fix(deps): update external major to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/checkout	action	major	v6 → v7
actions/setup-node	action	major	v6 → v7
mobx (source)	dependencies	major	6.16.1 → 7.0.3

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

mobxjs/mobx (mobx)

v7.0.3

Compare Source

Patch Changes

• 6f002b8e543ca39d3ee23681e28848d7f1724fae #​4696 Thanks @​gesposito! - perf: add a node export condition that routes Node and Bun to the existing dist/index.js entry, which picks the prebaked development or production CJS build once at require time. importing mobx in Node no longer executes the env-agnostic dist/mobx.mjs with per-call NODE_ENV checks, and mixing import and require in one Node app now yields a single mobx instance.

v7.0.2

Compare Source

Patch Changes

• ec1b708026c1578e1c1f6c7bd90be18b26f7ce85 #​4695 Thanks @​gesposito! - perf: evaluate NODE_ENV once at module scope in the env-agnostic esm bundles (dist/<pkg>.esm.js and dist/<pkg>.mjs) instead of at every __DEV__ call site. process.env is an exotic object in Node, so each check performed a real environment lookup on hot paths; consumers that execute these files as-is (Node ESM, vitest, SSR) see roughly 10x faster observable writes in dev mode. All env-set artifacts and bundler output are unchanged.

• 6d8b5fa6c7596d7e5b16e55e3121d81c0c5bb21a #​4672 Thanks @​chatman-media! - Fix ObservableSet.replace emitting spurious delete/add events (and triggering reactions) for values that are unchanged. It now only fires delete for removed values and add for newly added ones, mirroring ObservableMap.replace.

  Note: because replace no longer clears and re-adds every value, the iteration order after replace changes in a (subtle but observable) way. Surviving values now keep their original relative position and newly added values are appended, instead of the whole set being reordered to match the argument. For example, set(["a", "b", "c"]).replace(["d", "b", "a"]) previously iterated as d, b, a, and now iterates as a, b, d. This is arguably the more correct behavior (unchanged values are genuinely unchanged), but if you relied on replace reordering the set to match its argument, you may need to adjust.

v7.0.1

Compare Source

Patch Changes

• 9444c624b957b489875e1c6b45deb290034ce4e9 #​4694 Thanks @​mrpmohiburrahman! - fix: onBecomeObserved is now called for the dependencies of a computed that becomes observed while serving a cached value. Previously, observation only cascaded when the newly observed computed also happened to recompute, so an observable with a live observer chain up to a running reaction could still report itself as unobserved and never fire its hook.

• 53bb83fdf455a4e606bb721ea10040ded7c57796 #​4683 Thanks @​gesposito! - perf: fast-path primitives in deepEnhancer. Writing a primitive into a deep observable no longer runs the observable/array/plain-object/Map/Set/function type checks; primitives can never be made observable, so they are returned immediately. Creating an observable array of primitives is ~4x faster, and observable Set/Map writes are ~20-25% faster in the perf suite.

• 030498d6b2bfe4cc27340fed8c706177cb3b28e1 #​4684 Thanks @​a-y-ibrahim! - Fix a stack overflow ("Maximum call stack size exceeded") that could occur when an onBecomeUnobserved handler disposes a Reaction. Disposing a Reaction re-enters endBatch(), which used to recurse into the same pendingUnobservations drain loop instead of letting the already-running outer loop pick up the newly queued items, causing unbounded stack depth for long enough chains.

• a9086076b9ead1a9c933215bffaa9b57d44f6829 #​4681 Thanks @​spokodev! - Fix ObservableSet union, intersection and symmetricDifference to return results in receiver order, matching native Set, when the argument is a plain Set.

• c65a4e14cf48b42cb792dc4c64edbcf56234b32d #​4682 Thanks @​gesposito! - perf: lazily allocate the internal observers_ Set. Atoms and computed values no longer allocate an empty Set upfront; it is created on first observer instead. Most atoms in large stores are never observed, so this saves roughly 160 bytes per unobserved atom (e.g. ~35% lower heap usage when hydrating 50k instances with 10 observable fields each).

v7.0.0

Compare Source

Major Changes

• 1926c69f53168619d688f348aa587e8f3ae579ae #​4671 Thanks @​kubk! - Release MobX 7, mobx-react-lite 5, and mobx-react 10.

  Bundle sizes are down: ESM prod 17.02 KiB gzip -> 13.96 KiB gzip; a minimal tree-shaken example is 10.32 KiB gzip now.

  It removes long-deprecated compatibility paths and keeps the React bindings split between mobx-react-lite for function components and mobx-react for class-component support.

MobX 7

MobX 7 is a cleanup release focused on the modern runtime and decorator model.

-   MobX now always uses Proxy-backed observable objects and arrays. The ES5/non-proxy fallback has been removed.
-   `configure({ useProxies: ... })` is no longer supported.
-   `{ proxy: false }` options for `observable`, `observable.object`, and `observable.array` are no longer supported.
-   Legacy decorators are no longer supported.
-   Namespaced annotation and comparer properties now use named exports to reduce bundle size:

| Removed API           | Replacement         |
| --------------------- | ------------------- |
| `observable.ref`      | `observableRef`     |
| `observable.shallow`  | `observableShallow` |
| `observable.deep`     | `observableDeep`    |
| `observable.struct`   | `observableStruct`  |
| `computed.struct`     | `computedStruct`    |
| `action.bound`        | `actionBound`       |
| `flow.bound`          | `flowBound`         |
| `comparer.identity`   | `compareIdentity`   |
| `comparer.default`    | `compareDefault`    |
| `comparer.structural` | `compareStructural` |
| `comparer.shallow`    | `compareShallow`    |

-   The public `trace` API and its related runtime support have been removed. Use `toJS`, `getDependencyTree`, `getObserverTree`, `spy` or `mobx-log` package for debugging.

mobx-react-lite 5 and mobx-react 10

mobx-react-lite 5 and mobx-react 10 require MobX 7 and React 18 or later.

`mobx-react-lite` remains the function-component package. `mobx-react` remains a thin wrapper around `mobx-react-lite` that adds class component and Stage 3 `@observer` class decorator support.

-   Keep function-component imports on `mobx-react-lite` if you do not need class component support.
-   Use `mobx-react` when you need class components or `@observer` class decorators.
-   `mobx-react-lite` supports function components and `forwardRef`; `mobx-react` delegates function components to `mobx-react-lite` and handles classes itself.
-   Remove React batching imports, including the stale React Native batching deep import. React 18+ renderers handle batching.

The recommended public React binding surface for both packages is:

-   `observer`
-   `Observer`
-   `useLocalObservable`
-   `enableStaticRendering`
-   `isUsingStaticRendering`

The following APIs have been removed from the React binding packages:

-   `Provider`, `inject`, and `MobXProviderContext`; use `React.createContext` directly.
-   `disposeOnUnmount`; dispose reactions in `componentWillUnmount` or return cleanup functions from `useEffect`.
-   `PropTypes`; use TypeScript or the regular `prop-types` package.
-   `useObserver`; wrap components with `observer` or use `<Observer>`.
-   `useLocalStore`; use `useLocalObservable`.
-   `useAsObservableSource`; synchronize values from props into local observable state explicitly.
-   `useStaticRendering`; use `enableStaticRendering`.
-   `observerBatching`, `isObserverBatched`, `batchingForReactDom`, `batchingOptOut`, and `batchingForReactNative`; remove these imports because React 18+ renderers handle batching.
-   Deprecated `observer(fn, { forwardRef: true })`; pass an already-created `React.forwardRef(...)` component to `observer` instead.
-   Legacy function-component `contextTypes` handling.

Patch Changes

• 979d267d569734dc3cb969ed1880ed68bb79f1b5 #​4677 Thanks @​kubk! - Shorten minified error URL to reduce production bundle size.

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!