[renovate]

This PR contains the following updates:

Package	Type	Update	Change
@biomejs/biome (source)	devDependencies	pin	^2.4.4 → 2.5.15
@types/js-yaml (source)	devDependencies	pin	^4.0.9 → 4.0.9
@types/node (source)	devDependencies	pin	^22.0.0 → 22.20.5
@types/react (source)	devDependencies	pin	^18.3.0 → 18.3.31
@types/safe-regex (source)	devDependencies	pin	^1.1.6 → 1.1.6
blake2b	devDependencies	pin	^2.1.4 → 2.1.4
blake2b	dependencies	pin	^2.1.4 → 2.1.4
bun-types (source)	devDependencies	pin	^1.3.10 → 1.4.2
canonicalize	dependencies	pin	^3.0.0 → 3.0.0
chacha20-universal	devDependencies	pin	^1.0.4 → 1.0.4
chacha20-universal	dependencies	pin	^1.0.4 → 1.0.4
fast-check (source)	devDependencies	pin	^4.5.3 → 4.10.2
handlebars (source)	dependencies	pin	^4.7.10 → 4.7.10
js-yaml	overrides	pin	^4.3.2 → 4.3.2
nanoassert	devDependencies	pin	^3.1.0 → 3.1.0
nanoassert	dependencies	pin	^3.1.0 → 3.1.0
react-devtools-core (source)	devDependencies	pin	^7.0.1 → 7.0.1
sha256-universal	devDependencies	pin	^1.2.1 → 1.2.1
sha256-universal	dependencies	pin	^1.2.1 → 1.2.1
sha512-universal	devDependencies	pin	^1.2.1 → 1.2.1
sha512-universal	dependencies	pin	^1.2.1 → 1.2.1
shell-quote	overrides	pin	~1.11.0 → 1.11.0
siphash24	devDependencies	pin	^1.3.1 → 1.3.1
siphash24	dependencies	pin	^1.3.1 → 1.3.1
sodium-javascript	devDependencies	pin	^0.8.0 → 0.8.0
sodium-javascript	dependencies	pin	^0.8.0 → 0.8.0
typescript (source)	devDependencies	pin	^5.7.0 → 5.9.3
ws	overrides	pin	^8.21.0 → 8.22.0
ws	dependencies	pin	^8.21.0 → 8.22.0
xsalsa20	devDependencies	pin	^1.2.0 → 1.2.0
xsalsa20	dependencies	pin	^1.2.0 → 1.2.0

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8eccf979-6015-4139-8c1c-d6e958dca558

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​react@​18.3.28 ⏵ 18.3.31
	@​types/​node@​22.20.5
	ws@​8.21.0 ⏵ 8.22.0
	fast-check@​4.5.3 ⏵ 4.10.2	+1			+5
	@​biomejs/​biome@​2.5.15

View full report

[tps-flint]

Held for the 7-day bake (re-judged on or after 2026-10-26). Checked: the runtime pins are in the private workspace root only; published packages/** get devDependency pins, and their runtime ranges stay widened per this repo's config.