fix(dependabot): bump the npm-dependencies group across 1 directory with 11 updates

[dependabot]

Bumps the npm-dependencies group with 11 updates in the / directory:

Package	From	To
@octokit/types	16.0.0	17.0.0
@redocly/cli	2.34.0	2.43.2
ignore	7.0.5	7.0.6
@typeform/eslint-config	7.0.17	7.0.20
@types/node	26.0.0	26.1.2
eslint	10.5.0	10.8.0
js-yaml	5.0.0	5.2.3
lint-staged	17.0.8	17.3.0
prettier	3.8.4	3.9.6
typescript	6.0.3	7.0.2
vitest	4.1.9	4.1.10

Updates @octokit/types from 16.0.0 to 17.0.0

Release notes

Sourced from @​octokit/types's releases.

v17.0.0

17.0.0 (2026-08-01)

Features

• drop projects-classic endpoints, add GitHub API endpoints: cache limits (retention & storage) for repos/orgs/enterprises, billing budgets & usage, artifacts deployment metadata, and projectsV2 drafts & fields (#713) (0296144)

BREAKING CHANGES

• Removed /orgs/{org}/projects
• Removed /orgs/{org}/settings/billing/actions
• Removed /orgs/{org}/settings/billing/packages
• Removed /orgs/{org}/settings/billing/shared-storage
• Removed /orgs/{org}/teams/{team_slug}/projects
• Removed /orgs/{org}/teams/{team_slug}/projects/{project_id}
• Removed /projects/columns/{column_id}
• Removed /projects/columns/{column_id}/moves
• Removed /projects/{project_id}
• Removed /projects/{project_id}/collaborators
• Removed /projects/{project_id}/collaborators/{username}
• Removed /projects/{project_id}/collaborators/{username}/permission
• Removed /repos/{owner}/{repo}/projects
• Removed /teams/{team_id}/projects
• Removed /teams/{team_id}/projects/{project_id}
• Removed /user/projects
• Removed /users/{username}/projects
• Removed /users/{username}/settings/billing/actions
• Removed /users/{username}/settings/billing/packages
• Removed /users/{username}/settings/billing/shared-storage

Commits

• 0296144 feat: drop projects-classic endpoints, add GitHub API endpoints: cache limits...
• f672eb5 ci(action): update actions/create-github-app-token action to v3 (#702)
• 5a8840f chore(deps): update dependency npm-run-all2 to v9 (#707)
• 13d28d7 ci(action): update actions/add-to-project action to v2 (#705)
• 8303723 ci(action): update actions/checkout action to v7 (#709)
• de76901 ci(action): update actions/setup-node action to v7 (#711)
• b61f4ad chore(deps): update dependency handlebars to v4.7.9 [security] (#706)
• 52c1c75 ci(action): update actions/checkout action to v6 (#697)
• 9eebb16 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#695)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/types since your current version.

Updates @redocly/cli from 2.34.0 to 2.43.2

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.43.2

Patch Changes

• Updated @​redocly/client-generator to v0.2.0.
• Updated @​redocly/openapi-core to v2.43.2.

@​redocly/cli@​2.43.1

Patch Changes

• Updated @​redocly/openapi-core to v2.43.1.

@​redocly/cli@​2.43.0

Patch Changes

• Updated @​redocly/openapi-core to v2.43.0.

@​redocly/cli@​2.42.0

Minor Changes

• Added an experimental generate-client command that generates a typed, zero-dependency TypeScript client from an OpenAPI description — auth, retries, middleware, typed SSE streaming, pagination, and multipart included — plus optional companion generators for Zod validation, TanStack Query and SWR hooks, MSW mocks, and date transformers. See the generate-client command reference and the Use the generated client guide.

Patch Changes

• Updated @​redocly/client-generator to v0.1.0.
• Updated @​redocly/openapi-core to v2.42.0.

@​redocly/cli@​2.41.2

Patch Changes

• Updated js-yaml from 5.2.1 to 5.2.2 to resolve a vulnerability in YAML parsing.

• Added support for the Arazzo spec-compliant workflow reference form $sourceDescriptions.<name>.<workflowId> in dependsOn, step workflowId, and success/failure action workflowId.

  Unresolvable workflow references fail only the affected workflow with a clear error message, and no longer abort the whole run or pass unnoticed.

• Updated @​redocly/openapi-core to v2.41.2.

• Updated @​redocly/respect-core to v2.41.2.

@​redocly/cli@​2.41.1

Patch Changes

• Fixed an issue where the drift command's schema-consistency rule reported false-positive findings for oneOf schemas with a discriminator. Payloads are validated only against the branch selected by the discriminator value instead of every oneOf branch. Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior.
• Extended the drift command's built-in undocumented-header ignore list with x-amz-, x-amzn- and x-github- prefixes, and the x-hub-signature / x-hub-signature-256 webhook signature headers.

@​redocly/cli@​2.41.0

Minor Changes

... (truncated)

Commits

• 20db2e7 chore: 🔖 release new versions (#2995)
• da1ed3f feat(client-generator): add timeout, idempotency keys, and client identificat...
• 31281aa chore: change respect e2e to use cafe api (#2986)
• 6e5b000 chore: update @​redocly/config version to v0.53.1 (#2989)
• eb9a7a7 chore: 🔖 release new versions (#2991)
• 9ab0333 feat: keep extends unresolved when skipPluginEval is set (#2990)
• 62ce62e chore: 🔖 release new versions (#2988)
• a18bc09 feat: add skipPluginEval option to loadConfig (#2987)
• d9a7dcd chore: 🔖 release new versions (#2983)
• f7aac74 chore(deps): bump redocly/config version to v0.53.0 (#2984)
• Additional commits viewable in compare view

Updates ignore from 7.0.5 to 7.0.6

Release notes

Sourced from ignore's releases.

6.x (== 5.3.2)

6.x

• The release of 6.x is due to a mistake.
• Making an upgrade from 5.x to 6.x for now actually changes nothing and does no harm, everyone could just upgrade or ignore the version.
  • Actually 6.0.2 is 5.3.2
• The next major release will be 7.0.0

Commits

• 3823b5f 7.0.6
• f7520e2 test: adds tests for #153
• 424a2bb Merge pull request #161 from spokodev/fix/consecutive-leading-globstar
• e5cbe4a fix: consecutive leading **/ should match like a single **/
• ac68603 Merge pull request #159 from spokodev/fix/negated-character-class
• 5ba6b40 fix: negated character class [!...] should match like git
• See full diff in compare view

Updates @typeform/eslint-config from 7.0.17 to 7.0.20

Release notes

Sourced from @​typeform/eslint-config's releases.

v7.0.20

7.0.20 (2026-07-03)

Bug Fixes

• dependabot: bump tar from 7.5.13 to 7.5.19 (#130) (f1c2ba5)

v7.0.19

7.0.19 (2026-07-03)

Bug Fixes

• dependabot: bump sigstore from 4.0.0 to 4.1.1 (#135) (280193e)

v7.0.18

7.0.18 (2026-07-01)

Bug Fixes

• dependabot: bump the dependencies group across 1 directory with 6 updates (#132) (440b1cf)

Commits

• f1c2ba5 fix(dependabot): bump tar from 7.5.13 to 7.5.19 (#130)
• 280193e fix(dependabot): bump sigstore from 4.0.0 to 4.1.1 (#135)
• 440b1cf fix(dependabot): bump the dependencies group across 1 directory with 6 update...
• See full diff in compare view

Updates @types/node from 26.0.0 to 26.1.2

Commits

• See full diff in compare view

Updates eslint from 10.5.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

Updates js-yaml from 5.0.0 to 5.2.3

Changelog

Sourced from js-yaml's changelog.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

[5.2.1] - 2026-07-02

Fixed

• Add Map support to !!omap (should work when realMapTag used)

Security

• Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

... (truncated)

Commits

• 6740445 5.2.3 released
• 94e766d Update changelog
• c3bd7ca Polish previous commit, #780
• 00209b6 presenter: treat a tab-indented line in a folded scalar as more-indented (#780)
• 40fcb4f Fix missing mapping values before document markers and reject unpaired mappin...
• 49280f3 Fix !!timestamp resolution for years 0000-0099, #775
• 355dc96 fix: prevent prototype fallback in tag and harden object lookups, #782 (than...
• d524f83 docs: add contributing guidelines
• 3c29559 5.2.2 released
• 3e5240f parser: avoid reparsing flow sequence pair keys
• Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

... (truncated)

Commits

• d153443 Merge pull request #1828 from lint-staged/changeset-release/main
• 5162c14 chore(changeset): release
• a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
• ea96cab style: enable oxlint "suspicious" category
• 2fae007 style: add @e18e/eslint-plugin
• 2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
• 1453ae6 test: relax assertion so that it passes in worktree
• 15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
• dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
• 286e25c feat: allow running parallel tasks by nesting arrays
• Additional commits viewable in compare view

Updates prettier from 3.8.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vitest from 4.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[gitstream-cm]

🚨 gitStream Monthly Automation Limit Reached 🚨

Your organization has exceeded the number of pull requests allowed for automation with gitStream.
Monthly PRs automated: 250/250

To continue automating your PR workflows and unlock additional features, please contact LinearB.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 2
• ✅ No security vulnerabilities detected

---

💡 Trigger a new security scan by commenting @pr-auditor rescan on this PR.

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.