[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/eslintrc	3.3.6 → 3.3.7
@types/react (source)	19.2.18 → 19.3.0
@types/react-dom (source)	19.2.4 → 19.3.0
convex (source)	1.44.0 → 1.49.0
convex-test (source)	0.0.62 → 0.0.67
eslint-plugin-react-refresh	0.5.4 → 0.5.7
prettier (source)	3.9.6 → 3.9.10
typescript-eslint (source)	8.67.0 → 8.72.1
vitest (source)	4.1.11 → 4.1.12

---

Release Notes

eslint/eslintrc (@​eslint/eslintrc)

v3.3.7

Compare Source

Bug Fixes

• Bump js-yaml to 4.3.1 (#​239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#​243) (bb0d97a)

convex/convex-backend (convex)

v1.49.0

• New npx convex plugins install command, which installs the Convex plugin for
  Claude Code and Codex on macOS and Linux. It works with the terminal CLIs, the
  desktop apps and the VS Code extensions. Running it again upgrades the plugin
  to the latest version.
• This version drops support for Node.js 20. Please update to Node.js 22 or
  newer.
• Adds the v.function({ fnType, args, returns }) validator, which validates
  that a value is a well-formed function handle. You can specify fnType,
  args, and returns for TypeScript typechecking and including type
  signatures in codegen, but they are not checked when running functions or
  writing to a table at runtime. The inferred type of v.function() is
  FunctionHandle_future, which has the same type semantics as
  FunctionReference_future. When incorporating v.function() into your
  codebase, existing code that uses the FunctionHandle type may need to be
  updated to use FunctionHandle_future.
• Security fixes for
  GHSA-qw8j-4xj7-6f28
  and
  GHSA-9mw5-7p28-rvv4.

v1.48.0

• Convex deployments can now sign their own JWTs with an internally managed
  key-pair. The ctx.auth.signJwt API is available in mutations. The JWTs
  can be verified with the public key in the JWKS hosted at
  ${CONVEX_CLOUD_URL}/.well-known/jwks.json.

• npx convex dev --verbose and npx convex deploy --verbose no longer print
  environment variable values. The logged list of environment variables shows
  every value as <redacted>, and values of 8 or more characters are also
  redacted wherever else they appear in the logged push response and diff, such
  as auth providers that auth.config.ts builds from process.env.

• When an AI agent runs npx convex env list or npx convex env default list,
  they now list only names by default, so secrets stay out of the agent's
  context. Agents are detected from the environment variables they set. Pass
  --include-values to print the values.

• Fixed npx convex ai-files install and npx convex ai-files update reporting
  success and exiting 0 when the guidelines download or the agent skills
  install failed. They now exit with code 1.

• ctx.storage.store() and ctx.storage.get() are now available in mutations,
  not just actions. Files stored and read in a mutation count toward its
  transaction limits.

v1.47.0

• Fixed the next step printed by npx convex project create. It suggested
  npx convex deployment create <team>:<project>:dev --type dev, which always
  failed because dev is reserved for your default dev deployment. It now
  suggests a dev/my-feature reference and passes --select.
• npx convex deploy now asks for confirmation before creating or changing an
  index on a large table, since the deploy blocks until the index is backfilled.
  Stage the index (staged: true) to backfill it in the background instead, or
  pass the new --skip-large-indexes-check flag to proceed without
  confirmation. That flag also covers deleting large indexes, replacing the
  hidden --allow-deleting-large-indexes flag, which keeps working.
• The envList MCP tool now returns only environment variable names by default,
  so secrets stay out of the agent's context. Pass includeValues: true to get
  the values too, or use envGet to read a single variable.
• npx convex env list and npx convex env default list have a new
  --include-values flag for printing values explicitly. Values are still
  printed by default. The docs and help text now use --include-values wherever
  the values are needed, like
  npx convex env list --include-values > .env.convex, and --names-only for
  just listing variables.
• Added .staged() to defineTable for validating a schema change in the
  background instead of blocking the deploy on a scan of the table. Pass the
  fields to add or change, set a field to undefined to remove it, or pass a
  full validator. The current validator stays enforced while Convex checks
  existing documents and new writes against the staged one. npx convex deploy
  and npx convex deploy --dry-run report each staged table as validating,
  validated, or failed, and the dry-run warning about scanning large tables now
  suggests staging the validator. Once a staged validator is validated, moving
  it into defineTable deploys without scanning the table. A deploy that would
  discard pending or completed staged validation asks for confirmation; pass
  --allow-unstaging-schema to skip the prompt in CI. See
  https://docs.convex.dev/database/schemas#staged-validators.
• ctx.meta.getSnapshotTs() is now public API. It returns the database
  timestamp of the snapshot the current function reads from, in nanoseconds, on
  the same clock as db.vars.commitTs. See
  https://docs.convex.dev/database/advanced/commit-timestamp.
• convex/server exports getServiceUrl, which returns the base URL of a
  Convex-managed service such as the AI gateway, to pair with getServiceToken,
  along with a ServiceName type. The client no longer rejects service names it
  doesn't know about, so libraries can adopt new services without requiring a
  newer convex version.
• Fixed the Convex MCP server stalling permanently after overlapping tool calls.
• Fixed the error reported when a function or symbol is passed where a Convex
  value is expected. It now names the unsupported type and its path, like
  Function "[Function]" is not a supported Convex type at .cb, instead of
  throwing Cannot read properties of undefined (reading 'length').
• When a push fails because an environment variable used by auth.config.ts is
  not set on the deployment, the CLI now prints the npx convex env set
  commands to run and a link to the deployment's environment variable settings.
• Region prompts in the CLI list regions in the same order as the dashboard, and
  npx convex deployment create --region accepts the Canada
  (aws-ca-central-1) and Asia Pacific (aws-ap-southeast-2) regions. See
  https://docs.convex.dev/production/regions.
• npx convex deployment usage-limits set --metric aiGatewayCostDollars sets
  the AI gateway spending limit.

v1.46.0

• Added .optional() to all validators. For example, v.string().optional() is
  equivalent to v.optional(v.string()). This changes TypeScript compatibility
  between validators from different Convex versions; projects sharing validators
  across packages may need to align their convex dependency versions.
• npx convex deploy --dry-run now warns when a schema change requires checking
  every document in large tables against the new schema, since these deploys can
  take a long time. The warning lists the affected tables along with their
  document counts and sizes.
• Fixed a bug where npx convex deploy could fail with a deployment:data:view
  permission error when deleting indexes with a deploy key that only has
  deployment:deploy. The CLI now reuses the schema evaluation response to size
  the affected tables instead of reading them directly, so
  deployment:data:view is no longer required.
• convex/server exports FunctionReference_future, a reference type whose
  arguments are checked similar to the way Convex checks them at runtime. Use it
  instead of FunctionReference when you accept someone else's Convex function
  as a callback and know which arguments you will pass it. Behavior summary: it
  rejects a function requiring arguments you never pass, rejects a function that
  does not declare a top-level argument you do pass, and accepts a function
  taking broader values than you pass. A plain FunctionReference gets the
  first and third backwards. The surplus-key check stops at the top level: a
  surplus key inside a nested object, array element, or union arm is not
  detected. A value of the type is usable with ctx.runMutation,
  ctx.scheduler.runAfter, createFunctionHandle, and every other API in this
  package that takes a reference, all of which now accept
  FunctionReference | FunctionReference_future. It is deliberately not
  assignable to a plain FunctionReference, so forwarding one into code typed
  that way is a compile error rather than a silent loss of argument checking.
  Library code that wants to accept either kind of reference should take that
  same union and read arguments and return types through FunctionArgs and
  FunctionReturnType, which accept either kind.
• As a part of the FunctionReference_future work, the _args and
  _returnType slots on FunctionReference are deprecated. They'll be removed
  in a future version. FunctionReference gains an optional _fn slot that
  enables the checked comparison of args.

v1.45.0

• Local deployments now upgrade to a new backend version in place, instead of
  going through a snapshot export and import. Upgrades no longer depend on the
  size of your local data, and no longer prompt about transferring it.
• The Convex MCP server (npx convex mcp) now supports the stateless MCP
  protocol (2026-07-28 MCP specification).
• Added a new getServiceToken function that generates service tokens for
  first-party Convex services. This will be used by the upcoming Convex AI
  gateway.
• Improved the error message when npx convex export fails because a snapshot
  export is already in progress.

convex/convex-test (convex-test)

v0.0.67

Compare Source

• Adds support for file storage access in mutations.

v0.0.66

Compare Source

• perf: only visit the queried table's documents in _iterateDocs (#​154)

v0.0.65

Compare Source

• Adds support for Convex mutations that call the ctx.auth.signJwt API.

v0.0.64

Compare Source

• Update pagination restriction to match backend: components can now call
  .paginate and mutations can paginate multiple times.

v0.0.63

Compare Source

• Pin Date.now(), Date(), and new Date() for each query or mutation,
  including nested calls and t.run. Like the Convex backend, the pinned time
  is at or after the transaction's snapshot timestamp and at or before the
  _creationTime of documents the transaction inserts. Scheduled functions
  still become due according to the wall clock, as in the real Convex backend.
  (#​144)
• Enforce the 1,024-candidate limit for text search during iteration and
  pagination, including candidates excluded by post-search filters. Queries
  can stop early with .take(), smaller pages, or an early exit from iteration
  to stay within the limit. (#​169, #​171)
• Fail early when calling, scheduling, or creating a function handle for an
  unregistered component, with an error that explains how to register it and
  lists the registered components. (#​164)
• Preserve a stored Blob's content type in _storage metadata. (#​170)

ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)

v0.5.7

Compare Source

Add allowCompoundComponents option (#​117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

v0.5.6

Compare Source

• Support re-exporting namespace components (fixes #​116)

v0.5.5

Compare Source

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #​114 (fixes #​113)
• Add contentType and size to allowExportNames in Next config #​115

prettier/prettier (prettier)

v3.9.10

Compare Source

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

v3.9.9

Compare Source

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

v3.9.8

Compare Source

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#​20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.7 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a

{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.8 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

v3.9.7

Compare Source

diff

Markdown: Prevent indentation drift in list-item code blocks (#​19647, #​19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.

      second paragraph at six spaces that wraps
      onto another line here.

<!-- Prettier 3.9.6 -->
- [x] short first line.

      second paragraph at six spaces that wraps
          onto another line here.

<!-- Prettier 3.9.7 -->
- [x] short first line.

      second paragraph at six spaces that wraps
      onto another line here.

JavaScript: Fix embedded template literal idempotency (#​19725 by @​fisker)

// Input
const foo = html`
            <div>${getText({
            value,
            })}</div>
`;

// Prettier 3.9.6 (first format)
const foo = html`
  <div>
    ${getText({
              value,
            })}
  </div>
`;

// Prettier 3.9.6 (second format)
const foo = html`
  <div>
    ${getText({
      value,
    })}
  </div>
`;

// Prettier 3.9.7
const foo = html`
  <div>
    ${getText({
      value,
    })}
  </div>
`;

Markdown: Preserve Liquid blocks after Markdown tables (#​19730 by @​wanxiankai, @​seiyab)

<!-- Input -->
| Argument | Type |
| -------- | ---- |
{% set default_params = {
    "model": ["str"],
} %}

<!-- Prettier 3.9.6 -->
| Argument                  | Type |
| ------------------------- | ---- |
| {% set default_params = { |

    "model": ["str"],

} %}

<!-- Prettier 3.9.7 -->
| Argument | Type |
| -------- | ---- |
{% set default_params = {
    "model": ["str"],
} %}

Markdown: Preserve single tildes in Markdown (#​19739 by @​lazerg)

Since 3.9.0, single-tilde spans like H~2~O were rewritten to double tildes, turning subscript syntax into strike-through. Only double tildes are treated that way now, matching GitHub.

<!-- Input -->
H~2~O

<!-- Prettier 3.9.6 -->
H~~2~~O

<!-- Prettier 3.9.7 -->
H~2~O

Markdown: Fix Markdown blockquote containing > characters (#​19802 by @​seiyab)

<!-- Input -->
> **test**\>

<!-- Prettier 3.9.6 -->
> **test**>\>

<!-- Prettier 3.9.7 -->
> **test**\>

Markdown: Strip blockquote markers from a setext heading's continuation lines (#​19878 by @​Kjubikstronk)

A setext heading spanning multiple lines inside a blockquote kept the > marker of its continuation lines as literal text.

<!-- Input -->
> Multi
> Line
> ===

<!-- Prettier 3.9.6 -->
> Multi > Line
> ===

<!-- Prettier 3.9.7 -->
> Multi
> Line
> ===

Markdown: Fix HTML block indentation drift in markdown list items (#​19987 by @​lazerg)

<!-- Input -->
1. Enable images:

    <p align="center">
      <img alt="example">
    </p>

<!-- Prettier 3.9.6 (--tab-width=4) -->
1. Enable images:

     <p align="center">
       <img alt="example">
     </p>

<!-- Prettier 3.9.7 (--tab-width=4) -->
1. Enable images:

    <p align="center">
      <img alt="example">
    </p>

Angular: Support @boundary error boundaries (#​20014 by @​Yahiro025)

<!-- Input -->
@boundary {
<complex-chart [data]="data"/>
}
@error (let err) {
<p>{{err.message}}</p>
}

<!-- Prettier 3.9.6 -->
SyntaxError: Unexpected character "EOF" (Do you have an unescaped "{" in your template? Use "{{ '{' }}") to escape it.) (6:1)

<!-- Prettier 3.9.7 -->
@boundary {
  <complex-chart [data]="data" />
} @error (let err) {
  <p>{{ err.message }}</p>
}

typescript-eslint/typescript-eslint (typescript-eslint)

v8.72.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.0

Compare Source

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#​12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.68.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitest-dev/vitest (vitest)

v4.1.12

Compare Source

   🐞 Bug Fixes

• mocker: Harden manual and redirect mocks [backport to v4]  -  by @​sheremet-va in #​11580 (b8253)

    View changes on GitHub

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Between 12:00 AM and 04:59 AM, only on Monday (* 0-4 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/convex/automerge-sync/@convex-dev/automerge-sync@15

commit: d4b8a0c