chore: bump the dev-dependencies group across 1 directory with 12 updates by dependabot[bot] · Pull Request #129 · jegj/protondb-cli

dependabot · 2026-07-06T06:34:03Z

Bumps the dev-dependencies group with 12 updates in the / directory:

Package	From	To
@biomejs/biome	`2.4.15`	`2.5.2`
@commitlint/cli	`19.8.1`	`21.2.0`
@commitlint/config-conventional	`19.8.1`	`21.2.0`
@types/node	`22.19.19`	`26.1.0`
c8	`9.1.0`	`11.0.0`
esmock	`2.7.5`	`2.7.6`
husky	`8.0.3`	`9.1.7`
markdownlint-cli2	`0.22.1`	`0.23.0`
sinon	`17.0.1`	`22.0.0`
@types/sinon	`17.0.4`	`22.0.0`
tsx	`4.21.0`	`4.23.0`
typescript	`5.9.3`	`6.0.3`

Updates @biomejs/biome from 2.4.15 to 2.5.2

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.2

2.5.2

Patch Changes
#10595 f458028 Thanks @pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

#10798 4a32b63 Thanks @pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.
#10545 f3d4c00 Thanks @Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.
<script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>
#10752 f62fb8b Thanks @ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

#10796 f1b3ab2 Thanks @ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.
#10719 aa649b5 Thanks @minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.
// No longer flagged (returns are `string`):
function getValue(b: boolean): string {
  if (b) return "a" as string;
  return "b" as string;
}
// Now also reported, like as const (returns false):
function isReady(): boolean {
return false as false;
}
#10678 8f073a7 Thanks @PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.
#10756 5ec965a Thanks @denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.
-.powerPathNavigator
-  .helm
-  button.pressedButton, // pressed
+.powerPathNavigator .helm button.pressedButton, // pressed
 .powerPathNavigator .helm button:active:not(.disabledButton) {
 }

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.2

Patch Changes
#10595 f458028 Thanks @pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

#10798 4a32b63 Thanks @pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.
#10545 f3d4c00 Thanks @Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.
<script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>
#10752 f62fb8b Thanks @ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

#10796 f1b3ab2 Thanks @ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.
#10719 aa649b5 Thanks @minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.
// No longer flagged (returns are `string`):
function getValue(b: boolean): string {
  if (b) return "a" as string;
  return "b" as string;
}
// Now also reported, like as const (returns false):
function isReady(): boolean {
return false as false;
}
#10678 8f073a7 Thanks @PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.
#10756 5ec965a Thanks @denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.
-.powerPathNavigator
-  .helm
-  button.pressedButton, // pressed
+.powerPathNavigator .helm button.pressedButton, // pressed
 .powerPathNavigator .helm button:active:not(.disabledButton) {
 }
#10757 6232fcd Thanks @PranavAchar01! - Fixed #8269: the CSS parser now accepts Tailwind @variant and @utility names that start with a digit, such as the 2xl breakpoint.

... (truncated)

Commits

e649198 ci: release (#10747)
4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
f3d4c00 feat(js/nursery): add noSvelteNoUnnecessaryStateWrap rule (#10545)
f458028 feat(lint): add ignoreBooleanCoercion option to useNullishCoalescing (#10595)
ffe7d33 chore: revert
564d660 chore: revert
0abf1a5 ci: release (#10627)
23814f1 chore(biome_configuration): add allowTrailingCommas to json-schema to make VS...
a0f197e chore: dead and old links (#10668)
c0b9832 ci: release (#10499)
Additional commits viewable in compare view

Updates @commitlint/cli from 19.8.1 to 21.2.0

Release notes

Sourced from @commitlint/cli's releases.

v21.2.0

21.2.0 (2026-06-30)

Features

feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9/v10) by @escapedcat in conventional-changelog/commitlint#4859

Chore

ci: install git in stock-Ubuntu baseline job by @escapedcat in conventional-changelog/commitlint#4847

Full Changelog: conventional-changelog/commitlint@v21.1.0...v21.2.0

v21.1.0

21.1.0 (2026-06-23)

Bug Fixes

fix: remove duplicate es-toolkit@1.47.1 keys from lockfile by @escapedcat in conventional-changelog/commitlint#4833

Features

feat(cli): add --default-config flag to lint without a config file by @escapedcat in conventional-changelog/commitlint#4805

feat(lint): allow for custom commit parser function by @esatterwhite in conventional-changelog/commitlint#4829

Docs, chore, etc.

test(cli): verify --cwd redirects config resolution #997 by @escapedcat in conventional-changelog/commitlint#4796

docs: add ai agent support (skill, guide, llms.txt) by @escapedcat in conventional-changelog/commitlint#4804

docs: add TDD commit flow and review expectations for contributors by @escapedcat in conventional-changelog/commitlint#4836

New Contributors

@esatterwhite made their first contribution in conventional-changelog/commitlint#4829

Full Changelog: conventional-changelog/commitlint@v21.0.2...v21.1.0

v21.0.2

... (truncated)

Changelog

Sourced from @commitlint/cli's changelog.

21.2.0 (2026-06-30)

Features

resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

21.1.0 (2026-06-23)

Features

cli: add --default-config flag to lint without a config file (#4805) (7af27ba), closes #3662

21.0.2 (2026-05-29)

Bug Fixes

disallow same commit hash for --from and --to (#4773) (121005e)

21.0.1 (2026-05-12)

Note: Version bump only for package @commitlint/cli

21.0.0 (2026-05-08)

chore!: minimum node version v22 (#4679) (ac2b3f4), closes #4679

BREAKING CHANGES

drop node v18 and v20 support

... (truncated)

Commits

1b4e5bc v21.2.0
fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
6f1c0af v21.1.0
7af27ba feat(cli): add --default-config flag to lint without a config file (#4805)
51a2d7f test(cli): verify --cwd redirects config resolution (#997) (#4796)
8069048 v21.0.2
121005e fix: disallow same commit hash for --from and --to (#4773)
db8d7d6 v21.0.1
1329a25 chore: migrate to pnpm (#4762)
db39968 chore: pre pnpm cleanup (#4759)
Additional commits viewable in compare view

Updates @commitlint/config-conventional from 19.8.1 to 21.2.0

Release notes

Sourced from @commitlint/config-conventional's releases.

v21.2.0

21.2.0 (2026-06-30)

Features

feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9/v10) by @escapedcat in conventional-changelog/commitlint#4859

Chore

ci: install git in stock-Ubuntu baseline job by @escapedcat in conventional-changelog/commitlint#4847

Full Changelog: conventional-changelog/commitlint@v21.1.0...v21.2.0

v21.1.0

21.1.0 (2026-06-23)

Bug Fixes

fix: remove duplicate es-toolkit@1.47.1 keys from lockfile by @escapedcat in conventional-changelog/commitlint#4833

Features

feat(cli): add --default-config flag to lint without a config file by @escapedcat in conventional-changelog/commitlint#4805

feat(lint): allow for custom commit parser function by @esatterwhite in conventional-changelog/commitlint#4829

Docs, chore, etc.

test(cli): verify --cwd redirects config resolution #997 by @escapedcat in conventional-changelog/commitlint#4796

docs: add ai agent support (skill, guide, llms.txt) by @escapedcat in conventional-changelog/commitlint#4804

docs: add TDD commit flow and review expectations for contributors by @escapedcat in conventional-changelog/commitlint#4836

New Contributors

@esatterwhite made their first contribution in conventional-changelog/commitlint#4829

Full Changelog: conventional-changelog/commitlint@v21.0.2...v21.1.0

v21.0.2

... (truncated)

Changelog

Sourced from @commitlint/config-conventional's changelog.

21.2.0 (2026-06-30)

Features

resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

21.1.0 (2026-06-23)

Note: Version bump only for package @commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @commitlint/config-conventional

21.0.1 (2026-05-12)

Note: Version bump only for package @commitlint/config-conventional

21.0.0 (2026-05-08)

chore!: minimum node version v22 (#4679) (ac2b3f4), closes #4679

BREAKING CHANGES

drop node v18 and v20 support

Bump engines to >=v22 in all 39 package.json files

Update @types/node to ^22.0.0

Update CI matrix to [22, 24]

Update Ubuntu baseline job to ubuntu:26.04

Update Dockerfile.ci, .mise.toml, .codesandbox/ci.json

... (truncated)

Commits

1b4e5bc v21.2.0
fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
6f1c0af v21.1.0
8069048 v21.0.2
db8d7d6 v21.0.1
1329a25 chore: migrate to pnpm (#4762)
6099ae5 chore: replace eslint with oxlint (#4756)
f081a8e v21.0.0
44c3174 chore: update dependency yargs to v18 #4432 (#4686)
ac2b3f4 chore!: minimum node version v22 (#4679)
Additional commits viewable in compare view

Updates @types/node from 22.19.19 to 26.1.0

Commits

See full diff in compare view

Updates c8 from 9.1.0 to 11.0.0

Release notes

Sourced from c8's releases.

v11.0.0

11.0.0 (2026-02-22)

⚠ BREAKING CHANGES

deps: transitive deps require 20 || >=22

Bug Fixes

deps: pull newer minimatch addressing CVE-2026-26996 (#576) (678eeca)

v10.1.3

10.1.3 (2024-12-10)

Bug Fixes

deps: update bcoe/v8-coverage addressing v8 issue (#552) (b32a563)

v10.1.2

10.1.2 (2024-06-13)

Bug Fixes

deps: make monocart-coverage-reports an optional with meta defined (3b91fda)

v10.1.1

10.1.1 (2024-06-11)

Bug Fixes

stop installing monocart-coverage-reports (#535) (13979a7)

v10.1.0

10.1.0 (2024-06-11)

Features

add experimental monocart reports (#521) (2e5e297)

v10.0.0

10.0.0 (2024-06-10)

⚠ BREAKING CHANGES

... (truncated)

Changelog

Sourced from c8's changelog.

11.0.0 (2026-02-22)

⚠ BREAKING CHANGES

deps: transitive deps require 20 || >=22

Bug Fixes

deps: pull newer minimatch addressing CVE-2026-26996 (#576) (678eeca)

10.1.3 (2024-12-10)

Bug Fixes

deps: update bcoe/v8-coverage addressing v8 issue (#552) (b32a563)

10.1.2 (2024-06-13)

Bug Fixes

deps: make monocart-coverage-reports an optional with meta defined (3b91fda)

10.1.1 (2024-06-11)

Bug Fixes

stop installing monocart-coverage-reports (#535) (13979a7)

10.1.0 (2024-06-11)

Features

add experimental monocart reports (#521) (2e5e297)

10.0.0 (2024-06-10)

⚠ BREAKING CHANGES

deps: Node 18 is now the minimum supported Node.js version

Bug Fixes

deps: update test-exclude with new glob / minimatch (#531) (e33cf30)

Commits

ce78df4 chore(main): release 11.0.0 (#577)
678eeca fix(deps)!: pull newer minimatch addressing CVE-2026-26996 (#576)
ec4c5e4 chore: .editorconfig to avoid unintended mods to .snap files (#556)
1ec3cc4 chore(main): release 10.1.3 (#553)
b32a563 fix(deps): update bcoe/v8-coverage addressing v8 issue (#552)
75fa99f chore(deps): update dependency @types/node to v22 (#548)
ff146b4 chore(main): release 10.1.2 (#538)
3b91fda fix(deps): make monocart-coverage-reports an optional with meta defined
e3560e1 chore(main): release 10.1.1 (#536)
13979a7 fix: stop installing monocart-coverage-reports (#535)
Additional commits viewable in compare view

Updates esmock from 2.7.5 to 2.7.6

Release notes

Sourced from esmock's releases.

wildcard-issue resolved

mostly resolves a recently-discovered issue resolving certain wildcard-pattern export keys

update test-coverage badge to reference "main" branch,

specify node v24 at build+publish ci-job

increment eslint and lint-related

increment resolvewithplus, resolves wildcard-export-related issue. see iambumblehead/resolvewithplus#76 thanks @AdaptivChris

Changelog

Sourced from esmock's changelog.

changelog

2.7.7 ???

update github ci actions

2.7.6 May.27.2026

update test-coverage badge to reference "main" branch,

specify node v24 at build+publish ci-job

increment eslint and lint-related

increment resolvewithplus, resolves wildcard-export-related issue. see iambumblehead/resolvewithplus#76

2.7.5 May.09.2026

migrate to eslint 10

migrate to @eslint/markdown

remove c8 test-coverage package, use node's --test-cover

2.7.4 May.04.2026

update tests to resolve tests that began to fail,

add suuport for typescript modules, no tests, thanks @mbrevda,

add node 25.x to test matrix,

disable tests using node-ts (seems un-maintained),

windows tests are disabled for "tests-node", lacking windows env to resolve

2.7.3 Sep.12.2025

drop node version 18 and 20 from tests.

increment some dependencies and reduce audit warnings.

restore ava and all other disabled test-runner tests

2.7.2 Sep.01.2025

increment resolvewithplus, match exact export paths, thanks @matz3

2.7.1 Jul.01.2025

added node v24 to test matrix

2.7.0 Jan.24.2025

update resolver to correctly resolve openai package

update typescript-eslint

2.6.9 Oct.18.2024

added --glob option for rimraf usage removing un-used sources

added node v23 to test matrix

resolve v23-related error when module.exports is exported

2.6.8 Oct.17.2024

added pnpm unit-test, thanks @darcyrush

resolve issue for pnpm by escaping '+' char in regexp

add log utility function for debugging loader

dropped ava and jest from test sequence, node v22 --loader issues

2.6.7 Jul.16.2024

add swc tests and remove swc caution from README thanks @Brooooooklyn

unpin node 22.1 at test CI and use latest 22.x

2.6.6 Jun.15.2024

add tsx tests and remove tsx caution from README thanks @galexite

pin node 22.1 at test CI and ignore regressions in new node 22

migrate to eslint 9

2.6.5 Apr.25.2024

add node 22 to ci test pipeline thanks @aladdin-add

use json import syntax with { type: 'json' } for node 22

skip node 22 tests on windows-latest ci, where node 22 is in a broken state, see nodejs/node#52682

... (truncated)

Commits

ba5d2d2 Merge pull request #340 from iambumblehead/fix-changelog-link
21dd0b4 fix CHANGELOG.md link
d0fea76 Merge pull request #339 from iambumblehead/increment-resolvewith-plus
08be213 increment resolvewithplus
99d4d86 Merge pull request #338 from iambumblehead/increment-eslint-and-related
9ce6992 increment eslint and related
405b513 Merge pull request #337 from iambumblehead/update-build-ci-job-spec-node-v24
3642278 update build+publish ci job spec
1b4b287 Merge pull request #336 from iambumblehead/reference-main-branch-test-coverag...
c17920a reference main branch test-coverage-badge
See full diff in compare view

Updates husky from 8.0.3 to 9.1.7

Release notes

Sourced from husky's releases.

v9.1.7

What's Changed

fix: add husky label to deprecated warning by @smackfu in typicode/husky#1538

New Contributors

@smackfu made their first contribution in typicode/husky#1538

Full Changelog: typicode/husky@v9.1.6...v9.1.7

v9.1.6

What's Changed

Fix issue where example pre-commit file is generated incorrectly by @dexmlee in typicode/husky#1519

New Contributors

@OlegKipchatov made their first contribution in typicode/husky#1495

@Byron2016 made their first contribution in typicode/husky#1499

@dexmlee made their first contribution in typicode/husky#1519

Full Changelog: typicode/husky@v9.1.5...v9.1.6

v9.1.5

What's Changed

fixes #1494, support pre-merge-commit hook by @RainMeoCat in typicode/husky#1497

New Contributors

@RainMeoCat made their first contribution in typicode/husky#1497

Full Changelog: typicode/husky@v9.1.4...v9.1.5

v9.1.4

Improve deprecation notice

v9.1.3

fix: better handle space in PATH

v9.1.2

Show a message instead of automatically removing deprecated code.

This only concerns projects that still have the following code in their hooks:
- #!/usr/bin/env sh # <- This is deprecated, remove it
- . "$(dirname -- "$0")/_/husky.sh"  # <- This is deprecated, remove it
Rest of your hook code
Hooks with these lines will fail in v10.0.0

v9.1.1

... (truncated)

Commits

799e84b 9.1.7
30f2049 fix: add husky label to deprecated warning (#1538)
a2d942a 9.1.6
b4465ed fix: add parens around the null coalescing operator to fix issues when npm_co...
3b3e7f1 docs(spanish): improve spanish translation (#1504)
dcf3aed dosc: repair support Spanish sponsors links (#1500)
c3afd5f docs: support Spanish documentation (#1499)
c5f4f48 docs: support Russian documentation (#1495)
2fee8d2 9.1.5
397e7f0 fixes #1494 support pre-merge-commit hook
Additional commits viewable in compare view

Updates markdownlint-cli2 from 0.22.1 to 0.23.0

Changelog

Sourced from markdownlint-cli2's changelog.

0.23.0

Add overrides configuration option

Improve options/configuration file handling

Update dependencies (including markdownlint)

Remove support for end-of-life Node 20

Commits

5341662 Update to version 0.23.0.
5a7b0fd Add test cases to ensure user-provided Options object properties that use imp...
73c8de8 Bump eslint from 10.5.0 to 10.6.0
fb55bdb Bump js-yaml from 5.1.0 to 5.2.0
f4ee8c9 Bump eslint-plugin-jsdoc from 63.0.9 to 63.0.10
b4f4a52 Add support for configuration object "extends" to new "overrides" behavior.
dacefd5 Refactor "extends" implementation to modify objects in place (simpler, more f...
2be557f Bump eslint-plugin-n from 18.2.0 to 18.2.1
184d8d6 Bump eslint-plugin-jsdoc from 63.0.8 to 63.0.9
60ac5bc Bump eslint-plugin-n from 18.1.0 to 18.2.0
Additional commits viewable in compare view

Updates sinon from 17.0.1 to 22.0.0

Changelog

Sourced from sinon's changelog.

22.0.0

ed911df5 Update Ruby gems (Carl-Erik Kopseng)

75a1e5b8 Update to Node 26 (Carl-Erik Kopseng)

197d6608 Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)

c5ddf80b Update fake-timers@15.4: includes new Temporal API (Carl-Erik Kopseng)

f4ab02f6 Update updatable packages (Carl-Erik Kopseng)

0536afc8 Quality: Global mutable call id can grow unbounded across long-lived processes (#2691) (tuanaiseo)

refactor: global mutable call id can grow unbounded across l

callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.

Affected files: proxy-invoke.js

Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com

Wrap around for all values that are too high

Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

f4f7d93b Perform additional cleanup when calling callThrough() (#2670) (Cyrille)

6199e9e4 improve GitHubworkflows by introducing zizmor for monitoring (#2686) (Till!)

fix(workflows): fetch-depth is for actions/checkout

chore(workflows): update

pin all actions to precise commits

avoid credential leakage from actions/checkout

group action updates going forward

add zimor config to ignore "secrets outside env"

add job to keep validating workflows

f7476b59 Use path.normalize() for path normalization (Carl-Erik Kopseng)

2c975393 fix: make build and node test scripts cross-platform (laplace young)

a7692917 fix: isolate walk state from Object prototype (laplace young)

66df977a Fix sinon.restore() cascade-restoring sub-sandboxes (#2704) (Charlie Leitheiser)

The ESM port of createApi (#2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:

... (truncated)

Commits

52555af 22.0.0
ed911df Update Ruby gems
75a1e5b Update to Node 26
197d660 Update documentation on faking timers to reflect the current state of fake-ti...
c5ddf80 Update fake-timers@15.4: includes new Temporal API
f4ab02f Update updatable packages
0536afc Quality: Global mutable call id can grow unbounded across long-lived processe...
f4f7d93 Perform additional cleanup when calling callThrough() (#2670)
6199e9e improve GitHubworkflows by introducing zizmor for monitoring (#2686)
1519009Description has been truncated

…ates Bumps the dev-dependencies group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.15` | `2.5.2` | | [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `19.8.1` | `21.2.0` | | [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `19.8.1` | `21.2.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.19` | `26.1.0` | | [c8](https://github.com/bcoe/c8) | `9.1.0` | `11.0.0` | | [esmock](https://github.com/iambumblehead/esmock) | `2.7.5` | `2.7.6` | | [husky](https://github.com/typicode/husky) | `8.0.3` | `9.1.7` | | [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) | `0.22.1` | `0.23.0` | | [sinon](https://github.com/sinonjs/sinon) | `17.0.1` | `22.0.0` | | [@types/sinon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sinon) | `17.0.4` | `22.0.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.23.0` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.3` | Updates `@biomejs/biome` from 2.4.15 to 2.5.2 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.2/packages/@biomejs/biome) Updates `@commitlint/cli` from 19.8.1 to 21.2.0 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.0/@commitlint/cli) Updates `@commitlint/config-conventional` from 19.8.1 to 21.2.0 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.0/@commitlint/config-conventional) Updates `@types/node` from 22.19.19 to 26.1.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `c8` from 9.1.0 to 11.0.0 - [Release notes](https://github.com/bcoe/c8/releases) - [Changelog](https://github.com/bcoe/c8/blob/main/CHANGELOG.md) - [Commits](bcoe/c8@v9.1.0...v11.0.0) Updates `esmock` from 2.7.5 to 2.7.6 - [Release notes](https://github.com/iambumblehead/esmock/releases) - [Changelog](https://github.com/iambumblehead/esmock/blob/main/CHANGELOG.md) - [Commits](iambumblehead/esmock@v2.7.5...v2.7.6) Updates `husky` from 8.0.3 to 9.1.7 - [Release notes](https://github.com/typicode/husky/releases) - [Commits](typicode/husky@v8.0.3...v9.1.7) Updates `markdownlint-cli2` from 0.22.1 to 0.23.0 - [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md) - [Commits](DavidAnson/markdownlint-cli2@v0.22.1...v0.23.0) Updates `sinon` from 17.0.1 to 22.0.0 - [Release notes](https://github.com/sinonjs/sinon/releases) - [Changelog](https://github.com/sinonjs/sinon/blob/main/CHANGES.md) - [Commits](sinonjs/sinon@v17.0.1...v22.0.0) Updates `@types/sinon` from 17.0.4 to 22.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sinon) Updates `tsx` from 4.21.0 to 4.23.0 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.23.0) Updates `typescript` from 5.9.3 to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.3) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@commitlint/cli" dependency-version: 21.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies - dependency-name: "@commitlint/config-conventional" dependency-version: 21.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies - dependency-name: "@types/node" dependency-version: 26.1.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies - dependency-name: c8 dependency-version: 11.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies - dependency-name: esmock dependency-version: 2.7.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: husky dependency-version: 9.1.7 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies - dependency-name: markdownlint-cli2 dependency-version: 0.23.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: sinon dependency-version: 22.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies - dependency-name: "@types/sinon" dependency-version: 22.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies - dependency-name: tsx dependency-version: 4.23.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: typescript dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-06T06:34:40Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
husky@8.0.3 ⏵ 9.1.7	⁺¹	^-17
tsx@4.21.0 ⏵ 4.23.0	^-4	^-9
@commitlint/cli@19.8.1 ⏵ 21.2.0		⁺¹	⁺¹
@types/sinon@17.0.4 ⏵ 22.0.0			⁺⁷
@types/node@22.19.19 ⏵ 26.1.0	⁺¹	⁺¹
c8@9.1.0 ⏵ 11.0.0		⁺¹
markdownlint-cli2@0.22.1 ⏵ 0.23.0	⁺¹	⁺¹	⁺⁶
sinon@17.0.1 ⏵ 22.0.0
typescript@5.9.3 ⏵ 6.0.3	⁺¹	⁺¹
esmock@2.7.5 ⏵ 2.7.6			⁺²
@commitlint/config-conventional@19.8.1 ⏵ 21.2.0			⁺¹
@biomejs/biome@2.4.15 ⏵ 2.5.2			^-1

View full report

socket-security · 2026-07-06T06:34:42Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `jiti` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: npm-shrinkwrap.json → `npm/@commitlint/cli@21.2.0` → `npm/jiti@2.6.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jiti@2.6.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump the dev-dependencies group across 1 directory with 12 updates#129

chore: bump the dev-dependencies group across 1 directory with 12 updates#129
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-212884993e

dependabot Bot commented on behalf of github Jul 6, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 6, 2026

Uh oh!

socket-security Bot commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.5.2

2.5.2

Patch Changes

2.5.2

Patch Changes

v21.2.0

21.2.0 (2026-06-30)

Features

Chore

v21.1.0

21.1.0 (2026-06-23)

Bug Fixes

Features

Docs, chore, etc.

New Contributors

v21.0.2

21.2.0 (2026-06-30)

Features

21.1.0 (2026-06-23)

Features

21.0.2 (2026-05-29)

Bug Fixes

21.0.1 (2026-05-12)

21.0.0 (2026-05-08)

BREAKING CHANGES

v21.2.0

21.2.0 (2026-06-30)

Features

Chore

v21.1.0

21.1.0 (2026-06-23)

Bug Fixes

Features

Docs, chore, etc.

New Contributors

v21.0.2

21.2.0 (2026-06-30)

Features

21.1.0 (2026-06-23)

21.0.2 (2026-05-29)

21.0.1 (2026-05-12)

21.0.0 (2026-05-08)

BREAKING CHANGES

v11.0.0

11.0.0 (2026-02-22)

⚠ BREAKING CHANGES

Bug Fixes

v10.1.3

10.1.3 (2024-12-10)

Bug Fixes

v10.1.2

10.1.2 (2024-06-13)

Bug Fixes

v10.1.1

10.1.1 (2024-06-11)

Bug Fixes

v10.1.0

10.1.0 (2024-06-11)

Features

v10.0.0

10.0.0 (2024-06-10)

⚠ BREAKING CHANGES

11.0.0 (2026-02-22)

⚠ BREAKING CHANGES

Bug Fixes

10.1.3 (2024-12-10)

Bug Fixes

10.1.2 (2024-06-13)

Bug Fixes

10.1.1 (2024-06-11)

Bug Fixes

10.1.0 (2024-06-11)

Features

10.0.0 (2024-06-10)

⚠ BREAKING CHANGES

Bug Fixes

wildcard-issue resolved

dependabot Bot commented on behalf of github Jul 6, 2026 •

edited

Loading