Update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@electron/remote	2.1.2 → 2.1.3
@mdi/font (source)	7.2.96 → 7.4.47
@mdi/js	7.2.96 → 7.4.47
@microsoft/applicationinsights-web	3.0.9 → 3.4.4
@reduxjs/toolkit (source)	1.9.3 → 1.9.7
@swc/core (source)	1.10.0 → 1.16.2
@swc/jest (source)	0.2.37 → 0.2.39
@testing-library/jest-dom	5.16.5 → 5.17.0
@testing-library/react	14.0.0 → 14.3.1
@types/adm-zip (source)	0.5.0 → 0.5.8
@​types/date-fns	2.6.0 → 2.6.3
@types/ftp (source)	0.3.33 → 0.3.36
@types/klaw (source)	3.0.3 → 3.0.7
@types/lodash.range (source)	3.2.7 → 3.2.9
@types/mousetrap (source)	1.6.11 → 1.6.15
@types/react (source)	17.0.55 → 17.0.93
@types/react-dom (source)	18.2.6 → 18.3.7
@types/react-redux (source)	7.1.25 → 7.1.34
@types/semver (source)	7.3.13 → 7.8.0
@types/shasum (source)	1.0.0 → 1.0.2
@types/triple-beam (source)	1.3.2 → 1.3.5
adm-zip	^0.5.5 → ^0.6.0
applicationinsights	2.9.6 → 2.9.8
autoprefixer	10.4.14 → 10.5.5
commander	10.0.0 → 10.0.1
date-fns	2.29.3 → 2.30.0
electron	43.4.1 → 43.6.0
electron-store	8.1.0 → 8.2.0
esbuild	^0.27.2 → ^0.28.0
esbuild-sass-plugin	3.6.0 → 3.7.0
esbuild-style-plugin	1.6.2 → 1.6.3
eslint-config-prettier	8.8.0 → 8.10.2
eslint-import-resolver-typescript	3.5.5 → 3.10.1
eslint-plugin-import	2.27.5 → 2.32.0
eslint-plugin-jsonc (source)	2.20.1 → 2.21.1
eslint-plugin-jsx-a11y	6.7.1 → 6.10.2
eslint-plugin-prettier	5.5.4 → 5.5.6
eslint-plugin-react	7.32.2 → 7.37.5
eslint-plugin-react-hooks (source)	4.6.0 → 4.6.2
fast-glob	3.2.12 → 3.3.3
focus-visible	5.2.0 → 5.2.1
jest (source)	29.5.0 → 29.7.0
jest-environment-jsdom (source)	29.5.0 → 29.7.0
npm-run-all2	6.0.5 → 6.2.6
postcss (source)	8.4.24 → 8.5.28
postcss-modules	6.0.0 → 6.0.1
prettier-plugin-tailwindcss	^0.7.2 → ^0.8.0
protobufjs	8.6.5 → 8.8.0
react (source)	18.2.0 → 18.3.1
react-bootstrap (source)	1.6.6 → 1.6.8
react-dom (source)	18.2.0 → 18.3.1
react-flip-toolkit	7.0.17 → 7.2.4
react-resize-detector	9.1.0 → 9.1.1
react-test-renderer (source)	18.2.0 → 18.3.1
semver	7.3.8 → 7.8.5
systeminformation (source)	5.25.11 → 5.33.10
tailwindcss (source)	3.4.14 → 3.4.19
tsx (source)	4.20.3 → 4.23.13
typescript (source)	5.9.2 → 5.9.3
typescript-eslint (source)	8.45.0 → 8.70.0
winston	3.8.2 → 3.19.0
zod (source)	3.23.8 → 3.25.76

---

Release Notes

electron/remote (@​electron/remote)

v2.1.3

Compare Source

Bug Fixes

• add ServiceWorkerMain module (#​221) (cac51a2)

Templarian/MaterialDesign-Webfont (@​mdi/font)

v7.4.47

Compare Source

v7.3.67

Compare Source

Templarian/MaterialDesign-JS (@​mdi/js)

v7.4.47

Compare Source

v7.3.67

Compare Source

microsoft/ApplicationInsights-JS (@​microsoft/applicationinsights-web)

v3.4.4

Compare Source

This is a maintenance release for the 3.4.x version line containing runtime reliability and bundler compatibility fixes, build tooling and dependency security hardening, documentation corrections, and a test reliability fix. There are no SDK API changes. The @microsoft/1ds-post-js channel is numbered 4.4.4 and requires v3.4.4.

