[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@convex-dev/eslint-plugin (source)	5.0.0 → 5.0.1			devDependencies	patch
@convex-dev/workflow	0.4.4 → 0.4.10			dependencies	patch
@convex-dev/workpool (source)	0.4.8 → 0.4.15			dependencies	patch	0.4.16
@eslint/eslintrc	3.3.6 → 3.3.7			devDependencies	patch
@types/node (source)	24.13.3 → 24.19.2			devDependencies	minor
@types/react (source)	19.2.17 → 19.3.0			devDependencies	minor
@types/react-dom (source)	19.2.3 → 19.3.0			devDependencies	minor
@vitejs/plugin-react (source)	6.0.4 → 6.2.1			devDependencies	minor	6.3.0
actions/checkout (changelog)	de0fac2 → d23441a			action	digest
actions/setup-node (changelog)	48b55a0 → 2499707			action	digest
convex (source)	1.46.0 → 1.49.0			devDependencies	minor
convex-helpers	0.1.128 → 0.1.134			dependencies	patch	0.1.135
convex-test (source)	0.0.62 → 0.0.67			devDependencies	patch	0.0.69
eslint-plugin-react-refresh	0.5.3 → 0.5.7			devDependencies	patch
globals	17.8.0 → 17.14.0			devDependencies	minor
pkg-pr-new (source)	0.0.80 → 0.0.93			devDependencies	patch
prettier (source)	3.9.6 → 3.9.10			devDependencies	patch
react (source)	19.2.8 → 19.3.1			devDependencies	minor
react-dom (source)	19.2.8 → 19.3.1			devDependencies	minor
type-fest	5.8.0 → 5.10.0			dependencies	minor
typescript-eslint (source)	8.65.0 → 8.72.1			devDependencies	minor	8.72.2
vite (source)	8.1.5 → 8.3.6			devDependencies	minor	8.3.8 (+1)
vitest (source)	5.0.0 → 5.1.0			devDependencies	minor

---

Release Notes

convex/convex-backend (@​convex-dev/eslint-plugin)

v5.0.1

• Fix false positives in @convex-dev/no-collect-in-query with type-aware
  linting. In projects that include Convex's types, the rule reported every
  .collect() call, including ones on classes and objects unrelated to Convex.
  It now only reports .collect() on Convex queries. Thanks to
  @​stickerdaniel for the fix.
• Fix false positives in @convex-dev/no-filter-in-query with type-aware
  linting. The rule recognized Convex queries partly by name, so it reported
  .filter() on unrelated types, such as a class whose predicate takes a
  parameter of a type named FilterBuilder, or a non-Convex db.query() result
  stored in a variable. It now only reports .filter() on Convex queries.

get-convex/workflow (@​convex-dev/workflow)

v0.4.10

Compare Source

• Updates the /test entrypoint for compatibility with convex-test's new
  defineTestApp capability.

v0.4.9

Compare Source

• Update types for convex 1.46 FunctionReference_future

v0.4.8

Compare Source

• When paired with the latest Workpool (0.4.12), it will avoid registering an
  onComplete callback for the successful execution of workflow handlers,
  reducing unnecessary scheduled functions. (#​283)

v0.4.7

Compare Source

• Improves patching and restoration of globals to work better with convex-test.
  For best results, use convex-test >= 0.0.58

v0.4.6

Compare Source

• Fixes the type of step.runWorkflow(child, args): it now resolves to the
  child workflow's return value (per its returns validator) instead of the
  child's WorkflowId, which is what it has always resolved to at runtime. A
  workflow with no returns validator resolves to unknown. Code that relied
  on the old (incorrect) type will need updating.
• Workflow mutations now declare an argument validator, so statically generated
  API types describe their real shape instead of any. Malformed calls are
  rejected by argument validation rather than reaching the handler, so some
  errors are now Convex validator errors rather than workflow-specific ones.

v0.4.5

Compare Source

• Adds lenientCtx = step.withOptions({ unstableArgs: true }) to return a new
  WorkflowCtx that can be passed to libraries that have unstable arguments. All
  calls on the scoped lenientCtx will have the specified options applied to
  the relevant calls. This can also be used to provide a default retry policy
  for actions scheduled with the scoped WorkflowCtx.

convex/workpool (@​convex-dev/workpool)

v0.4.15

Compare Source

• Upgrades @​convex-dev/batch-worker to 0.3. Requires Convex 1.43 or later.
• Records each pendingStart ID on its work document, so the next minor version
  can report status accurately for work already in flight. Not backwards
  compatible due to this schema change.
• Adds a one-off migration that records the queue entry on work enqueued before
  this version and removes queue entries whose work is gone. Before upgrading to
  0.5, deploy this version and run
  npx convex run --component workpool migrations:backfillPendingStartIds,
  replacing workpool with each component instance's name.

v0.4.14

Compare Source

• Updates the /test entrypoint for compatibility with convex-test's new
  defineTestApp capability.

v0.4.13

Compare Source

• Avoid unused local in shared.ts type assertion (#​242)

v0.4.12

Compare Source

• Adds onCompleteExcludeKinds to filter callbacks by result kind (#​237). Use
  this to avoid callbacks on success or canceled results if you don't care about
  those cases.

v0.4.11

Compare Source

• Bump Batch Worker dependency to prevent OCC conflicts on enqueue.
• Keeps the Batch Worker running for a 10-second cooldown while Workpool is
  saturated, reducing enqueue retries with worker status transitions.

v0.4.10

Compare Source

• Adds vRunResult and type-safety for passing onComplete handlers with return
  values and context validator.
• Expands vOnCompleteArgs to take an optional second parameter for the
  validator for the return value to expect.
• Adds a returnValue named parameter to workpool.defineOnComplete that does
  the same.

v0.4.9

Compare Source

• Runs actions and queries in batches of up to 32 from a single scheduled
  action, instead of scheduling them individually. This reduces scheduled
  function use and reduces the number of actions used (previously each action
  had another action wrapping it).

eslint/eslintrc (@​eslint/eslintrc)

v3.3.7

Compare Source

Bug Fixes

• Bump js-yaml to 4.3.1 (#​239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#​243) (bb0d97a)

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.2.1

Compare Source

Fix refreshInclude and refreshExclude options not working (#​1543)

Fix mistake from #​1516

v6.2.0

Compare Source

Add refreshInclude and refreshExclude options (#​1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#​1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#​1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

v6.1.2

Compare Source

Fix HMR for compound components (#​1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#​1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #​1478) (#​1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

v6.1.1

Compare Source

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#​1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

v6.1.0

Compare Source

Add experimental native React Compiler support (#​1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'

export default defineConfig({
  plugins: [
     react({ compiler: true })
  ]
})

v6.0.5

Compare Source

Fixed the react compiler preset filter to be linear (#​1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#​1349). The filter was changed to be linear to avoid that.

convex/convex-backend (convex)

v1.49.0

• New npx convex plugins install command, which installs the Convex plugin for
  Claude Code and Codex on macOS and Linux. It works with the terminal CLIs, the
  desktop apps and the VS Code extensions. Running it again upgrades the plugin
  to the latest version.
• This version drops support for Node.js 20. Please update to Node.js 22 or
  newer.
• Adds the v.function({ fnType, args, returns }) validator, which validates
  that a value is a well-formed function handle. You can specify fnType,
  args, and returns for TypeScript typechecking and including type
  signatures in codegen, but they are not checked when running functions or
  writing to a table at runtime. The inferred type of v.function() is
  FunctionHandle_future, which has the same type semantics as
  FunctionReference_future. When incorporating v.function() into your
  codebase, existing code that uses the FunctionHandle type may need to be
  updated to use FunctionHandle_future.
• Security fixes for
  GHSA-qw8j-4xj7-6f28
  and
  GHSA-9mw5-7p28-rvv4.

v1.48.0

• Convex deployments can now sign their own JWTs with an internally managed
  key-pair. The ctx.auth.signJwt API is available in mutations. The JWTs
  can be verified with the public key in the JWKS hosted at
  ${CONVEX_CLOUD_URL}/.well-known/jwks.json.

• npx convex dev --verbose and npx convex deploy --verbose no longer print
  environment variable values. The logged list of environment variables shows
  every value as <redacted>, and values of 8 or more characters are also
  redacted wherever else they appear in the logged push response and diff, such
  as auth providers that auth.config.ts builds from process.env.

• When an AI agent runs npx convex env list or npx convex env default list,
  they now list only names by default, so secrets stay out of the agent's
  context. Agents are detected from the environment variables they set. Pass
  --include-values to print the values.

• Fixed npx convex ai-files install and npx convex ai-files update reporting
  success and exiting 0 when the guidelines download or the agent skills
  install failed. They now exit with code 1.

• ctx.storage.store() and ctx.storage.get() are now available in mutations,
  not just actions. Files stored and read in a mutation count toward its
  transaction limits.

v1.47.0

• Fixed the next step printed by npx convex project create. It suggested
  npx convex deployment create <team>:<project>:dev --type dev, which always
  failed because dev is reserved for your default dev deployment. It now
  suggests a dev/my-feature reference and passes --select.
• npx convex deploy now asks for confirmation before creating or changing an
  index on a large table, since the deploy blocks until the index is backfilled.
  Stage the index (staged: true) to backfill it in the background instead, or
  pass the new --skip-large-indexes-check flag to proceed without
  confirmation. That flag also covers deleting large indexes, replacing the
  hidden --allow-deleting-large-indexes flag, which keeps working.
• The envList MCP tool now returns only environment variable names by default,
  so secrets stay out of the agent's context. Pass includeValues: true to get
  the values too, or use envGet to read a single variable.
• npx convex env list and npx convex env default list have a new
  --include-values flag for printing values explicitly. Values are still
  printed by default. The docs and help text now use --include-values wherever
  the values are needed, like
  npx convex env list --include-values > .env.convex, and --names-only for
  just listing variables.
• Added .staged() to defineTable for validating a schema change in the
  background instead of blocking the deploy on a scan of the table. Pass the
  fields to add or change, set a field to undefined to remove it, or pass a
  full validator. The current validator stays enforced while Convex checks
  existing documents and new writes against the staged one. npx convex deploy
  and npx convex deploy --dry-run report each staged table as validating,
  validated, or failed, and the dry-run warning about scanning large tables now
  suggests staging the validator. Once a staged validator is validated, moving
  it into defineTable deploys without scanning the table. A deploy that would
  discard pending or completed staged validation asks for confirmation; pass
  --allow-unstaging-schema to skip the prompt in CI. See
  https://docs.convex.dev/database/schemas#staged-validators.
• ctx.meta.getSnapshotTs() is now public API. It returns the database
  timestamp of the snapshot the current function reads from, in nanoseconds, on
  the same clock as db.vars.commitTs. See
  https://docs.convex.dev/database/advanced/commit-timestamp.
• convex/server exports getServiceUrl, which returns the base URL of a
  Convex-managed service such as the AI gateway, to pair with getServiceToken,
  along with a ServiceName type. The client no longer rejects service names it
  doesn't know about, so libraries can adopt new services without requiring a
  newer convex version.
• Fixed the Convex MCP server stalling permanently after overlapping tool calls.
• Fixed the error reported when a function or symbol is passed where a Convex
  value is expected. It now names the unsupported type and its path, like
  Function "[Function]" is not a supported Convex type at .cb, instead of
  throwing Cannot read properties of undefined (reading 'length').
• When a push fails because an environment variable used by auth.config.ts is
  not set on the deployment, the CLI now prints the npx convex env set
  commands to run and a link to the deployment's environment variable settings.
• Region prompts in the CLI list regions in the same order as the dashboard, and
  npx convex deployment create --region accepts the Canada
  (aws-ca-central-1) and Asia Pacific (aws-ap-southeast-2) regions. See
  https://docs.convex.dev/production/regions.
• npx convex deployment usage-limits set --metric aiGatewayCostDollars sets
  the AI gateway spending limit.

convex/convex-helpers (convex-helpers)

v0.1.134

Patch Changes

• open-api-spec renders unions as anyOf, so a value matching more than one member
  validates. It also supports v.bytes() instead of aborting with "bytes unsupported".

v0.1.133

• Zod 4 support: when a z.object() schema is passed as args to
  zCustomQuery/zCustomMutation/zCustomAction, checks on the object
  itself (.refine(), .superRefine(), .check()) are now run. Previously
  they were silently skipped. (#​1055)

v0.1.132

Compare Source

• Enforces defaultPolicy: "deny" for RLS on bare db.get calls where
  table name is not provided and cannot be determined.

v0.1.131

Compare Source

• Zod 4 support: fixed a regression in 0.1.130 when chaining multiple .brand()
  calls together.

v0.1.130

Compare Source

• Zod 4 support: bug fixes when used across different Zod versions:
  • zodToConvex now makes the fields of z.partialRecord optional on Zod 4.5
    and later, with literal and enum keys. Thanks to @​aymanemt1 for the fix!
    (#​1025, #​1047)
  • Fixed TS2589: Type instantiation is excessively deep and possibly infinite
    when calling convexToZod inline (e.g. in the args of zCustomMutation)
    on Zod 4.6.6 and later. Thanks to @​jherth for the fix! (#​1043)
  • Fixed the type of v.commitTs() in convexToZod on Zod 4.6. (#​1050)
  • Fixed the type of branded zod/mini objects on Zod 4.0–4.2. (#​1051)
• validate and parse now reject arrays and class instances (e.g. Date,
  Map) for v.record(...) validators, as Convex does. Thanks to
  @​RishavTiwari25 for the fix! (#​1040)

v0.1.129

Compare Source

• (fix:streams) Retry later groups after nonempty pages (#​1027)
• (fix:validators) Only match own keys of an object validator's fields. Thanks to
  @​mikirejf for the fix! (#​1035)

convex/convex-test (convex-test)

v0.0.67

Compare Source

• Adds support for file storage access in mutations.

v0.0.66

Compare Source

• perf: only visit the queried table's documents in _iterateDocs (#​154)

v0.0.65

Compare Source

• Adds support for Convex mutations that call the ctx.auth.signJwt API.

v0.0.64

Compare Source

• Update pagination restriction to match backend: components can now call
  .paginate and mutations can paginate multiple times.

v0.0.63

Compare Source

• Pin Date.now(), Date(), and new Date() for each query or mutation,
  including nested calls and t.run. Like the Convex backend, the pinned time
  is at or after the transaction's snapshot timestamp and at or before the
  _creationTime of documents the transaction inserts. Scheduled functions
  still become due according to the wall clock, as in the real Convex backend.
  (#​144)
• Enforce the 1,024-candidate limit for text search during iteration and
  pagination, including candidates excluded by post-search filters. Queries
  can stop early with .take(), smaller pages, or an early exit from iteration
  to stay within the limit. (#​169, #​171)
• Fail early when calling, scheduling, or creating a function handle for an
  unregistered component, with an error that explains how to register it and
  lists the registered components. (#​164)
• Preserve a stored Blob's content type in _storage metadata. (#​170)

ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)

v0.5.7

Compare Source

Add allowCompoundComponents option (#​117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

v0.5.6

Compare Source

• Support re-exporting namespace components (fixes #​116)

v0.5.5

Compare Source

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #​114 (fixes #​113)
• Add contentType and size to allowExportNames in Next config #​115

v0.5.4

Compare Source

• Add instant to allowExportNames in Next config #​112

sindresorhus/globals (globals)

v17.14.0

Compare Source

• Update globals (2026-11-01) (#​355) 7abfb5d

---

v17.13.0

Compare Source

• Update globals (2026-10-01) (#​354) b007369

---

v17.12.0

Compare Source

• Update globals (2026-09-01) (#​353) 50a2119
• Add __webpack_layer__ global (#​351) 779a11a

---

v17.11.0

Compare Source

• Add react-native globals (#​337) 61eafbf

---

v17.10.0

Compare Source

• Add GM_cookie to Greasemonkey globals (#​349) f468407

---

v17.9.0

Compare Source

• Update globals (2026-08-01) (#​348) 5a958ed

---

stackblitz-labs/pkg.pr.new (pkg-pr-new)

v0.0.93

Compare Source

v0.0.92

Compare Source

v0.0.91

Compare Source

v0.0.90

Compare Source

v0.0.88

Compare Source

v0.0.87

Compare Source

v0.0.86

Compare Source

v0.0.84

Compare Source

v0.0.83

Compare Source

v0.0.82

Compare Source

v0.0.81

Compare Source

prettier/prettier (prettier)

v3.9.10

Compare Source

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

v3.9.9

Compare Source

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#​20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

<!-- Prettier 3.9.8 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR`from`c.sh`, before anything else runs here.

<!-- Prettier 3.9.9 -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.

v3.9.8

Compare Source

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#​20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.7 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a

{{jsxref("TypeError")}} is thrown.

<!-- Prettier 3.9.8 -->
If `module` is not a [`WebAssembly.Module`](/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.

v3.9.7

Compare Source

diff

Markdown: Prevent indentation drift in list-item code blocks (#​19647, #​19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.

      second paragraph at six spaces that wraps
      onto another line here.

<!-- Prettier 3.9.6 -->
- [x] short first line.

      second paragraph at six spaces that wraps
          onto another line here.

<!-- Prettier 3.9.7 -->
- [x] short first line.

      second paragraph at six spaces that wraps
      onto another line here.

JavaScript: Fix embedded template literal idempotency (#​19725 by @​fisker)

// Input
const foo = html`
            <div>${getText({
            value,
            })}</div>
`;

// Prettier 3.9.6 (first format)
const foo = html`
  <div>
    ${getText({
              value,
            })}
  </div>
`;

// Prettier 3.9.6 (second format)
const foo = html`
  <div>
    ${getText({
      value,
    })}
  </div>
`;

// Prettier 3.9.7
const foo = html`
  <div>
    ${getText({
      value,
    })}
  </div>
`;

Markdown: Preserve Liquid blocks after Markdown tables (#​19730 by @​wanxiankai, @​seiyab)

<!-- Input -->
| Argument | Type |
| -------- | ---- |
{% set default_params = {
    "model": ["str"],
} %}

<!-- Prettier 3.9.6 -->
| Argument    

> [!IMPORTANT]
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone America/Los_Angeles)

- Branch creation
  - Between 12:00 AM and 04:59 AM, only on Monday (`* 0-4 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/convex/workos-authkit).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjIyLjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@convex-dev/workos-authkit@69

commit: 50efe10