chore(deps-dev): bump react-doctor from 0.5.8 to 0.7.6 in the dev-dependencies group across 1 directory

[dependabot]

Bumps the dev-dependencies group with 1 update in the / directory: react-doctor.

Updates react-doctor from 0.5.8 to 0.7.6

Release notes

Sourced from react-doctor's releases.

react-doctor@0.7.6

Patch Changes

• #1159 3aef25a Thanks @​aidenybai! - Assign derived-state effect writes to one stable rule owner instead of emitting overlapping sibling diagnostics.

• #1114 76cd6be Thanks @​aidenybai! - Reduce cold full-scan CPU and allocation overhead with comment-tolerant security-rule content gates, semantic analysis only for rules that consume it, cached binding-mutation scans, analysis-local scope and reference caches, host-native component/export collection, combined state observation passes, single-pass control-flow construction, allocation-free and decorator-aware visitor-key traversal for closure-capture, effect cleanup, and React render analysis, lazy shadow-binding sets, constant-time dependency checks, compatible React Compiler plugin resolution, and newer Oxc parser and resolver releases. Preserve ESLint filename fallbacks, decorator scope semantics, scope-aware React HOC identity, and bodyless TypeScript declarations across the optimized analysis paths.

• Updated dependencies [dbd4067, bc49aaa, 3075e10, 0654849, 18e8717, a240f8b, 76cd6be, 8fc5848, 22bb155, 21da48f, 20cd922, d9676e2, 3afd146, 70eff9a]:

  • oxlint-plugin-react-doctor@0.7.6
  • deslop-js@0.7.6

react-doctor@0.7.5

Patch Changes

• #1117 99ac4ff Thanks @​aidenybai! - Fix project discovery failing with "No React project found" when the resolved typescript package loads as CJS without named ESM exports (e.g. typescript@5.3 under pnpm's isolated layout): import the TypeScript compiler API via its default export, and surface unexpected discovery exceptions as a new ProjectDiscoveryFailed error instead of masking them as ProjectNotFound. (#1115)

• #1120 9380081 Thanks @​aidenybai! - Emit JSON report schema version 3 with deterministic diagnostic identities and exact per-project scan coverage while retaining v1 and v2 decoding.

• Updated dependencies [d4f2209, 5113067, 118f806, 63fc41f, 98005f2, 7bbb792, 5aa82e8, 11333b9, b47d053, a31f5e8, a989008, 6610ea9, 6292f89, 593824d, 2b5a18e, 6821fe0, 3ec8e1e, b686594, 4a5d9bb, 3867cf1, 70b5d99]:

  • oxlint-plugin-react-doctor@0.7.5
  • deslop-js@0.7.5

react-doctor@0.7.4

Patch Changes

• Updated dependencies [f91ede7, 6b70b32, 82187a3]:
  • oxlint-plugin-react-doctor@0.7.4
  • deslop-js@0.7.4

react-doctor@0.7.2

Patch Changes

• #1077 9cb4149 Thanks @​aidenybai! - Align 30+ rules with their documented behavior, fixing the false-positive clusters confirmed by a validation pass of 2,143 sampled diagnostics against the official rule prompts. Highlights: jsx-key now flags key-after-spread (the documented hazard) instead of the safe key-before-spread shape and exempts props rest parameters; no-did-update-set-state honors the prop-comparison guard exemption; no-console skips Node CLI scripts; circular-dependency skips type-only, lazy-import, and render-time-only cycles; query-mutation-missing-invalidation exempts read-only mutations; insecure-crypto-risk requires cryptographic context instead of matching identifier names; no-unknown-property allows valid hyphenated SVG attributes; no-aria-hidden-on-focusable verifies the element is actually focusable; no-flush-sync implements the documented DOM-measurement carve-out.

• #1069 5809083 Thanks @​rayhanadev! - Add --supply-chain / --no-supply-chain CLI flags to toggle the dependency supply-chain scan, mirroring --lint/--no-lint and --dead-code/--no-dead-code. Supply-chain enablement now resolves as a scan option (InspectOptions.supplyChain) against supplyChain.enabled — the flag wins — so it takes precedence over per-project config on every scan (a workspace module's config can't undo --no-supply-chain), and config isn't mutated so scan.hasCustomConfig telemetry stays accurate. The enabled state also rides the per-scan wide event as scan.supplyChain.

• #1083 5d2f17f Thanks @​skoshx! - query-destructure-result no longer classifies rest-destructuring (const { data, ...rest } = query) — that shape is query-no-rest-destructuring's territory, and claiming it in both rules reported the same line twice (#1082). The rule now fires only on the consumption it uniquely owns: spreading the whole TanStack Query result into JSX (<Inner {...query} />) or an object literal, which enumerates every field and subscribes the component to all of them.

• #1070 64452aa Thanks @​rayhanadev! - Fix whole-repo scan cache replaying another project's diagnostics when a .git-less checkout sits inside an unrelated repository (e.g. a gitignored benchmark/mining clone directory reused across projects). The cache key's git identity (HEAD sha, worktree fingerprint) resolved from the enclosing repository, which cannot see the checkout's files, so two different projects materialized at the same path keyed identically. The key now requires the fingerprinted repository to actually track files under the project directory (cache off otherwise), and every cache hit re-verifies the stored payload's directory and package.json content hash so any future keying bug of this class degrades to a miss instead of a cross-project replay.

• #1077 9cb4149 Thanks @​aidenybai! - Third-round FP sweep: honor eslint-disable react-hooks/<rule> spellings for React Compiler diagnostics, suppress immutability findings inside Reanimated worklets, skip the vulnerability axis for devDependencies in supply-chain scoring, suppress query-no-usequery-for-mutation for polled/read-verb POST endpoints, prune compile-time-erased edges from circular-dependency detection, and fix unused-export/unused-file/unused-dev-dependency false positives in deslop-js.

• Updated dependencies [9cb4149, 1880b15, 5d2f17f, 9cb4149]:

  • oxlint-plugin-react-doctor@0.7.2
  • deslop-js@0.7.2

react-doctor@0.7.1

Patch Changes

• #1062 6b21b70 Thanks @​devin-ai-integration! - Surface when a scan target had no discoverable React project, so a gated-off run can't pass for a clean one.

... (truncated)

Changelog

Sourced from react-doctor's changelog.

0.7.6

Patch Changes

• #1159 3aef25a Thanks @​aidenybai! - Assign derived-state effect writes to one stable rule owner instead of emitting overlapping sibling diagnostics.

• #1114 76cd6be Thanks @​aidenybai! - Reduce cold full-scan CPU and allocation overhead with comment-tolerant security-rule content gates, semantic analysis only for rules that consume it, cached binding-mutation scans, analysis-local scope and reference caches, host-native component/export collection, combined state observation passes, single-pass control-flow construction, allocation-free and decorator-aware visitor-key traversal for closure-capture, effect cleanup, and React render analysis, lazy shadow-binding sets, constant-time dependency checks, compatible React Compiler plugin resolution, and newer Oxc parser and resolver releases. Preserve ESLint filename fallbacks, decorator scope semantics, scope-aware React HOC identity, and bodyless TypeScript declarations across the optimized analysis paths.

• Updated dependencies [dbd4067, bc49aaa, 3075e10, 0654849, 18e8717, a240f8b, 76cd6be, 8fc5848, 22bb155, 21da48f, 20cd922, d9676e2, 3afd146, 70eff9a]:

  • oxlint-plugin-react-doctor@0.7.6
  • deslop-js@0.7.6

0.7.5

Patch Changes

• #1117 99ac4ff Thanks @​aidenybai! - Fix project discovery failing with "No React project found" when the resolved typescript package loads as CJS without named ESM exports (e.g. typescript@5.3 under pnpm's isolated layout): import the TypeScript compiler API via its default export, and surface unexpected discovery exceptions as a new ProjectDiscoveryFailed error instead of masking them as ProjectNotFound. (#1115)

• #1120 9380081 Thanks @​aidenybai! - Emit JSON report schema version 3 with deterministic diagnostic identities and exact per-project scan coverage while retaining v1 and v2 decoding.

• Updated dependencies [d4f2209, 5113067, 118f806, 63fc41f, 98005f2, 7bbb792, 5aa82e8, 11333b9, b47d053, a31f5e8, a989008, 6610ea9, 6292f89, 593824d, 2b5a18e, 6821fe0, 3ec8e1e, b686594, 4a5d9bb, 3867cf1, 70b5d99]:

  • oxlint-plugin-react-doctor@0.7.5
  • deslop-js@0.7.5

0.7.4

Patch Changes

• Updated dependencies [f91ede7, 6b70b32, 82187a3]:
  • oxlint-plugin-react-doctor@0.7.4
  • deslop-js@0.7.4

0.7.3

Patch Changes

• #978 b97a92f Thanks @​rayhanadev! - Fix #976: Next.js projects using output: "export" (static export) no longer receive server-only fix recommendations that are impossible without a request-time server. server-fetch-without-revalidate is gated off, nextjs-no-client-side-redirect keeps firing but its advice drops the middleware / getServerSideProps clause (recommending a render-time or client-side redirect instead), and no-prevent-default emits the framework-neutral <form> message rather than recommending Server Actions. The detection also works when the static export lives in a workspace: a monorepo-root scan whose apps/web sets output: "export" is now recognized (the config is read next to the manifest that supplies the next dependency).

  Under the hood this refactors framework gating into one typed capability vocabulary — a Capability union both requires/disabledWhen metadata and the runtime hasCapability(settings, …) check compile against, so a misspelled token fails tsc instead of silently never matching. Rules own their capability-conditioned prose via a new recommendationFor(hasCapability) hook (core no longer rewrites specific rules' advice), and no-prevent-default's hardcoded SPA framework list is replaced by the new client-only capability. ESLint-plugin users who suppressed the <form> variant via settings["react-doctor"].framework should now set settings["react-doctor"].capabilities: ["client-only"].

  Project discovery now traverses workspaces once instead of up to ~7 times (one pass collects react/tailwind/zod/framework, React Native awareness, reanimated, expo, flash-list, and next facts), and workspace precedence is sorted-deterministic instead of filesystem readdir order — on multi-workspace repos where several packages could supply the framework or React version signal, the first in sorted walk order now consistently wins.

• 9b59d96 Thanks @​aidenybai! - New rule no-locale-format-in-render (warn, SSR-capable projects only): flags locale/timezone-dependent formatting evaluated during render — toLocaleString / toLocaleDateString / toLocaleTimeString on date-shaped receivers, Intl.DateTimeFormat(...).format(...), and Date default stringification — because the server's locale and timezone differ from the browser's, causing hydration mismatches. Number formatting (Intl.NumberFormat, bare toLocaleString() on numbers) is deliberately out of scope: its only environment input is the ICU locale, a far weaker mismatch signal that was almost always client-fetched dashboard data in corpus validation. Formatting with an explicit locale and timeZone, inside event handlers or effects, behind client-only guards, or under suppressHydrationWarning stays unflagged. rendering-hydration-no-flicker gained a matching escape so the recommended post-mount useEffect + state fix is never flagged as a flicker.

• #1103 08b768b Thanks @​aidenybai! - Rescue oxlint OOM-dropped files with a serial replay instead of reporting a partial scan. When a parallel lint pass drops files because oxlint's native binding SIGABRT'd under memory pressure (oxc's fixed-size allocator panics when N concurrent oxlint processes compete for memory on very large packages), those files are now replayed once, serially, one single-file batch each — the memory pressure is usually a function of sibling processes, not the file itself, so the replay typically completes the scan. Only files that still fail alone stay dropped and reported.

• 9b59d96 Thanks @​aidenybai! - prefer-use-sync-external-store now detects hand-rolled module-scope stores: a mutable module binding plus a listener registry and same-file subscribe function, consumed as useState(sharedState) with a useEffect(() => subscribe(setState), []). Publishes fired between the render-time snapshot and the effect-time subscription are lost and concurrent renders can tear — useSyncExternalStore(subscribe, getSnapshot) is the fix. Genuine useSyncExternalStore usage, imported subscribe functions, and effects with non-empty dependencies stay unflagged.

• #1102 da7bb4b Thanks @​aidenybai! - no-react19-deprecated-apis no longer flags useContext. React 19's use() is an additive alternative — useContext remains a fully supported, non-deprecated API, so calling it deprecated was misinformation. The rule still flags forwardRef (both named imports and React.forwardRef member access) on React 19+ projects.

... (truncated)

Commits

• e877ca7 chore: version packages (#1145)
• 037bd56 perf(core): cache per-file lint results in audit mode (#1158)
• 3aef25a fix: assign derived state diagnostics to one owner (#1159)
• 76cd6be perf: reduce cold scan startup and add V8 profiling (#1114)
• 0f07133 chore: version packages (#1118)
• 118f806 fix(rules): expand effect cleanup lifecycle coverage (#1123)
• b47d053 feat(rules): add SSR and hydration diagnostics (#1122)
• 3867cf1 fix(rules): tighten React 19 and JSX precision (#1121)
• 9380081 feat(report): add versioned JSON v3 metadata (#1120)
• b686594 fix(rules): unify state and effect provenance (#1119)
• Additional commits viewable in compare view