Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 6 updates - #134

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-a7a94b89a8
Open

build(deps): bump the minor-and-patch group across 1 directory with 6 updates#134
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-a7a94b89a8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates in the / directory:

Package From To
eslint 10.12.0 10.14.0
prettier 3.9.9 3.9.10
turbo 2.11.7 2.11.10
typescript-eslint 8.71.0 8.72.1
hono 4.13.13 4.13.16
wrangler 4.147.0 4.158.0

Updates eslint from 10.12.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

  • d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

  • 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
  • 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
  • 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
  • 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
  • 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
  • cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
  • 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

  • 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
  • dab466e docs: Update README (GitHub Actions Bot)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
  • 7697550 docs: Update README (GitHub Actions Bot)
  • 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
  • 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
  • e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

  • 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
  • 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
  • a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
  • 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
  • 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
  • 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
  • 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])

... (truncated)

Commits
  • 12cbff4 10.14.0
  • 6b696e7 Build: changelog update for 10.14.0
  • 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
  • 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
  • 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
  • dab466e docs: Update README
  • 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
  • 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
  • 161558a fix: handle LS, PS and empty hashbang comments (#21419)
  • Additional commits viewable in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

  • Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits
  • 1172b82 Release 3.9.10
  • d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
  • 953b908 Bump Prettier dependency to 3.9.9
  • ad8a6bf Clean changelog_unreleased
  • See full diff in compare view

Updates turbo from 2.11.7 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • e521641 publish 2.11.10 to registry
  • aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
  • 9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
  • af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
  • b42cc68 chore: Remove CODEOWNERS file (#14810)
  • 921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
  • 9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
  • 6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
  • 57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
  • d926d6a fix: Match package configuration files and directory inputs in task-level aff...
  • Additional commits viewable in compare view

Updates typescript-eslint from 8.71.0 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
  • eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
  • typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

  • eslint-plugin: lazy load rules (#13010)
  • eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
  • typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

  • ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
  • eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
  • eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
  • eslint-plugin: [require-array-sort-compare] check tuples (#13058)
  • eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
  • type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
  • typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.1 (2026-10-05)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates hono from 4.13.13 to 4.13.16

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

  • fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

What's Changed

... (truncated)

Commits
  • c91b60a 4.13.16
  • e1dd588 fix(jwt): reject a signature segment outside the base64url alphabet and a hea...
  • bf16471 Merge commit from fork
  • d88fab3 Merge commit from fork
  • 34f9043 Merge commit from fork
  • 8a103aa Merge commit from fork
  • 15bbd96 Merge commit from fork
  • 3cb29de 4.13.15
  • 17ad0e2 fix(context): allow c.header() after the response body is consumed (#5587)
  • ee88684 docs(contributing): drop the note about linking a fork branch (#5593)
  • Additional commits viewable in compare view

Updates wrangler from 4.147.0 to 4.158.0

Release notes

Sourced from wrangler's releases.

wrangler@4.158.0

Minor Changes

  • #16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

    Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

    In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

  • #16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

    These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

  • #16700 dc35efb Thanks @​cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

    Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.

  • #16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

    These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

  • #16700 dc35efb Thanks @​cjol! - Bump bundled shell-quote from 1.10.0 to 1.11.0 to pick up a security fix

    shell-quote is bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.

  • #16700 dc35efb Thanks @​cjol! - Bump bundled yaml from 2.8.1 to 2.9.0 to pick up a security fix

    yaml is bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.

  • #16688 fa3edb3 Thanks @​FlorentCollin! - Use the account_id from the configuration file in wrangler d1 migrations list --remote

    Before this change, the command ignored the account_id in the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configured account_id, as wrangler d1 migrations apply does.

  • #16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16695 b2061f4 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261103.1 ^5.20261104.1
    workerd 1.20261103.1 1.20261104.1

  • #16306 36e64f2 Thanks @​efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

... (truncated)

Commits
  • c579d50 Version Packages (#16681)
  • f1d81a2 [miniflare] Enable local Artifacts in development tools [3/3] (#16186)
  • dc35efb Bump dependencies to clear 101 Dependabot alerts (#16700)
  • 4d88a45 [miniflare] Stabilize Artifacts integration tests on Windows (#16693)
  • 0083f80 [wrangler] Harden the local KV pagination regression test (#16697)
  • fa3edb3 [wrangler] Use config account_id in d1 migrations list --remote (#16688)
  • 9a0732c Version Packages (#16654)
  • 44d1ee4 fix(wrangler): stop wrangler delete orphaning Container applications (#16011)
  • 8ac43df Require explicit route metadata flags when downloading Worker configuration (...
  • 680666e Version Packages (#16646)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@bryanfawcett
Bryan Fawcett (bryanfawcett) force-pushed the dependabot/npm_and_yarn/minor-and-patch-a7a94b89a8 branch from 483669b to 5208ac7 Compare November 7, 2026 13:20
@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 6…
8f827ec 
… updates

Bumps the minor-and-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.14.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.9` | `3.9.10` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.7` | `2.11.10` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.0` | `8.72.1` |
| [hono](https://github.com/honojs/hono) | `4.13.13` | `4.13.16` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.147.0` | `4.158.0` |



Updates `eslint` from 10.12.0 to 10.14.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.14.0)

Updates `prettier` from 3.9.9 to 3.9.10
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.9...3.9.10)

Updates `turbo` from 2.11.7 to 2.11.10
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.7...v2.11.10)

Updates `typescript-eslint` from 8.71.0 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

Updates `hono` from 4.13.13 to 4.13.16
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.13...v4.13.16)

Updates `wrangler` from 4.147.0 to 4.158.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.158.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: turbo
  dependency-version: 2.11.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.156.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-a7a94b89a8 branch from 5208ac7 to 8f827ec Compare November 9, 2026 02:09

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants