Skip to content

Bump the npm-development group across 1 directory with 11 updates - #104

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-development-c8a9269203
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-development-c8a9269203

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-development group with 11 updates in the / directory:

Package From To
@rollup/plugin-commonjs 29.0.2 29.0.3
@rollup/plugin-typescript 12.3.0 12.3.1
@typescript-eslint/eslint-plugin 8.57.1 8.72.0
eslint 10.0.3 10.13.0
eslint-plugin-jest 29.15.0 29.17.0
eslint-plugin-prettier 5.5.5 5.5.7
globals 17.4.0 17.13.0
jest 30.3.0 30.5.2
prettier 3.8.1 3.9.10
rollup 4.59.0 4.65.0
ts-jest 29.4.6 29.4.15

Updates @rollup/plugin-commonjs from 29.0.2 to 29.0.3

Changelog

Sourced from @​rollup/plugin-commonjs's changelog.

v29.0.3

2026-05-29

Bugfixes

Commits

Updates @rollup/plugin-typescript from 12.3.0 to 12.3.1

Changelog

Sourced from @​rollup/plugin-typescript's changelog.

v12.3.1

2026-10-21

Bugfixes

  • typescript: clear the pending program update when a build closes the watch program (#2025)
Commits
  • 7d2f6e4 chore(release): typescript v12.3.1
  • 79dce0e fix(typescript): clear the pending program update when a build closes the wat...
  • 5800bf3 chore(repo): test migration to vitest. phase 4 (#1978)
  • 7d22981 chore(repo): add rollup-plugin keyword in package.json (#1955)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​rollup/plugin-typescript since your current version.


Updates @typescript-eslint/eslint-plugin from 8.57.1 to 8.72.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

  • eslint-plugin: lazy load rules (#13010)
  • eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
  • typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

  • ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
  • eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
  • eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
  • eslint-plugin: [require-array-sort-compare] check tuples (#13058)
  • eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
  • type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
  • typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

8.71.2 (2026-10-12)

🩹 Fixes

  • eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#12989)
  • eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#12974)
  • eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)
  • eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)
  • eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)
  • type-utils: match linked packages and packages with missing version in TypeOrValueSpecifier (#12948)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.72.0 (2026-10-19)

🚀 Features

  • eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
  • eslint-plugin: lazy load rules (#13010)

🩹 Fixes

  • type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
  • eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
  • eslint-plugin: [require-array-sort-compare] check tuples (#13058)
  • eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
  • eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
  • typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

🩹 Fixes

  • eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)
  • eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)
  • eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)
  • eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#12974)
  • eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#12989)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.1 (2026-10-05)

... (truncated)

Commits
  • a4c2603 chore(release): publish 8.72.0
  • c6eb98c feat(eslint-plugin): [await-thenable] add allowMixedPromiseArrays option (#...
  • b382b74 fix(type-utils): discriminateAnyType crashes when calling getAwaitedType on a...
  • 79edd89 fix(eslint-plugin): [require-array-sort-compare] ignore extra this type argum...
  • e7d57dd fix(eslint-plugin): [require-array-sort-compare] check tuples (#13058)
  • 2d107ae fix(eslint-plugin): use isTypeLiteralType instead of type.isLiteral() to incl...
  • e4695b3 feat(eslint-plugin): lazy load rules (#13010)
  • a1a912b fix(eslint-plugin): [no-deprecated] report deprecated properties in object li...
  • 1edc975 fix(eslint-plugin): [prefer-readonly-parameter-types] check where allowed typ...
  • 61cb700 chore: fix all eslint-plugin-internal/no-multiple-lines-of-errors (#12893)
  • Additional commits viewable in compare view

Updates eslint from 10.0.3 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
  • e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

v10.12.0

Features

  • 4618052 feat: handle astral letters in new-cap (#21357) (sary)
  • 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
  • efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
  • 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
  • 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
  • b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
  • 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
  • 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

