build: update all non-major dependencies (main) - #34050
Merged
alan-agius4 merged 1 commit intoSep 9, 2026
Merged
Conversation
See associated pull request for more information.
angular-robot
added
action: merge
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates several third-party dependency versions across multiple package.json files in the repository, including ESLint, TypeScript ESLint, Puppeteer, Beasties, Sass, Less, PostCSS, and Inquirer packages. I have no feedback to provide.
alan-agius4
approved these changes
Sep 9, 2026
Collaborator
|
This PR was merged into the repository. The changes were merged into the following branches:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.1.0→2.1.16.3.0→6.3.28.7.0→8.7.20.148.0→0.149.08.69.0→8.70.08.69.0→8.70.010.5.4→10.5.50.5.3→0.5.410.9.1→10.10.04.9.0→4.9.10.148.0→0.149.08.5.26→8.5.2825.9.0→25.10.01.103.1→1.104.01.103.1→1.104.08.10.1→8.10.26.10.1→6.10.38.2.0→8.3.0Release Notes
eslint/rewrite (@eslint/compat)
v2.1.1Compare Source
Bug Fixes
SBoudrias/Inquirer.js (@inquirer/confirm)
v6.3.2Compare Source
@inquirer/confirm@6.3.2
What's new
confirm()now trims surrounding whitespace from answers before matching yes/no keywords, so values such asyes— accidentally typed or piped into the prompt — no longer silently fall through to the default (#2254).Dependencies
@inquirer/corebumped to^12.0.3— fixes same-tick keystrokes reaching handlers of settled prompts (#2255)v6.3.1Compare Source
typescript-eslint/typescript-eslint (@typescript-eslint/eslint-plugin)
v8.70.0Compare Source
🚀 Features
🩹 Fixes
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
typescript-eslint/typescript-eslint (@typescript-eslint/parser)
v8.70.0Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
postcss/autoprefixer (autoprefixer)
v10.5.5Compare Source
danielroe/beasties (beasties)
v0.5.4Compare Source
👉 Changelog
compare changes
🩹 Fixes
🤖 CI
64bf9c8)❤️ Contributors
eslint/eslint (eslint)
v10.10.0Compare Source
Features
264b434feat: adddandvflags tono-unexpected-multiline(#21305) (Gihyeon Jeong / 정기현)c6cc6c5feat: checkObject.prototypeproperty names innew-cap(#21269) (crimsonjay0)5661fa6feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)Bug Fixes
bb47dc6fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)427ac0afix: use format strings in debug calls (#21247) (Francesco Trotta)9d81532fix: support__proto__in/* exported */comments (#21261) (sethamus)87e0a08fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)8e2cb14fix:new-capfalse positive forUTCcalls withproperties: false(#21275) (Pixel)9f4a364fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)Documentation
2417caddocs: Update README (GitHub Actions Bot)9cecb8adocs: document\ccontrol letter escapes in no-control-regex (#21286) (한국)8724829docs: update compat table links (#21263) (fnx)5634542docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)Chores
b3d876bchore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)1696682ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))2c7f5d6chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])3c753f1chore: update eslint (#21289) (renovate[bot])1c73469chore: update ecosystem plugins (#21280) (ESLint Bot)08a02betest: add error locations tono-extra-boolean-cast(#21266) (lumir)77bb1dbchore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])007e81aci: skip EMFILE test on Node.js 26 (#21265) (lumir)0430280chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)less/less.js (less)
v4.9.1Compare Source
Changes
oxc-project/oxc (oxc-parser)
v0.149.0🐛 Bug Fixes
c966acaparser: Do not omit<token opening type argument list (#26328) (overlookmotel)postcss/postcss (postcss)
v8.5.28Compare Source
v8.5.27Compare Source
/*#(by @dylanpulver).*hack before a comment in Custom Properties (by @Jaybhade).list.comma()(by @MahinAnowar).list.space()(by @MahinAnowar).puppeteer/puppeteer (puppeteer)
v25.10.0: puppeteer: v25.10.0Compare Source
♻️ Chores
Dependencies
sass/dart-sass (sass)
v1.104.0Compare Source
Potentially breaking compatibility fix: Colors now convert the special
values NaN and negative zero, as well as infinity and negative infinity for
polar-hue channels, to 0 as per the CSS spec.
The special value negative zero is now serialized as
-0instead of0forgreater compatibility when using it in CSS calculations.
sass/embedded-host-node (sass-embedded)
v1.104.0Compare Source
Potentially breaking compatibility fix: Colors now convert the special
values NaN and negative zero, as well as infinity and negative infinity for
polar-hue channels, to 0 as per the CSS spec.
The special value negative zero is now serialized as
-0instead of0forgreater compatibility when using it in CSS calculations.
nodejs/undici (undici)
v8.10.2Compare Source
High severity
BalancedPoolcould drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preservesconnectand legacytlsoptions when creating upstreams. Fixed by 8f5868fb.TypeErrorthat could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.Medium severity
WebSocketStreamclose could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.maxSize. Fixed by 7aac7f12.Low severity
POSTorDELETE. Undici now restricts cache reads and writes to safe methods while preserving invalidation by successful unsafe requests. Fixed by 2be07bf9.Content-Lengthwas present. Undici now enforcesmaxSizeagainst received bytes and aborts oversized responses. Fixed by 6d583124.Content-Rangeagainst the original response framing before resuming. Fixed by 0160a719.What's Changed
New Contributors
Full Changelog: nodejs/undici@v8.10.1...v8.10.2
verdaccio/verdaccio (verdaccio)
v6.10.3Compare Source
Patch Changes
98b58ef: fix: do not fetch client-controlled dist.tarball urls off-uplink @cOmrade3267Only fetch a tarball url that a configured uplink actually serves. Off-uplink urls are
fetched without uplink credentials and only for uplink-synced packages (recorded in
_distfiles); a locally published package returns 404 instead of being fetched. Preventssending an uplink
Authorizationheader to an unrelated host.v6.10.2Compare Source
Patch Changes
6d972d1: fix: resolve fast-uri and brace-expansion security advisoriesfast-uri 3.1.6. Bumps the
ajv/fast-uriresolution from 3.1.5 to 3.1.6, whichfixes four high-severity advisories in the URI parser used by
ajvfor schemaformat validation: host confusion via skipped IDN canonicalization
(GHSA-5jgf-p345-68v8),
SSRF via malformed IPv6 normalization
(GHSA-f65p-4m7j-42xc),
SSRF via repeated hostname percent-decoding
(GHSA-fph4-wmhf-6fwf),
and host confusion via percent-encoded scheme normalization
(GHSA-jqff-g426-hqxp).
brace-expansion DoS cleanup. Updates the remaining vulnerable
brace-expansiontrees (1.1.11 → 1.1.18, 2.0.1 → 2.1.4) forGHSA-mh99-v99m-4gvg and
drops the temporary audit ignores that covered them while the patched
releases were still quarantined by the minimal-age gate.
6d972d1: chore: update e2e libraryca00ee0: fix: stop re-compressing tarballs for gzip-accepting clientsmime-db marks
application/octet-streamas compressible, so the compressionmiddleware re-gzipped every (already gzipped)
.tgzdownload for clientsthat accept gzip — npm and undici do by default — wasting CPU on every
download and stripping the
Content-Lengthheader. Tarball responses arenow excluded from compression; JSON metadata responses stay compressed.
Measured on a 30 MB tarball: ~18x less server CPU and ~20x faster downloads,
with slightly fewer bytes on the wire (gzip over gzip nets negative).
d4b8199: Update verdaccio dependencies to thelatestnpm dist-tag (@verdaccio/ui-themetracksnext-9):@verdaccio/ui-theme:9.0.0-next-9.28→9.0.0-next-9.30d94ebff: fix: validate the scope segment on the web package endpointsThe readme and sidebar web endpoints now validate the
:scoperoute segmentand return 404 for malformed requests.
webpack/webpack-dev-middleware (webpack-dev-middleware)
v8.3.0Compare Source
Minor Changes
Added a
hotoption that enables hot module replacement, replacing the need forwebpack-hot-middleware. Passhot: trueto enable with defaults, orhot: { path, heartbeat, progress, statsOptions }to customize. The client runtime is served by the middleware itself. (by @bjohansebas in #2370)Take the diagnostics a hot payload carries from the
statsoption, so one setting governs what a build reports in the terminal and in the browser:stats: "errors-only"keeps warnings out of both, andstats: falsekeeps errors and warnings out of both, the client's error overlay included — reach for the client's?logging=or?overlay=to quiet the browser alone.hot.statsOptionsis deprecated and will be removed in the next major release; itshash,timingsandchildrenkeys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @alexander-akait in #2392)Patch Changes
Fixed a crash when calling
invalidate()in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) ownscompiler.watch(), the middleware now invalidates the host'swatchinginstead (each child compiler's one for aMultiCompileron webpack < 5.109). When nothing is watching it logs a warning and completes the callback, asclose()does, rather than leavinginvalidate(callback)waiting on a build that never runs. (by @bjohansebas in #2378)Reject with
403 Forbiddenthe requests whose resolved filename falls outsideoutputPath(GHSA-g84c-rxfj-3j2c). With apublicPathwithout a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @bjohansebas in #2404)Update the changelog generator to the
@changesets/get-github-info1.0 API. (by @alexander-akait in #2396)Update dependencies. (by @alexander-akait in #2394)