chore(deps): update dependency @adobe/eslint-config-helix

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@adobe/eslint-config-helix	3.0.24 → 3.0.28
@web/dev-server-import-maps (source)	0.2.1 → 0.3.0
@web/test-runner (source)	0.20.2 → 1.0.0
@web/test-runner-commands (source)	0.9.0 → 1.0.0
eslint (source)	9.39.4 → 9.39.5
globals	17.5.0 → 17.7.0
sinon (source)	21.1.2 → 22.0.0
stylelint (source)	17.8.0 → 17.14.0

---

Release Notes

adobe/helix-eslint-config (@​adobe/eslint-config-helix)

v3.0.28

Compare Source

Bug Fixes

• deps: update dependency @​eslint/config-helpers to v0.6.0 (#​262) (2f48ca3)

v3.0.27

Compare Source

Bug Fixes

• deps: update dependency globals to v17.6.0 (#​261) (b5f2998)

v3.0.26

Compare Source

Bug Fixes

• deps: update external fixes (#​260) (57a9682)

v3.0.25

Compare Source

Bug Fixes

• deps: update dependency @​eslint/config-helpers to v0.5.4 (#​259) (4dbc4f0)

modernweb-dev/web (@​web/dev-server-import-maps)

v0.3.0

Compare Source

Minor Changes

• a7084b7: Drop support for Node.js 18 and 20, which have reached end-of-life. The minimum supported Node.js version is now 22.0.0.
  The Node code is compiled to ES2024 which is aligned with the Node 22.

Patch Changes

• Updated dependencies [1a058e6]
• Updated dependencies [5260164]
  • @​web/dev-server-core@​1.0.0
  • @​web/parse5-utils@​3.0.0

modernweb-dev/web (@​web/test-runner)

v1.0.0

Compare Source

Major Changes

• 5260164: Drop support for Node.js 18 and 20, which have reached end-of-life. The minimum supported Node.js version is now 22.0.0.
  The Node code is compiled to ES2024 which is aligned with the Node 22.

Patch Changes

• Updated dependencies [5260164]
• Updated dependencies [8fe1b90]
  • @​web/browser-logs@​1.0.0
  • @​web/config-loader@​1.0.0
  • @​web/dev-server@​1.0.0
  • @​web/test-runner-chrome@​1.0.0
  • @​web/test-runner-commands@​1.0.0
  • @​web/test-runner-core@​1.0.0
  • @​web/test-runner-mocha@​1.0.0

modernweb-dev/web (@​web/test-runner-commands)

v1.0.0

Compare Source

Major Changes

• 5260164: Drop support for Node.js 18 and 20, which have reached end-of-life. The minimum supported Node.js version is now 22.0.0.
  The Node code is compiled to ES2024 which is aligned with the Node 22.

Patch Changes

• Updated dependencies [5260164]
  • @​web/test-runner-core@​1.0.0

eslint/eslint (eslint)

v9.39.5

Compare Source

sindresorhus/globals (globals)

v17.7.0

Compare Source

v17.6.0

Compare Source

• Update globals (2026-05-01) (#​343) 00a4dd9

---

sinonjs/sinon (sinon)

v22.0.0

Compare Source

• ed911df5
  Update Ruby gems (Carl-Erik Kopseng)
• 75a1e5b8
  Update to Node 26 (Carl-Erik Kopseng)
• 197d6608
  Update documentation on faking timers to reflect the current state of fake-timers (Carl-Erik Kopseng)
• c5ddf80b
  Update fake-timers@​15.4: includes new Temporal API (Carl-Erik Kopseng)
• f4ab02f6
  Update updatable packages (Carl-Erik Kopseng)
• 0536afc8
  Quality: Global mutable call id can grow unbounded across long-lived processes (#​2691) (tuanaiseo)

  • refactor: global mutable call id can grow unbounded across l

  callId is module-scoped and incremented on every invocation. In long-running test runners or embedded usage, this can grow indefinitely and eventually lose integer precision semantics for strict ordering comparisons.

  Affected files: proxy-invoke.js

  Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com

  • Wrap around for all values that are too high

  ---

  Signed-off-by: tuanaiseo 221258316+tuanaiseo@users.noreply.github.com
  Co-authored-by: Carl-Erik Kopseng carlerik@gmail.com

• f4f7d93b
  Perform additional cleanup when calling callThrough() (#​2670) (Cyrille)
• 6199e9e4
  improve GitHubworkflows by introducing zizmor for monitoring (#​2686) (Till!)

  • fix(workflows): fetch-depth is for actions/checkout

  • chore(workflows): update

  • pin all actions to precise commits
  • avoid credential leakage from actions/checkout
  • group action updates going forward
  • add zimor config to ignore "secrets outside env"
  • add job to keep validating workflows

• f7476b59
  Use path.normalize() for path normalization (Carl-Erik Kopseng)
• 2c975393
  fix: make build and node test scripts cross-platform (laplace young)
• a7692917
  fix: isolate walk state from Object prototype (laplace young)
• 66df977a
  Fix sinon.restore() cascade-restoring sub-sandboxes (#​2704) (Charlie Leitheiser)

  The ESM port of createApi (#​2683, shipped in 21.1.0) replaced createSandbox: createSandbox with a wrapper that pushes every newly-created sandbox into the root sandbox's fake collection:

  createSandbox: function createSandbox(config) {
      const s = createConfiguredSandbox(config);
      sandbox.getFakes().push(s);
      return s;
  }
  

  Sandbox#restore then walks that collection and calls .restore() on each entry. Because a sub-sandbox is itself an entry, every top-level sinon.restore() cascades into every sub-sandbox and undoes its stubs/timers/etc. — defeating the whole point of having an isolated sub-sandbox. The same cascade hits resetHistory and
  verifyAndRestore. This is the regression reported in #​2701.

  Restore the pre-21.1 behaviour: hand the root API a direct reference to createConfiguredSandbox. Sub-sandboxes are now isolated; only subSandbox.restore() (or verifyAndRestore) clears their fakes.

  Also flip the four sandbox tests that were locking in the buggy cascade: they now assert the parent's restore/resetHistory leaves the child untouched, with an explicit child-side cleanup at the
  end.

  Closes #​2701

• f0bd6e1b
  fix: exclude proto from walk() (#​2699) (Kevin Locke)

  __proto__ is a special property to access an object's prototype. It
  has many pitfalls:

  • Setting it to an object value changes an object's prototype, which is
    generally discouraged and may be unexpected by the iterator callback.
  • Setting it to a non-object value does nothing (meaning seen[k] = true has no effect).
  • When Node.js is run with the --disable-proto=throw option, getting
    or setting __proto__ causes an exception with code
    ERR_PROTO_ACCESS to be thrown.

  Additionally, since this property (and all properties of
  Object.prototype) are currently unused in this project by consumers of
  walk(), it is both safe and preferable to exclude.

  Fixes: #​2695

  Signed-off-by: Kevin Locke kevin@kevinlocke.name

• 1f8afd50
  chore: add context7.json for ownership confirmation (Morgan Roderick)

Released by Carl-Erik Kopseng on 2026-05-05.

stylelint/stylelint (stylelint)

v17.14.0

Compare Source

It fixes 3 bugs, including a false negative one.

• Fixed: performance of getting module paths (#​9354) (@​jeddy3).
• Fixed: performance by dynamically importing TIMING only on use (#​9356) (@​jeddy3).
• Fixed: function-calc-no-unspaced-operator false negatives for unspaced + and - operators following a * or / operator (#​9357) (@​sarathfrancis90).

v17.13.0

Compare Source

It fixes 3 bugs, including a false negative one.

• Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#​9324) (@​sarathfrancis90).
• Fixed: selector-max-type false positives for nested selectors (#​9319) (@​romainmenke).
• Fixed: selector-type-no-unknown false positives for install (#​9308) (@​Mouvedia).

v17.12.0

Compare Source

It fixes 3 bugs, including a false negative one.

• Fixed: block-no-empty reported range when using comments (#​9294) (@​romainmenke).
• Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#​9292) (@​romainmenke).
• Fixed: value-keyword-layout-mappings false positives for caption-side (#​9293) (@​romainmenke).

v17.11.1

Compare Source

It fixes 2 bugs.

• Fixed: node_modules ignore for codeFilename paths containing a dot-prefixed directory (#​9282) (@​tuhtah).
• Fixed: declaration-block-no-redundant-longhand-properties range for contiguous redundant longhand properties (#​9273) (@​pamelalozano16).

v17.11.0

Compare Source

It adds 2 features, including a loader property to referenceFiles: {} for when the order of appearance in the reference styles matters.

• Added: loader to experimental referenceFiles: {} (#​9251) (@​romainmenke).
• Added: autofixed to the result object (#​8771) (@​Rob--W).

v17.10.0

Compare Source

It adds 3 rules and fixes 4 bugs. You can use the *-layout-mappings rules to enforce logical or physical properties, units and keywords.

• Added: selector-no-invalid rule (#​9232) (@​jeddy3).
• Added: unit-layout-mappings rule (#​9229) (@​jeddy3).
• Added: value-keyword-layout-mappings rule (#​9233) (@​jeddy3).
• Fixed: inconsistent error messages when module is not found (#​9260) (@​ybiquitous).
• Fixed: property-layout-mappings false negatives for property names in declaration values (#​9222) (@​jeddy3).
• Fixed: property-layout-mappings false positives for @page properties (#​9223) (@​jeddy3).
• Fixed: selector-pseudo-class-no-unknown false positives for nested webkit-scrollbar part (#​9259) (@​rkdfx).

v17.9.1

Compare Source

It fixes 4 bugs. We also documented the messageArgs each rule provides to the message configuration property.

• Fixed: ConfigurationError regression for custom syntaxes (#​9245) (@​jeddy3).
• Fixed: MD5 hash algorithm to SHA256 for caching (#​9241) (@​rkdfx).
• Fixed: property-no-deprecated autofix for page-break-*: always (#​9214) (@​rkdfx).
• Fixed: selector-no-deprecated false positives for ::part() (#​9227) (@​SaekiTominaga).

v17.9.0

Compare Source

It adds 3 new features. Adding the referenceFiles property to your configuration object makes the no-unknown-animations, no-unknown-custom-media and no-unknown-custom-properties rules more useful.

• Added: experimental referenceFiles to configuration object (#​9179) (@​jeddy3).
• Added: experimental abortSignal option to Node.js API for cancellation support (#​9213) (@​adalinesimonian).
• Added: maxWarnings to configuration object (#​9181) (@​mrginglymus).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.