Significant Changes (since 3.4.3)

• ESM XHR Instrumentation: Fixed tree shaking of the XHR capability check so automatic XHR instrumentation is preserved in ESM bundles.
• Vite 8 and Rolldown Compatibility: Normalized generated PURE annotations by expression so invalid annotations on primitive literals no longer produce warnings, while valid call and new expression annotations remain tree-shakable.
• OpenTelemetry Async Error Propagation: Fixed startActiveSpan() so promise rejections from asynchronous callbacks propagate to callers instead of being swallowed.
• Dependency Security Hardening: Resolved the repository's npm audit and Component Governance findings by updating vulnerable transitive build dependencies and replacing Puppeteer's vulnerable extract-zip dependency with a maintained compatible package. Rush was upgraded to 5.178.1 and pnpm to 10.34.5, while API Extractor remains on the latest Node.js 18-compatible release. These are build/tooling changes and do not affect the published runtime code.
• GitHub Actions Supply-Chain Hardening: Pinned third-party GitHub Actions to full-length commit SHAs and added grouped weekly Dependabot updates with a seven-day cooldown.

Changelog

• #​2768 Fix ESM XHR instrumentation tree shaking
• #​2767 docs: fix Offline Channel setup example
• #​2766 fix: normalize PURE annotations for Vite 8 and Rolldown
• #​2761 fix(deps): remediate Component Governance vulnerabilities
• #​2758 Pin GitHub Actions to full-length commit SHAs
• #​2757 fix(otel): propagate promise rejection from startActiveSpan async callback
• #​2754 fix(test): stabilize flaky SpanLifeCycle custom endTime test
• #​2753 fix(deps): remediate npm audit vulnerabilities and add local Puppeteer Edge fallback

Full Changelog: microsoft/ApplicationInsights-JS@3.4.3...3.4.4

v3.4.3

Compare Source

This is a maintenance release for the 3.4.x version line adding a new SDK statistics feature, a PostChannel reliability fix, and dependency security hardening. The @microsoft/1ds-post-js channel is numbered 4.4.3 and requires v3.4.3.

Significant Changes (since 3.4.2)

• Customer SDK Stats: Added a new SdkStats feature that periodically collects internal SDK usage/health statistics. It is enabled by default and can be disabled (or explicitly configured) via the featureOptIn configuration (e.g. featureOptIn: { SdkStats: { mode: FeatureOptInMode.disable } }); the collection interval defaults to 15 minutes (sdkStats.int).

• PostChannel Auto-Flush Stall Fix: Fixed a permanent stall in @microsoft/1ds-post-js where, under sustained intermittent send failures (e.g. a load balancer returning occasional 503s), auto flush could wedge behind the flush() wait-for-idle timer and permanently stop draining the in-memory queue — causing telemetry to be silently dropped as QueueFull until the process was restarted. Auto flush is now fire-and-forget and no longer parks the scheduler waiting for the manager to become completely idle.

• Dependency Security Hardening: Pinned tar to >=7.5.16 to remediate CVE-2026-53655 and resolved the remaining npm audit findings in build tooling via dependency overrides (js-yaml, yaml, markdown-it, linkify-it). These are build/tooling changes and do not affect the published runtime packages.

Changelog

• #​2746 Fix PostChannel auto-flush permanent stall under sustained intermittent send failures
• #​2745 fix(security): pin tar >=7.5.16 to remediate CVE-2026-53655
• #​2707 Enable Customer SDK Stats
• Resolve remaining npm audit findings via dependency overrides (js-yaml, yaml, markdown-it, linkify-it)

Full Changelog: microsoft/ApplicationInsights-JS@3.4.2...3.4.3

v3.4.2

Compare Source

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Significant Changes (since 3.4.1)

• Prototype Pollution Hardening: The extend() and objExtend() helpers now filter unsafe keys (__proto__, constructor, prototype) to prevent prototype pollution when merging untrusted objects.

• Dependency Vulnerability Resolution: Migrated the repository from npm to pnpm for dependency management and resolved all known dependency vulnerabilities. This is a build/tooling change and does not affect the published runtime packages.

• OsPlugin Field Name Correction: The OsPlugin now emits the correct Common Schema 4.0 field names (ext.os.name and ext.os.ver). Telemetry consumers relying on the previously emitted (incorrect) field names should update to the corrected names.

• RequestEnvelopeCreator Envelope Name Fix: Fixed RequestEnvelopeCreator so request telemetry is sent with the correct envelope name (Microsoft.ApplicationInsights.{ikey}.Request) instead of RequestData.

• Offline Channel Reliability: Fixed a missing return after reject() in the offline channel that could lead to a null provider dereference.

• Fixed [INVALID_ANNOTATION] warnings in Rolldown / Vite 8 consumers (#​2736): The per-module dist-es5 output (the package module entry that modern bundlers import) emitted parenthesized PURE tree-shaking annotations with whitespace after the opening parenthesis (e.g. ( /*#__PURE__*/"http.")), which stricter bundlers such as Rolldown (Vite 8) rejected. The build now canonicalizes these annotations to the flush form ((/*#__PURE__*/"http.")) in the dist-es5 output, accepted by all bundlers while preserving the wrapping parentheses required for older Rollup / Webpack / Terser to tree-shake the constants. This complements #​2737, which only normalized the rollup-bundled dist/es5 (main) output.

CI / Tooling

• Dropped Node.js 16 from CI matrix: Node.js 16 is End-of-Life and several dependencies (e.g. puppeteer, @pnpm/error) now require Node.js 18 or later. The CI pipeline no longer runs against Node.js 16.
• Added Node.js 22 and 24 to CI matrix: The CI pipeline now tests against Node.js 18, 20, 22, and 24.
• Migrated from npm to pnpm: Dependency management now uses pnpm.

Changelog

• #​2733 fix: Migrate from npm to pnpm and resolve all dependency vulnerabilities
• #​2742 fix(ci): repair Node.js CI (Chrome install, bundle-size limits, ts-async offline-channel hang)
• #​2737 fix: remove invalid PURE literal annotations and add bundle validation tests
• #​2736 fix: canonicalize PURE annotations in dist-es5 (module) output to fix Rolldown/Vite 8 [INVALID_ANNOTATION] warnings
• #​2735 fix: prevent prototype pollution in extend() and objExtend() via unsafe key filtering
• #​2734 fix(offline-channel): Add missing return after reject() to prevent null provider dereference
• #​2732 fix(OsPlugin): use correct CS 4.0 field names ext.os.name and ext.os.ver
• #​2731 Drop Node.js 16 from CI matrix; add Node.js 22 and 24
• #​2729 Potential fix for code scanning alert no. 2273: Workflow does not contain permissions
• #​2728 Potential fix for code scanning alert no. 5940: Unused variable, import, function or class
• #​2727 Potential fix for code scanning alert no. 5402: Semicolon insertion
• #​2726 Potential fix for code scanning alert no. 5401: Unused variable, import, function or class
• #​2725 Potential fix for code scanning alert no. 4240: Semicolon insertion
• #​2724 fix: RequestEnvelopeCreator sends "RequestData" as envelope name instead of "Microsoft.ApplicationInsights.{ikey}.Request"
• #​2722 Update Components
• #​2721 Add CfgSync documentation

Full Changelog: microsoft/ApplicationInsights-JS@3.4.1...3.4.2

v3.4.1

Compare Source

This is the first full supported release of the 3.4.x version line. While a 3.4.0-beta was previously released for early testing and validation, version 3.4.0 was not released as a standard supported version — 3.4.1 is the first production-ready release in this series. The @microsoft/1ds-post-js channel is numbered 4.4.1 and requires v3.4.1.

Significant Changes (since 3.3.11)

The following are the significant changes since the previous full release (3.3.11). Some of these changes were previously included in the 3.4.0-beta release.

• W3C Trace State Support: Added full support for managing W3C Trace State and sending headers in distributed tracing, including new distributed tracing modes AI_AND_W3C_TRACE and W3C_TRACE that enable the tracestate header to be sent with requests when trace state information is available, the existing states will continue to not send the header.

• New Distributed Tracing Modes: Added new eDistributedTracingModes enum values:

  • AI_AND_W3C_TRACE (17): Sends Application Insights headers + W3C traceparent + W3C tracestate headers (if state value is present)
  • W3C_TRACE (18): Sends only W3C traceparent + W3C tracestate headers (if state value is present)

• Enhanced Distributed Tracing: Refactored the distributed tracing implementation to provide better support for the W3C Trace Context specification and prepare for future OpenTelemetry Span-style API integration.

• New W3C TraceState API: Introduced the IW3cTraceState interface that provides a mutable, ordered list of key/value pairs for trace state information with proper parent-child relationships.

• OpenTelemetry Integration Preparation: Added foundational OpenTelemetry interfaces (IOTelSpanContext, IOTelTraceState) to provide OpenTelemetry API compatibility.

• Additional Configuration: Added new configuration properties for W3C trace state support:

  • traceHdrMode: Controls if the SDK should look for the traceparent and/or tracestate values from service timing headers or meta tags from the initial page load (in IConfiguration)
  • Enhanced distributedTracingMode property to support the new W3C trace state modes (in ICorrelationConfig)

• Dependencies Extension: The dependency tracking extension now includes additional logic for W3C trace state handling, which may affect custom dependency listeners or initializers. The following interfaces and functions have been enhanced with W3C trace state support:

  • IDependencyListenerDetails interface now also includes a readonly traceState along with the previous traceId, spanId, traceFlags properties
  • addDependencyListener() function now provides access to W3C trace state information through the enhanced details object
  • addDependencyInitializer() function continues to work with existing dependency telemetry processing
  • Custom dependency listeners can now access and modify W3C trace state information before requests are sent

• Enhanced Cookie Management: Cookie values are now cached in memory when cookies are disabled instead of being lost, enabling support for consent banner workflows where cookies must be temporarily disabled until user approval. Automatic flushing occurs when cookies are re-enabled.

• OsPlugin Reliability Improvements: Improved OsPlugin with proactive OS retrieval, unload handling, and session caching for more reliable OS detection.

• URL Redaction Enhancements: Made URL redaction more dynamic for improved flexibility in field redaction scenarios.

Package Deprecation

The following packages have been merged into @microsoft/applicationinsights-core-js and are now deprecated. They continue to be published as backward-compatible shims (re-exporting from Core) so existing code will not break, but they are no longer used as dependencies by the main SDK packages. You should stop importing from these packages and migrate to @microsoft/applicationinsights-core-js directly.

• @microsoft/applicationinsights-common — All exports have been merged into @microsoft/applicationinsights-core-js. The package is now a compatibility shim that re-exports from Core. See the Migration Guide for details on updating your imports. This package will be removed in a future major release (4.0.0).

• @microsoft/1ds-core-js — All exports have been merged into @microsoft/applicationinsights-core-js. The package is now a compatibility shim that re-exports from Core. See the 1DS Core Migration Guide for class/import name changes and migration steps. Consumers should update their imports to reference @microsoft/applicationinsights-core-js directly. This package will be removed in a future major release (4.0.0).

Breaking Changes

The following is a list of known breaking changes for anyone attempting to implement the interfaces, for end-users / consumers of the existing interface this is considered to be only a potential breaking change as the existing functions are still provided and provide the same level of functionality. The breaking nature of these changes is for anyone attempting to provide their own implementation of these changes.

Interface Changes

• The IDistributedTraceContext interface has been significantly expanded to include W3C trace state management capabilities, which may affect custom telemetry processors that interact with distributed tracing context.
  • Added additional "required" property accessors which update ONLY the current trace context instance and DO NOT update any parent context instances (pageName, traceId, spanId and traceFlags).
    • The previous set functions continue to also update (replace) any parent context values for existing backward compatability, but have been marked as depracted and will be removed in a future release due to their side-effects of overwriting the parent values.

Potential Breaking Changes

• Class Removal: The TelemetryTrace class has been removed and is no longer exported as part of the distributed tracing refactoring, with its functionality integrated into the new W3C trace state implementation.

  • The properties telemetryTrace is now a complete adpater to the existing core.getTraceCtx() value and as such is now marked as deprecated and will be removed in a future release.
  • The value of the appInsights.context.telemetryTrace is no longer an instance of this removed class.

• Trace Context Initialization: Due to the distributed tracing refactoring, the core instance and SDK will now always have a valid traceId available through core.getTraceCtx(). The traceId will be either a newly generated random value or inherited from any detected parent trace context. This ensures consistent trace context availability but may affect applications that previously relied on the absence of a traceId to determine if distributed tracing was active.

• Dependencies Extension - ajaxRecord Class Removal: The internal ajaxRecord class has been removed and is no longer exported from the dependencies extension (@microsoft/applicationinsights-dependencies-js). The internal implementation now implements the new IAjaxRecordData interface. This class was previously used internally for AJAX request tracking and was referenced in the IInstrumentationRequirements.includeCorrelationHeaders() function signature. Important: The previous exporting of the ajaxRecord class was unintentional and was never meant to be part of the public API - it was an internal implementation detail that inadvertently became accessible to external code.

  • Previous Signature: includeCorrelationHeaders(ajaxData: ajaxRecord, input?: Request | string, init?: RequestInit, xhr?: XMLHttpRequestInstrumented): any
  • New Signature: includeCorrelationHeaders(ajaxData: IAjaxRecordData, input?: Request | string, init?: RequestInit, xhr?: XMLHttpRequestInstrumented): any
  • New Interface: The IAjaxRecordData interface has been introduced to replace the ajaxRecord class in public API signatures and provides access to essential AJAX request properties:
    • getAbsoluteUrl(): string | null - Gets the absolute URL for the request
    • getPathName(): string | null - Gets the sanitized path name for the request URL
    • traceCtx: IDistributedTraceContext - The distributed trace context for the request
    • requestHeaders: { [key: string]: string } - Object containing request headers
    • aborted?: number - Indicates whether the request was aborted
    • context?: { [key: string]: any } - Optional context object for dependency listeners
  • Impact: This change only affects custom implementations that directly referenced the ajaxRecord class or implemented the IInstrumentationRequirements interface. Standard SDK usage and most custom dependency listeners/initializers are unaffected.
  • Migration: If your code previously referenced ajaxRecord or implemented IInstrumentationRequirements, update it to use the new IAjaxRecordData interface, which provides the same essential properties with proper TypeScript definitions and comprehensive JSDoc documentation.
  • Need Help?: If you discover that your code depends on other functions or properties from the dependencies extension that are no longer exported and you believe should be part of the public API, please raise an issue with details about your use case so we can review and potentially provide a proper public API alternative.

• Flush Method Signature Change: Renamed flush method parameter from async to isAsync in IChannelControls interface to avoid potential keyword conflicts (only affects code that relies on named parameters).

  • Fixed return type of flush method to properly include boolean when callbacks complete synchronously

Potential behavioral changes

This release enhances the cookie management behavior when cookies are disabled. Previously, when cookies were disabled, calls to cookieMgr.set() would return false and cookie values would be lost. Now, these operations are cached in memory and automatically applied when cookies are re-enabled to allow for cookie compliance banners and delayed approval.

Behavior changes:

• cookieMgr.set() now returns true when cookies are disabled (because values are cached), instead of false
• cookieMgr.get() now returns cached values when cookies are disabled, instead of empty strings
• cookieMgr.del() operations are now cached and applied when cookies are re-enabled
• Applications can now recover cookie state after temporary cookie blocking scenarios

These changes improve data persistence and are considered enhancements rather than breaking changes. If your application logic depends on the previous behavior of set() returning false when cookies are disabled, you may need to check cookieMgr.isEnabled() instead, or configure disableCookieCache: true in your cookieCfg to maintain the previous behavior.

Known Limitations

• SDK Loader (Snippet) automatically downgrades to v2.x on Internet Explorer: When the SDK Loader detects that Internet Explorer is being used (via the msie or trident/ user agent strings), it automatically rewrites the CDN URL to load the v2.x SDK instead of v3.x (e.g. ai.3.gbl.min.js becomes ai.2.gbl.min.js). This means any v3.x-only APIs — including the new OpenTelemetry-based APIs — will not be available for users on Internet Explorer. If your code uses these newer APIs, you should check for their existence before calling them. This fallback does not apply when using the NPM package directly.

