fix(deps): update npm dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@apollo/client (source)	4.3.1 → 4.3.3
@​codemirror/view	6.43.13 → 6.43.14
@graphql-codegen/cli (source)	7.4.3 → 7.4.6
@graphql-codegen/typescript (source)	6.1.0 → 6.1.2
@graphql-codegen/typescript-operations (source)	6.1.9 → 6.1.10
@tanstack/react-router (source)	1.170.41 → 1.170.42
@tanstack/router-plugin (source)	1.168.42 → 1.168.43
@types/node (source)	24.19.1 → 24.19.2
js-yaml	5.4.2 → 5.4.3
prettier (source)	3.9.9 → 3.9.10
vite (source)	8.3.2 → 8.3.4

---

Release Notes

apollographql/apollo-client (@​apollo/client)

v4.3.3

Compare Source

Patch Changes

• #​13479 0ab2579 Thanks @​phryneas! - Fix a memory leak in isDeferredFragment/isStreamField

v4.3.2

Compare Source

Patch Changes

• #​13467 7786771 Thanks @​SSpirate11! - Fix an unhandled AbortError promise rejection that occurred when unsubscribing from a multipart HTTP subscription.

dotansimha/graphql-code-generator (@​graphql-codegen/cli)

v7.4.6

Compare Source

Patch Changes

• #​10985
  d8aa07f
  Thanks @​eddeee888! - Build with strict: true, which changes
  these emitted type declarations:

  • @graphql-codegen/cli: mkdirp returns Promise<string | undefined>, and the require (-r)
    CLI option's default is typed never[] instead of any[].
  • @graphql-codegen/visitor-plugin-common: BaseResolversVisitor and BaseTypesVisitor
SchemaDefinition()/SchemaExtension() return null instead of any.
  • @graphql-codegen/visitor-plugin-common: BaseSelectionSetProcessor.typeCache is keyed by
    Location | undefined.
  • @graphql-codegen/visitor-plugin-common: SelectionSetToObject.buildSelectionSet returns
    typeInfo as { name: string; type: string } | null.
  • @graphql-codegen/visitor-plugin-common: getPossibleTypes accepts null as the type, which
    graphql 15's schema.getType() can return.
  • @graphql-codegen/visitor-plugin-common: removeDescription returns nodes with
    description: undefined instead of any.
  • @graphql-codegen/typescript: TsIntrospectionVisitor's constructor takes pluginConfig as
    TypeScriptPluginConfig | undefined, DirectiveDefinition() returns null and
    ObjectTypeDefinition() returns string | null.
  • @graphql-codegen/client-preset: the babel preset accepts options as
    ClientBabelPresetOptions | null | undefined.
  • @graphql-codegen/testing: mockGraphQLServer returns nock.Scope | null.
  • @graphql-codegen/graphql-modules-preset: a schema without extensions (graphql 15) throws the
    "requires to use GraphQL SDL" error instead of a TypeError.

  Generated output is unchanged.

• Updated dependencies
  [d8aa07f]:

  • @​graphql-codegen/client-preset@6.2.3

v7.4.5

Compare Source

Patch Changes

• #​11043
  31761f9
  Thanks @​eddeee888! - dependencies updates:

  • Updated dependency
    @graphql-tools/apollo-engine-loader@^8.0.38 ↗︎
    (from ^8.0.28, in dependencies)
  • Updated dependency
    @graphql-tools/code-file-loader@^8.1.41 ↗︎
    (from ^8.1.39, in dependencies)
  • Updated dependency
    @graphql-tools/git-loader@^8.0.44 ↗︎
    (from ^8.0.32, in dependencies)
  • Updated dependency
    @graphql-tools/github-loader@^9.1.11 ↗︎
    (from ^9.0.6, in dependencies)
  • Updated dependency
    @graphql-tools/graphql-file-loader@^8.1.22 ↗︎
    (from ^8.1.11, in dependencies)
  • Updated dependency
    @graphql-tools/json-file-loader@^8.0.36 ↗︎
    (from ^8.0.26, in dependencies)
  • Updated dependency
    @graphql-tools/load@^8.1.19 ↗︎
    (from ^8.1.8, in dependencies)
  • Updated dependency
    @graphql-tools/merge@^9.2.6 ↗︎
    (from ^9.2.4, in dependencies)
  • Updated dependency
    @graphql-tools/url-loader@^9.1.12 ↗︎
    (from ^9.0.6, in dependencies)
  • Updated dependency
    @graphql-tools/utils@^12.0.3 ↗︎
    (from ^11.2.0, in dependencies)
  • Updated dependency
    graphql-config@^5.1.8 ↗︎ (from
    ^5.1.6, in dependencies)

• #​11043
  31761f9
  Thanks @​eddeee888! - Update @graphql-tools/utils to v12, and
  other @graphql-tools/* dependencies and graphql-config to releases that use it, to pick up the
  fix for GHSA-7mx3-vvmw-hjmv (prototype
  pollution in mergeDeep, @graphql-tools/utils <= 12.0.0).

  @graphql-codegen/cli now unwraps the AggregateError that newer @graphql-tools/load versions
  throw, so schema and document syntax errors still print the native GraphQLError with its file
  location.

• Updated dependencies
  [31761f9,
  31761f9,
  31761f9,
  31761f9]:

  • @​graphql-codegen/client-preset@6.2.2
  • @​graphql-codegen/core@6.2.2
  • @​graphql-codegen/plugin-helpers@7.4.2

v7.4.4

Compare Source

Patch Changes

• #​11025
  43d0f65
  Thanks @​BuddhaBing! - Widen
  Types.SchemaWithLoaderOptions['loader'] to accept a custom loader function
  (CustomSchemaLoaderFn) in addition to a path string.

  A per-entry schema custom loader ({ '<pointer>': { loader, ...options } }) is resolved by
  @graphql-tools/load's useCustomLoader, which already accepts either a path string (resolved
  via require()) or a function value at runtime (typeof loaderPointer === 'function'). Only the
  TypeScript type restricted loader to string, forcing consumers who pass an imported loader
  function (or a class instance exposing a bound loader property) to cast the schema array to
  bypass the type error, even though it worked correctly at runtime.

  This is additive and backward compatible — loader: string continues to type-check exactly as
  before.

  Also fixes a schema-cache collision for function loaders in @graphql-codegen/cli: the cache key
  is JSON.stringify(schemaPointerMap), and JSON.stringify drops functions, so two generates
  targets using different loader functions for the same pointer
  ({ 'schema.graphql': { loader: fnA } } vs { loader: fnB }) both keyed as
  {"schema.graphql":{}} and the second silently reused the first's schema. Function values are now
  keyed by object identity (via the existing getJsObjectId), so distinct loaders load separately
  while one function reused across targets still loads once.

• #​11020
  82ebbb5
  Thanks @​eddeee888! - Fix type errors in cli under
  strict: true:

  • @graphql-codegen/cli: loadCodegenConfig returns Promise<LoadCodegenConfigResult | null>,
    matching the null it resolves to when no config file is found. YamlCliFlags includes the
    kebab-case ignore-no-documents, emit-legacy-common-js-imports and import-extension flags
    that the CLI reads. CodegenContext.filepath is optional, and watch mode only watches the
    config file when the context has a filepath. CodegenContext.getConfig() without an argument
    returns Types.Config, and getConfig(extraConfig) returns T & Types.Config.
    CodegenContext.checkModeStaleFiles is typed as string[]. Adds @types/yargs,
    @types/babel__generator and @types/babel__template as dev dependencies.
  • @graphql-codegen/plugin-helpers: normalizeInstanceOrArray and normalizeConfig accept
    null and undefined, returning [].

  Generated output is unchanged.

• Updated dependencies
  [43d0f65,
  82ebbb5,
  e972b6d,
  eae0e62,
  1f7566f]:

  • @​graphql-codegen/plugin-helpers@7.4.1
  • @​graphql-codegen/client-preset@6.2.1

dotansimha/graphql-code-generator (@​graphql-codegen/typescript)

v6.1.2

Compare Source

Patch Changes

• #​10985
  d8aa07f
  Thanks @​eddeee888! - Build with strict: true, which changes
  these emitted type declarations:

  • @graphql-codegen/cli: mkdirp returns Promise<string | undefined>, and the require (-r)
    CLI option's default is typed never[] instead of any[].
  • @graphql-codegen/visitor-plugin-common: BaseResolversVisitor and BaseTypesVisitor
SchemaDefinition()/SchemaExtension() return null instead of any.
  • @graphql-codegen/visitor-plugin-common: BaseSelectionSetProcessor.typeCache is keyed by
    Location | undefined.
  • @graphql-codegen/visitor-plugin-common: SelectionSetToObject.buildSelectionSet returns
    typeInfo as { name: string; type: string } | null.
  • @graphql-codegen/visitor-plugin-common: getPossibleTypes accepts null as the type, which
    graphql 15's schema.getType() can return.
  • @graphql-codegen/visitor-plugin-common: removeDescription returns nodes with
    description: undefined instead of any.
  • @graphql-codegen/typescript: TsIntrospectionVisitor's constructor takes pluginConfig as
    TypeScriptPluginConfig | undefined, DirectiveDefinition() returns null and
    ObjectTypeDefinition() returns string | null.
  • @graphql-codegen/client-preset: the babel preset accepts options as
    ClientBabelPresetOptions | null | undefined.
  • @graphql-codegen/testing: mockGraphQLServer returns nock.Scope | null.
  • @graphql-codegen/graphql-modules-preset: a schema without extensions (graphql 15) throws the
    "requires to use GraphQL SDL" error instead of a TypeError.

  Generated output is unchanged.

• Updated dependencies
  [d8aa07f,
  5078faf]:

  • @​graphql-codegen/visitor-plugin-common@7.2.10

v6.1.1

Compare Source

Patch Changes

• #​11019
  eae0e62
  Thanks @​eddeee888! - Fix type errors in plugin-helpers under
  strict: true:

  • @graphql-codegen/plugin-helpers: ProfilerEvent.cat is optional, matching the Trace Event
    format and Profiler.run's optional cat. FederationMeta's reference selection sets are
    typed recursively ({ [field: string]: true | ReferenceSelectionSet }), matching the nested
    selections @key/@requires/@provides produce. oldVisit's visitor param is typed as
    OldVisitor: enter and leave maps keyed by AST node kind, whose callbacks receive the typed
    node plus graphql's key, parent, path and ancestors. Federation directives missing their
    fields argument, and operations whose root type is missing from the schema, throw a
    descriptive error.
  • @graphql-codegen/typescript and @graphql-codegen/typescript-operations: the
    InputValueDefinition visitor methods take path and ancestors as required params, since the
    visitor always passes them.

  Generated output is unchanged.

• #​11014
  7a376ef
  Thanks @​eddeee888! - Fix type errors in typescript under
  strict: true by typing the shared visitor methods it overrides:

  • @graphql-codegen/visitor-plugin-common: adds NormalizedDeclarationKindConfig (every
    declaration kind set), used by normalizeDeclarationKind, DEFAULT_DECLARATION_KINDS and
    ParsedTypesConfig.declarationKind. BaseTypesVisitor's NamedType, ListType,
    FieldDefinition, InputValueDefinition and UnionTypeDefinition have typed visitor params
    (key and parent are required, since the visitor always passes them), and
    ObjectTypeDefinition, EnumTypeDefinition and DirectiveDefinition may return null.
  • @graphql-codegen/typescript: skips document files without a document when collecting
    introspection types, types the TsVisitor visitor params, and TsVisitor.EnumTypeDefinition
    may return null like the introspection visitor's override.

  Generated output is unchanged.

• Updated dependencies
  [43d0f65,
  82ebbb5,
  eae0e62,
  1f7566f,
  7a376ef,
  3caccd3,
  ccc0d5c]:

  • @​graphql-codegen/plugin-helpers@7.4.1
  • @​graphql-codegen/visitor-plugin-common@7.2.8

dotansimha/graphql-code-generator (@​graphql-codegen/typescript-operations)

v6.1.10

Compare Source

Patch Changes

• #​11019
  eae0e62
  Thanks @​eddeee888! - Fix type errors in plugin-helpers under
  strict: true:

  • @graphql-codegen/plugin-helpers: ProfilerEvent.cat is optional, matching the Trace Event
    format and Profiler.run's optional cat. FederationMeta's reference selection sets are
    typed recursively ({ [field: string]: true | ReferenceSelectionSet }), matching the nested
    selections @key/@requires/@provides produce. oldVisit's visitor param is typed as
    OldVisitor: enter and leave maps keyed by AST node kind, whose callbacks receive the typed
    node plus graphql's key, parent, path and ancestors. Federation directives missing their
    fields argument, and operations whose root type is missing from the schema, throw a
    descriptive error.
  • @graphql-codegen/typescript and @graphql-codegen/typescript-operations: the
    InputValueDefinition visitor methods take path and ancestors as required params, since the
    visitor always passes them.

  Generated output is unchanged.

• #​11009
  1f7566f
  Thanks @​eddeee888! - Fix type errors in typescript-operations
  under strict: true by widening the shared types it calls into:

  • @graphql-codegen/plugin-helpers: Types.ComplexPluginOutput's prepend and append now
    accept null items. Core already skipped them.
  • @graphql-codegen/visitor-plugin-common: DeclarationBlock.withComment accepts undefined,
    parseEnumValues's mapOrStr is optional (it already defaulted to {}),
    ImportSource.namespace accepts null, and optimizeOperations's includeFragments is
    optional.
  • @graphql-codegen/typescript-operations: skips document files without a document, and no
    longer throws when called without the plugin info argument.

  Generated output is unchanged.

• Updated dependencies
  [43d0f65,
  82ebbb5,
  eae0e62,
  1f7566f,
  7a376ef,
  3caccd3,
  ccc0d5c]:

  • @​graphql-codegen/plugin-helpers@7.4.1
  • @​graphql-codegen/visitor-plugin-common@7.2.8

TanStack/router (@​tanstack/react-router)

v1.170.42

Compare Source

Patch Changes

• #​8594 2413cc0 - reduce component nesting per route match

• #​8602 efc2042 - Links of a route that the pending navigation leaves skip deriving the destination location, and clicks and preloads follow the href a Link displays. buildLocation now builds mask and routeMasks locations from the same _fromLocation as the destination.

• #​8602 efc2042 - Fixed Link destinations that resolve to a route mask are now reused across navigations instead of being rebuilt every time. A mounted Link now follows changes to its href and reloadDocument props, and React Links no longer each subscribe to a hydration flag.

• #​8579 d35aab4 - Cancel pending link preload timers when starting navigation to avoid redundant preloading while the destination is loading.

• Updated dependencies [dfe3dea, dfe3dea, dfe3dea, efc2042, efc2042, dfe3dea, 663282b]:

  • @​tanstack/history@1.162.5
  • @​tanstack/router-core@1.171.35

TanStack/router (@​tanstack/router-plugin)

v1.168.43

Compare Source

Patch Changes

• Updated dependencies [dfe3dea, 2413cc0, efc2042, efc2042, dfe3dea, d35aab4, 663282b]:
  • @​tanstack/router-core@1.171.35
  • @​tanstack/react-router@1.170.42
  • @​tanstack/router-generator@1.167.41

nodeca/js-yaml (js-yaml)

v5.4.3

Compare Source

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented
  line, #​802.

prettier/prettier (prettier)

v3.9.10

Compare Source

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

vitejs/vite (vite)

v8.3.4

Compare Source

Features

• bundled-dev: support import.meta.hot.acceptExports (#​23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #​23575) (#​23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#​23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #​23652) (#​23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#​23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#​23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#​23688) (cf52011)
• deps: update all non-major dependencies (#​23648) (8a4c19c)
• deps: update rolldown-related dependencies (#​23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #​23392) (#​23484) (70d56ea)
• don't treat modules ending with js-like query as js (#​23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#​23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #​23628) (#​23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#​23678) (8579189)
• remove input option unescaping for now (#​23694) (facc2fb)
• server: match static aliases on path boundaries (#​23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#​23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#​23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#​23674) (182f5b2)

v8.3.3

Compare Source

Bug Fixes

• deps: update launch-editor to v2.14.2 (#​23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#​23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#​23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#​23656) (c3e06f9)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 9am on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 796521f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cloudoperators.github.io/juno/pr-preview/pr-2079/
Built to branch gh-pages at 2026-10-17 12:27 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[Copilot]

🟡 Changes recommended

Several Vitest importer snapshots still resolve jsdom 30.1.1, leaving the dependency update incomplete.

1 open finding

• Complete jsdom update across Vitest workspace configurations · New

What changed in this PR

Updates four npm dependencies across the monorepo and refreshes their lockfile resolutions.

Changes:

• Updates React Query and Immer patch versions in affected apps.
• Updates jsdom across test-enabled workspaces.
• Updates vite-plugin-dts across library packages.

File	Description
pnpm-lock.yaml	Refreshes dependency resolutions and transitive packages.
packages/​url-state-provider/​package.json	Updates jsdom and vite-plugin-dts.
packages/​ui-components/​package.json	Updates jsdom and vite-plugin-dts.
packages/​template/​package.json	Updates jsdom and vite-plugin-dts.
packages/​oauth/​package.json	Updates vite-plugin-dts.
packages/​messages-provider/​package.json	Updates vite-plugin-dts.
packages/​k8s-client/​package.json	Updates vite-plugin-dts.
packages/​greenhouse-auth-provider/​package.json	Updates vite-plugin-dts.
packages/​communicator/​package.json	Updates jsdom and vite-plugin-dts.
apps/​template/​package.json	Updates jsdom.
apps/​supernova/​package.json	Updates React Query, Immer, and jsdom.
apps/​heureka/​package.json	Updates React Query and jsdom.
apps/​greenhouse/​package.json	Updates React Query and Immer.
apps/​doop/​package.json	Updates React Query and jsdom.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ArtieReus]

checking!!