Update Routine updates

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@convex-dev/rate-limiter	^0.3.0 → ^0.4.0			dependencies	minor	0.4.1
@convex-dev/workpool (source)	0.4.10 → 0.4.13			dependencies	patch
@eslint/eslintrc	3.3.6 → 3.3.7			devDependencies	patch
@types/node (source)	24.13.3 → 24.19.1			devDependencies	minor
@types/react (source)	19.2.17 → 19.3.0			devDependencies	minor
actions/checkout (changelog)	9c091bb → 3d3c42e			action	digest
actions/setup-node (changelog)	48b55a0 → 2499707			action	digest
convex (source)	1.44.0 → 1.46.0			devDependencies	minor
convex-test (source)	0.0.54 → 0.0.60			devDependencies	patch
eslint (source)	10.7.0 → 10.12.0			devDependencies	minor
eslint-plugin-react-refresh	0.5.3 → 0.5.7			devDependencies	patch
globals	17.7.0 → 17.13.0			devDependencies	minor
pkg-pr-new (source)	0.0.75 → 0.0.88			devDependencies	patch	0.0.91 (+1)
prettier (source)	3.9.5 → 3.9.9			devDependencies	patch
react (source)	19.2.7 → 19.3.0			devDependencies	minor
react-dom (source)	19.2.7 → 19.3.0			devDependencies	minor
remeda (source)	2.39.0 → 2.51.0			dependencies	minor
resend	6.17.2 → 6.32.0			dependencies	minor	6.32.1
svix	1.96.1 → 1.99.1			dependencies	minor
tsc-alias (source)	1.9.0 → 1.9.7			devDependencies	patch
typescript-eslint (source)	8.63.0 → 8.71.0			devDependencies	minor	8.71.1
vitest (source)	5.0.0 → 5.0.3			devDependencies	patch
zizmorcore/zizmor-action	v0.5.7 → v0.6.4			action	minor

---

Release Notes

get-convex/rate-limiter (@​convex-dev/rate-limiter)

v0.4.0

Compare Source

• Add a new async mode to the Rate Limiter component that improves throughput
  under highly concurrent workloads. Setting applyUpdates: "asynchronously" on
  a limit in the RateLimiter client will cause updates to be enqueued to be
  processed asynchronously, and checking the limit to use a stale snapshot,
  providing eventual consistency instead of full transactionality.

get-convex/workpool (@​convex-dev/workpool)

v0.4.13

Compare Source

• Avoid unused local in shared.ts type assertion (#​242)

v0.4.12

Compare Source

• Adds onCompleteExcludeKinds to filter callbacks by result kind (#​237). Use
  this to avoid callbacks on success or canceled results if you don't care about
  those cases.

v0.4.11

Compare Source

• Bump Batch Worker dependency to prevent OCC conflicts on enqueue.
• Keeps the Batch Worker running for a 10-second cooldown while Workpool is
  saturated, reducing enqueue retries with worker status transitions.

eslint/eslintrc (@​eslint/eslintrc)

v3.3.7

Compare Source

Bug Fixes

• Bump js-yaml to 4.3.1 (#​239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#​243) (bb0d97a)

get-convex/convex-backend (convex)

v1.46.0

• Added .optional() to all validators. For example, v.string().optional() is
  equivalent to v.optional(v.string()). This changes TypeScript compatibility
  between validators from different Convex versions; projects sharing validators
  across packages may need to align their convex dependency versions.
• npx convex deploy --dry-run now warns when a schema change requires checking
  every document in large tables against the new schema, since these deploys can
  take a long time. The warning lists the affected tables along with their
  document counts and sizes.
• Fixed a bug where npx convex deploy could fail with a deployment:data:view
  permission error when deleting indexes with a deploy key that only has
  deployment:deploy. The CLI now reuses the schema evaluation response to size
  the affected tables instead of reading them directly, so
  deployment:data:view is no longer required.
• convex/server exports FunctionReference_future, a reference type whose
  arguments are checked similar to the way Convex checks them at runtime. Use it
  instead of FunctionReference when you accept someone else's Convex function
  as a callback and know which arguments you will pass it. Behavior summary: it
  rejects a function requiring arguments you never pass, rejects a function that
  does not declare a top-level argument you do pass, and accepts a function
  taking broader values than you pass. A plain FunctionReference gets the
  first and third backwards. The surplus-key check stops at the top level: a
  surplus key inside a nested object, array element, or union arm is not
  detected. A value of the type is usable with ctx.runMutation,
  ctx.scheduler.runAfter, createFunctionHandle, and every other API in this
  package that takes a reference, all of which now accept
  FunctionReference | FunctionReference_future. It is deliberately not
  assignable to a plain FunctionReference, so forwarding one into code typed
  that way is a compile error rather than a silent loss of argument checking.
  Library code that wants to accept either kind of reference should take that
  same union and read arguments and return types through FunctionArgs and
  FunctionReturnType, which accept either kind.
• As a part of the FunctionReference_future work, the _args and
  _returnType slots on FunctionReference are deprecated. They'll be removed
  in a future version. FunctionReference gains an optional _fn slot that
  enables the checked comparison of args.

v1.45.0

• Local deployments now upgrade to a new backend version in place, instead of
  going through a snapshot export and import. Upgrades no longer depend on the
  size of your local data, and no longer prompt about transferring it.
• The Convex MCP server (npx convex mcp) now supports the stateless MCP
  protocol (2026-07-28 MCP specification).
• Added a new getServiceToken function that generates service tokens for
  first-party Convex services. This will be used by the upcoming Convex AI
  gateway.
• Improved the error message when npx convex export fails because a snapshot
  export is already in progress.

get-convex/convex-test (convex-test)

v0.0.60

Compare Source

• Improves the implementation of finishAllScheduledFunctions to avoid false positives in the hung scheduled function detection.

v0.0.59

Compare Source

• Improves global isolation, improving interactions with vitest.stubGlobal (#​142).
• Implements ctx.meta.getRequestMetadata() by introducing t.withRequestMetadata
  with the IP, user agent, and identity's auth token(#​134, #​135, #​136)

v0.0.58

Compare Source

• Globals modified within query/mutation/actions (e.g. for Workflow) are now
  scoped so they don't contaminate other functions or tests.
• Queries and mutations now throw when calling fetch, setTimeout,
  clearTimeout, setInterval, or clearInterval. These restrictions also apply
  to t.run and inline t.query / t.mutation callbacks. Move test setup that
  fetches data or waits on timers into the test body before calling these methods.
  Use actions for application code that needs these APIs; scheduling through
  ctx.scheduler remains supported.
• The return value of t.withIdentity(identity) now has a .withIdentity
  method itself, which also returns context for function calls for a particular
  identity. We made that change because we will soon add more methods in
  TestConvexForDataModel, and we want for these methods to be callable
  in any order.
• Add implementation for ctx.meta.getRequestMetadata() in mutations, actions
  and HTTP actions. Every call from the test starts a new request, and the
  functions it calls share the request's requestId, components included.
  Scheduled functions run as their own request, with their
  _scheduled_functions document ID exposed as scheduledFunctionId.
• Add t.withRequestMetadata({ ip, userAgent }), which returns an accessor
  whose calls report the given IP address and user agent.
• t.withIdentity(identity) now also gives the request an authToken: an
  unsecured JWT carrying the identity's claims, so that functions which read
  the raw token can be tested.

v0.0.57

Compare Source

• Reject function args validators that aren't an object or v.any(), matching
  the error the real backend raises at push time. Previously e.g. a top-level
  v.union(...) args validator worked in tests but failed to deploy. (#​138)
• Support upcoming feature ctx.meta.getSnapshotTs()

v0.0.56

Compare Source

• Document the second parameter to finishAllScheduledFunctions

v0.0.55

Compare Source

• Support db.vars.commitTs and v.commitTs().
• Fix an issue where finishAllScheduledFunctions would drop functions
  scheduled under real timers.

eslint/eslint (eslint)

v10.12.0

Compare Source

Features

• 4618052 feat: handle astral letters in new-cap (#​21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#​21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#​21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#​21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#​21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#​21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#​21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#​21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#​21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#​21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#​21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#​21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#​21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#​21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#​21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#​21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#​21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#​21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#​21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#​21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#​21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#​21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#​21342) (ESLint Bot)

v10.11.0

Compare Source

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#​21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#​21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#​21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#​21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#​21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#​21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#​21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#​21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#​21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#​21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#​21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#​21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#​21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#​21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#​21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#​21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#​20395) (Nitin Kumar)

v10.10.0

Compare Source

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#​21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#​21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#​21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#​20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#​21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#​21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#​21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#​21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#​21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#​21286) (한국)
• 8724829 docs: update compat table links (#​21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#​21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#​21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#​21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#​21296) (renovate[bot])
• 3c753f1 chore: update eslint (#​21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#​21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#​21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#​21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#​21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#​21178) (crimsonjay0)

v10.9.1

Compare Source

Bug Fixes

• 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#​21251) (Aleksandr Shoronov)

Documentation

• ad74a8d docs: add deprecation steps for EOL package versions (#​21248) (Francesco Trotta)

Chores

• 3c3ae53 chore: update ecosystem plugins (#​21249) (ESLint Bot)

v10.9.0

Compare Source

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#​21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#​21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#​21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#​21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#​21207) (김채영)

Documentation

• 9ef407a docs: use eslint.config.* wherever config file names are listed (#​21216) (Marry (Subin Yang))
• 87f66f4 docs: Update README (GitHub Actions Bot)
• 585ef37 docs: update architecture documentation (#​21112) (Francesco Trotta)
• f3993b0 docs: Update README (GitHub Actions Bot)
• ffc87d6 docs: fix broken links in Further Reading sections (#​21203) (Minsu)
• 1a761e1 docs: update moved JSX specification links (#​21198) (Imran Mustafa)
• 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#​21202) (lumir)
• 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

• 899dbf1 chore: update github/codeql-action action to v4.37.7 (#​21243) (renovate[bot])
• 9aa3873 chore: update ecosystem plugins (#​21235) (ESLint Bot)
• dc1e7a8 chore: update ecosystem plugins (#​21208) (ESLint Bot)
• f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#​21200) (dependabot[bot])
• 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#​21199) (dependabot[bot])

v10.8.1

Compare Source

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#​21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#​21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#​21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#​20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#​21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#​21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#​21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#​21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#​21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#​21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#​21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#​21151) (JIYEON)
• d086293 test: add error locations to no-undef (#​21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#​21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#​21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#​21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#​21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#​21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#​21138) (dongkyu lee)

v10.8.0

Compare Source

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#​21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
• [2710b18

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@convex-dev/resend@105

commit: 1da7c85