build(deps-dev): bump the dev-dependencies group with 5 updates

[dependabot]

Bumps the dev-dependencies group with 5 updates:

Package	From	To
@typescript-eslint/eslint-plugin	8.64.0	8.65.0
@typescript-eslint/parser	8.64.0	8.65.0
eslint	10.7.0	10.8.0
globals	17.7.0	17.8.0
svelte	5.56.6	5.56.8

Updates @typescript-eslint/eslint-plugin from 8.64.0 to 8.65.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
• typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.65.0 (2026-07-20)

🚀 Features

• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
• add warning when TS 7 is detected (#12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)

🩹 Fixes

• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 63ba81b chore(release): publish 8.65.0
• aa602bd fix(eslint-plugin): [no-unnecessary-parameter-property-assignment] don't flag...
• 1e90d67 feat(eslint-plugin): [no-shadow] specialized error on enum declaration and me...
• b32fb34 docs: fix broken code samples in no-extraneous-class and prefer-function-type...
• eaf4576 feat: add warning when TS 7 is detected (#12529)
• 18c01c7 feat(eslint-plugin): [no-restricted-imports] deprecate extension rule (#12527)
• 96e8fe2 fix(eslint-plugin): [unbound-method] report unbound methods accessed via memb...
• 0d06406 chore: add attw validation to repo (#12437)
• 9d9973b fix(eslint-plugin): [prefer-string-starts-ends-with] handle escaped $ ending ...
• c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
• See full diff in compare view

Updates @typescript-eslint/parser from 8.64.0 to 8.65.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
• typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 63ba81b chore(release): publish 8.65.0
• eaf4576 feat: add warning when TS 7 is detected (#12529)
• d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
• 0d06406 chore: add attw validation to repo (#12437)
• c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
• See full diff in compare view

Updates eslint from 10.7.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

Commits

• 36c7659 17.8.0
• 7394811 Update globals (2026-07-01) (#347)
• See full diff in compare view

Updates svelte from 5.56.6 to 5.56.8

Release notes

Sourced from svelte's releases.

svelte@5.56.8

Patch Changes

• fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

• fix: preserve select selection when spread attributes omit value (#18561)

svelte@5.56.7

Patch Changes

• chore: provide indent option for print (#18474)

Changelog

Sourced from svelte's changelog.

5.56.8

Patch Changes

• fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

• fix: preserve select selection when spread attributes omit value (#18561)

5.56.7

Patch Changes

• chore: provide indent option for print (#18474)

Commits

• 44a7813 Version Packages (#18572)
• 3dde011 fix: call onerror and provide a working reset when hydrating a failed bou...
• 2bace30 fix: preserve select selection with spread attributes (#18561)
• b29d700 Version Packages (#18560)
• b791cac chore: provide indent option for print (#18474)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying quickadd with    Cloudflare Pages

Latest commit:	7fe8dde
Status:	✅  Deploy successful!
Preview URL:	https://442f5001.quickadd.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-dev-l6c7.quickadd.pages.dev

View logs

[chhoumann]

Verdict: APPROVE as-is. Highest-value PR in the batch. No code change needed.

@typescript-eslint/{eslint-plugin,parser} 8.64.0 -> 8.65.0, eslint 10.7.0 -> 10.8.0, globals 17.7.0 -> 17.8.0, svelte 5.56.6 -> 5.56.8.

House pin style preserved

package.json touches only the two @typescript-eslint/* caret ranges. eslint "10", globals "17", svelte "^5", jsdom "29" and the obsidian/undici pins are untouched; those move in the lockfile only. The overrides block is byte-identical.

This clears a HIGH advisory

Measured pnpm audit on each branch:

branch	HIGH findings
master	2 (postcss path traversal, brace-expansion DoS)
this PR	1 (postcss only)
#1599	2
#1600	2

The @typescript-eslint 8.65.0 bump pulls brace-expansion past 5.0.8, clearing GHSA-mh99-v99m-4gvg. That is a concrete reason to land this one first.

The remaining postcss HIGH (GHSA-r28c-9q8g-f849) is pre-existing on every branch: a duplicate postcss@8.5.15 copy dragged in by svelte-eslint-parser@1.8.0, while everything else already uses the patched 8.5.20. Dev-only, not introduced here. Surfaced, not folded in.

The lint/type toolchain bumps are inert here, verified rather than assumed

• no-shadow enum specialization, no-restricted-imports deprecation: neither rule is enabled. The flat config uses typescriptEslint.configs.recommended + eslint-plugin-svelte flat/recommended + hand-written overrides; neither preset contributes those rules.
• "warn when TS 7 is detected": SUPPORTED_TYPESCRIPT_VERSIONS is unchanged at >=4.8.4 <6.1.0 and the installed TypeScript is 6.0.3, so the check returns early. The warn branch also only prints on a TTY.
• globals 17.8.0 removes AsyncDisposableStack/DisposableStack/SuppressedError: only bites through no-undef, which is not enabled.
• eslint 10.8.0: one feature, six rule fixes, none of the six touched rules is enabled here; no config-loading changes.

pnpm lint is clean, unchanged from master.

svelte is the real risk, because its runtime ships in main.js

I did not take the changelog's word for it. Diffing the installed 5.56.6 and 5.56.8 trees, exactly four source files differ:

• src/internal/client/dom/blocks/boundary.js (bundled) - svelte #18556
• src/internal/client/dom/elements/bindings/select.js (bundled) - svelte #18561
• src/compiler/print/index.js (compiler)
• src/version.js

Does the compiler change affect generated code? I compiled all 49 QuickAdd .svelte components with both versions and diffed the emitted JS:

svelte 5.56.6 compiled 49 components
svelte 5.56.8 compiled 49 components
=> byte-for-byte IDENTICAL

So the only shipped delta is the two runtime files. main.js grows 1287631 -> 1287813 bytes (+182), consistent with boundary.js's added code; the rest of the byte diff is esbuild minifier symbol churn cascading from the size shift.

select.js adds a guard if ('__value' in select) before select_option. Strictly less destructive: it can only skip a deselect that previously happened. The repo has no spread attributes at all, so the newly guarded path is not reached; Dropdown.svelte (bind:value) and the two <select value={...}> sites both set __value before init_select, so the guard passes.

boundary.js is a 91-line extract-method refactor that moves the reset/invoke_onerror machinery into #create_reset(error), adding a call site in the hydration-failure path. This repo never hydrates (mountComponent.ts uses mount() only). On the mount path I verified handle_error_result runs exactly once per #handle_error (the sync branch and the single .then branch are mutually exclusive), so moving #create_reset inside it preserves the per-error did_reset/calling_on_error lifetime.

Live proof in Obsidian, not just tests

ChoiceView.svelte:433 is the repo's only <svelte:boundary>, and it is the #1451/#1566 hardening that keeps a bad choice from blanking the whole settings tab. I drove it in an isolated worktree-local Obsidian instance under both svelte versions: format engine, a Template choice executing and writing a file, mounting the choice list, a malformed-folder tree, a forced render-time throw to trip the boundary, and a healthy re-mount afterwards.

{"format":"y=2026 v=carmack","noteCreated":true,"noteContent":"hello carmack in 2026\n",
 "happy":{"showsChoice":true,"fellBack":false,"htmlLen":6426},
 "malformed":{"showsHead":true,"showsTail":true,"showsBroken":true,"fellBack":false},
 "boundary":{"fellBackToUnavailable":true,"mentionsOurError":true},
 "recovered":{"showsChoice":true,"fellBack":false},"ok":true}

The output is byte-identical between 5.56.6 and 5.56.8, htmlLen: 6426 included. The boundary fired (onerror logged SMOKE_BOUNDARY_TRIP), the failed snippet rendered ChoicesUnavailable, and a healthy mount afterwards still worked. dev:errors reports no errors.

Two things worth knowing

1. This PR changes bytes users execute, but cuts no release. svelte is a devDependency whose runtime is bundled. The release policy is [{"scope":"deps","type":"build","release":"patch"}], and build(deps-dev) does not match scope deps, so nothing ships from this PR directly. It will ride whatever release comes next. Relatedly, .github/dependabot.yml currently says "production bumps ship and dev bumps do not", which is false for svelte and worth correcting.
2. min-release-age=7: svelte@5.56.8 (07-24) and eslint@10.8.0 (07-24) clear on 2026-07-31; globals@17.8.0 (07-26) clears 2026-08-02. @typescript-eslint 8.65.0 (07-20) is already clear.

Gap surfaced, deliberately not folded in

ChoiceView.svelte's <svelte:boundary> has no automated test coverage despite being the #1451/#1566 hardening. I proved it live here, but the next svelte bump will need the same manual work. A test that mounts a throwing child and asserts onerror fires, the failed snippet renders, and reset() re-renders would make future bumps self-verifying. Worth its own PR.

Full gauntlet (branch rebased onto current master)

pnpm install --frozen-lockfile, tsc -noEmit, eslint ., svelte-check (1149 files, 0 errors), vitest 4463 passed / 37 skipped, pnpm run build, plus the live Obsidian smoke above. All green.

Risk: low, but it is the only PR here that alters shipped bytes. Merge FIRST (see #1600 for the ordering).