Skip to content

build(deps-dev): bump prettier from 3.9.5 to 3.9.6 in the development-dependencies group#2565

Merged
pethers merged 2 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-f8ec6eb6c9
Jul 21, 2026
Merged

build(deps-dev): bump prettier from 3.9.5 to 3.9.6 in the development-dependencies group#2565
pethers merged 2 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-f8ec6eb6c9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 1 update: prettier.

Updates prettier from 3.9.5 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the development-dependencies group with 1 update: [prettier](https://github.com/prettier/prettier).


Updates `prettier` from 3.9.5 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.5...3.9.6)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Dependency updates label Jul 21, 2026
@dependabot
dependabot Bot requested a review from pethers as a code owner July 21, 2026 08:40
@dependabot dependabot Bot added the dependencies Dependency updates label Jul 21, 2026
@github-actions github-actions Bot added infrastructure CI/CD and build infrastructure javascript JavaScript dependencies labels Jul 21, 2026
@pethers

pethers commented Jul 21, 2026

Copy link
Copy Markdown
Member

@copilot override deps and upgrade all and fix security issues

🔒 Checking for security vulnerabilities...

npm audit report

body-parser 2.0.0 - 2.2.2
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement - GHSA-v422-hmwv-36x6
fix available via npm audit fix
node_modules/body-parser

brace-expansion 3.0.0 - 5.0.6
Severity: high
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups - GHSA-3jxr-9vmj-r5cp
fix available via npm audit fix
node_modules/brace-expansion

2 vulnerabilities (1 low, 1 high)

To address all issues, run:
npm audit fix
⚠️ Vulnerabilities detected - checking against documented false positives...

❌ Found NEW or HIGH/CRITICAL vulnerabilities not documented as false positives
Undocumented GHSAs found:
- GHSA-3jxr-9vmj-r5cp
- GHSA-v422-hmwv-36x6
Please review and update SECURITY.md if these are false positives

Co-authored-by: pethers <1726836+pethers@users.noreply.github.com>

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

@copilot override deps and upgrade all and fix security issues

🔒 Checking for security vulnerabilities...
...

Remediated both reported advisories and upgraded the remaining outdated direct dependencies in commit 30c15c4b. npm audit now reports 0 vulnerabilities; lint, build, format checks, and all 5,952 tests pass.

@pethers
pethers merged commit adc1cbb into main Jul 21, 2026
16 checks passed
@pethers
pethers deleted the dependabot/npm_and_yarn/development-dependencies-f8ec6eb6c9 branch July 21, 2026 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates infrastructure CI/CD and build infrastructure javascript JavaScript dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants