[dependabot]

Bumps the npm-minor-and-patch group with 16 updates in the / directory:

Package	From	To
@sentry/node	10.74.0	10.78.0
express	5.2.1	5.3.0
express-rate-limit	8.7.0	8.7.1
morgan	1.12.0	1.12.1
ws	8.21.3	8.22.0
@types/ws	8.18.1	8.18.2
@jest/globals	30.5.1	30.5.2
@types/node	22.20.1	22.20.5
@types/ws	8.18.1	8.18.2
@typescript-eslint/eslint-plugin	8.69.0	8.72.1
@typescript-eslint/parser	8.69.0	8.72.1
eslint	10.10.0	10.13.0
globals	17.12.0	17.13.0
jest	30.5.1	30.5.2
prettier	3.9.6	3.9.10
supertest	7.2.2	7.3.1
ts-jest	29.4.12	29.4.15

Updates @sentry/node from 10.74.0 to 10.78.0

Release notes

Sourced from @​sentry/node's releases.

10.78.0

• feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
• fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)
• fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
• fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)
• fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

Bundle size 📦

Path	Size
@​sentry/browser	27.64 KB
@​sentry/browser - with treeshaking flags	26.12 KB
@​sentry/browser (incl. Tracing)	46.2 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.96 KB
@​sentry/browser (incl. Tracing, Profiling)	50.87 KB
@​sentry/browser (incl. Tracing, Replay)	84.73 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	74.6 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	89.33 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	101.65 KB
@​sentry/browser (incl. Feedback)	44.42 KB
@​sentry/browser (incl. sendFeedback)	32.34 KB
@​sentry/browser (incl. FeedbackAsync)	37.34 KB
@​sentry/browser (incl. Metrics)	28.7 KB
@​sentry/browser (incl. Logs)	28.94 KB
@​sentry/browser (incl. Metrics & Logs)	29.6 KB
@​sentry/react	29.42 KB
@​sentry/react (incl. Tracing)	48.46 KB
@​sentry/vue	33.39 KB
@​sentry/vue (incl. Tracing)	48.52 KB
@​sentry/svelte	27.66 KB
CDN Bundle	30 KB
CDN Bundle (incl. Tracing)	48.13 KB
CDN Bundle (incl. Logs, Metrics)	31.56 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	49.42 KB
CDN Bundle (incl. Replay, Logs, Metrics)	70.13 KB
CDN Bundle (incl. Tracing, Replay)	84.97 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	86.24 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	90.65 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91.9 KB
CDN Bundle - uncompressed	89.11 KB
CDN Bundle (incl. Tracing) - uncompressed	145.03 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.71 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	148.92 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	216.26 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	262.18 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	266.05 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	275.56 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	279.42 KB
@​sentry/nextjs (client)	51.06 KB

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

10.78.0

• feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
• fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)
• fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
• fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)
• fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

10.77.1

Important Changes

• feat(v10/nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25559)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  With the handler, tunnel requests go through your middleware. If your middleware blocks unauthenticated requests, exclude the tunnel route in its matcher.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(v10/nextjs): Send tunnel route requests with credentials: 'omit' (#25561)

  With tunnelRoute and no tunnel route handler, @sentry/nextjs now sends events from the browser with credentials: 'omit', because the tunnel route does not need cookies. If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser Sentry.init call:

  // instrumentation-client.ts
  Sentry.init({
    transportOptions: { fetchOptions: { credentials: 'same-origin' } },
  });

• fix(v10/deps)!: Limit @opentelemetry/api to <1.10.0 and the OpenTelemetry SDK to <3.0.0 (#25715)

  Breaking change

  If your app uses @opentelemetry/api 1.10.0 or OpenTelemetry SDK v3 together with v10 of the Sentry SDK, you must stay on @opentelemetry/api below 1.10.0 and OpenTelemetry SDK v2, or upgrade to v11.

  @opentelemetry/api 1.10.0 only works with OpenTelemetry SDK v3 (@opentelemetry/core 3.x, @opentelemetry/instrumentation 0.300.x). The SDK v2 packages that v10 uses only support @opentelemetry/api below 1.10.0, and SDK v3 needs Node.js 22.15.0 or newer, while v10 supports Node.js 18 and newer. For this reason, v10 now limits @opentelemetry/api to <1.10.0, and the @opentelemetry/instrumentation and @opentelemetry/exporter-trace-otlp-http peer dependencies of @sentry/node-core to <0.300.0.

  If your app depends on @opentelemetry/api directly, use a version below 1.10.0 (for example ~1.9.1). With 1.10.0, your app and the Sentry SDK use different copies of the API, and the OpenTelemetry calls of your app do not see the tracer provider of the Sentry SDK.

  To use @opentelemetry/api 1.10.0 and OpenTelemetry SDK v3, upgrade to v11 of the Sentry SDK. For the upgrade steps, see the migration guide.

... (truncated)

Commits

• 5f277de release: 10.78.0
• a4cc5f9 meta(changelog): Update changelog for 10.78.0 (#25831)
• e4ea7fd fix(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
• 26744d3 fix(v10/core): Drop sampled-out errors before they take a promise buffer slot...
• 3c8e1d7 fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
• 0664050 fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js vers...
• 76defeb fix(v10/core): Use trace_metric data category for metrics rate limits and c...
• e2fa5ba meta(changelog): Merge 10.77.0 into 10.77.1 because 10.77.0 was not released ...
• bb2bb52 fix(v10/astro): defer to @sentry/cloudflare/vite on Cloudflare Workers (#25...
• 65d23eb fix(v10/elysia): Set SDK metadata on the options passed to init (#25486)
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
• 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
• 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
• 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
• Additional commits viewable in compare view

Updates morgan from 1.12.0 to 1.12.1

Release notes

Sourced from morgan's releases.

1.12.1

Important

• Security fix for CVE-2026-87859 (GHSA-9f6g-j8ch-79g4)

What's Changed

• docs: fix typos across documentation by @​vaibhavmashal in expressjs/morgan#378
• test: run CI on Windows and macOS by @​kilisamemarisaaa in expressjs/morgan#379
• build(deps): bump github/codeql-action/upload-sarif to 4.37.9 by @​dependabot[bot] in expressjs/morgan#381
• build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 by @​dependabot[bot] in expressjs/morgan#382
• build(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 by @​dependabot[bot] in expressjs/morgan#383
• build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 by @​dependabot[bot] in expressjs/morgan#384
• 1.12.1 by @​UlisesGascon in expressjs/morgan#386

New Contributors

• @​vaibhavmashal made their first contribution in expressjs/morgan#378
• @​kilisamemarisaaa made their first contribution in expressjs/morgan#379

Full Changelog: expressjs/morgan@1.12.0...1.12.1

Changelog

Sourced from morgan's changelog.

1.12.1

• Security fix for CVE-2026-87859(GHSA-9f6g-j8ch-79g4)

Commits

• b1272e7 1.12.1 (#386)
• 4b695ed fix: escape double quotes in log fields
• 0f74eca build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#384)
• e399e3c build(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#383)
• 1e86b34 build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.37.9 (#382)
• 87c0afd build(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#381)
• 286b000 test: run CI on Windows and macOS (#379)
• 5a5902a docs: fix typos across documentation (#378)
• See full diff in compare view

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

• Introduced the protocols option (8b918b01).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

• 297202c [dist] 8.22.0
• 8b918b0 [feature] Introduce the protocols option
• 73e03eb [ci] Update actions/setup-node action to v7
• d9b8954 [fix] Change the ready state after validating the arguments (#2337)
• See full diff in compare view

Updates @types/ws from 8.18.1 to 8.18.2

Commits

• See full diff in compare view

Updates @jest/globals from 30.5.1 to 30.5.2

Release notes

Sourced from @​jest/globals's releases.

v30.5.2

Features

• [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

• [jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)
• [jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)
• [@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

New Contributors

• @​winklemad made their first contribution in jestjs/jest#16345

Full Changelog: jestjs/jest@v30.5.1...v30.5.2

Changelog

Sourced from @​jest/globals's changelog.

30.5.2

Features

• [@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

• [jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)
• [jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)
• [@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

Commits

• 202dd8a v30.5.2
• See full diff in compare view

Updates @types/node from 22.20.1 to 22.20.5

Commits

• See full diff in compare view

Updates @types/ws from 8.18.1 to 8.18.2

Commits

• See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.69.0 to 8.72.1

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: lazy load rules (#13010)
• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

• ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz
• Shaan GS @​ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• eslint-plugin: lazy load rules (#13010)

🩹 Fixes

• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

🩹 Fixes

• eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)
• eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)
• eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)

... (truncated)

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• 1166ba2 chore(type-utils): detect methods in isTypeReadonly without reading the inter...
• 2f0343a fix(eslint-plugin): [no-unnecessary-type-assertion] bound recursive type trav...
• c49d287 chore: [ci] test on oldest supported TS version (#13024)
• 594fe28 fix(eslint-plugin): [no-unnecessary-condition] false positives on unresolved ...
• a4c2603 chore(release): publish 8.72.0
• c6eb98c feat(eslint-plugin): [await-thenable] add allowMixedPromiseArrays option (#...
• b382b74 fix(type-utils): discriminateAnyType crashes when calling getAwaitedType on a...
• 79edd89 fix(eslint-plugin): [require-array-sort-compare] ignore extra this type argum...
• Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.69.0 to 8.72.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: lazy load rules (#13010)
• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

• ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz
• Shaan GS @​ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.72.1 (2026-10-26)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.1 (2026-10-05)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

... (truncated)

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• a4c2603 chore(release): publish 8.72.0
• 7488d68 chore(release): publish 8.71.2
• d57b8da chore(release): publish 8.71.1
• 8695664 chore(release): publish 8.71.0
• 23d38ce chore(release): publish 8.70.1
• 7ee7608 chore(release): publish 8.70.0
• See full diff in

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
journally-api	Ready	Preview	Nov 1, 2026 12:10pm UTC