deps: Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	^22.19.7 → ^22.19.9
@types/react (source)	^19.2.10 → ^19.2.13
dotenv	^17.2.3 → ^17.2.4
react-hotkeys-hook (source)	^5.2.3 → ^5.2.4
turbo (source)	^2.8.0 → ^2.8.3
vite-plugin-dts	^3.8.1 → ^3.9.1
vite-plugin-dts	^4.5.0 → ^4.5.4

---

Release Notes

motdotla/dotenv (dotenv)

v17.2.4

Compare Source

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#​915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

JohannesKlauss/react-keymap-hook (react-hotkeys-hook)

v5.2.4

Compare Source

• Merge pull request #​1312 from JohannesKlauss/revert-1275-main 1197daf
• Revert Regression introduced in "Try to prevent events firing incorrectly when using useKey: true" 612e549
• Merge pull request #​1311 from ShrimpCryptid/feat/clarify-ishotkeypressed-multiple-key-behavior 0219c01
• doc: Updated wording on isHotkeyPressed key argument 9203b7f
• fix: Update documentation for isHotkeyPressed to describe arguments correctly 154eab9

---

vercel/turborepo (turbo)

v2.8.3: Turborepo v2.8.3

Compare Source

What's Changed

Changelog

• fix: Upgrade capnp to 0.24 by @​anthonyshew in #​11656
• fix: Upgrade h2 to fix CONTINUATION Flood by @​anthonyshew in #​11658
• fix: Upgrade crossbeam-channel to 0.5.15 by @​anthonyshew in #​11657
• chore: Remove abandoned turbo clone command by @​anthonyshew in #​11673
• fix: Upgrade rustls and ring by @​anthonyshew in #​11659
• fix: Upgrade openssl to 0.10.75 by @​anthonyshew in #​11660
• fix: Replace unmaintained adler with adler2 by @​anthonyshew in #​11661

Full Changelog: vercel/turborepo@v2.8.2...v2.8.3

v2.8.2: Turborepo v2.8.2

Compare Source

What's Changed

Docs

• fix: Upgrade next to fix HTTP deserialization DoS by @​anthonyshew in #​11597
• fix: Upgrade mermaid to fix lodash-es vulnerability by @​anthonyshew in #​11611
• fix: Upgrade recharts to fix lodash vulnerability by @​anthonyshew in #​11606
• chore: Move applications to apps/ directory by @​anthonyshew in #​11613
• fix: Upgrade rehype packages to fix mdast-util-to-hast vulnerability by @​anthonyshew in #​11616

create-turbo

• fix: Upgrade tsup to fix rollup and glob vulnerabilities by @​anthonyshew in #​11601
• fix: Upgrade inquirer to 8.2.7 to fix tmp vulnerability by @​anthonyshew in #​11622
• fix: Upgrade ts-jest to 29.4.6 to fix brace-expansion ReDoS vulnerabilities by @​anthonyshew in #​11623
• feat: Migrate from tsup to tsdown by @​anthonyshew in #​11649

@​turbo/codemod

• fix: Upgrade axios to fix SSRF vulnerability by @​anthonyshew in #​11599
• fix: Replace axios with native fetch in turbo-codemod by @​anthonyshew in #​11600
• fix: Upgrade diff to fix DoS vulnerabilities by @​anthonyshew in #​11621

eslint

• fix: Upgrade eslint devDependency to fix stack overflow vulnerability by @​anthonyshew in #​11610
• fix: Upgrade esbuild to fix arbitrary request vulnerability by @​anthonyshew in #​11615

Examples

• examples: Update NODE_VERSION to 24.13.1 in Dockerfile by @​i5d6 in #​11591
• fix: escaping for link titles in LinksService by @​odaysec in #​11632

Changelog

• fix: Add allowComments and allowTrailingCommas to turbo.json schema by @​ddmoney420 in #​11579
• chore: Eliminate ts-rs serde attribute parse warnings by @​anthonyshew in #​11589
• fix: Extract git argument validation into reusable helper by @​anthonyshew in #​11593
• fix: Upgrade fast-xml-parser to fix RangeError DoS by @​anthonyshew in #​11598
• fix: Upgrade semver to fix ReDoS vulnerability by @​anthonyshew in #​11596
• fix: Upgrade tar to fix security vulnerabilities by @​anthonyshew in #​11602
• fix: Upgrade @​actions/github to fix @​octokit vulnerabilities by @​anthonyshew in #​11607
• fix: Upgrade @​vercel/blob and @​actions packages to fix undici vulnerability by @​anthonyshew in #​11608
• docs: Running Root Tasks by @​Netail in #​11630
• Update README.md title and remove features section by @​anthonyshew in #​11651
• docs: Update using-environment-variables.mdx by @​anthonyshew in #​11652
• fix: Upgrade js-yaml to address CVE-2025-64718 by @​alexmkio in #​11650
• fix: Remove smooth scrolling from docs by @​anthonyshew in #​11654
• fix: Add sitemap link to 404 page and fix TurborepoLogo gradient by @​anthonyshew in #​11655

New Contributors

• @​ddmoney420 made their first contribution in #​11579
• @​i5d6 made their first contribution in #​11591
• @​Netail made their first contribution in #​11630
• @​alexmkio made their first contribution in #​11650

Full Changelog: vercel/turborepo@v2.8.1...v2.8.2

v2.8.1: Turborepo v2.8.1

Compare Source

What's Changed

Docs

• docs: Release post for 2.8 by @​anthonyshew in #​11559
• docs: Update oxc.mdx to include cache false by @​bestickley in #​11571
• docs: Fix curl markdown Accept header syntax in 2.8 release blog by @​marko-hologram in #​11580
• docs: Fix worktree command in blog post by @​anthonyshew in #​11583
• docs: Rename command → subcommand by @​anthonyshew in #​11584
• feat: Add requestType tracking for header-negotiated markdown by @​molebox in #​11585

Changelog

• fix: Support trailing commas in microfrontends JSONC files by @​anthonyshew in #​11573
• perf: Replace third-party crates with Rust std lib equivalents by @​anthonyshew in #​11569
• perf: Reduce duplicate dependency versions by @​anthonyshew in #​11568
• chore: Remove legacy Go/goreleaser buildcontainer directory by @​anthonyshew in #​11576
• chore: Rename README.md to RULE.md in skills directory by @​anthonyshew in #​11582
• fix: Validate turbo version from lockfile for all package managers by @​anthonyshew in #​11587

New Contributors

• @​bestickley made their first contribution in #​11571
• @​marko-hologram made their first contribution in #​11580

Full Changelog: vercel/turborepo@v2.8.0...v2.8.1

---

Configuration

📅 Schedule: Branch creation - "after 12pm on Friday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview