse-openvsx/openvsx/releases)
- [Changelog](https://github.com/eclipse-openvsx/openvsx/blob/main/cli/CHANGELOG.md)
- [Commits](https://github.com/eclipse-openvsx/openvsx/commits/v1.3.0/cli)

Updates `@fluentui/react-components` from 9.74.9 to 9.74.10
- [Release notes](https://github.com/microsoft/fluentui/releases)
- [Commits](https://github.com/microsoft/fluentui/commits)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `sass` from 1.105.1 to 1.106.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.105.1...1.106.0)

Updates `react-window` from 2.3.4 to 2.4.1
- [Release notes](https://github.com/bvaughn/react-window/releases)
- [Changelog](https://github.com/bvaughn/react-window/blob/main/CHANGELOG.md)
- [Commits](bvaughn/react-window@2.3.4...2.4.1)

Updates `transliteration` from 2.6.1 to 2.6.2
- [Release notes](https://github.com/yf-hk/transliteration/releases)
- [Changelog](https://github.com/yf-hk/transliteration/blob/main/CHANGELOG.md)
- [Commits](yf-hk/transliteration@v2.6.1...v2.6.2)

Updates `@codemirror/autocomplete` from 6.20.3 to 6.20.4
- [Changelog](https://github.com/codemirror/autocomplete/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/autocomplete/commits)

Updates `@codemirror/view` from 6.43.14 to 6.43.15
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `node-sqlite3-wasm` from 0.8.60 to 0.8.61
- [Release notes](https://github.com/tndrle/node-sqlite3-wasm/releases)
- [Commits](tndrle/node-sqlite3-wasm@v0.8.60...v0.8.61)

Updates `i18next` from 26.4.4 to 26.5.3
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.4.4...v26.5.3)

Updates `typo-js` from 1.3.2 to 1.4.0
- [Commits](https://github.com/cfinke/Typo.js/commits)

Updates `typescript-eslint` from 8.71.2 to 8.72.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: turbo
  dependency-version: 2.11.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: js-yaml
  dependency-version: 5.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: node-html-parser
  dependency-version: 9.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: markdown-it
  dependency-version: 15.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@posit-dev/positron"
  dependency-version: 0.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: ovsx
  dependency-version: 1.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@fluentui/react-components"
  dependency-version: 9.74.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: sass
  dependency-version: 1.106.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: react-window
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: transliteration
  dependency-version: 2.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@codemirror/autocomplete"
  dependency-version: 6.20.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: node-sqlite3-wasm
  dependency-version: 0.8.61
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: i18next
  dependency-version: 26.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: typo-js
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 28, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 28, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-and-patch-8cd84c42cc branch October 28, 2026 15:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants