Skip to content

build(deps-dev): bump the development-dependencies group with 2 updates#2564

Merged
pethers merged 2 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-7e88dccb56
Jul 20, 2026
Merged

build(deps-dev): bump the development-dependencies group with 2 updates#2564
pethers merged 2 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-7e88dccb56

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 2 updates: @typescript-eslint/eslint-plugin and @typescript-eslint/parser.

Updates @typescript-eslint/eslint-plugin from 8.64.0 to 8.65.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
  • typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.65.0 (2026-07-20)

🚀 Features

  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • 63ba81b chore(release): publish 8.65.0
  • aa602bd fix(eslint-plugin): [no-unnecessary-parameter-property-assignment] don't flag...
  • 1e90d67 feat(eslint-plugin): [no-shadow] specialized error on enum declaration and me...
  • b32fb34 docs: fix broken code samples in no-extraneous-class and prefer-function-type...
  • eaf4576 feat: add warning when TS 7 is detected (#12529)
  • 18c01c7 feat(eslint-plugin): [no-restricted-imports] deprecate extension rule (#12527)
  • 96e8fe2 fix(eslint-plugin): [unbound-method] report unbound methods accessed via memb...
  • 0d06406 chore: add attw validation to repo (#12437)
  • 9d9973b fix(eslint-plugin): [prefer-string-starts-ends-with] handle escaped $ ending ...
  • c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
  • See full diff in compare view

Updates @typescript-eslint/parser from 8.64.0 to 8.65.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
  • typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • 63ba81b chore(release): publish 8.65.0
  • eaf4576 feat: add warning when TS 7 is detected (#12529)
  • d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
  • 0d06406 chore: add attw validation to repo (#12437)
  • c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the development-dependencies group with 2 updates
a588925 
Bumps the development-dependencies group with 2 updates: [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) and [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser).


Updates `@typescript-eslint/eslint-plugin` from 8.64.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.64.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Dependency updates label Jul 20, 2026
@dependabot
dependabot Bot requested a review from pethers as a code owner July 20, 2026 20:07
@dependabot dependabot Bot added the dependencies Dependency updates label Jul 20, 2026
@github-actions github-actions Bot added infrastructure CI/CD and build infrastructure javascript JavaScript dependencies labels Jul 20, 2026
@pethers

pethers commented Jul 20, 2026

Copy link
Copy Markdown
Member

@copilot

Run echo "🔒 Checking for security vulnerabilities..."
🔒 Checking for security vulnerabilities...

npm audit report

axios 1.0.0 - 1.17.0
Severity: moderate
Axios: Excessive recursion in formDataToJSON can cause denial of service - GHSA-42h9-826w-cgv3
Axios: Prototype pollution auth subfields can inject Basic auth - GHSA-xj6q-8x83-jv6g
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service - GHSA-pmv8-rq9r-6j72
fix available via npm audit fix
node_modules/axios

1 moderate severity vulnerability

To address all issues, run:
npm audit fix
⚠️ Vulnerabilities detected - checking against documented false positives...

❌ Found NEW or HIGH/CRITICAL vulnerabilities not documented as false positives
Undocumented GHSAs found:
- GHSA-42h9-826w-cgv3
- GHSA-pmv8-rq9r-6j72
- GHSA-xj6q-8x83-jv6g
Please review and update SECURITY.md if these are false positives

update axios to 1.8.1

@pethers
fix: override axios to patched release
da9a0ab 
Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>

Copilot AI commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

@copilot

Run echo "🔒 Checking for security vulnerabilities..."
...

Addressed in da9a0ab by overriding transitive axios to 1.18.1 and refreshing the lockfile. npm audit now reports 0 vulnerabilities.

@github-actions github-actions Bot added news News generation and articles content Content updates and improvements ui User interface improvements labels Jul 20, 2026
@pethers
pethers merged commit f0d8cfb into main Jul 20, 2026
16 checks passed
@pethers
pethers deleted the dependabot/npm_and_yarn/development-dependencies-7e88dccb56 branch July 20, 2026 20:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pethers pethers pethers approved these changes

Assignees

No one assigned

Labels

content Content updates and improvements dependencies Dependency updates infrastructure CI/CD and build infrastructure javascript JavaScript dependencies news News generation and articles ui User interface improvements

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@pethers