fix(deps): update patch updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@tanstack/react-query (source)	5.104.0 → 5.104.1			dependencies	patch
@types/node (source)	24.19.0 → 24.19.1			devDependencies	patch	24.19.2
@vitejs/plugin-react (source)	6.1.1 → 6.1.2			devDependencies	patch
libc	0.2.189 → 0.2.190			dependencies	patch
shadcn (source)	4.21.0 → 4.21.3			dependencies	patch	4.21.4
tokio (source)	1.53.1 → 1.53.2			dependencies	patch
vite (source)	8.3.1 → 8.3.3			devDependencies	patch	8.3.4

---

Release Notes

TanStack/query (@​tanstack/react-query)

v5.104.1

Compare Source

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@5.104.1

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.1.2

Compare Source

Fix HMR for compound components (#​1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#​1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #​1478) (#​1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

rust-lang/libc (libc)

v0.2.190

Compare Source

There is now a single config for enabling 64-bit time_t: libc_unstable_time64. This can be set
unconditionally; it opts in to 64-bit time_t on the following platforms that use 32-bit by
default:

• 32-bit Linux-GNU
• 32-bit Linux-uClibc
• 32-bit Linux-musl. Note that setting this flag also enables some other changes that happend in
  musl v1.2.
• 32-bit Windows-GNU
• ESP-IDF (all targets with this environment are 32-bit)

Most other 32-bit platforms are either already using 64-bit time_t, or are considered legacy
and will not be gaining support from their upstream maintainers.

You can enable this using RUSTFLAGS:

RUSTFLAGS='--cfg=libc_unstable_time64' cargo ...

Note that there may still be some changes to features gated by this config option, hence "unstable"
in its name. In the near future we will rename it to just libc_time64. Until then, please test it
out and report any bugs you find!

Support

• Add initial support for HelenOS (#​4355)

Added

We are slowly filling out the Default implementations, to reduce the need for mem::zeroed() in user code:

• Unix: Implement Default for a number of structs, especially on Apple platforms (#​5576)
• Linux, NetBSD: Give statvfs a Default impl (#​5583)
• Linux: Add Default to a linux/can.rs structs (#​5257)

Other additions:

• Expose the libc_unstable_time64 cfg (#​5411)
• Android, Glibc: Add pthread_gettid_np (#​5359)
• Android: Add RTLD_NEXT (#​5323)
• Android: Add reuseport BPF socket options (#​5366)
• Apple: Add TCP header flags, options and SACK limits (#​5358)
• Apple: Add NET_RT_DUMP2 (#​5442)
• Apple: Add posix_spawn_file_actions_add(f)chdir(_np) (#​5558)
• BSD: Add BPF_WORDALIGN (#​5320)
• BSD: Add lchmod and lchflags where supported (#​5400)
• BSD: Add minherit and related constants (#​4849)
• Docs: Add more links to public headers and manual pages (#​5407), (#​5485)
• Emscripten: Add epoll support (#​5427)
• FreeBSD: Add AT_RENAME_* and RENAME_* constants (#​5560)
• FreeBSD: Add renameat2 (#​5563)
• FreeBSD: Add rt_msghdr and rt_metrics (#​5367)
• Hurd: Add handling of LFS under libc_unstable_gnu_time_bits (#​5242)
• Linux-GNU: Add environ (#​5339)
• Linux-GNU: Add the new f_type field to statvfs and statvfs64 (#​5434)
• Linux-like: Add additional STATX_* constants (#​5412)
• Linux-musl, Emscripten: Add SIGEV_THREAD_ID (#​5375)
• Linux-musl: Add *_SUPER_MAGIC constants (#​5453)
• Linux-musl: Make statx always available (#​5448)
• Linux-s390x: Add max_align_t (#​5389)
• Linux: Add BCACHEFS_SUPER_MAGIC (#​5516)
• Linux: Add ETH_P_LLDP (#​5438)
• Linux: Add FUTEX_ROBUST_UNLOCK and FUTEX_ROBUST_LIST32 (#​5525)
• Linux: Add NLMSG_* helpers (#​5321)
• Linux: Update the definition of siginfo_t and add more getter functions (#​5345)
• Musl riscv64: Add SYS_futex_waitv (#​5527)
• Newlib: Add __errno (#​5346)
• OpenBSD: Add RTLD_NODELETE and RTLD_NOLOAD (#​5377)
• OpenBSD: Add getexecpath (#​5465)
• OpenBSD: Add bindings from sensors.h (#​5510)
• OpenBSD: Add missing HW_* sysctl constants (#​5371)
• QNX: Add definitions for io-sock (#​5469)
• Redox: Add FILENAME_MAX (#​5530)
• Redox: Add clock_settime and pause (#​5363)
• Redox: Add getrandom bindings (#​5333)
• Unix: Add RFC 3678 multicast group_req/group_source_req and MCAST_* where supported (#​5236)
• Unix: Add HOST_NAME_MAX (#​5531)
• Unix: Add _PATH_BSHELL and _PATH_DEFPATH where available (#​5449)
• WASI: Add SOCK_CLOEXEC (#​5336)
• WASI: Add locale category constants (#​5378)
• WASI: Add more pthread APIs (#​5310)
• uClibc: Support 64-bit time_t on 32-bit platforms via cfg (#​5261)

Deprecated

• AIX: deprecate _kernel_simple_lock (#​5380)
• Deprecate integer *_MIN/*_MAX in favor of e.g. c_int::MAX (#​5404)
• Fuchsia: Deprecate types that do not exist upstream (#​5127)
• Hurd: Deprecate fallocate64, which does not exist on the platform (#​5242)
• Hurd: Deprecate redundant glob64 types and routines (#​5242)
• L4Re: deprecate LFS bindings (#​5173)
• OpenBSD: Deprecate syscall, mincore, and KERN_NSELCOLL, all of which have been removed upstream (87992e9895c2)
• Unix: Deprecate the POSIX-obsoleted tmpnam, tempnam (#​5478)

Fixed

• breaking AIX: Change the type of BPF_ALIGNMENT to size_t to match upstream and harmonize with other platforms. (#​5373)
• breaking Apple: change the type of BPF_ALIGNMENT to size_t to match upstream and harmonize with other platforms. (#​5348)
• Exclude non-required repository files from the published crate (#​5312)
• AIX: Correct the function signature in fileops_t.fo_select (#​5380)
• AIX: Fix the alignment of file (#​5380)
• Android: Add missing padding to ucontext_t (#​5189)
• Android: Fix the value of RISC-V O_ flags (#​5554)
• Fuchsia: Correct mcontext_t and ucontext_t and make them usable on more platforms (#​5127)
• Fuchsia: Fix available fields in glob_t and statvfs (#​5127)
• Fuchsia: Fix the definition of sigevent and correct the layout of other pthread.h types (#​5127)
• Haiku: Correct the definition of sem_t (#​5351)
• Linux-GNU: Fix the padding field in statvfs64 on 32-bit RISC-V (#​5518)
• Linux: Correct PowerPC64 speed symbols with elfv2 (#​5342)
• Linux: Fix syscall numbers on 32-bit RISC-V (#​5455)
• Musl riscv64: Fix the definition of ipc_perm (#​5527)
• Musl riscv64: Fix the name of the uc_flags field in ucontext_t (#​5527)
• NetBSD: Fix WIFSTOPPED (#​5458)
• Newlib: Update the time_t alias. This is a correction on Arm32 RTEMS (#​5132)
• NuttX: Correct O_ open flags (#​5414)
• RTEMS: Correct socket.h definitions (#​5313)
• RTEMS: Correct the size of clock and storage type aliases (#​5450)
• Redox: Correct signal.h types (#​5436)

Changed

• The unstable cfg libc_unstable_musl_v1_2_3 has been renamed to a more accurate
  libc_unstable_musl_v1_2. The old version will continue to work for now, but will be removed in
  1-2 releases. (#​5376)
• AIX: Make function pointers in signatures unsafe (#​5380)
• Cygwin: Change POSIX_SPAWN_* flags to c_short (#​5572)
• Hermit: Make iovec fields public (#​5460)
• Improve the panic message for out-of-range fds in FD_* functions (#​5528)
• Musl riscv64: Fix the name of __riscv_mc_q_ext_state.__reserved and make it private (#​5533)
• Various: Make obsolete stat fields non-pub (#​5542)
• uClibc: No longer link to libutil (#​5165)

Removed

libc exposed quite a bit of API on all Apple platforms that is not actually available anywhere other than MacOS. This release removes a number of these cases.

• breaking Apple: Disable mach.h API on Apple mobile OSs (e6bfb187513c)
• breaking Apple: Remove a large number of items from iOS, tvOS, watchOS, and visionOS that are only available on MacOS. (#​5158)
• breaking Apple: Remove the unsupported exec* and fork calls from tvOS and watchOS (#​5158)

Additionally, this release cleans up a lot of API that has been deprecated since at least libc 0.2.100, released 2021-08-20.

• breaking Android, Linux: remove unsound af_alg_iv trait implementations. The have been deprecated for a long time because they allowed out-of-bounds reads via safe functions. (444db4456f38)
• breaking Remove most items that have been deprecated since before 0.2.100 (#​5401)

Other removed items:

• Dragonfly: Remove INHERIT_ZERO that does not exist upstream (#​5587)
• Musl riscv64: Remove GNU-gated REG_* definitions (#​5527)
• Musl riscv64: Remove non-esxistant REG_NARGS (#​5527)

A huge thank you to our GSoC student Adam Martinez (@​dybucc) who did a
huge amount of the time64 work, as well as many of the platform fixes!

shadcn-ui/ui (shadcn)

v4.21.3

Compare Source

Patch Changes

• #​12148 596be8dda8f94927281184b8c4575150531f85ea Thanks @​shadcn! - Fix ERR_REQUIRE_CYCLE_MODULE when running the CLI with pnpm dlx on Windows.

• Updated dependencies [596be8dda8f94927281184b8c4575150531f85ea]:

  • @​shadcn/registry@0.1.2

v4.21.2

Compare Source

Patch Changes

• #​12143 8c2bf3882cb856ac10abbb162bdc0b8383ebd432 Thanks @​shadcn! - Accept components.json and package.json files that start with a UTF-8 byte order mark.

• #​12142 95efb5cd8d7f13adba70b58b1119211e8980683f Thanks @​shadcn! - replace cosmiconfig with a smaller custom reader.

• #​12140 3b1ae6e43f082dd82d0e5710b813cfad929abdb4 Thanks @​shadcn! - Skip npm audit and the funding check when installing or removing dependencies, or creating a project, with npm.

• Updated dependencies [8c2bf3882cb856ac10abbb162bdc0b8383ebd432, 95efb5cd8d7f13adba70b58b1119211e8980683f, 3b1ae6e43f082dd82d0e5710b813cfad929abdb4]:

  • @​shadcn/registry@0.1.1

v4.21.1

Compare Source

Patch Changes

• #​12087 bf6646b449684e687f28531305eca4e4768c2782 Thanks @​shadcn! - Add @shadcn/registry, the registry engine behind the CLI. shadcn now depends on it, and shadcn/registry and shadcn/schema re-export it, so there are no changes for existing users.

• #​12061 a9c1da49ec4eab488dc99c69ae20a7ffaa4897d4 Thanks @​shadcn! - fix shimmer reduced motion handling when used with a variant

• #​12087 bf6646b449684e687f28531305eca4e4768c2782 Thanks @​shadcn! - shadcn docs only rewrites links on the ui.shadcn.com host.

• Updated dependencies [bf6646b449684e687f28531305eca4e4768c2782]:

  • @​shadcn/registry@0.1.0

tokio-rs/tokio (tokio)

v1.53.2: Tokio v1.53.2

Compare Source

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#​8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#​8540)
• process: unregister Windows wait before closing child handle (#​8564)
• rt: drop blocking pool mutex before shutting down rejected task (#​8562)
• sync: fix mpsc index wraparound in block reclamation (#​8546)
• sync: forget mpsc Permit before sending value (#​8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#​8548)
• sync: wake broadcast Sender::closed outside mutex (#​8558)
• task: drop replaced waker outside lock in JoinSet (#​8554)
• time: drop timer lock before dropping waker in clear_entry (#​8552)
• time: expire timers directly on shutdown without rotating wheel (#​8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#​8572)
• rt: ignore current_thread task dumps from other runtimes (#​8544)
• rt: preserve io_uring context if a completion waker panics (#​8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#​8542)
• taskdump: restore deferred leaf wakes during capture (#​8445)
• time: drop stored waker when cancelling alt timer entry (#​8550)

vitejs/vite (vite)

v8.3.3

Compare Source

Bug Fixes

• deps: update launch-editor to v2.14.2 (#​23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#​23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#​23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#​23656) (c3e06f9)

v8.3.2

Compare Source

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#​23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#​23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#​23568) (bc598a6)
• deps: update all non-major dependencies (#​23601) (9944fa6)
• deps: update rolldown-related dependencies (#​23602) (88c1741)
• html: resolve percent-encoded srcset urls (#​23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#​23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#​23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#​23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#​23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#​23586) (744269e)
• server: handle file watcher errors without crashing (#​23503) (6894f5c)
• server: release previous environments after initialization (#​23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#​23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#​23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#​23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#​23510) (cf5c028)
• only register time middleware when debug logging is enabled (#​23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#​23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#​23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#​23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#​23606) (634745d)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.