[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@axa-fr/react-oidc	>=7.24.0 <7.27.0 → >=7.24.0 <7.30.0
@commitlint/cli (source)	20.4.3 → 20.5.3
@commitlint/config-conventional (source)	20.4.3 → 20.5.3
@types/node (source)	24.12.0 → 24.19.2
@types/react (source)	19.2.14 → 19.3.0
@types/react-dom (source)	19.2.3 → 19.3.0
autoprefixer	10.4.27 → 10.6.2
eslint-config-next (source)	16.1.6 → 16.4.5

---

Release Notes

AxaFrance/oidc-client (@​axa-fr/react-oidc)

v7.29.8

Compare Source

• 7c498e99 - [skip ci] Update to version 7.29.8 in package.json, 2026-10-15 by github-actions[bot]
• f2bfe0e6 - fix(oidc): emit syncTokensAsync_begin, syncTokensAsync_end and syncTokensAsync_error events (release) (#​1738), 2026-10-15 by Christopher Pruijsen

v7.29.7

Compare Source

• 77a5ca3b - [skip ci] Generate changelog to version 7.29.7, 2026-10-13 by github-actions[bot]
• 90e5dcdd - [skip ci] Update to version 7.29.7 in package.json, 2026-10-13 by github-actions[bot]
• 46712524 - Increase npm package verification retry attempts in release workflow (#​1737) (release), 2026-10-13 by Copilot
• df8c4ba0 - Refresh workspace and CI toolchain metadata (#​1736) (release), 2026-10-13 by Copilot

v7.29.6

Compare Source

• 67915c5d - [skip ci] Generate changelog to version 7.29.6, 2026-09-20 by github-actions[bot]
• 59afc43a - [skip ci] Update to version 7.29.6 in package.json, 2026-09-20 by github-actions[bot]
• 7463acfc - Rework FAQ with verified troubleshooting guidance and Mermaid diagrams (release) (#​1734), 2026-09-20 by Copilot

v7.29.5

Compare Source

• 722e93f4 - [skip ci] Generate changelog to version 7.29.5, 2026-09-19 by github-actions[bot]
• 9c9fefb1 - [skip ci] Update to version 7.29.5 in package.json, 2026-09-19 by github-actions[bot]
• 0a9dcf84 - refactor: Add package regression tests and streamline token parsing and fetch hooks (#​1732) (release), 2026-09-19 by Copilot

v7.29.4

Compare Source

• 29ae343c - [skip ci] Generate changelog to version 7.29.4, 2026-09-19 by github-actions[bot]
• 58ff7b53 - [skip ci] Update to version 7.29.4 in package.json, 2026-09-19 by github-actions[bot]
• 95ab5aa4 - Clarify package documentation and replace architecture images with Mermaid (#​1730) (release), 2026-09-19 by Copilot

v7.29.3

Compare Source

• e470a539 - [skip ci] Generate changelog to version 7.29.3, 2026-09-15 by github-actions[bot]
• 84649474 - [skip ci] Update to version 7.29.3 in package.json, 2026-09-15 by github-actions[bot]
• 3b18c50d - Make React Oidc publish reruns idempotent when versions already exist on npm (#​1728) (release), 2026-09-15 by Copilot
• eb0f40a1 - chore(deps): update all pnpm workspace dependencies (#​1727) (release), 2026-09-15 by Guillaume Chervet
• f91327ff - fix(oidc): ignore bare trailing hash in getPath (release) (#​1725), 2026-09-13 by Paul Martin

v7.29.2

Compare Source

• 9325ced4 - [skip ci] Generate changelog to version 7.29.2, 2026-09-02 by github-actions[bot]
• 8e7d95fb - [skip ci] Update to version 7.29.2 in package.json, 2026-09-02 by github-actions[bot]
• 658d033f - fix: publish npm (release), 2026-09-02 by Guillaume Chervet
• 99eb8992 - fix: npm publish (release), 2026-09-02 by Guillaume Chervet
• afeeb194 - fix: publish (release), 2026-09-02 by Guillaume Chervet
• b896d948 - fix: publish now with npm OIDC (release), 2026-09-01 by Guillaume Chervet

v7.29.1

Compare Source

• 8af7d30f - [skip ci] Generate changelog to version 7.29.1, 2026-08-05 by github-actions[bot]
• 6f83c671 - [skip ci] Update to version 7.29.1 in package.json, 2026-08-05 by github-actions[bot]
• e880d47a - fix(ci): publish npm (release), 2026-08-05 by Guillaume Chervet
• 6a0b8511 - fix(ci): npm publish (release), 2026-08-05 by Guillaume Chervet
• aff49c35 - fix(ci): publish npm (release), 2026-08-05 by Guillaume Chervet
• 61edf77f - fix(ci): publish npm (release), 2026-08-05 by Guillaume Chervet
• 9e1a60f6 - fix(ci): publish npm (release), 2026-08-05 by Guillaume Chervet
• cf4b796e - [skip ci] Generate changelog to version 7.29.0, 2026-07-31 by github-actions[bot]
• 8207e25c - [skip ci] Update to version 7.29.0 in package.json, 2026-07-31 by github-actions[bot]
• a0b3dbd7 - 7.29.0, 2026-07-31 by github-actions[bot]

v7.27.19

Compare Source

• de470065 - Handle service worker AbortError on tab shutdown to avoid uncaught rejections (#​1702) (release), 2026-06-24 by Guillaume Chervet

v7.27.18

Compare Source

• e4afee9c - Handle corrupted or missing OIDC state with a clear, descriptive error (#​1700) (release), 2026-06-23 by Guillaume Chervet

v7.27.17

Compare Source

• 940aa8da - fix: Prevent logoutAsync from clearing local session before navigation to avoid re-auth race (#​1701) (release), 2026-06-23 by Guillaume Chervet

v7.27.16

Compare Source

• cb8fc882 - Gracefully handle hooks outside OidcProvider and add test provider #​1679 (#​1698) (release), 2026-06-23 by Guillaume Chervet

v7.27.15

Compare Source

• e4cd2bd8 - Fix issue #​1696: loadingTimeout_error fires on authenticated/idle state after a silent session restore (regression from #​1681 / #​1692) (#​1697) (release), 2026-06-21 by Guillaume Chervet

v7.27.14

Compare Source

• 416a1b52 - Auto fix for issue #​1682: CallbackManager: no observable signal that post-callback navigation has committed (Safari edge case) (#​1691) (release), 2026-06-16 by Guillaume Chervet

v7.27.13

Compare Source

• 7b97a98f - Auto fix for issue #​1681: OidcProvider can sit in loading/authenticating indefinitely with no timeout event (#​1692) (release), 2026-06-16 by Guillaume Chervet

v7.27.12

Compare Source

• db7af26e - Document and expose the public service worker message protocol (#​1694) (release), 2026-06-16 by Guillaume Chervet

v7.27.11

Compare Source

v7.27.8

Compare Source

• c67eabfb - Update all dependencies to latest versions (#​1665) (release), 2026-05-15 by Copilot

v7.27.7

Compare Source

v7.27.4

Compare Source

• 9d94b3d6 - chore(all): Update workspace libraries (#​1659) (release), 2026-04-27 by Copilot
• 78a0bfa6 - Remove sonar badges from all README.md files (#​1658), 2026-04-24 by Copilot
• a18f8101 - docs: remove twitter badge, add npm weekly downloads badges to READMEs (#​1657), 2026-04-24 by Copilot
• 06918197 - Remove sonar badges from README.md (#​1656), 2026-04-24 by Copilot

v7.27.3

Compare Source

• 3ae9f19f - fix: cache service worker registration to prevent repeated register calls (#​1655) (release), 2026-04-21 by Copilot

v7.27.2

Compare Source

• ad4036a3 - Update npm-publish.yml (release), 2026-07-15 by Guillaume Chervet

v7.27.1

Compare Source

• de470065 - Handle service worker AbortError on tab shutdown to avoid uncaught rejections (#​1702) (release), 2026-06-24 by Guillaume Chervet

v7.27.0

Compare Source

• 48d3ad02 - feat(oidc-client): Add a 'login_state_storage' option to allow storing the auth flow state separately to tokens (#​1646) (release), 2026-03-11 by Alex O'Callaghan

conventional-changelog/commitlint (@​commitlint/cli)

v20.5.3

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.5.2

Compare Source

Note: Version bump only for package @​commitlint/cli

v20.5.0

Compare Source

Bug Fixes

• cli: validate that --cwd directory exists before execution (#​4658) (cf80f75), closes #​4595

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/cli

20.4.3 (2026-03-03)

Bug Fixes

• footer parser does not escape special chars for regex #​4560 (#​4634) (8ff7c7f)

20.4.2 (2026-02-19)

Note: Version bump only for package @​commitlint/cli

20.4.1 (2026-02-02)

Note: Version bump only for package @​commitlint/cli

v20.4.4

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.5.3

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

v20.5.0

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

20.4.4 (2026-03-12)

Note: Version bump only for package @​commitlint/config-conventional

20.4.3 (2026-03-03)

Bug Fixes

• footer parser does not escape special chars for regex #​4560 (#​4634) (8ff7c7f)

20.4.2 (2026-02-19)

Note: Version bump only for package @​commitlint/config-conventional

20.4.1 (2026-02-02)

Note: Version bump only for package @​commitlint/config-conventional

v20.4.4

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

postcss/autoprefixer (autoprefixer)

v10.6.2

Compare Source

• Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
• Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
• Fixed selector duplicates on multiple Autoprefixer runs.
• Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
• Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
• Fixed source maps for Grid prefixes (by @​dualfroz).

v10.6.1

Compare Source

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

v10.6.0

Compare Source

• Added initial-letter support (by @​thomasmattheussen).

v10.5.6

Compare Source

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

v10.5.5

Compare Source

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

v10.5.4

Compare Source

• Fixed prefixed rule duplication (by @​xianjianlf2).

v10.5.3

Compare Source

• Fixed brackets and gradient parser (@​alanturing881).

v10.5.2

Compare Source

• Moved -webkit-fill-available before -moz-available, so Firefox
  will use -webkit- version which is closer to stretch.

v10.5.1

Compare Source

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

v10.5.0

Compare Source

• Added mask-position-x and mask-position-y support (by @​toporek).

vercel/next.js (eslint-config-next)

v16.4.5

Compare Source

This release contains security fixes for the following advisories:

Moderate

• Cross-tenant sensitive information disclosure in Next.js 'use cache' when called through unstable_cache
• Cache leak across root param values in nested 'use cache' functions (follow-up)
• Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
• Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
• Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
• SVG rejection bypass in Next.js image optimization
• HttpOnly cookie exposure through internal response header on Next.js Edge runtime routes

v16.4.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#​100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#​100619)
• [lts-active] Revert "Optimize strict module factory chunks (#​98421)" (#​100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#​100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#​100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#​100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#​100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

v16.4.3

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#​100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#​100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#​95732)" (#​100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#​100123)
• [lts-active] test: Pin react-virtualized (#​100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#​100572)
• [lts-active] Keep OpenTelemetry request traces together (#​100349, #​100294, #​100324, #​100350, #​100552, #​100583) (#​100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#​100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

v16.4.2

Compare Source

What's Changed

• [lts-active] turbo-tasks snapshot consistency fixes (#​99644, #​99732, #​99649) by @​lukesandberg in #​100002
• [lts-active] Turbopack: backport Pages Router dev module graph chaining (#​98823, #​99910, #​100091) by @​sokra in #​100008
• [lts-active] fix(next-code-frame): snap visible window to char boundaries by @​lukesandberg in #​100212
• [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @​lukesandberg in #​100209
• [lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @​lukesandberg in #​100217
• [lts-active] Backport docs fixes since v16.4.0 by @​icyJoseph in #​100246
• [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @​lukesandberg in #​100211
• [lts-active] Backport additional documentation fixes since v16.4.0 by @​aurorascharff in #​100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

Compare Source

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution in use cache functions returning typed arrays
• Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

• Denial of Service in App Router using Server Actions

v16.4.0

Compare Source

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

• Show compiler plugin warning in more situations: #​75682
• fix(scripts): correct typo in rm.mjs error message: #​87015
• docs: improve clarity and punctuation in README: #​86096
• Fix debug build paths Pages Router support entries: #​93529
• bundle-analyzer: record historical snapshots on each analyze run: #​93520
• fix: detect proxy.ts correctly with compound pageExtensions: #​93246
• feat(turbopack): support false values for resolveAlias config: #​93331

Misc Changes

• docs: correction to dynamicParams migration: #​96624
• docs: proxy event argument: #​96435
• docs: remove experimental note from runtime prefetching: #​96615
• Preserve per-segment prefetching after dynamic navigation: #​96583
• Rename static generation stream option to waitForAllReady: #​96564
• Remove obsolete static generation plumbing: #​96563
• [turbopack] Drop dead writes to exports: #​96381
• [turbopack] Ignore writes to exports after a module.exports = {} writes: #​96380
• [turbopack] Add test for sideEffects with optimizePackageImports: #​96549
• [turbopack] Strip leading BOM before parsing CSS: #​96678
• Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #​96550
• docs: use relative doc links in instant-navigation error pages: #​96672
• Turbopack: terminate failed plugin worker threads: #​96592
• Fix HTML-limited bot matching in prerender bypass rules: #​96584
• [ci] Fix create_release_branch for new repo permissions: #​96641
• test: skip action module instance deploy test: #​96629
• docs: quote the dynamicParams build error in a blockquote: #​96633
• [react-sync] Open pull requests as the bot that authors the commits: #​96682
• [Bench] Fixes for pure Fizz bench: #​96771
• Derive foreground cache revalidation from the consumer: #​96731
• Fix race when navigating Back before hydration: #​96252
• docs: present each Skill as steps in the AI agents guide: #​96751
• Reuse completed cache entries for the rest of a request: #​96727
• Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #​96735
• Remove WorkStore execution mode: #​96674
• Remove cache revalidation execution mode reads: #​96670
• Separate App Route render and prerender pipelines: #​96662
• Remove App Page execution mode reads: #​96660
• test: fix missing await in css-chunking test: #​96725
• docs (Skills): stop assuming app/ at the root and port 3000: #​96696
• Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #​95808
• Use Tailwind Turbopack loader in create-next-app: #​96606
• docs: instant navigation quick start with an adoption prompt: #​96663
• Separate App Page render and prerender pipelines: #​96659
• Move App Router execution intent to entrypoints: #​96640
• Pass explicit render capabilities through App Render: #​96576
• Pass explicit prefetch hint policy through App Render: #​96572
• Replace WorkStore isStaticGeneration with executionMode: #​96570
• docs: document ! exclusion and src/ prefix for --debug-build-paths: #​96703
• Change loadManifest to return undefined with handleMissing: #​96530
• Refactor server from CacheNodeSeedData -> TransportData: #​96679
• Unify full/partial navigation response types: #​96439
• Unify RouteTree and CacheNodeSeedData on the client: #​96406
• Consolidate Promise.withResolvers polyfills: #​96772
• [ci] Open automated update pull requests with nextjs-bot: #​96683
• Require Cache Components for Instant Navigation testing: #​96745
• Fix use cache over- and under-invalidation in dev: #​96235
• Fix which pages the dev server announces, and when: #​96250
• docs: update redirected links to current targets: #​96723
• Fix(deployment-id): prevent exception on old webkit: #​94604
• [fragment-scroll] Remove config.experimental.appNewScrollHandler: #​95602
• [turbopack] Enable reexport-unknown execution test: #​96774
• ci: stop publishing @​vercel/devlow-bench: #​96887
• fix(turbopack): name the module in the non-ESM-placeable error, and stop duplicating the importer in traces: #​96560
• fix(turbopack): support type: 'text' in rules, and error on binding imports of non-ESM modules: #​96558
• Lint devlow-bench with the root eslint config: [#&

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.