build(deps): update development dependencies and peer dependencies

[repowarden-app]

Summary

This PR updates 9 development and peer dependencies, including significant updates to TypeScript, SWC tooling, type definitions, and the Plyr library. All updates are either minor or patch versions.

Changes

Build Tools & Compilers

• @swc/core: 1.3.42 → 1.15.41 (minor)
• @swc/jest: 0.2.24 → 0.2.39 (patch)
• tsdown: 0.2.0 → 0.22.3 (minor)

TypeScript & Type Definitions

• typescript: 5.0.4 → 5.9.3 (minor)
• typescript-eslint: 8.41.0 → 8.61.1 (minor)
• @types/react: 18.0.28 → 18.3.31 (minor)
• eslint-import-resolver-typescript: 4.4.4 → 4.4.5 (patch)

Testing

• @testing-library/jest-dom: 5.16.5 → 5.17.0 (minor)

Peer Dependencies

• plyr: 3.7.7 → 3.8.4 (minor)

Risk Assessment

Risk Level: Medium

• TypeScript 5.9.3: Includes new language features and stricter type checking that may require code adjustments
• Plyr 3.8.4: As a peer dependency in a library, this update should be tested for API compatibility
• @swc/core major jump: 1.3.x → 1.15.x is a significant version increase that may affect compilation behavior
• tsdown: 0.2.0 → 0.22.3 represents substantial evolution of the bundler

Action Items

Configuration Review

• Review tsconfig.json for any deprecated options or new recommended settings for TypeScript 5.9
• Verify eslint.config.js (flat format) works correctly with typescript-eslint 8.61.1
• Check if any new TypeScript strict checks need addressing

Testing Recommendations

As this is a library, thorough testing across all target environments is critical:

• Run full test suite (npm test)
• Verify type definitions compile without errors (tsc --noEmit)
• Test against all target Node.js LTS versions: 18, 20, 22
• Build the library and verify output (npm run build)
• Test in a consuming React application with both React 17 and 18
• Verify Plyr 3.8.4 compatibility with existing component API
• Check for any TypeScript compilation warnings or new strict mode errors
• Validate ESLint rules still work as expected
• Consider testing the built package with npm pack and installing in a sample project

Peer Dependency Considerations

⚠️ Important: Since Plyr is updated from 3.7.7 → 3.8.4, verify that:

• The peer dependency range in package.json is still appropriate
• Any breaking changes in Plyr 3.8.x are accounted for
• Documentation is updated if needed

Related PRs

After merging this PR, the following Dependabot PRs can likely be closed as they may contain overlapping updates:

• build(deps): bump the npm_and_yarn group across 1 directory with 5 updates #1260: build(deps): bump the npm_and_yarn group
• build(deps): bump the npm_and_yarn group across 1 directory with 5 updates #1254: build(deps): bump the npm_and_yarn group
• build(deps-dev): bump prettier from 3.6.2 to 3.7.4 #1238: build(deps-dev): bump prettier from 3.6.2 to 3.7.4

---

🤖 Generated by RepoWarden

Available Commands

Comment on this PR with any of the following:

• @repowarden-app rebase — Rebase this PR onto the base branch
• @repowarden-app fix-tests — Analyze CI failures and push a fix
• @repowarden-app resolve-comments — Address review feedback and push updates

RepoWarden Checklist

• Dependencies updated
• Lock file regenerated
• CI passing
• Ready to merge

---

💸 Estimated time saved: ~30 min (≈ £25 of engineering time) — based on internal benchmarks for deps update tasks.

---

Security Vulnerabilities Resolved

• 🟡 brace-expansion: Fix available: yes — severity: moderate
• 🔴 defu: Fix available: yes — severity: high
• 🔴 minimatch: Fix available: yes — severity: high
• 🔴 picomatch: Fix available: yes — severity: high

New Vulnerabilities Introduced

Warning: The following new vulnerabilities were detected after upgrading:

• brace-expansion: Fix available: yes — severity: moderate
• minimatch: Fix available: yes — severity: high
• picomatch: Fix available: yes — severity: high

Remaining vulnerabilities: 20

---

Supply Chain Safety Report

Skipped (unsafe):

• @swc/core@1.15.41 (npm)
  • ⚠️ Package has postinstall script(s) that run during installation.
  • ⚠️ Package name "@swc/core" is very similar to popular package "jose" (edit distance: 2). Verify this is the intended package.
• eslint-import-resolver-typescript@4.4.5 (npm)
  • 🚨 Package maintainer changed recently: "jounqin" -> "GitHub Actions" (version 4.4.5 published 2026-06-01).

Warnings (upgraded with caution):

• @swc/jest@0.2.39 (npm)
  • ⚠️ Package name "@swc/jest" is very similar to popular package "next" (edit distance: 2). Verify this is the intended package.
• @types/react@18.3.31 (npm)
  • ⚠️ Package name "@types/react" is very similar to popular package "preact" (edit distance: 1). Verify this is the intended package.

---

Supply chain safety: The following packages were skipped due to safety concerns:

• @swc/core@1.15.41: Package has postinstall script(s) that run during installation.; Package name "@swc/core" is very similar to popular package "jose" (edit distance: 2). Verify this is the intended package.
• eslint-import-resolver-typescript@4.4.5: Package maintainer changed recently: "jounqin" -> "GitHub Actions" (version 4.4.5 published 2026-06-01).

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​typescript-eslint/​parser@​8.41.0 ⏵ 8.61.1			+1
	typescript-eslint@​8.41.0 ⏵ 8.61.1			+1
	@​types/​react@​18.3.24 ⏵ 18.3.31				-1
	@​typescript-eslint/​eslint-plugin@​8.41.0 ⏵ 8.61.1	-10		+1
	plyr@​3.8.4
	tsdown@​0.2.17 ⏵ 0.22.3	+27		+12	+3
	typescript@​5.9.2 ⏵ 5.9.3			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/tsdown@0.22.3 → npm/eslint-import-resolver-typescript@4.4.4 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @typescript-eslint/eslint-plugin is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@typescript-eslint/eslint-plugin@8.61.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript-eslint/eslint-plugin@8.61.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[repowarden-app]

This PR has been open for 14 days without being merged, so I'm closing it.

If there was an issue with these changes, please reply with feedback so I can improve!

— RepoWarden

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud