chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/parse (source)	^20.3.1 → ^20.4.0
@types/react (source)	^19.2.9 → ^19.2.10
nx (source)	22.4.1 → 22.4.4
pnpm (source)	10.28.1 → 10.28.2
react (source)	^19.2.3 → ^19.2.4
react-dom (source)	^19.2.3 → ^19.2.4
type-fest	^5.4.1 → ^5.4.3
typescript-eslint (source)	^8.53.1 → ^8.54.0

---

Release Notes

nrwl/nx (nx)

v22.4.4

Compare Source

22.4.4 (2026-01-30)

🚀 Features

• core: add decorative banners for Nx Cloud CNW completion message (#​34270)

🩹 Fixes

• testing: add timeout to runCommandUntil to prevent hanging tests (#​34148)
• testing: preload vitest/node to prevent race condition on Node 24 (#​34261, #​34028, #​33091)

❤️ Thank You

• Colum Ferry @​Coly010
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz

v22.4.3

Compare Source

22.4.3 (2026-01-29)

🚀 Features

• core: add Nx Cloud connect URL to template README (#​34249)
• nx-dev: add llms-full.txt and HTTP Link headers for LLM discovery (#​34232)

🩹 Fixes

• core: hide already-installed nx packages from suggestion list during nx import (#​34227)
• core: improve plugin worker error messages and lifecycle timeouts (#​34251)
• core: do not throw error if worker.stdout is not instanceof socket (#​34224)
• gradle: use tooling api compatible flags (#​34247)
• nx-dev: update dead links across nx-dev UI libraries (#​34238)
• vite: handle sophisticated vite plugins (#​34242)
• web: ensure vitest config file is created (#​34216)

❤️ Thank You

• AgentEnder @​AgentEnder
• Caleb Ukle
• Claude
• Claude Opus 4.5
• Colum Ferry @​Coly010
• Craigory Coppola @​AgentEnder
• Drew Teachout @​drewteachout
• Jack Hsu @​jaysoo
• Louie Weng @​lourw
• MaxKless @​MaxKless

v22.4.2

Compare Source

22.4.2 (2026-01-26)

🚀 Features

• core: display batch tasks in the tui (#​33695)
• core: add variant 2 to CNW cloud prompts with promo message (#​34223)

🩹 Fixes

• core: handle resizing a bit better for inline_tui (#​34006)
• core: consolidate GitHub URL messaging when gh push fails (#​34196)
• core: cloud commands are noop when not connected rather than errors (#​34193)
• core: fall back to node_modules when tmp has noexec (#​34207, #​33991)
• devkit: allow null values in JSON schema validation (#​34167)
• react: remove file-loader dependency and update svgr migration (#​34218)

❤️ Thank You

• Claude Opus 4.5
• Colum Ferry @​Coly010
• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jack Hsu @​jaysoo
• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez
• Miguel @​mpsanchis

pnpm/pnpm (pnpm)

v10.28.2: pnpm 10.28.2

Compare Source

Patch Changes

• Security fix: prevent path traversal in directories.bin field.

• When pnpm installs a file: or git: dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked into node_modules.

  This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) and have their contents copied when the package is installed.

  Note: This only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.

• Fixed optional dependencies to request full metadata from the registry to get the libc field, which is required for proper platform compatibility checks #​9950.

Platinum Sponsors

Gold Sponsors

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ab66f06

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[nx-cloud]

View your CI Pipeline Execution ↗ for commit ab66f06

Command	Status	Duration	Result
nx affected --targets=test:sherif,test:docs,tes...	✅ Succeeded	26s	View ↗
nx run-many --target=build	✅ Succeeded	11s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-02-02 01:10:00 UTC

[pkg-pr-new]

npm i https://pkg.pr.new/@tanstack/eslint-config@337

npm i https://pkg.pr.new/@tanstack/publish-config@337

npm i https://pkg.pr.new/@tanstack/typedoc-config@337

npm i https://pkg.pr.new/@tanstack/vite-config@337

commit: ab66f06