[renovate-appwrite]

This PR contains the following updates:

Package	Change	Age	Confidence
@​appwrite.io/pink	^0.11.0 → ^0.26.0
@​appwrite.io/pink-icons	^0.25.0 → ^0.26.0
@tanstack/react-router (source)	1.170.45 → 1.170.46
@tanstack/react-start (source)	1.169.3 → 1.169.4
@tanstack/router-plugin (source)	1.168.47 → 1.168.48
@types/node (source)	20.19.39 → 20.19.43
@types/react (source)	18.3.28 → 18.3.31
@vitejs/plugin-react (source)	6.1.2 → 6.2.1
dotenv	16.4.7 → 16.6.1
nodemailer (source)	10.2.0 → 10.3.1
xss	1.0.15 → 1.0.17

---

Release Notes

TanStack/router (@​tanstack/react-router)

v1.170.46

Compare Source

Patch Changes

• #​8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

• #​8671 689a7c5 - Publish the @tanstack/react-router agent skills (react-router, compositions/router-query, lifecycle/migrate-from-react-router), which were missing from the package's files list.

• Updated dependencies [32a3360]:

  • @​tanstack/router-core@1.171.39

TanStack/router (@​tanstack/react-start)

v1.169.4

Compare Source

Patch Changes

• #​8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

• Updated dependencies [32a3360, 689a7c5, ed55775, 63a886d, d9b07e8]:

  • @​tanstack/react-router@1.170.46
  • @​tanstack/start-client-core@1.170.39
  • @​tanstack/start-server-core@1.169.45
  • @​tanstack/start-plugin-core@1.171.55
  • @​tanstack/react-start-client@1.168.44
  • @​tanstack/react-start-rsc@0.1.65
  • @​tanstack/react-start-server@1.167.52

TanStack/router (@​tanstack/router-plugin)

v1.168.48

Compare Source

Patch Changes

• #​8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

• #​8737 647cb73 - Remove the enableRouteGeneration option. Route generation now always runs, so autoCodeSplitting always has the route metadata it needs.

• Updated dependencies [32a3360, 689a7c5]:

  • @​tanstack/react-router@1.170.46
  • @​tanstack/router-core@1.171.39
  • @​tanstack/router-generator@1.167.46

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.2.1

Compare Source

Fix refreshInclude and refreshExclude options not working (#​1543)

Fix mistake from #​1516

v6.2.0

Compare Source

Add refreshInclude and refreshExclude options (#​1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#​1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#​1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

motdotla/dotenv (dotenv)

v16.6.1

Compare Source

Changed

• Default quiet to true – hiding the runtime log message (#​874)
• NOTICE: 17.0.0 will be released with quiet defaulting to false. Use config({ quiet: true }) to suppress.
• And check out the new dotenvx. As coding workflows evolve and agents increasingly handle secrets, encrypted .env files offer a much safer way to deploy both agents and code together with secure secrets. Simply switch require('dotenv').config() for require('@dotenvx/dotenvx').config().

v16.6.0

Compare Source

Added

• Default log helpful message [dotenv@16.6.0] injecting env (1) from .env (#​870)
• Use { quiet: true } to suppress
• Aligns dotenv more closely with dotenvx.

v16.5.0

Compare Source

Added

• 🎉 Added new sponsor Graphite - the AI developer productivity platform helping teams on GitHub ship higher quality software, faster.

[!TIP]
Become a sponsor

The dotenvx README is viewed thousands of times DAILY on GitHub and NPM.
Sponsoring dotenv is a great way to get in front of developers and give back to the developer community at the same time.

Changed

• Remove _log method. Use _debug #​862

nodemailer/nodemailer (nodemailer)

v10.3.1

Compare Source

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

v10.3.0

Compare Source

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#​1904) (47f2b25)

v10.2.1

Compare Source

Bug Fixes

• drop the comments of a Content-Type or Content-Disposition value with the stripComments option (b3052b7)

leizongmin/js-xss (xss)

v1.0.17

Compare Source

• fix: use the default callback when escapeHtml, onTag, onTagAttr, onIgnoreTag, onIgnoreTagAttr or safeAttrValue is null, undefined, or not a function. An own function still overrides the default, and inherited properties are still ignored (#​304).
• fix: filterXSSWithResult() copies only own option properties, so a polluted prototype can no longer supply callbacks.
• fix: treat null and undefined whiteList / allowList as unset. An explicit object, including {}, is still used. When whiteList is unset, allowList is used; otherwise the default whitelist is used.

v1.0.16

Compare Source

• fix: reject unsafe URL schemes in action and formaction when allowed by a custom whitelist. Form destinations now allow only HTTP(S) and relative URLs; other schemes, including javascript:, data:, mailto:, tel: and FTP, are rejected. The default whitelist is unaffected.
• fix: ignore inherited properties when reading sanitizer options and whitelists to prevent prototype pollution from overriding filtering behavior
• feat: add filterXSSWithResult() to return sanitized HTML and records of ignored tags and attributes, with TypeScript declarations (#​297, #​299, #​300).
• ci: update GitHub Actions and tested Node.js versions

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Monday (* * * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[appwrite]

🟢 Tier S · Ready to merge

All three locked installs succeeded, the site build and CI JavaScript syntax checks passed, and the reviewed package changes do not break the APIs used here.

Refreshes the root UI and router packages, plus the dotenv and Nodemailer lockfile resolutions. The Pink stylesheet and icon packages are also moved to 0.26.0, and xss and related transitive packages are updated.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 4

File	Change
package.json	Updates the Pink and Pink Icons dependency ranges to 0.26.0.
package-lock.json	Resolves the new UI packages and updates TanStack, React typings, Vite React plugin, and xss dependencies.
appwrite/package-lock.json	Updates the locked dotenv version to 16.6.1.
functions/rejectProject/package-lock.json	Updates the locked Nodemailer version to 10.3.1.

---

_{Reviewed 2be8ab1 · Details · Comment @appwrite review to re-run, or mention @appwrite with a question.}

[appwrite]

🟢 Tier S · Looks good to merge. Summary