[code-infra-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
es-toolkit (source)	^1.53.0 → ^1.53.1
ip-address	^10.7.4 → ^10.7.6
postcss (source)	^8.5.31 → ^8.5.32
ws	^8.22.0 → ^8.22.1

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

toss/es-toolkit (es-toolkit)

v1.53.1

Compare Source

Released on October 31st, 2026.

This release includes security fixes for es-toolkit/compat, and we recommend upgrading.
The fixes match Lodash, so results may differ if you relied on the previous behavior.

• Fixed compat/template to reject variable values and imports keys that are not
  plain parameter names, and to replace all whitespace in sourceURL, preventing code injection.
• Fixed compat/defaultsDeep to ignore __proto__ keys, preventing prototype pollution.
• Fixed compat/unset, compat/omit, and compat/pullAt to stop when __proto__,
  constructor, or prototype appears before the last path key, preventing the deletion
  of built-in prototype properties.

The following are other fixes in this release.

• Fixed clone to preserve the offset and length of a DataView. ([#​2166])
• Fixed split to keep surrogate pairs and combining marks together for an empty separator. ([#​2171])
• Fixed withTimeout to clear its timer after the operation completes. ([#​2170])
• Fixed compat/pickBy to not treat objects with a numeric length as array-like. ([#​2165])
• Fixed compat/findLast and compat/some to not treat length as an element of
  array-likes. ([#​2168])

We sincerely thank @​arba-octo, @​dayongkr, @​frogscooper, and @​KooYS for their contributions.
We appreciate your great efforts!

beaugunderson/ip-address (ip-address)

v10.7.6

Compare Source

Full Changelog: beaugunderson/ip-address@v10.7.5...v10.7.6

v10.7.5

Compare Source

Full Changelog: beaugunderson/ip-address@v10.7.4...v10.7.5

postcss/postcss (postcss)

v8.5.32

Compare Source

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

websockets/ws (ws)

v8.22.1

Compare Source

Bug fixes

• The path of IPC URLs is no longer truncated at : (#​2344).

Other notable changes

• http.websocketMask() and http.websocketUnmask() are now used
  instead of the bufferutil variants when available (2ab3d3e).
• Sender.frame() no longer returns empty chunks (85319a7).

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Between 02:00 AM and 06:59 AM, only on Friday (* 2-6 * * 5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by self-hosted Renovate.

[pkg-pr-new]

• base-ui-tanstack-start

• vite-css-base-ui-example

  pnpm add https://pkg.pr.new/mui/base-ui/@base-ui/react@6139
  

  pnpm add https://pkg.pr.new/mui/base-ui/@base-ui/utils@6139
  

commit: f12faa0

[code-infra-dashboard]

Bundle size

Bundle	Parsed size	Gzip size
@base-ui/react	0B(0.00%)	0B(0.00%)

Details of bundle changes

Performance

No regressions in 36 benchmarks · ran 4m 07s · details

---

Check out the code infra dashboard for more information about this PR.

[netlify]

✅ Deploy Preview for base-ui ready!

Name	Link
🔨 Latest commit	f12faa0
🔍 Latest deploy log	https://app.netlify.com/projects/base-ui/deploys/6aee19830e6fbdd9645a55de
😎 Deploy Preview	https://deploy-preview-6139--base-ui.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.