Changelog

• #​2719 Improve OsPlugin reliability: proactive OS retrieval, unload handling, and session caching
• #​2718 Address issue with the AppInsightsExtCore using the wrong version number
• #​2716 Make URL Redaction more dynamic
• #​2712 [Main] Merge 1ds-core-js into applicationinsights-core-js
• #​2710 [Main] Merge Trace API Features from Beta
• #​2628 Fix flush method root cause - handle async callbacks in _doSend with proper error handling
  • Potential breaking change: Renamed flush method parameter from async to isAsync in IChannelControls interface to avoid potential keyword conflicts (only affects code that relies on named parameters)
  • Fixed return type of flush method to properly include boolean when callbacks complete synchronously
  • Fixed root cause where _doSend() couldn't handle asynchronous callbacks from preparePayload() when compression is enabled
  • await applicationInsights.flush() now works correctly with compression enabled
  • Added proper error handling and promise rejection propagation through async callback chains
  • Improved handling of both synchronous and asynchronous callback execution patterns
  • No polling overhead - uses direct callback invocation for better performance
• #​2631 [Feature] Update the ICookieMgr implementation to write cookies after being enabled
  • Enhancement: Cookie values are now cached in memory when cookies are disabled instead of being lost, enabling support for consent banner workflows where cookies must be temporarily disabled until user approval
  • Enhancement: Automatic flushing occurs when cookies are re-enabled via setEnabled(true) or dynamic configuration changes
  • Enhancement: Added disableCookieDefer configuration option to maintain backward compatibility with previous behavior (defaults to false)
  • Behavior change: cookieMgr.set() now returns true when disabled (cached) instead of false
  • Behavior change: cookieMgr.get() now returns cached values when disabled instead of empty strings
• [Beta] Add W3c Trace State support / handling and refactor distributed trace handling to prepare for OpenTelemetry Span style API / management

Full Changelog: microsoft/ApplicationInsights-JS@3.3.11...3.4.1

v3.3.11

Compare Source

Changelog

• #​2642 Separate BeaconSendFailure and BeaconSendFailure from SizeLimitExceeded
• #​2675 Fix offline channel recovery for Offline -> Online (#​2674)
• #​2666 Fix unload() to return promise when called without parameters
• #​2667 Add a check to prevent non-string URLs from being passed to fieldRedaction method

Infrastructure changes

• #​2684 Fix minor issue with E2E test
• #​2681 Add redact URL configuration in readme
• #​2676 Fix Flakey Ajax test which has race condition
• #​2670 Fix static web CDN test assertion (Fixes failing CI tests)

Web snippet 1.2.3 (November 10, 2025)

• #​2659 [Web-Snippet] [BUG] @​microsoft/applicationinsights-web-snippet Fix Snippet Loader Error

v3.3.10

Compare Source

Interface changes

This release includes:

• Support for custom providers for Offline Channel which has added customProvider and customUnloadProvider interfaces to the IOfflineChannelConfiguration.
• IAnalyticsConfig is exported for Analytics extension.
• redactUrls and redactQueryParams are added to IConfiguration to support URL redaction.

Changelog

• #​2649 [Main][Task] 2792261: Provide Custom Provider Under Web Worker for Offline Channel
• #​2638 [Main][Task] 3447059: Update Async Tests Under Dependencies Extension To Use the Modern AsyncQueue Pattern
• #​2637 [Main][Task] 3447059: Update AISKU Async Tests To Use the Modern AsyncQueue Pattern
• #​2636 Fix TypeError in Click Analytics Data Collector
• #​2633 Fix flush method root cause - handle async callbacks in _doSend with proper error handling
• #​2632 [Feature] Implement cookie caching when disabled and automatic flushing when enabled with backward compatibility option
• #​2625 Add Azure API Management proxy documentation to FAQ sections
• #​2607 Update Async Tests Under AISKULight to Use the Modern AsyncQueue Pattern
• #​2597 Fix TypeScript compatibility issue with ITelemetryPlugin interface
• [#​2595](https://redirect.github.com/microsoft/Applicat

❗ Important

✂ PR body was truncated to here.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: @nordicsemiconductor/pc-nrfconnect-shared@176.0.0
npm ERR! Found: esbuild@0.21.1
npm ERR! node_modules/esbuild
npm ERR!   esbuild@"0.21.1" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer esbuild@"^0.19.4" from esbuild-sass-plugin@2.16.1
npm ERR! node_modules/esbuild-sass-plugin
npm ERR!   esbuild-sass-plugin@"2.16.1" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate/cache/others/npm/_logs/2024-05-09T01_25_14_727Z-debug-0.log

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: @nordicsemiconductor/pc-nrfconnect-shared@260.0.0
npm ERR! Found: @types/react@17.0.93
npm ERR! node_modules/@types/react
npm ERR!   @types/react@"17.0.93" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer @types/react@"^18.0.0" from @types/react-dom@18.3.7
npm ERR! node_modules/@types/react-dom
npm ERR!   @types/react-dom@"18.3.7" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /runner/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-09-16T20_46_43_870Z-debug-0.log

[CLAassistant]

All committers have signed the CLA.