[dependabot]

Bumps the dev-dependencies group with 6 updates in the / directory:

Package	From	To
@types/node	26.1.2	26.6.5
eslint	10.8.0	10.12.0
js-yaml	5.2.3	5.4.3
lint-staged	17.3.0	17.6.0
prettier	3.9.6	3.9.10
yaml	2.9.0	2.9.1

Updates @types/node from 26.1.2 to 26.6.5

Commits

• See full diff in compare view

Updates eslint from 10.8.0 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

... (truncated)

Commits

• a438ec3 10.12.0
• 32a73f1 Build: changelog update for 10.12.0
• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
• 152067f chore: update ecosystem plugins (#21362)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
• 67eb586 docs: Update README
• bfaea12 perf: cache normalized config globals per languageOptions (#21364)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
• d166567 chore: update dependency prettier to v3.9.9 (#21371)
• Additional commits viewable in compare view

Updates js-yaml from 5.2.3 to 5.4.3

Changelog

Sourced from js-yaml's changelog.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

... (truncated)

Commits

• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• Additional commits viewable in compare view

Updates lint-staged from 17.3.0 to 17.6.0

Release notes

Sourced from lint-staged's releases.

v17.6.0

Minor Changes

• #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*': {
  title: 'Fail if PDF files are committed',
  task: async (filepaths, { log }) => {
  const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
  if (pdfFiles.length > 0) {
  log('PDF files should not be committed: %s', pdfFiles)
  throw new Error('Failed')
  }
  },
  },
  })

• #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

  If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

• #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

• #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
  })

• #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

• #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

v17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.6.0

Minor Changes

• #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*': {
  title: 'Fail if PDF files are committed',
  task: async (filepaths, { log }) => {
  const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
  if (pdfFiles.length > 0) {
  log('PDF files should not be committed: %s', pdfFiles)
  throw new Error('Failed')
  }
  },
  },
  })

• #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

  If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

• #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

• #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
  })

• #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

• #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

... (truncated)

Commits

• 48f9f4e Merge pull request #1857 from lint-staged/changeset-release/main
• 16b2e21 chore(changeset): release
• 195f156 docs: improve changeset
• 0ba6261 fix: create hidden directory only when required
• 66ac2de docs: fixes to changesets
• 80af8d7 Merge pull request #1863 from lint-staged/fix-issues
• e433488 fix: handle task editing a symlinked file to a regular file, and --fail-on-ch...
• e5019b3 fix: handle trailing newlines when detecting changed files
• 74efec8 ci: run Cygwin and MSYS2 tests on Node.js 26
• 655b7dc fix: use TypeScript types instead of JSDoc
• Additional commits viewable in compare view

Updates prettier from 3.9.6 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

... (truncated)

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.