chore(deps): lock file maintenance by renovate[bot] · Pull Request #219 · TanStack/hotkeys

renovate · 2026-11-01T03:19:42Z

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-11-01T03:19:47Z

⚠️ No Changeset found

Latest commit: a06d467

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-11-01T03:19:50Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: TanStack/hotkeys
Branch: main
File: .coderabbit.yaml
Commit: e56edd6
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 7928adfb-dacf-48e4-a52e-249e724ca87f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

github-actions · 2026-11-01T03:20:14Z

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

socket-security · 2026-11-01T03:20:19Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@angular-devkit/build-angular@22.2.1 ⏵ 22.2.5			⁺¹	^-45
	@size-limit/preset-small-lib@14.1.0 ⏵ 14.3.0	⁺¹		⁺⁴	⁺¹
	happy-dom@20.14.5 ⏵ 20.14.6		⁺²	⁺¹		^-30
	nx@23.2.1 ⏵ 23.3.1			⁺¹
	@angular/platform-browser-dynamic@22.2.1 ⏵ 22.2.4				^-1
	@typescript-eslint/parser@8.71.0 ⏵ 8.72.1
	@angular/platform-browser@22.2.1 ⏵ 22.2.4			⁺¹	^-1
	alpinejs@3.17.4 ⏵ 3.17.5			⁺¹	^-2
	@angular/compiler-cli@22.2.1 ⏵ 22.2.4				^-1
	@sveltejs/package@3.0.0 ⏵ 3.0.2			⁺¹	^-1
	@angular/router@22.2.1 ⏵ 22.2.4			⁺¹	^-1
	@angular/forms@22.2.1 ⏵ 22.2.4	⁺¹		⁺¹
	@angular/cli@22.2.1 ⏵ 22.2.5			⁺¹
	@angular/compiler@22.2.1 ⏵ 22.2.4	⁺¹
	@angular/core@22.2.1 ⏵ 22.2.4			⁺¹	^-1	^-19
	@angular/common@22.2.1 ⏵ 22.2.4
	vitest@5.0.3 ⏵ 5.0.5			⁺¹
	@types/node@26.6.4 ⏵ 26.6.6	⁺¹		⁺¹
	@embroider/vite@1.7.13 ⏵ 1.8.0	⁺¹		⁺¹²
	vite@8.3.2 ⏵ 8.3.5	⁺¹	⁺²²	⁺¹	^-1
	size-limit@14.1.0 ⏵ 14.3.0	⁺¹		⁺¹	⁺¹
	react@19.3.0 ⏵ 19.3.1
	@tanstack/react-router@1.170.41 ⏵ 1.170.46			⁺¹	⁺¹
	svelte@5.57.1 ⏵ 5.57.3	⁺¹		⁺¹	⁺²
	tsdown@0.23.0 ⏵ 0.23.4	⁺¹		⁺¹	⁺²
	@embroider/addon-shim@1.10.3 ⏵ 1.11.0	⁺¹		⁺¹	⁺²
	vite-plugin-solid@2.11.14 ⏵ 2.11.15				^-7
	@vitejs/plugin-vue@6.0.9 ⏵ 6.0.10
	vue@3.5.43 ⏵ 3.5.44			⁺¹
	tslib@2.9.1
	@vitejs/plugin-react@6.1.1 ⏵ 6.1.2	⁺¹		⁺¹
	@testing-library/preact@3.2.4 ⏵ 3.2.6				⁺⁶
See 8 more rows in the dashboard

View full report

socket-security · 2026-11-01T03:20:21Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	Publisher changed: npm `tslib` is now published by microsoft1es Author: microsoft1es From: examples/angular/injectHeldKeys/package.json → `npm/tslib@2.9.1` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/tslib@2.9.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Publisher changed: npm `@harperfast/extended-iterable` is now published by ethan_arrowood Author: ethan_arrowood From: pnpm-lock.yaml → `npm/@angular-devkit/build-angular@22.2.5` → `npm/@harperfast/extended-iterable@1.0.5` ℹ Read more on: This package \| This alert \| What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@harperfast/extended-iterable@1.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Deprecated by its maintainer: npm `@angular-devkit/build-angular` Reason: Angular's Webpack support is deprecated. Use the esbuild and Vite-based "@angular/build" package instead. From: examples/angular/injectHeldKeys/package.json → `npm/@angular-devkit/build-angular@22.2.5` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@angular-devkit/build-angular@22.2.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Deprecated by its maintainer: npm `@ngtools/webpack` Reason: Angular's Webpack support is deprecated. Use the esbuild and Vite-based "@angular/build" package instead. From: pnpm-lock.yaml → `npm/@angular-devkit/build-angular@22.2.5` → `npm/@ngtools/webpack@22.2.5` ℹ Read more on: This package \| This alert \| What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@ngtools/webpack@22.2.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@yuku-core/binding-android-arm64` Location: Package overview From: pnpm-lock.yaml → `npm/tsdown@0.23.4` → `npm/@yuku-core/binding-android-arm64@0.19.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@yuku-core/binding-android-arm64@0.19.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@yuku-core/binding-freebsd-x64` Location: Package overview From: pnpm-lock.yaml → `npm/tsdown@0.23.4` → `npm/@yuku-core/binding-freebsd-x64@0.19.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@yuku-core/binding-freebsd-x64@0.19.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@yuku-core/binding-linux-arm-gnu` Location: Package overview From: pnpm-lock.yaml → `npm/tsdown@0.23.4` → `npm/@yuku-core/binding-linux-arm-gnu@0.19.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@yuku-core/binding-linux-arm-gnu@0.19.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@yuku-core/binding-linux-arm-musl` Location: Package overview From: pnpm-lock.yaml → `npm/tsdown@0.23.4` → `npm/@yuku-core/binding-linux-arm-musl@0.19.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@yuku-core/binding-linux-arm-musl@0.19.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Low adoption: npm `@yuku-core/binding-win32-arm64` Location: Package overview From: pnpm-lock.yaml → `npm/tsdown@0.23.4` → `npm/@yuku-core/binding-win32-arm64@0.19.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@yuku-core/binding-win32-arm64@0.19.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

pkg-pr-new · 2026-11-01T03:20:53Z

Open in StackBlitz

@tanstack/alpine-hotkeys

npm i https://pkg.pr.new/@tanstack/alpine-hotkeys@219

@tanstack/angular-hotkeys

npm i https://pkg.pr.new/@tanstack/angular-hotkeys@219

@tanstack/angular-hotkeys-devtools

npm i https://pkg.pr.new/@tanstack/angular-hotkeys-devtools@219

@tanstack/ember-hotkeys

npm i https://pkg.pr.new/@tanstack/ember-hotkeys@219

@tanstack/hotkeys

npm i https://pkg.pr.new/@tanstack/hotkeys@219

@tanstack/hotkeys-devtools

npm i https://pkg.pr.new/@tanstack/hotkeys-devtools@219

@tanstack/lit-hotkeys

npm i https://pkg.pr.new/@tanstack/lit-hotkeys@219

@tanstack/octane-hotkeys

npm i https://pkg.pr.new/@tanstack/octane-hotkeys@219

@tanstack/preact-hotkeys

npm i https://pkg.pr.new/@tanstack/preact-hotkeys@219

@tanstack/preact-hotkeys-devtools

npm i https://pkg.pr.new/@tanstack/preact-hotkeys-devtools@219

@tanstack/react-hotkeys

npm i https://pkg.pr.new/@tanstack/react-hotkeys@219

@tanstack/react-hotkeys-devtools

npm i https://pkg.pr.new/@tanstack/react-hotkeys-devtools@219

@tanstack/solid-hotkeys

npm i https://pkg.pr.new/@tanstack/solid-hotkeys@219

@tanstack/solid-hotkeys-devtools

npm i https://pkg.pr.new/@tanstack/solid-hotkeys-devtools@219

@tanstack/svelte-hotkeys

npm i https://pkg.pr.new/@tanstack/svelte-hotkeys@219

@tanstack/svelte-hotkeys-devtools

npm i https://pkg.pr.new/@tanstack/svelte-hotkeys-devtools@219

@tanstack/vue-hotkeys

npm i https://pkg.pr.new/@tanstack/vue-hotkeys@219

@tanstack/vue-hotkeys-devtools

npm i https://pkg.pr.new/@tanstack/vue-hotkeys-devtools@219

commit: a06d467

renovate · 2026-11-01T03:41:32Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

chore(deps): lock file maintenance

f94a53d

renovate Bot added the dependencies label Nov 1, 2026

ci: apply automated fixes

a06d467

Navigation Menu

Repository navigation

chore(deps): lock file maintenance - #219

chore(deps): lock file maintenance#219
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/lock-file-maintenance

renovate Bot commented Nov 1, 2026

Uh oh!

changeset-bot Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Nov 1, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Nov 1, 2026

Uh oh!

socket-security Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Nov 1, 2026

Configuration

Uh oh!

changeset-bot Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Nov 1, 2026

🚀 Changeset Version Preview

Uh oh!

socket-security Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate Bot commented Nov 1, 2026

Edited/Blocked Notification

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

changeset-bot Bot commented Nov 1, 2026 •

edited

Loading

coderabbitai Bot commented Nov 1, 2026 •

edited

Loading

socket-security Bot commented Nov 1, 2026 •

edited

Loading

socket-security Bot commented Nov 1, 2026 •

edited

Loading

pkg-pr-new Bot commented Nov 1, 2026 •

edited

Loading