Update dependency react-doctor to ^0.9.3

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
react-doctor (source)	^0.7.1 → ^0.9.3

---

Release Notes

millionco/react-doctor (react-doctor)

v0.9.3

Compare Source

Patch Changes

• #​1519 83f3ff8 Thanks @​aidenybai! - Detect Astro projects, run template design rules through Astro's compiler with source-mapped diagnostics, and keep Astro's default sharp image service out of unused-dependency findings.

• #​1470 f1a1b16 Thanks @​aidenybai! - Detect React Compiler transforms passed through bundled config wrappers such as Vite's defineConfig.

• #​1533 2db2a97 Thanks @​aidenybai! - Reduce scan startup time and workspace contention by loading lightweight rule
  metadata, sharing Oxlint subprocess capacity across projects, and reusing
  semantic and filesystem analysis within each scan. Keep cached diagnostics
  correct when imported browser guards, Next.js manifests, nested project
  targets, or TypeScript path configuration change, and ignore explicitly
  disabled inline CSS animations and transitions in Remotion rules.

• #​1457 b31fd85 Thanks @​skoshx! - Keep baseline comparisons accurate when the GitHub Action scans a rootDir subdirectory.

• #​1540 5268cb4 Thanks @​skoshx! - fix(server-auth-actions): skip credential-establishing actions via SDK detection

  The server-auth-actions rule now correctly skips server actions that perform credential-establishing operations (signup, signin, OTP verification, password reset) by detecting calls to auth SDK methods like supabase.auth.signUp(), auth.signInWithPassword(), and auth.verifyOtp(). These actions legitimately run for anonymous callers, so requiring authentication would be incorrect.

  This resolves the documented false positive where credential-establishing endpoints were incorrectly flagged as unauthenticated privileged operations.

  Closes #​1538

• #​1467 3728102 Thanks @​aidenybai! - Upgrade the Oxc toolchain to the latest releases.

• #​1488 d6f02bb Thanks @​aidenybai! - Detect browser-dependent hydration branches through render-time helpers, mutable aliases, state initializers, and compiled React output.

• #​1426 3f3197f Thanks @​aidenybai! - Show scan progress immediately after interactive project selection while Git and project setup continue. Keep the experimental TUI usable across terminal sizes with a compact visual hierarchy, balanced report layouts, readable active findings, and a theme-safe action menu. Render repeated live diagnostics without React key warnings.

• #​1516 86add14 Thanks @​aidenybai! - --staged now honors --project and the config's projects field, so a monorepo pre-commit scan stops reporting clean with every React rule gated off. Each selected package brings its own package.json / tsconfig / config into the staged snapshot, and every staged path belongs to exactly one package. Selecting a package also makes the --json report package-scoped, so packageRoot is no longer always the report's directory; diagnostic ids are unchanged, so baselines still match.

  Selecting several packages prints the aggregate project summary rather than a single-scan report, notes how many staged files fell outside the selected projects, and writes --output-dir on a quiet (--json / --score) run where it previously wrote nothing.

  Failures stay out of the committer's way. A projects entry that no longer resolves, or that points outside the scanned tree, warns and falls back to a root scan rather than blocking every commit; an explicit --project still fails, since it was typed this run. A staged run whose git index cannot be read fails rather than treating it as empty, but individual paths that cannot be snapshotted are reported and skipped, and when nothing is left to scan the run warns and exits 0 — nobody can act on an oversized blob mid-commit, and failing would only send them to --no-verify.

• Updated dependencies [83f3ff8, 3d67ca1, 1098b9c, c126684, 992205a, 8402820, de6d280, 0cc5efb, d81eeda, 16972ae, 5f23826, c6bdd2d, 57743f8, 1938763, 29e35d5, 01ca0b3, 69d19b5, 2db2a97, 5268cb4, 3728102, b10cd4c, 9418a1c, 444e177, 8170ba2, 65539af, b07af9d, d6f02bb, 9512488, adcee58, 1f6e181, 6b64dfa, c672551, a81b3d6, 660200e, 8715808, 3a0b9a0, 2992a03, 443082a, bf470d5, b479d7d, a9a1f40, 5dc936e, fb5f881, a8115b8, 3bc63ea, 811a2ff]:

  • deslop-js@​0.9.3
  • oxlint-plugin-react-doctor@​0.9.3

v0.9.2

Compare Source

Patch Changes

• #​1451 4fbab2d Thanks @​aidenybai! - Detect TanStack Start root documents that omit client scripts and unsafe filesystem containment checks that compare resolved paths with a bare string prefix.

• #​1454 4ebd0a0 Thanks @​aidenybai! - Add opt-in diagnostics for auto-scrolling content, decorative radial effects, pulsing status dots, repeated container copy, and shape-assembled illustrations. Improve existing design and copy diagnostics with stricter visibility, cascade, motion, contrast, and structural analysis.

• #​1450 7ee59d3 Thanks @​aidenybai! - Detect active React Compiler transforms referenced through Node require.resolve.

• #​1461 80e89c5 Thanks @​skoshx! - Fix a stack overflow in React Compiler project discovery when nested configuration helpers forward same-named parameters or config bindings resolve cyclically.

• #​1445 b1b62db Thanks @​aidenybai! - Avoid jsx-no-undef false positives for identifiers confirmed by an active unplugin-auto-import configuration and its current generated ESLint globals.

• #​1458 1aa6b12 Thanks @​aidenybai! - Detect active React Compiler transforms imported recursively from dependency packages.

• #​1443 8534d86 Thanks @​aidenybai! - Scan JavaScript in standard inline HTML script blocks, including Three.js code, while preserving HTML file paths and source locations in diagnostics.

• #​1427 5d2f66d Thanks @​aidenybai! - Add React Native diagnostics for Reanimated 4 migrations, Gorhom Bottom Sheet integration, Expo platform tree shaking, Babel plugin order, and Android release shrinking. Expand recycler support to current Legend List and animated FlashList entrypoints, follow proven same-file renderer indirection, tighten heterogeneous recycler detection, and refresh outdated React Native recommendations.

• Updated dependencies [4fbab2d, 4ebd0a0, 49c5c1e, 846c2df, b1b62db, 5d2f66d]:

  • oxlint-plugin-react-doctor@​0.9.2
  • deslop-js@​0.9.2

v0.9.1

Compare Source

Patch Changes

• #​1428 1e67af0 Thanks @​aidenybai! - Add seven conservative diagnostics for responsive accessible names, reduced-motion content, animation ownership and focus timing, loading-control identity, request error states, and composite-widget feedback. Keep project-wide reduced-motion policy on the existing require-reduced-motion diagnostic instead of introducing a duplicate rule.

• #​1437 30369b6 Thanks @​skoshx! - Detect React Compiler from its compatibility runtime so compiler-gated diagnostics stay disabled when configuration lives outside the scanned package.

• #​1434 db9d300 Thanks @​aidenybai! - Make every design-tagged rule opt-in during general scans while keeping the focused design command and explicit rule configuration able to enable them.

• Updated dependencies [1e67af0, 707378a, 8765ca3, db9d300]:

  • oxlint-plugin-react-doctor@​0.9.1
  • deslop-js@​0.9.1

v0.9.0

Compare Source

Minor Changes

• #​979 9155bc0 Thanks @​aidenybai! - Add an experimental Ink TUI at react-doctor experimental-tui. It streams diagnostics during the scan, then renders the complete score-sorted report with keyboard navigation, inline code frames, focused fix prompts, and optional agent handoff. Monorepos get interactive project selection and one combined report with project-qualified paths. Ink and React load lazily, so the default static, JSON, and score-only paths are unaffected.

Patch Changes

• #​1423 3d7ea66 Thanks @​aidenybai! - Speed up custom Hook and wildcard re-export analysis, and upgrade the Oxc toolchain.

• #​1424 76263ec Thanks @​aidenybai! - Add direct Three.js and WebGL diagnostics derived from the React Three Fiber suite, covering hot animation and pointer paths, render-time construction, resource cleanup, device pixel ratio, shadowed point lights, frame delta, instance-buffer and projection updates, WebGPU legacy APIs, TSL uniform branches, and synchronous GPU readbacks. Prevent cyclic config bindings from crashing project discovery.

• Updated dependencies [3d7ea66, 599e30d, 76263ec]:

  • deslop-js@​0.9.0
  • oxlint-plugin-react-doctor@​0.9.0

v0.8.3

Compare Source

Patch Changes

• 8d4d5a8 Thanks @​aidenybai! - Remove extraneous usage copy from the package README.

• Updated dependencies []:

  • oxlint-plugin-react-doctor@​0.8.3
  • deslop-js@​0.8.3

v0.8.2

Compare Source

Patch Changes

• #​1419 8c4959b Thanks @​aidenybai! - Correct false positives and false negatives found by an all-rules 2,000-project parity audit. Tighten project capability detection, browser-target compatibility, React Compiler configuration reachability, Tailwind conflict handling, JSX attribute ordering, accessible-name evidence, server-action provenance, state/effect execution analysis, image and motion evidence, and framework export handling.

• #​1337 0b0b5ac Thanks @​aidenybai! - Add deterministic design-quality lint rules spanning motion performance, accessibility, and Tailwind/JSX hygiene.

  Add react-doctor design [directory] for a focused UI audit. The command runs the complete design-rule bucket plus other explicitly design-tagged rules, deliberately activates that family's focused opt-in diagnostics, respects explicit per-rule disablements, and skips unrelated analyzers, external lint configuration, custom plugins, and health scoring.

  Motion

  • motion-create-in-render — Motion component factories executed during a component or custom-hook render, including synchronous iteration callbacks. Module scope, event/effect callbacks, and stable React initializers remain valid.
  • motion-value-constructor-in-render — manual motionValue() objects recreated during React render. Recommends useMotionValue() while preserving module-scope and explicitly stabilized values.
  • motion-use-transform-range-length — statically provable useTransform() input and output arrays with different lengths. Aliased and namespace imports are resolved; dynamic and spread-backed ranges are skipped.
  • motion-keyframe-times-mismatch — static Motion keyframe arrays whose transition times count does not match the keyframe count, including transition objects nested inside animate.
  • motion-value-subscription-in-render — .on() subscriptions attached to proven hook-created Motion values during render. Effect/event subscriptions and useMotionValueEvent() remain valid.
  • motion-imperative-animation-in-render — imperative animate() calls, animation-control starts, and Motion-value writes executed during React render. Resolves imported APIs, aliases, and useAnimate() tuple bindings while preserving effects, event handlers, deferred callbacks, and userland lookalikes.
  • motion-animate-presence-must-outlive-child — presence boundaries removed by the same condition as an exit-bearing child, which prevents Motion from observing the child leave. Stable outer boundaries, correctly propagated nested boundaries, and JSX hidden inside uninvoked callbacks remain valid.
  • motion-unstable-layout-id-in-iteration — repeated literal or index-derived layoutId values inside map() and flatMap() callbacks. Stable item-derived IDs, conditional shared markers, and item-scoped layout groups remain valid.
  • motion-layout-on-inline-element — proven Motion layout animations attached to an explicitly inline element, where transform-based layout animation cannot take effect. Static inline styles and unvariant Tailwind display utilities are resolved with CSS precedence.
  • motion-drag-axis-constraint-mismatch — x-axis drags constrained only by vertical bounds, y-axis drags constrained only by horizontal bounds, and statically inverted numeric intervals. Refs, dynamic objects, spreads, and userland lookalikes remain valid.
  • waapi-animation-in-render — Element.animate() calls on proven DOM receivers during component or custom-hook render, including synchronous callbacks and memo initializers. Effects, handlers, deferred work, module scope, and userland methods remain valid.
  • web-animation-offsets-valid — Web Animations keyframe offsets outside [0, 1] or in descending order, across array-form and property-indexed keyframes. Equal, missing, null, dynamic, and spread-backed offsets remain valid.
  • no-conflicting-spring-options — proven Motion transition objects that combine physics spring controls (stiffness, damping, or mass) with duration controls (duration or bounce) that Motion ignores. Handles direct and nested transition objects while skipping dynamic and spread-overridden configurations.
  • prefer-motion-transform-property — opt-in guidance for compositor-critical Motion animations that use individual transform keys instead of one directly accelerated transform value. Scope resolution limits findings to actual Motion components.
  • pointer-capture-needs-cancel-handler — manual intrinsic-element drags that capture their pointer and define move/up handling without a pointer-cancel or lost-capture cleanup path. Requires a proven local event.currentTarget.setPointerCapture(event.pointerId) call and skips spreads, custom components, nested callbacks, and uncertain handlers.
  • no-unthrottled-scroll-mutation — direct animation-style writes or Element.animate() calls from an unthrottled native scroll listener. Read-only handlers, small class toggles, non-animation style changes, timer throttles, and unknown emitters remain valid.
  • no-unbounded-animation-frame-loop — opt-in detection for a self-rescheduling requestAnimationFrame callback with no stop gate and no retained request ID.
  • no-layout-property-animation (extended) — now inspects statically provable Web Animations API keyframes in addition to Motion props.
  • no-large-animated-blur (extended) — now covers Motion and Web Animations keyframes while no longer misclassifying a static inline blur as animation.
  • no-permanent-will-change (extended) — now recognizes permanently active static Tailwind will-change-* utilities while preserving state-prefixed and scroll-position cases.
  • no-global-css-variable-animation (narrowed) — reports animated variables only on the document root or body, avoiding false positives for variables deliberately scoped to one element.
  • no-transition-all (extended) — now also flags the Tailwind transition-all class (was inline-style-only). Animating every property that changes includes expensive layout properties and instant ones like focus rings; name the properties (transition-colors, transition-transform).
  • no-tailwind-layout-transition — Tailwind arbitrary transition-[width|height|top|left|right|bottom|margin|padding], which animates layout properties the browser recomputes every frame. Animate transform/opacity instead.
  • no-ease-in-motion — exact inline, Motion, and Tailwind ease-in timing that delays the visible response, including transition configuration nested inside static Motion animation targets; preserves ease-in-out and dynamic timing values.
  • no-long-transition-duration (extended) — now covers static Motion transition objects, including nested transition configuration, while preserving perpetual loops, decorative hidden motion, dynamic values, unproven components, and duration values ignored by physics-based springs.
  • no-scale-from-zero (extended) — now covers inline transform transitions and Tailwind scale transitions in addition to proven Motion components.
  • no-excessive-motion-stagger — opt-in detection for proven Motion stagger intervals above 80 ms, including staggerChildren and scope-resolved stagger() calls used by delayChildren.
  • no-hover-only-reveal (extended) — now recognizes statically hidden Motion opacity states revealed by whileHover without an equivalent whileFocus state, in addition to Tailwind hover utilities.

  Accessibility

  • no-static-motion-config-never — root application Motion policies that permanently opt out of the user's reduced-motion setting. Subtree policies, dynamic user preferences, aliases, development conditionals, spreads, and non-Motion components remain valid.
  • no-blocked-paste — password, username, and one-time-code inputs whose paste handler definitely prevents the event, while preserving conditional policies, custom controls, spread-owned handlers, and non-authentication confirmation fields.
  • no-autoplay-without-muted — <video autoPlay> / <audio autoPlay> missing muted (sound-on autoplay is hostile to users and browser-blocked). Skips dynamic autoPlay, spreads, and truthy/dynamic muted.
  • no-uninformative-aria-label — an aria-label whose value is a content-free element-type word ("icon", "button", "image", "link", …) that tells screen-reader users nothing about the action.
  • no-invalid-progress-range — statically impossible native and ARIA progress ranges, including nonpositive native maxima, inverted ARIA bounds, and current values outside their declared range. Dynamic values and spread-owned props remain valid.
  • role-button-requires-complete-keyboard-activation — custom intrinsic elements with role="button" whose statically resolved keyboard activation handles Enter or Space but not both. Native buttons, opaque handlers, spreads, and uncertain control flow remain valid.
  • no-low-contrast-inline-style — computes the real WCAG 2.1 contrast ratio from a co-located inline color + backgroundColor and flags pairs below 4.5:1 (3:1 for large/bold text). Only fires on opaque, statically-resolvable colors (skips alpha, var(), gradients).
  • no-broken-image-source — intrinsic <img> elements with missing, empty, or hash-only static sources; skips dynamic and spread-provided sources.
  • no-placeholder-only-field — text inputs and textareas that rely on placeholder text without an associated label; recognizes wrapping labels, htmlFor, explicit ARIA names, and uncertain spread props.
  • no-all-caps-body-text — long semantic body passages transformed to uppercase or authored entirely in capitals; short labels and headings remain valid.
  • no-tight-body-leading — long body copy with a statically proven line-height ratio below 1.3, including precise inline values and Tailwind's tight leading utilities.
  • no-crushed-letter-spacing — static inline or arbitrary Tailwind tracking below -0.08em on text-bearing elements.
  • no-overwide-text-measure — explicit body-text widths above 80ch in inline styles or arbitrary Tailwind utilities.
  • no-skipped-heading-level — opt-in analysis of explicit heading sequences inside static page or article trees, without inferring across component boundaries.
  • no-cramped-container-padding — text inside an explicitly bounded or colored surface with less than 8px of static padding.
  • no-assertive-status: flags status regions that use assertive live announcements instead of a deliberate alert.
  • no-focusable-content-in-aria-hidden: finds statically focusable descendants inside an aria-hidden subtree.
  • no-multiple-unlabeled-navigation-landmarks: finds static JSX trees with multiple unnamed navigation landmarks.
  • no-aria-invalid-without-description: opt-in detection for invalid controls that do not reference explanatory text.
  • details-requires-summary: opt-in detection for native disclosure widgets without a first-child summary.
  • fieldset-requires-legend: opt-in detection for field groups with multiple controls but no direct legend.
  • data-table-requires-accessible-name: opt-in detection for tables with header cells but no caption or ARIA name.
  • no-multiple-main-landmarks: finds static JSX trees with multiple main landmarks.
  • no-nonresizable-textarea: opt-in detection for textareas that disable both resize axes.
  • form-control-requires-name: opt-in detection for native form controls that cannot contribute a name to form submission.
  • no-ungated-tailwind-animation: opt-in detection for continuous Tailwind animations without a reduced-motion gate.
  • no-transitioned-focus-ring — detects Tailwind focus rings or outlines whose box-shadow/outline transition delays visible keyboard focus; color-only hover transitions remain valid.
  • aria-braille-equivalent — opt-in detection for nonempty braille labels or role descriptions without a provable non-braille accessible equivalent.
  • no-aria-hidden-on-body — opt-in detection for a statically true aria-hidden on the document body.
  • no-focusable-content-in-role-text — opt-in detection for intrinsic focusable controls whose semantics are flattened by a static role="text" ancestor.
  • empty-table-header — opt-in detection for native or ARIA table headers with no accessible content or explicit name.
  • html-xml-lang-mismatch — opt-in detection for conflicting static base languages in root lang and xml:lang declarations.
  • no-duplicate-static-id-reference — opt-in static-tree detection for duplicated literal IDs used by labels or ARIA ID references.
  • iframe-title-unique — opt-in static-tree detection for frames whose normalized literal titles are duplicated.
  • no-server-side-image-map — opt-in detection for statically enabled server-side image maps.
  • no-presentation-role-conflict — opt-in detection for presentational elements that remain focusable or expose global ARIA state.
  • html-no-nested-interactive (extended) — now catches statically focusable descendants inside roles whose children become presentational, including controls with a negative tabIndex.

  Design / Tailwind hygiene

  • no-redundant-display-class — a display utility matching the element's default (block on a <div>, inline on a <span>); skips variant-prefixed and meaningful displays (flex, grid, hidden).
  • prefer-truncate-shorthand — overflow-hidden text-ellipsis whitespace-nowrap collapses to the single truncate utility.
  • no-full-viewport-width — w-screen / w-[100vw] / inline 100vw, which overflows horizontally when a scrollbar is visible; prefer w-full / width: 100%.
  • no-svg-currentcolor-with-fill-class — fill="currentColor" / stroke="currentColor" fighting a fill-* / stroke-* color class (the class silently wins); keep one, or use fill-current.
  • no-pointer-disabled-enabled-control — opt-in detection for enabled native controls that statically disable pointer input through inline styles or an unvariant Tailwind utility. Disabled, inert, hidden, nonfocusable, dynamic, and variant-scoped cases remain valid.
  • no-clipped-overlay — absolute menus, listboxes, dialogs, and tooltips nested under overflow-hidden or overflow-clip containers.
  • no-nested-card-surface — opt-in detection for a complete rounded, bounded card treatment nested inside another card surface.
  • no-side-tab-border (extended) — also recognizes heavy top or bottom accents on rounded surfaces while preserving square dividers.
  • no-oversized-long-heading — opt-in detection for sentence-length <h1> copy set at an explicit hero display size.
  • no-italic-serif-display-heading — opt-in detection for oversized headings that combine serif and italic treatments.
  • no-repeated-kicker-labels — opt-in file-level detection for three or more short uppercase tracked labels immediately preceding headings.
  • no-numbered-section-markers — opt-in detection for consecutive decorative number labels preceding section headings.
  • no-image-hover-transform — opt-in detection for images that scale or rotate on hover through static Tailwind utilities.
  • no-repeating-gradient-decoration — opt-in detection for repeating CSS gradients used as generic surface texture.
  • no-hairline-border-wide-shadow — opt-in detection for card treatments that combine a one-pixel border with a broad shadow.
  • no-icon-tile-heading-stack — opt-in detection for repeated card composition built from a colored icon tile followed by a heading.
  • no-hero-eyebrow-chip — opt-in detection for tracked uppercase eyebrow copy placed immediately before an oversized hero heading.
  • no-common-root-font — opt-in detection for page roots that explicitly select a commonly reused UI font.
  • no-default-warm-page-surface — opt-in detection for full-page warm-neutral Tailwind surfaces.
  • no-default-purple-page-gradient — opt-in detection for full-page purple-to-blue or purple-to-cyan Tailwind gradients.
  • no-generic-purple-blue-icon-gradient — opt-in detection for compact, rounded purple-to-blue gradient tiles used as generic icons or avatars.
  • no-dynamic-tailwind-class-fragment — opt-in detection for Tailwind utilities assembled across runtime template interpolations, which the Tailwind source scanner cannot discover as complete class names.
  • no-emoji-heading-decoration — opt-in detection for decorative emoji embedded in static native heading copy while preserving dynamic content, icon components, and non-product example paths.
  • no-inert-pointer-affordance — opt-in detection for noninteractive native elements that advertise clickability with cursor-pointer but have no local or delegated interaction signal.
  • no-repeated-placeholder-navigation — opt-in detection for navigation containers that repeat bare href="#" destinations while preserving real fragment links and isolated scroll-to-top anchors.
  • no-tiny-uppercase-tracked-label — opt-in detection for static labels that combine an explicit font size of 11 px or less with uppercase transformation and non-default tracking, while preserving code-like values, dynamic copy, responsive-only styles, and readable sizes.

  Tailwind-specific design detectors now require a detected Tailwind dependency, and JSX-only design detectors require React. The newest visual heuristics also abstain when spreads, custom-component forwarding, later utility precedence, or semantic emoji placement make the verdict uncertain.

  • no-flat-page-type-scale — opt-in page-level analysis for three or more explicit text sizes compressed into less than a 2× range.
  • no-monotonous-page-spacing — opt-in page-level analysis for a dominant spacing value repeated across a sufficiently large static sample.
  • no-generic-marketing-copy — opt-in detection for broad promotional phrases in static page or article copy.
  • no-manufactured-contrast-copy — opt-in detection for pages that repeatedly frame claims as short artificial contrasts.
  • no-decorative-grid-background — opt-in detection for layered one-pixel linear gradients that draw a coordinate grid outside data-visualization contexts.
  • no-smooth-scroll-without-reduced-motion: opt-in detection for smooth-scrolling utilities without a reduced-motion override.
  • no-inert-sticky-position: opt-in detection for sticky elements without a static inset anchor.
  • no-img-without-dimensions: opt-in detection for images without intrinsic dimensions or a statically reserved CSS box.
  • no-small-form-control-text: opt-in detection for native controls with a static font size below 16 px.
  • no-undersized-icon-button: opt-in detection for icon-only buttons with a provable target below 24 px on either axis.
  • no-layout-shifting-interaction-state: opt-in detection for interaction utilities that change layout geometry or font metrics.
  • no-hover-only-reveal: opt-in detection for content revealed on hover without an equivalent keyboard-focus state.
  • no-invisible-focus-control: opt-in detection for fully transparent native controls whose proxy surface provides no visible keyboard-focus treatment.
  • no-fixed-inside-transformed-ancestor: opt-in detection for fixed descendants whose static ancestor establishes a containing block.
  • no-decorative-blur-orb — opt-in detection for empty, absolutely positioned, strongly blurred circular color fields used as generic decoration.
  • no-repeated-glass-surfaces — opt-in page-level detection for three or more complete translucent, blurred, bordered, and rounded surface treatments.
  • no-excessive-pill-treatment — opt-in page-level detection for five or more short labels or actions presented as filled or outlined pills.
  • no-uniform-feature-card-grid — opt-in detection for grids whose direct children all repeat the same complete card, heading, and paragraph composition.
  • no-excessive-centered-copy — opt-in page-level detection for repeated substantial paragraphs set as centered copy.
  • no-full-viewport-centered-hero — opt-in detection for structurally simple hero sections that combine full-viewport height, centered layout, and a primary heading.
  • no-repeated-emoji-tiles — opt-in page-level detection for three or more emoji-only glyphs placed in small, rounded, colored square tiles.
  • no-uppercase-mono-label — opt-in detection for static short labels that combine monospace, uppercase, and explicit tracking while preserving code elements and dynamic identifiers.
  • no-tight-display-tracking — opt-in detection for static primary headings using Tailwind's tightest built-in letter spacing.
  • no-excessive-card-surfaces — opt-in page-level detection for six or more complete card surfaces in a static page tree.
  • no-repeated-section-shells — opt-in detection for pages that repeat the same large vertical section padding and centered max-width wrapper structure at least three times.
  • no-pure-black-shadow — opt-in detection for visible inline or Tailwind shadows colored with opaque or translucent pure black.
  • no-decorative-pulse — opt-in detection for stable text that pulses continuously outside a proven loading or progress state.
  • no-excessive-font-families — opt-in page-level detection for four or more literal font families while preserving tokenized font variables.
  • no-fake-browser-chrome — opt-in detection for framed previews that recreate empty red, yellow, and green browser controls as decoration.
  • no-overloaded-hover-state — opt-in detection for a single hover state that stacks three or more effect families such as motion, color, shadow, opacity, or filters.
  • no-placeholder-persona-copy — opt-in detection for generic sample identities rendered in top-level page copy.
  • no-repeated-hover-scale — opt-in page-level detection for the same hover scale repeated on at least three elements within one static page root.
  • no-tight-all-caps-heading — opt-in detection for long all-caps headings with a statically proven line-height below 1.0.
  • prefer-tabular-numeric-data — opt-in detection for dynamically formatted numeric table cells without inherited tabular or monospace figures.
  • require-autoplay-video-poster — opt-in detection for statically autoplaying intrinsic videos without a poster frame.
  • no-empty-card-shell — opt-in detection for empty elements styled as complete card surfaces.
  • no-mixed-icon-libraries — opt-in file-level detection for JSX that mixes imports from multiple icon-system families.
  • no-pill-navigation-count — opt-in detection for bare numeric navigation counts styled as generic pills instead of semantic badges.
  • no-redundant-title-tooltip — opt-in detection for title text that merely repeats an element's visible static label.
  • no-symmetric-text-button-padding — opt-in detection for text buttons whose static Tailwind padding is symmetric on both axes.
  • no-uppercase-tracked-navigation-label — opt-in detection for static navigation labels combining uppercase and expanded tracking.
  • require-scale-reveal-transform-origin — opt-in detection for proven Motion reveal elements that animate scale without a static transform origin.
  • no-gradient-text (extended) — now recognizes Tailwind v4 linear, radial, conic, numeric-angle, and arbitrary gradient background utilities without combining utilities across variants.
  • design-no-three-period-ellipsis (extended) — now checks static placeholders, titles, alternative text, and ARIA labels in addition to JSX text.
  • design-no-vague-button-label (narrowed) — preserves conventional Continue navigation when the same form proves a Back or Previous action.
  • design-no-em-dash-in-jsx-text (narrowed) — skips files in conventional long-form documentation, article, blog, content, and post paths.
  • no-cramped-container-padding (narrowed) — no longer treats a one-sided table or layout divider as a closed container around text.

  Render lifecycle

  • no-create-object-url-in-render — detects global URL.createObjectURL() calls in component or custom-hook render, including memo and state initializers, where discarded renders can leak disposable browser resources.

  HTML and component contracts

  • html-no-nested-form: finds statically nested native forms, which HTML parsing and submission do not support.
  • html-label-has-single-control: finds labels that statically contain more than one labelable control.
  • motion-animate-presence-requires-key: requires keys on direct static children of proven Motion AnimatePresence components.
  • motion-animate-presence-wait-single-child: finds mode="wait" instances with multiple direct static children.
  • no-mixed-srcset-descriptors: finds srcSet candidates that mix width and pixel-density descriptor modes.
  • shadcn-tabs-trigger-requires-list: opt-in detection for proven shadcn-style tab triggers outside a corresponding tab list.
  • no-srcset-without-sizes: requires sizes when an intrinsic image uses width descriptors in a static srcSet.

  Metadata

  • nextjs-metadata-url-consistency — statically provable disagreement between a Next.js page's canonical URL and openGraph.url, with normalization for equivalent trailing slashes and no claims about dynamic or inherited values.

  Tailwind canonicalization (distilled from ui.sh's canonicalize-tailwind guidance)

  • no-deprecated-tailwind-class — Tailwind v4 renamed/removed bg-gradient-* → bg-linear-*, flex-shrink-* → shrink-*, flex-grow-* → grow-*, overflow-ellipsis → text-ellipsis. Gated on a new tailwind:4 capability so v3 projects are unaffected.
  • no-arbitrary-px-font-size — text-[13px] doesn't scale with the user's root font size; use rem (text-[0.8125rem]). Pixels stay fine for border-*/outline-*.
  • prefer-dvh-over-vh — h-screen/min-h-screen/h-[100vh] overflow under mobile browser chrome; prefer dvh (h-dvh/min-h-dvh). Gated on tailwind:3.4.

  Also adds a tailwind:4 project capability to @react-doctor/core for version-gated Tailwind rules.

  React Compiler detection now recognizes the Vite 6 reactCompilerPreset() integration, the supported JavaScript, TypeScript, CommonJS, and ESM Babel configuration filenames, and the official Rsbuild and Rspack reactCompiler configuration. This keeps compiler-redundant diagnostics disabled when those integrations are active without changing the JSON report shape.

  Large-corpus validation keeps the highest-noise visual heuristics (no-arbitrary-px-font-size, no-cramped-container-padding, no-full-viewport-width, and prefer-motion-transform-property) in the focused design scan instead of the general scan. It also avoids diagnostics for responsive navigation variants and opaque navigation wrappers, translated fragment content, custom label components, display-sized paragraphs, test image mocks, imperatively sourced image refs, non-production placeholder fields, link-named editor actions, image boxes controlled by unresolved CSS, card-styled controls and code blocks, and terminal-style technical labels.

• #​1403 3598138 Thanks @​aidenybai! - Fix false positives in React Hooks, server action authentication, server prop deduplication, MDX execution risk, public debug artifact, secret fallback, and React Native Babel preset diagnostics. Detect server actions exported through later named or default exports, and gate the legacy Metro preset diagnostic on React Native version and actual package resolution.

• #​1402 cd9ca68 Thanks @​aidenybai! - Add library-version capabilities, cross-file resolution, cache fingerprinting, shared rule-analysis utilities, and mock-fixture filename recognition.

• #​1411 f5f13b8 Thanks @​aidenybai! - Add 38 React Router diagnostics with installed-version, Framework/Data mode, and package-boundary gating.

• #​1381 f5f6a79 Thanks @​aidenybai! - Treat set-state-in-effect as advisory render guidance instead of a compiler bailout

• #​1376 1839566 Thanks @​aidenybai! - Match baseline diagnostics by rule, message, and normalized source evidence, using side-aware Git snapshots and parser-proven handler forwarding so unchanged findings can move safely while changed or additional findings remain reportable.

• Updated dependencies [5b468f8, cd9ca68, b4556e3, 7eca0ee, 82c4a12, f4aa821, 5332cb6, 8c4959b, 0b0b5ac, 284b4e4, 6fcd9c9, 21221c2, fc1b3a3, 26b4a0c, 61bf03e, af33723, 8e5ae45, 3598138, cd9ca68, cd9ca68, cd9ca68, cd9ca68, cd9ca68, cd9ca68, cd9ca68, cd9ca68, cd9ca68, cd9ca68, cd9ca68, cd9ca68, f5f13b8, cd9ca68, f5f6a79, d970055, b852961, e6a1557, fe241a9, a4eaedd, [a667b45](https://redirect.gith

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nextjs-woocommerce	Ready	Preview	Aug 4, 2026 6:31am

[github-actions]

🩺 React Doctor — Score: 86 / 100

Full diagnostics

``` ✓ Lockfile passes supply-chain policies (verified 2s ago) Lockfile is up to date, resolution step is skipped Already up to date

╭──────────────────────────────────────────╮
│ │
│ Update available! 11.17.0 → 11.20.0. │
│ Changelog: https://pnpm.io/v/11.20.0 │
│ To update, run: pnpm self-update │
│ │
╰──────────────────────────────────────────╯

Done in 1s using pnpm v11.17.0
$ echo n | react-doctor --verbose
React Doctor v0.9.3

✔ Select projects › nextjs-woocommerce

✔ Scanned 66 files in 1.8s [~4 workers]

⚠ Performance: transition: all animates everything ×3
Learn more: https://react.doctor/docs/rules/react-doctor/no-transition-all
Your users see janky animation because transition-all
animates every property that changes, including expensive
layout ones and instant ones like focus rings. Name the
properties: transition-colors, transition-opacity, or
transition-transform.
→ List the specific properties: transition: "opacity 200ms, transform 200ms". In Tailwind, use
transition-colors, transition-opacity, or
transition-transform

src/components/Category/Categories.component.tsx:16

src/components/Header/Navbar.component.tsx:32

src/components/Header/Navbar.component.tsx:40

⚠ Maintainability: deslop/unused-dependency
Unused dependency: sharp
→ An unused dependency adds install time and supply-chain
surface without being used; remove it from package.json if
it is genuinely unused.

────────────────────────────────────────────────────────────

All 4 issues

Performance › 3 warnings
Maintainability › 1 warning

┌─────┐ 86 / 100 Great
│ ◠ ◠ │ ███████████████████████████████████████████░░░░░░░
│ ▽ │ React Doctor (https://react.doctor)
└─────┘

Full diagnostics written to /tmp/react-doctor-e4e289a4-d289-41b8-b059-c6fd8d8300eb

────────────────────────────────────────────────────────────

Share: https://react.doctor/share?p=nextjs-woocommerce&s=86&w=4&f=3
Tell others how you did on socials

Docs: https://react.doctor/docs
Learn more about fixing issues, setting up CI/CD, and
configuring rules with a config file

GitHub: https://github.com/millionco/react-doctor
Report issues and star the repository!

</details>
> Powered by [react-doctor](https://github.com/millionco/react-doctor)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud