deps(ts): bump the npm-dependencies group in /typescript with 3 updates

[dependabot]

Bumps the npm-dependencies group in /typescript with 3 updates: @types/node, msw and oxlint.

Updates @types/node from 26.6.4 to 26.6.5

Commits

• See full diff in compare view

Updates msw from 2.15.0 to 3.0.2

Release notes

Sourced from msw's releases.

v3.0.2 (2026-10-03)

Bug Fixes

• vite: support virtual:msw imports in vitest (#2802) (e73c381e3adc0848fcf9a7ef291b614b06a0d92b) @​kettanaito

v3.0.1 (2026-09-30)

Bug Fixes

• treat CONNECT requests as the transport mechanism (#2796) (7cad86a03b0ddb2efdec96ce8a49b0ed07d9f4dc) @​kettanaito

v3.0.0 (2026-09-28)

• v3.0.0 (#2692) (2bb43428b79ac06f94bb8ea8aeacd6102fe31f56) @​kettanaito @​Andarist

⚠️ BREAKING CHANGES

• MSW is now ESM-only (#2765).
• Deprecate support for Node.js v18 and v20 (#2729). The minimal supported Node.js version is v22.
• msw/native is removed in favor of @msw/react-native.
• Require TypeScript 5.9 as the minimal version.
• Deprecate support for TypeScript 5.1 and 5.2 (#2730)
• worker.stop() returns a Promise (#2724). Awaiting it is relevant only for in-flight critical scenarios.
• graphql is now exported as msw/graphql (#2691). GraphQL is now handled as a proper optional peer dependency.
• Removes the handleRequest() utility. Please use the defineNetwork() API instead.
• GraphQLLinkHandlers type has been renamed to GraphQLLink.
• The file:// requests now throw in Node.js as they normally do (not supported by fetch).
• The Content-Length request header is now removed by bypass().
• HTTP-to-WebSocket upgrade requests performed via fetch() now throw in Node.js as they normally do (not supported by fetch).
• Cookies are no longer managed in Node.js for better compatibilty. Instead, whatever is the default behavior of your environment that's the cookie behavior you get. This has no effect on the browser.
• WebSocket connection life cycle event has been renamed to websocket:connection (#2783).
• onUnhandledRequest option has been renamed to onUnhandledFrame.
• The library no longer patches setTimeout to circumvent fake timers in test runners. You should advance the fake timers normally for delayed mocked responses to resolve.
• The library no longer returns a mocked cookie string on request.headers.get('cookie') in the handlers. It returns null in all environments. Please use the cookies resolver argument to have cookie-based logic.

Features

• Supports Node.js v24 and v26.
• Supports TypeScript v6.0 and v7.0.
• You can import individual utilities, like delay or passthrough, from the new msw/utils entrypoint for smaller footprint on your bundle.
• Support GraphQL v17.0.
• Support intercepting page navigations and form submissions (#2721).
• Support GraphQL subscriptions (#285, #2763).
• Migrate from path-to-regexp to @msw/url (#2678).
• Remove the following dependencies:
  • graphql
  • path-to-regexp
  • picocolors
  • statuses

... (truncated)

Commits

• a7fa5f0 chore(release): v3.0.2
• 01b1084 docs: feature "msw/http" imports in README examples
• e73c381 fix(vite): support virtual:msw imports in vitest (#2802)
• 6d6aef1 chore(release): v3.0.1
• 7cad86a fix: treat CONNECT requests as the transport mechanism (#2796)
• 975cb45 docs: remove spacing before logo, update description
• b6b50f0 chore(release): v3.0.0
• 32cf523 chore: run release job on ubuntu-latest to unlock provenance
• 2bb4342 feat!: v3.0.0 (#2692)
• 85f4bf3 docs: add blacksmith mention (#2780)
• Additional commits viewable in compare view

Updates oxlint from 1.86.0 to 1.87.0

Release notes

Sourced from oxlint's releases.

oxlint v1.87.0

🚀 Features

• 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
• cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
• 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

• 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
• 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
• 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
• 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
• e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
• 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
• f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
• 7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)
• ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#26925) (camc314)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Updates the npm dependencies for the TypeScript workspace, including a major version bump for msw from 2.x to 3.x.

• msw 3.x is ESM-only and requires Node.js 22.12+ and TypeScript 5.9+. It also drops msw/native in favor of @msw/react-native, renames onUnhandledRequest to onUnhandledFrame, and moves the graphql export to msw/graphql.
• @types/node updates from 26.6.4 to 26.6.5 and oxlint from 1.86.0 to 1.87.0.

Migration

• Confirm the workspace meets the new Node.js and TypeScript requirements, and review msw usage for the renamed APIs above.

^{Written for commit b0abd23. Summary will update on new commits.}

[Copilot]

🟡 Changes recommended

Existing test setup still uses an MSW option renamed in version 3.

1 open finding

• Update test server option for MSW 3 API rename · New

What changed in this PR

Updates TypeScript development dependencies, including the breaking MSW 3 upgrade.

Changes:

• Upgrades MSW to 3.0.2.
• Refreshes locked @types/node, Oxlint, and transitive dependencies.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
typescript/​package.json	Updates MSW’s declared version.
typescript/​package-lock.json	Locks updated direct and transitive dependencies.

Files not reviewed (1)

• typescript/package-lock.json: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

@dependabot rebase

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.