chore(deps-dev): bump react-doctor from 0.5.8 to 0.7.4

[dependabot]

Bumps react-doctor from 0.5.8 to 0.7.4.

Release notes

Sourced from react-doctor's releases.

react-doctor@0.7.4

Patch Changes

• Updated dependencies [f91ede7, 6b70b32, 82187a3]:
  • oxlint-plugin-react-doctor@0.7.4
  • deslop-js@0.7.4

react-doctor@0.7.2

Patch Changes

• #1077 9cb4149 Thanks @​aidenybai! - Align 30+ rules with their documented behavior, fixing the false-positive clusters confirmed by a validation pass of 2,143 sampled diagnostics against the official rule prompts. Highlights: jsx-key now flags key-after-spread (the documented hazard) instead of the safe key-before-spread shape and exempts props rest parameters; no-did-update-set-state honors the prop-comparison guard exemption; no-console skips Node CLI scripts; circular-dependency skips type-only, lazy-import, and render-time-only cycles; query-mutation-missing-invalidation exempts read-only mutations; insecure-crypto-risk requires cryptographic context instead of matching identifier names; no-unknown-property allows valid hyphenated SVG attributes; no-aria-hidden-on-focusable verifies the element is actually focusable; no-flush-sync implements the documented DOM-measurement carve-out.

• #1069 5809083 Thanks @​rayhanadev! - Add --supply-chain / --no-supply-chain CLI flags to toggle the dependency supply-chain scan, mirroring --lint/--no-lint and --dead-code/--no-dead-code. Supply-chain enablement now resolves as a scan option (InspectOptions.supplyChain) against supplyChain.enabled — the flag wins — so it takes precedence over per-project config on every scan (a workspace module's config can't undo --no-supply-chain), and config isn't mutated so scan.hasCustomConfig telemetry stays accurate. The enabled state also rides the per-scan wide event as scan.supplyChain.

• #1083 5d2f17f Thanks @​skoshx! - query-destructure-result no longer classifies rest-destructuring (const { data, ...rest } = query) — that shape is query-no-rest-destructuring's territory, and claiming it in both rules reported the same line twice (#1082). The rule now fires only on the consumption it uniquely owns: spreading the whole TanStack Query result into JSX (<Inner {...query} />) or an object literal, which enumerates every field and subscribes the component to all of them.

• #1070 64452aa Thanks @​rayhanadev! - Fix whole-repo scan cache replaying another project's diagnostics when a .git-less checkout sits inside an unrelated repository (e.g. a gitignored benchmark/mining clone directory reused across projects). The cache key's git identity (HEAD sha, worktree fingerprint) resolved from the enclosing repository, which cannot see the checkout's files, so two different projects materialized at the same path keyed identically. The key now requires the fingerprinted repository to actually track files under the project directory (cache off otherwise), and every cache hit re-verifies the stored payload's directory and package.json content hash so any future keying bug of this class degrades to a miss instead of a cross-project replay.

• #1077 9cb4149 Thanks @​aidenybai! - Third-round FP sweep: honor eslint-disable react-hooks/<rule> spellings for React Compiler diagnostics, suppress immutability findings inside Reanimated worklets, skip the vulnerability axis for devDependencies in supply-chain scoring, suppress query-no-usequery-for-mutation for polled/read-verb POST endpoints, prune compile-time-erased edges from circular-dependency detection, and fix unused-export/unused-file/unused-dev-dependency false positives in deslop-js.

• Updated dependencies [9cb4149, 1880b15, 5d2f17f, 9cb4149]:

  • oxlint-plugin-react-doctor@0.7.2
  • deslop-js@0.7.2

react-doctor@0.7.1

Patch Changes

• #1062 6b21b70 Thanks @​devin-ai-integration! - Surface when a scan target had no discoverable React project, so a gated-off run can't pass for a clean one.

  • The JSON report now carries reactDetected: false (additive optional field on schemaVersion 1 and 2) when no scanned project resolved a React or Preact runtime — the case where every React-runtime rule family gates off and the report would otherwise be byte-indistinguishable from a genuinely clean scan. It's true when any project resolved a runtime, and absent when nothing was scanned or the run errored. Consumers gating on the report (CI, verifiers, pre-commit hooks) should treat reactDetected === false as "wrong scan target", not "all clear"; per-project detail is already available via projects[].project.reactVersion / preactVersion.
  • The CLI prints a stderr warning in the same case: "No React project detected at — React rules were gated off; this is not the same as a clean scan."
  • The programmatic API mirrors the signal: diagnose() results carry reactDetected (DiagnoseResult.reactDetected, per-project on ProjectResultOk, aggregate on DiagnoseProjectsResult — absent when no project scanned successfully), and the hasReactRuntime(project) predicate is exported from react-doctor/api and @react-doctor/api.

• Updated dependencies [c0c3fc1]:

  • oxlint-plugin-react-doctor@0.7.1
  • deslop-js@0.7.1

react-doctor@0.7.0

Patch Changes

• #1060 ced746f Thanks @​rayhanadev! - The whole cache stack now survives CI's fresh checkouts, so the GitHub Action's persisted REACT_DOCTOR_CACHE_DIR actually warms every layer instead of only the content-addressed ones. The whole-repo scan-result cache moves under the shared per-project cache root (honoring REACT_DOCTOR_CACHE_DIR like the lint, sidecar, dead-code, and supply-chain caches — previously it silently escaped the action's cache into node_modules/.cache or the OS temp dir), and its key drops every stat-based fingerprint that a re-clone rotates: config files and gitignored dotenv files are now content-hashed, and the toolchain is keyed by package versions (matching the lint ruleset hash) rather than install mtimes. The stat-fingerprinted dead-code caches gain mtime repair (the ninja/restat pattern): entries carry a content-hash witness, and a stat mismatch over identical bytes — every file after a fresh checkout — re-hashes once, accepts the entry, and persists the refreshed stat so the cost is paid once per checkout, not per run. This covers core's whole-project dead-code result cache (per-file (mtime, size, hash) records replacing the stats-in-key fingerprint) and deslop-js's incremental summary store (parse summaries, package-reference facts, and the manifest/bundler-config fingerprints feeding the collect/resolution hashes). Expired supply-chain score entries are also pruned past their TTL so restored cache directories stop accumulating dead purls. Everything stays fail-open and byte-identical to an uncached scan; on a re-cloned repo with one changed file, a warm scan now replays ~100% of lint, sidecar, and parse work instead of starting cold.

• #1056 20d81f6 Thanks @​rayhanadev! - Hardened the dead-code result cache key against two silent-staleness classes. The fingerprinted extension and manifest name lists are now imported from deslop-js/analyzed-inputs — a new dependency-free subpath export assembled from the same constants deslop's own readers consume — so a deslop upgrade that widens its walk can never under-invalidate the cache. And the key now includes @react-doctor/core's own version, so upgrading react-doctor re-analyzes instead of replaying cached diagnostics shaped by an older core's post-processing. The cache schema-version constant remains for cache-format changes only.

• #1053 e257a5e Thanks @​rayhanadev! - Rescans now skip the dead-code analysis entirely when nothing it reads has changed. The pass persists its diagnostics keyed by a fingerprint over the analyzed source tree (stat-based, so additions, deletions, and edits all invalidate), the project's manifests, tsconfigs, lockfiles, knip/entry/ignore configuration, and the analyzer version — on an unchanged-input rerun the stored result replays instead of re-walking the whole import graph, cutting several seconds off warm rescans of large repos. Only complete, successful passes are stored; REACT_DOCTOR_NO_CACHE (or the granular REACT_DOCTOR_NO_DEAD_CODE_CACHE) disables it.

• #1057 ce49250 Thanks @​rayhanadev! - Dead-code analysis is now incremental across scans. deslop-js gains an opt-in incrementalCachePath config field: one stat walk per run (following directory symlinks, like the glob scans it stands in for) validates four independently keyed layers — per-file parse summaries (mtime+size), the collected file list, the module-resolution map (dropped whenever the file set or a bundler/tsconfig-like config changes, since resolution is file-set-dependent), and the per-file package-reference facts behind the unused-dependency content scans. The same walk also answers the stale-package file-discovery globs (config/docs/rescue/package.json/nx/tsconfig scans, verified byte-identical against fast-glob), so a cached run never re-walks the tree for them. Entry resolution deliberately stays live every run (it reads config/doc/sibling-source content no fingerprint can validate); on cached runs it moves to a dedicated worker thread so its filesystem work overlaps the main-thread analysis instead of serializing after it. Every layer fails open — corrupt, truncated, or version/config-mismatched stores degrade to a fresh computation, never a wrong result — writes are atomic and skipped when clean, and results are byte-identical to an uncached run. Unused-export detection also indexes re-export edges by source module, dropping an O(entry points × edges) scan that dominated the detector on large repos.

  react-doctor points the analysis worker at a per-project summary store next to the existing whole-result dead-code cache, so a changed-files rescan of a large repo re-parses only what changed (sentry, 9k files: ~8.0s → ~3.2s with 0-10 files edited; ~4.0s after adding a file; the cache-fill run costs the same as an uncached scan). The worker also stops running the discarded DRY-pattern redundancy detectors (reportRedundancy: false), which shrinks the summary store by dropping fields only those detectors read, and reports the cache outcome as deadCode.summaryCacheHits / deadCode.summaryCacheMisses in anonymized telemetry (absent whenever no analysis consulted the store). REACT_DOCTOR_NO_CACHE (or the granular REACT_DOCTOR_NO_DEAD_CODE_CACHE) disables it.

... (truncated)

Changelog

Sourced from react-doctor's changelog.

0.7.4

Patch Changes

• Updated dependencies [f91ede7, 6b70b32, 82187a3]:
  • oxlint-plugin-react-doctor@0.7.4
  • deslop-js@0.7.4

0.7.3

Patch Changes

• #978 b97a92f Thanks @​rayhanadev! - Fix #976: Next.js projects using output: "export" (static export) no longer receive server-only fix recommendations that are impossible without a request-time server. server-fetch-without-revalidate is gated off, nextjs-no-client-side-redirect keeps firing but its advice drops the middleware / getServerSideProps clause (recommending a render-time or client-side redirect instead), and no-prevent-default emits the framework-neutral <form> message rather than recommending Server Actions. The detection also works when the static export lives in a workspace: a monorepo-root scan whose apps/web sets output: "export" is now recognized (the config is read next to the manifest that supplies the next dependency).

  Under the hood this refactors framework gating into one typed capability vocabulary — a Capability union both requires/disabledWhen metadata and the runtime hasCapability(settings, …) check compile against, so a misspelled token fails tsc instead of silently never matching. Rules own their capability-conditioned prose via a new recommendationFor(hasCapability) hook (core no longer rewrites specific rules' advice), and no-prevent-default's hardcoded SPA framework list is replaced by the new client-only capability. ESLint-plugin users who suppressed the <form> variant via settings["react-doctor"].framework should now set settings["react-doctor"].capabilities: ["client-only"].

  Project discovery now traverses workspaces once instead of up to ~7 times (one pass collects react/tailwind/zod/framework, React Native awareness, reanimated, expo, flash-list, and next facts), and workspace precedence is sorted-deterministic instead of filesystem readdir order — on multi-workspace repos where several packages could supply the framework or React version signal, the first in sorted walk order now consistently wins.

• 9b59d96 Thanks @​aidenybai! - New rule no-locale-format-in-render (warn, SSR-capable projects only): flags locale/timezone-dependent formatting evaluated during render — toLocaleString / toLocaleDateString / toLocaleTimeString on date-shaped receivers, Intl.DateTimeFormat(...).format(...), and Date default stringification — because the server's locale and timezone differ from the browser's, causing hydration mismatches. Number formatting (Intl.NumberFormat, bare toLocaleString() on numbers) is deliberately out of scope: its only environment input is the ICU locale, a far weaker mismatch signal that was almost always client-fetched dashboard data in corpus validation. Formatting with an explicit locale and timeZone, inside event handlers or effects, behind client-only guards, or under suppressHydrationWarning stays unflagged. rendering-hydration-no-flicker gained a matching escape so the recommended post-mount useEffect + state fix is never flagged as a flicker.

• #1103 08b768b Thanks @​aidenybai! - Rescue oxlint OOM-dropped files with a serial replay instead of reporting a partial scan. When a parallel lint pass drops files because oxlint's native binding SIGABRT'd under memory pressure (oxc's fixed-size allocator panics when N concurrent oxlint processes compete for memory on very large packages), those files are now replayed once, serially, one single-file batch each — the memory pressure is usually a function of sibling processes, not the file itself, so the replay typically completes the scan. Only files that still fail alone stay dropped and reported.

• 9b59d96 Thanks @​aidenybai! - prefer-use-sync-external-store now detects hand-rolled module-scope stores: a mutable module binding plus a listener registry and same-file subscribe function, consumed as useState(sharedState) with a useEffect(() => subscribe(setState), []). Publishes fired between the render-time snapshot and the effect-time subscription are lost and concurrent renders can tear — useSyncExternalStore(subscribe, getSnapshot) is the fix. Genuine useSyncExternalStore usage, imported subscribe functions, and effects with non-empty dependencies stay unflagged.

• #1102 da7bb4b Thanks @​aidenybai! - no-react19-deprecated-apis no longer flags useContext. React 19's use() is an additive alternative — useContext remains a fully supported, non-deprecated API, so calling it deprecated was misinformation. The rule still flags forwardRef (both named imports and React.forwardRef member access) on React 19+ projects.

• 9b59d96 Thanks @​aidenybai! - Detection robustness against verdict-preserving source rewrites: rules no longer go silent when the same defect is spelled with a slightly different shape. Date.now() / Math.random() / performance.now() / crypto.randomUUID() and namespace-import calls like React.forwardRef now match through TS cast wrappers ((Date as any).now(), (React!).forwardRef); prefer-use-sync-external-store recognizes resync handlers written as block-bodied returns (() => { return setX(read()); }); and effect-body analyses (no-derived-state-effect, rendering-hydration-no-flicker, and everything on getCallbackStatements) skip no-op statements (void 0;, stray directives) instead of letting them flip a "body contains only setState" check.

• Updated dependencies [cb8f726, b1bf6b9, ee9948a, 82e0475, f10f9ca, b1bf6b9, 6680538, b1bf6b9, fb8ffb0, b97a92f, ea3e94e, 9b59d96, 11e9c87, 63e0657, 2953b25, 02b1f82, 9b59d96, da7bb4b, f83092d, dfdc763, 9b59d96]:

  • oxlint-plugin-react-doctor@0.7.3
  • deslop-js@0.7.3

0.7.2

Patch Changes

• #1077 9cb4149 Thanks @​aidenybai! - Align 30+ rules with their documented behavior, fixing the false-positive clusters confirmed by a validation pass of 2,143 sampled diagnostics against the official rule prompts. Highlights: jsx-key now flags key-after-spread (the documented hazard) instead of the safe key-before-spread shape and exempts props rest parameters; no-did-update-set-state honors the prop-comparison guard exemption; no-console skips Node CLI scripts; circular-dependency skips type-only, lazy-import, and render-time-only cycles; query-mutation-missing-invalidation exempts read-only mutations; insecure-crypto-risk requires cryptographic context instead of matching identifier names; no-unknown-property allows valid hyphenated SVG attributes; no-aria-hidden-on-focusable verifies the element is actually focusable; no-flush-sync implements the documented DOM-measurement carve-out.

• #1069 5809083 Thanks @​rayhanadev! - Add --supply-chain / --no-supply-chain CLI flags to toggle the dependency supply-chain scan, mirroring --lint/--no-lint and --dead-code/--no-dead-code. Supply-chain enablement now resolves as a scan option (InspectOptions.supplyChain) against supplyChain.enabled — the flag wins — so it takes precedence over per-project config on every scan (a workspace module's config can't undo --no-supply-chain), and config isn't mutated so scan.hasCustomConfig telemetry stays accurate. The enabled state also rides the per-scan wide event as scan.supplyChain.

• #1083 5d2f17f Thanks @​skoshx! - query-destructure-result no longer classifies rest-destructuring (const { data, ...rest } = query) — that shape is query-no-rest-destructuring's territory, and claiming it in both rules reported the same line twice (#1082). The rule now fires only on the consumption it uniquely owns: spreading the whole TanStack Query result into JSX (<Inner {...query} />) or an object literal, which enumerates every field and subscribes the component to all of them.

• #1070 64452aa Thanks @​rayhanadev! - Fix whole-repo scan cache replaying another project's diagnostics when a .git-less checkout sits inside an unrelated repository (e.g. a gitignored benchmark/mining clone directory reused across projects). The cache key's git identity (HEAD sha, worktree fingerprint) resolved from the enclosing repository, which cannot see the checkout's files, so two different projects materialized at the same path keyed identically. The key now requires the fingerprinted repository to actually track files under the project directory (cache off otherwise), and every cache hit re-verifies the stored payload's directory and package.json content hash so any future keying bug of this class degrades to a miss instead of a cross-project replay.

• #1077 9cb4149 Thanks @​aidenybai! - Third-round FP sweep: honor eslint-disable react-hooks/<rule> spellings for React Compiler diagnostics, suppress immutability findings inside Reanimated worklets, skip the vulnerability axis for devDependencies in supply-chain scoring, suppress query-no-usequery-for-mutation for polled/read-verb POST endpoints, prune compile-time-erased edges from circular-dependency detection, and fix unused-export/unused-file/unused-dev-dependency false positives in deslop-js.

• Updated dependencies [9cb4149, 1880b15, 5d2f17f, 9cb4149]:

  • oxlint-plugin-react-doctor@0.7.2
  • deslop-js@0.7.2

... (truncated)

Commits

• dfccac4 chore: version packages (#1113)
• fcb203e chore: version packages (#1086)
• b1bf6b9 RB-COMP-FIX: severity re-categorizations — align rule families at warn (#1098)
• b97a92f refactor(capabilities): unify framework gating into one capability vocabulary...
• aa519e5 chore: version packages (#1068)
• 9cb4149 fix(oxlint-plugin): precision sweep — narrow 40+ rules against verified FPs f...
• 5809083 feat(cli): add --supply-chain / --no-supply-chain to toggle the dependency sc...
• 64452aa fix(cli): scan cache no longer replays across projects at a reused path (#1070)
• 160f84c chore: version packages (#1063)
• 6b21b70 feat(core): surface reactDetected so a gated-off scan can't pass for clean (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
random-cat	Ready	Preview, Comment	Jul 14, 2026 7:47pm

[github-actions]

React Doctor could not complete this scan.

react-doctor exited with status 0 before producing a JSON report.

Report this bug

_{Reviewed by React Doctor for commit 7e81494.}