  • 67eb586 docs: Update README (GitHub Actions Bot)
  • 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
  • 8816c1d docs: Update README (GitHub Actions Bot)
  • 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

  • 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
  • bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
  • d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
  • 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
  • 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])

... (truncated)

Commits

Updates eslint-plugin-jest from 29.15.0 to 29.17.0

Release notes

Sourced from eslint-plugin-jest's releases.

v29.17.0

29.17.0 (2026-10-12)

Features

  • no-standalone-expect: allow expect assertions in beforeEach hooks (#2031) (ddcab00)

v29.16.11

29.16.11 (2026-10-10)

Bug Fixes

v29.16.10

29.16.10 (2026-10-10)

Bug Fixes

  • make sure most rules account for optional chaining (#2038) (2d68f61)

v29.16.9

29.16.9 (2026-10-10)

Bug Fixes

  • consistent-test-it: don't drop only and skip from each chains (#2037) (3f6b5aa)

Performance Improvements

  • cache parsing of nodes that turn out not to be jest function calls (#2035) (7b11cbd)

v29.16.8

29.16.8 (2026-10-10)

Bug Fixes

  • prefer-to-have-been-called-times: don't crash if there is no argument passed to expect (#2036) (4dc58f0)

v29.16.7

29.16.7 (2026-10-10)

... (truncated)

Changelog

Sourced from eslint-plugin-jest's changelog.

29.17.0 (2026-10-12)

Features

  • no-standalone-expect: allow expect assertions in beforeEach hooks (#2031) (ddcab00)

29.16.11 (2026-10-10)

Bug Fixes

29.16.10 (2026-10-10)

Bug Fixes

  • make sure most rules account for optional chaining (#2038) (2d68f61)

29.16.9 (2026-10-10)

Bug Fixes

  • consistent-test-it: don't drop only and skip from each chains (#2037) (3f6b5aa)

Performance Improvements

  • cache parsing of nodes that turn out not to be jest function calls (#2035) (7b11cbd)

29.16.8 (2026-10-10)

Bug Fixes

  • prefer-to-have-been-called-times: don't crash if there is no argument passed to expect (#2036) (4dc58f0)

29.16.7 (2026-10-10)

Bug Fixes

  • unbound-method: account for optional chaining (#2034) (b918d73)

29.16.6 (2026-08-30)

... (truncated)

Commits
  • 0d0c459 chore(release): 29.17.0 [skip ci]
  • ddcab00 feat(no-standalone-expect): allow expect assertions in beforeEach hooks (#2031)
  • 69dd5bd chore(deps): lock file maintenance (#2042)
  • 5878acf test: make test.each and it.each cases semantically valid (#2041)
  • 1a7fc77 chore(release): 29.16.11 [skip ci]
  • 3e363d1 fix(no-mocks-import): check dynamic imports (#2039)
  • 3ca13a7 fix(no-export): report export all declarations (#2040)
  • 169fda0 chore(release): 29.16.10 [skip ci]
  • 2d68f61 fix: make sure most rules account for optional chaining (#2038)
  • 68a144d chore(release): 29.16.9 [skip ci]
  • Additional commits viewable in compare view

Updates eslint-plugin-prettier from 5.5.5 to 5.5.7

Release notes

Sourced from eslint-plugin-prettier's releases.

v5.5.7

Patch Changes

  • #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

  • #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

New Contributors

Full Changelog: prettier/eslint-plugin-prettier@v5.5.6...v5.5.7

v5.5.6

Patch Changes

Changelog

Sourced from eslint-plugin-prettier's changelog.

5.5.7

Patch Changes

  • #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

  • #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

5.5.6

Patch Changes

Commits
  • e6dd27a chore: keep packageManager when cleaning package.json for release (#808)
  • 7544956 chore: release eslint-plugin-prettier (#799)
  • e3e5238 ci: enable npm publish provenance for changesets v3 (#807)
  • 7c923c4 build(deps): Bump http-cache-semantics from 4.2.0 to 4.3.0 (#806)
  • 1b7c433 fix: bump synckit to surface worker failures instead of hanging (#805)
  • a6b3feb docs: explain line endings and endOfLine behavior (#804)
  • 2f6ba1d ci: exercise the getLocFromIndex ponyfill on ESLint 9 (#803)
  • cf1d2c5 chore(deps): update (#802)
  • 9f14a55 chore(deps): update all dependencies (#788)
  • 7e53ecd fix: map fallback source locations to actual line starts (#796)
  • Additional commits viewable in compare view

Updates globals from 17.4.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

  • Update globals (2026-10-01) (#354) b007369

sindresorhus/globals@v17.12.0...v17.13.0

v17.12.0

  • Update globals (2026-09-01) (#353) 50a2119
  • Add __webpack_layer__ global (#351) 779a11a

sindresorhus/globals@v17.11.0...v17.12.0

v17.11.0

  • Add react-native globals (#337) 61eafbf

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

  • Add GM_cookie to Greasemonkey globals (#349) f468407

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

  • Update globals (2026-08-01) (#348) 5a958ed

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

  • Update globals (2026-07-01) (#347) 7394811

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

  • Update globals (2026-06-22) (#345) 33b75f9

sindresorhus/globals@v17.6.0...v17.7.0

... (truncated)

Commits

Updates jest from 30.3.0 to 30.5.2

Release notes

Sourced from jest's releases.

v30.5.2

Features

  • [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

  • [jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)
  • [jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)
  • [@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

New Contributors

Full Changelog: jestjs/jest@v30.5.1...v30.5.2

v30.5.1

Fixes

  • [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
  • [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
  • [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
  • [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
  • [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

  • [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴


This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @​timkindberg (#16053):

const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
</tr></table> 

... (truncated)

Changelog

Sourced from jest's changelog.

30.5.2

Features

  • [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

  • [jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)
  • [jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)
  • [@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

30.5.1

Fixes

  • [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
  • [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
  • [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
  • [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
  • [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

  • [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

30.5.0

Features

  • [@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#16053)
  • [@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#16053)
  • [jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (#16259)
  • [jest-circus, jest-environment, jest-runtime, jest-types] Add describe-level retries via jest.retryTimes(..., {entireDescribe: true}) (#16322)
  • [jest-circus, jest-message-util, jest-reporters, jest-types] Add retryMessages to AssertionResult and export formatErrorStack, so the retry log renders nested cause and AggregateError sections with code frames instead of serialized [cause]:/[errors]: markers (#16316)
  • [jest-circus, jest-types] Add unhandledErrorsDetailed to Circus.RunResult, so an unhandled rejection reports its cause chain and AggregateError entries with code frames instead of a pre-serialized stack (#16316)
  • [jest-haste-map] Replace NodeWatcher and FSEventsWatcher with @parcel/watcher for the non-watchman watch path (#16188)
  • [jest-resolve] Bump unrs-resolver to 1.12.1, remove jest-pnp-resolver and unnecessary checks (#15721)
  • [jest-resolve] Honor Node's --preserve-symlinks / NODE_PRESERVE_SYMLINKS in the default resolver by passing symlinks: false to unrs-resolver (#16260)
  • [jest-runtime] Apply automocking and manual __mocks__ files to synchronously evaluable ESM graphs on Node 24.9+ - static imports, dynamic import() and require() of an ESM file now generate an automock from the real module's namespace instead of failing with "Attempting to import a mock without a factory". Graphs that need async evaluation (top-level await) or an async-only resolver or transformer still throw (#16391)
  • [jest-runtime] Route process.getBuiltinModule through the sandbox, so it returns the sandbox process and the hooked node:module instead of the host's (#16391)
  • [jest-runtime] Throw an actionable error from module.register() and module.registerHooks() inside a test - the hooks attached to the loader running Jest itself, never saw the sandboxed requires they were meant for, and stayed registered for every later test file in the worker (#16391)
  • [jest-runtime] Surface resolution and import-attribute errors in an ESM graph before executing any of its CJS dependencies on Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the legacy loader on older versions keeps its linking-time execution order (#16391)
  • [jest-runtime] Throw ERR_SOURCE_PHASE_NOT_DEFINED with an actionable message for import source and import.source(), instead of failing at instantiation with V8's bare "Source phase import object is not defined" (#16391)
  • [jest-runtime] Emit the JSON-without-import-attribute deprecation warning once per test file instead of once per worker, so it is no longer silently swallowed for every file after the first (#16391)
  • [jest-runtime] Set import.meta.main to true in the test file and false in every module it loads, matching Node 24+ (#16367)
  • [jest-runtime] Resolve the module-sync export condition, so a package that exposes its ESM entry point for require() loads the same file Node would (#16336)
  • [jest-snapshot] Add external snapshot paths to custom reporter failure details (#16374)

Fixes

... (truncated)

Commits

Bumps the npm-development group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@rollup/plugin-commonjs](https://github.com/rollup/plugins/tree/HEAD/packages/commonjs) | `29.0.2` | `29.0.3` |
| [@rollup/plugin-typescript](https://github.com/rollup/plugins/tree/HEAD/packages/typescript) | `12.3.0` | `12.3.1` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.57.1` | `8.72.0` |
| [eslint](https://github.com/eslint/eslint) | `10.0.3` | `10.13.0` |
| [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) | `29.15.0` | `29.17.0` |
| [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) | `5.5.5` | `5.5.7` |
| [globals](https://github.com/sindresorhus/globals) | `17.4.0` | `17.13.0` |
| [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.3.0` | `30.5.2` |
| [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.9.10` |
| [rollup](https://github.com/rollup/rollup) | `4.59.0` | `4.65.0` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.6` | `29.4.15` |



Updates `@rollup/plugin-commonjs` from 29.0.2 to 29.0.3
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/commonjs/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/commonjs-v29.0.3/packages/commonjs)

Updates `@rollup/plugin-typescript` from 12.3.0 to 12.3.1
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/typescript/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/typescript-v12.3.1/packages/typescript)

Updates `@typescript-eslint/eslint-plugin` from 8.57.1 to 8.72.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/eslint-plugin)

Updates `eslint` from 10.0.3 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.0.3...v10.13.0)

Updates `eslint-plugin-jest` from 29.15.0 to 29.17.0
- [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases)
- [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md)
- [Commits](jest-community/eslint-plugin-jest@v29.15.0...v29.17.0)

Updates `eslint-plugin-prettier` from 5.5.5 to 5.5.7
- [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases)
- [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/eslint-plugin-prettier@v5.5.5...v5.5.7)

Updates `globals` from 17.4.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.4.0...v17.13.0)

Updates `jest` from 30.3.0 to 30.5.2
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.5.2/packages/jest)

Updates `prettier` from 3.8.1 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.1...3.9.10)

Updates `rollup` from 4.59.0 to 4.65.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.59.0...v4.65.0)

Updates `ts-jest` from 29.4.6 to 29.4.15
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.4.6...v29.4.15)

---
updated-dependencies:
- dependency-name: "@rollup/plugin-commonjs"
  dependency-version: 29.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development
- dependency-name: "@rollup/plugin-typescript"
  dependency-version: 12.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.72.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: eslint-plugin-jest
  dependency-version: 29.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: eslint-plugin-prettier
  dependency-version: 5.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development
- dependency-name: globals
  dependency-version: 17.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: jest
  dependency-version: 30.5.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: rollup
  dependency-version: 4.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development
- dependency-name: ts-jest
  dependency-version: 29.4.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot requested a review from ncalteen as a code owner October 26, 2026 12:34
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 26, 2026
@github-actions

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 5 0 0 0.09s
❌ ACTION zizmor 5 1 0 0.28s
✅ JSON jsonlint 23 0 0 0.13s
✅ JSON npm-package-json-lint yes no no 0.81s
✅ JSON prettier 23 0 0 1.77s
✅ JSON v8r 23 0 0 13.69s
✅ MARKDOWN markdownlint 1 0 0 1.11s
✅ REPOSITORY betterleaks yes no no 0.64s
✅ REPOSITORY checkov yes no no 19.85s
✅ REPOSITORY gitleaks yes no no 1.07s
✅ REPOSITORY git_diff yes no no 0.01s
✅ REPOSITORY grype yes no no 105.67s
❌ REPOSITORY osv-scanner yes 32 no 1.45s
✅ REPOSITORY secretlint yes no no 1.04s
✅ REPOSITORY syft yes no no 2.87s
✅ REPOSITORY trivy-sbom yes no no 1.1s
✅ REPOSITORY trufflehog yes no no 18.44s
❌ TYPESCRIPT eslint 8 1 0 5.65s
✅ TYPESCRIPT prettier 8 0 0 0.83s
✅ YAML prettier 19 0 0 0.6s
✅ YAML v8r 19 0 0 11.18s
✅ YAML yamllint 19 0 0 0.51s

Detailed Issues

❌ TYPESCRIPT / eslint - 1 error
src/types.ts
  6:5  error  Replace `|·MarkdownField⏎····|·TextareaField⏎····|·InputField⏎····|·DropdownField⏎···` with `MarkdownField·|·TextareaField·|·InputField·|·DropdownField`  prettier/prettier

✖ 1 problem (1 error, 0 warnings)
  1 error and 0 warnings potentially fixable with the `--fix` option.
❌ REPOSITORY / osv-scanner - 32 errors
Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 563 packages
End status: 49 dirs visited, 181 inodes visited, 1 Extract calls, 23.792205ms elapsed, 23.792366ms wall time

Total 12 packages affected by 32 known vulnerabilities (0 Critical, 21 High, 10 Medium, 1 Low, 0 Unknown) from 1 ecosystem.
32 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE                        | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-4x5r-pxfx-6jf8 | 3.2  | npm       | @babel/core (dev)              | 7.29.0  | 7.29.6        | package-lock.json |
| https://osv.dev/GHSA-p498-v437-472g | 5.7  | npm       | @humanfs/node (dev)            | 0.16.7  | 0.16.8        | package-lock.json |
| https://osv.dev/GHSA-w5vr-8v7q-w6rv | 6.6  | npm       | baseline-browser-mapping (dev) | 2.10.9  | 2.11.0        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.16        | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.19        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.13        | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.17        | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.21        | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.20        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 1.1.12  | 1.1.18        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.2         | package-lock.json |
| https://osv.dev/GHSA-6j4f-fj2g-mc7p | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.5         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.0.3         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.3         | package-lock.json |
| https://osv.dev/GHSA-q2hr-2g5m-vwhr | 5.3  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.7         | package-lock.json |
| https://osv.dev/GHSA-qhr7-859c-m2p7 | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.6         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev)          | 2.0.2   | 2.1.4         | package-lock.json |
| https://osv.dev/GHSA-73wf-gq98-2v4g | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-c83g-rgw3-j3cx | 7.5  | npm       | browserslist (dev)             | 4.28.1  | 4.28.7        | package-lock.json |
| https://osv.dev/GHSA-2883-xcg3-v3hh | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)                  | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)                  | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash (dev)                   | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash (dev)                   | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-23c5-xmqv-rm74 | 7.5  | npm       | minimatch (dev)                | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-3ppc-4f35-3m26 | 8.7  | npm       | minimatch (dev)                | 9.0.3   | 9.0.6         | package-lock.json |
| https://osv.dev/GHSA-7r86-cg39-jmmj | 7.5  | npm       | minimatch (dev)                | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)                | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)                     | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                           | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+--------------------------------+---------+---------------+-------------------+
❌ ACTION / zizmor - 1 error
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/check-dist.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx [email protected] --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,TYPESCRIPT_ES,TYPESCRIPT_PRETTIER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants