Skip to content

chore(deps)(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates - #70

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-d4f17b31e4
Closed

chore(deps)(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates#70
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-d4f17b31e4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 5 updates in the / directory:

Package From To
@preact/preset-vite 2.10.5 2.10.6
@preact/signals 2.9.0 2.9.4
@typescript-eslint/eslint-plugin 8.59.2 8.64.0
preact 10.29.1 10.29.7
prettier 3.8.3 3.9.5

Updates @preact/preset-vite from 2.10.5 to 2.10.6

Changelog

Sourced from @​preact/preset-vite's changelog.

2.10.6

Patch Changes

  • 676ed9d: - prevent the CJS build from rewriting the hook names helper import to require()
    • skip devtools plugin resolve/transform hooks unless devtools support is enabled
    • add the vite-plugin keyword for registry discovery
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​preact/preset-vite since your current version.


Updates @preact/signals from 2.9.0 to 2.9.4

Release notes

Sourced from @​preact/signals's releases.

@​preact/signals@​2.9.4

Patch Changes

  • #952 89000a2 Thanks @​JoviDeCroock! - Stop treating useContext as hook state in the auto-memoization heuristic. Context updates force-update their subscribers in Preact, bypassing shouldComponentUpdate entirely, so context consumers can safely keep the props-based render skipping.

@​preact/signals@​2.9.3

Patch Changes

  • #950 76f9155 Thanks @​joeyTedeschi! - Allow <For> to accept readonly arrays and signals containing readonly arrays.

  • #948 6b0a76c Thanks @​JoviDeCroock! - Dispose signal prop updaters when an element re-renders without any signal props.

    The disposal pass only ran when the new render still carried at least one signal-bound prop. When every signal prop was replaced by plain values, the old updater effect stayed subscribed and kept writing the previous signal's values straight into the DOM, overriding whatever Preact rendered.

  • Updated dependencies [2910fbf, d40746b]:

    • @​preact/signals-core@​1.14.4

@​preact/signals@​2.9.2

Patch Changes

  • #942 e76780c Thanks @​JoviDeCroock! - Fix stale <For> render-prop indexes after removals/reorders by making each cached item's index reactive (a per-item signal) instead of a frozen prop. Cached children are reused and re-render with the new index rather than being recreated, so DOM/component identity is preserved.

  • #938 e0ce9fd Thanks @​JoviDeCroock! - Fix Signal-bound DOM props getting stranded at a stale value when Preact reuses a DOM node. The prop-binding effect now writes the applied value back into the rendered props, keeping Preact's diff baseline in sync with the DOM instead of assuming Preact applied every update.

  • Updated dependencies [beb84c1]:

    • @​preact/signals-core@​1.14.3
Changelog

Sourced from @​preact/signals's changelog.

2.9.4

Patch Changes

  • #952 89000a2 Thanks @​JoviDeCroock! - Stop treating useContext as hook state in the auto-memoization heuristic. Context updates force-update their subscribers in Preact, bypassing shouldComponentUpdate entirely, so context consumers can safely keep the props-based render skipping.

2.9.3

Patch Changes

  • #950 76f9155 Thanks @​joeyTedeschi! - Allow <For> to accept readonly arrays and signals containing readonly arrays.

  • #948 6b0a76c Thanks @​JoviDeCroock! - Dispose signal prop updaters when an element re-renders without any signal props.

    The disposal pass only ran when the new render still carried at least one signal-bound prop. When every signal prop was replaced by plain values, the old updater effect stayed subscribed and kept writing the previous signal's values straight into the DOM, overriding whatever Preact rendered.

  • Updated dependencies [2910fbf, d40746b]:

    • @​preact/signals-core@​1.14.4

2.9.2

Patch Changes

  • #942 e76780c Thanks @​JoviDeCroock! - Fix stale <For> render-prop indexes after removals/reorders by making each cached item's index reactive (a per-item signal) instead of a frozen prop. Cached children are reused and re-render with the new index rather than being recreated, so DOM/component identity is preserved.

  • #938 e0ce9fd Thanks @​JoviDeCroock! - Fix Signal-bound DOM props getting stranded at a stale value when Preact reuses a DOM node. The prop-binding effect now writes the applied value back into the rendered props, keeping Preact's diff baseline in sync with the DOM instead of assuming Preact applied every update.

  • Updated dependencies [beb84c1]:

    • @​preact/signals-core@​1.14.3

2.9.1

Patch Changes

  • #924 ebcee90 Thanks @​JoviDeCroock! - Fix redundant DOM attribute writes when a parent rerenders with unchanged signal props. The DIFFED hook no longer writes Signal references back into vnode.props, which was causing Preact's prop diff to see a mismatch (old: Signal, new: peeked value) and re-apply every signal-bound attribute on every parent rerender.
Commits

Updates @typescript-eslint/eslint-plugin from 8.59.2 to 8.64.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

  • support parsing import defer (#12513)
  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

  • eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

  • eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)
  • eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
  • eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
  • scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

8.62.1 (2026-06-29)

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.64.0 (2026-07-13)

🚀 Features

  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

🚀 Features

  • eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

  • eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
  • eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
  • eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)
  • eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)

... (truncated)

Commits
  • 414d9ab chore(release): publish 8.64.0
  • bcfe16f feat(eslint-plugin): [no-loop-func] support using / await using declarati...
  • 5b5bfde fix(eslint-plugin): [require-array-sort-compare] handle constrained arrays (#...
  • 321856c chore: cleanup cspell config (#12526)
  • b418cf5 feat(typescript-estree): throw for invalid definite assignment in class prope...
  • 737de2b docs: align unified-signatures correct example parameter (#12506)
  • a63c17a docs: fix shadowed parameter name in unified-signatures example (#12502)
  • 290cf6c chore(release): publish 8.63.0
  • 8d8fda6 feat(eslint-plugin): [no-misused-promises] detect async usage of a sync dispo...
  • fec4f4f fix(eslint-plugin): [no-base-to-string] don't flag a shadowed String() call (...
  • Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.59.2 to 8.64.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

  • support parsing import defer (#12513)
  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

  • eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

  • eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)
  • eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
  • eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
  • scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

8.62.1 (2026-06-29)

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

  • remove redundant package.json "files" (#12444)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.1 (2026-06-15)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.0 (2026-06-08)

This was a version bump only for parser to align it with other projects, there were no code changes.

... (truncated)

Commits

Updates preact from 10.29.1 to 10.29.7

Release notes

Sourced from preact's releases.

10.29.7

Maintenance

10.29.6

We had to revert preactjs/preact#5055 due to an incompatibility with useSignalEffect

10.29.5

Fixes

10.29.4

Fixes

10.29.3

Fixes

Performance

Types

Maintenance

10.29.2

Fixes

Maintenance

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for preact since your current version.


Updates prettier from 3.8.3 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

3.9.4

  • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

🔗 Changelog

3.9.1

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

🔗 Changelog

3.8.4

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps-dev): bump the dev-dependencies group across 1 direc…
14cd6ba 
…tory with 6 updates

Bumps the dev-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@preact/preset-vite](https://github.com/preactjs/preset-vite) | `2.10.5` | `2.10.6` |
| [@preact/signals](https://github.com/preactjs/signals/tree/HEAD/packages/preact) | `2.9.0` | `2.9.4` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.59.2` | `8.64.0` |
| [preact](https://github.com/preactjs/preact) | `10.29.1` | `10.29.7` |
| [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.5` |



Updates `@preact/preset-vite` from 2.10.5 to 2.10.6
- [Release notes](https://github.com/preactjs/preset-vite/releases)
- [Changelog](https://github.com/preactjs/preset-vite/blob/main/CHANGELOG.md)
- [Commits](https://github.com/preactjs/preset-vite/commits)

Updates `@preact/signals` from 2.9.0 to 2.9.4
- [Release notes](https://github.com/preactjs/signals/releases)
- [Changelog](https://github.com/preactjs/signals/blob/main/packages/preact/CHANGELOG.md)
- [Commits](https://github.com/preactjs/signals/commits/@preact/signals@2.9.4/packages/preact)

Updates `@typescript-eslint/eslint-plugin` from 8.59.2 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.59.2 to 8.64.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/parser)

Updates `preact` from 10.29.1 to 10.29.7
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](preactjs/preact@10.29.1...10.29.7)

Updates `prettier` from 3.8.3 to 3.9.5
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.3...3.9.5)

---
updated-dependencies:
- dependency-name: "@preact/preset-vite"
  dependency-version: 2.10.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@preact/signals"
  dependency-version: 2.9.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: preact
  dependency-version: 10.29.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:

  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 6 packages with OpenSSF Scorecard issues.

View full job summary

@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown

📊 Test Coverage Report

Metric Coverage CI Gate Target
Lines ✅ 86.4% (11426/13228) 75% 80%
Statements ✅ 86.4% (11426/13228) 75% 80%
Branches ✅ 80.4% (1382/1719) 70% 80%
Functions 🟡 78.3% (257/328) — 80%

🟡 CI gate passed — coverage below 80% target

Files below 80% coverage
File Lines Functions Branches
src/middlewares/guardrail/GuardrailInterceptorHook.ts 76.6% 100.0% 73.0%
src/middlewares/guardrail/GuardrailMiddleware.ts 75.6% 66.7% 68.2%
src/middlewares/guardrail/GuardrailScanner.ts 93.4% 100.0% 64.3%
src/middlewares/guardrail/GuardrailWriteScannerHook.ts 71.0% 100.0% 78.2%
src/middlewares/guardrail/ModerationGuardHook.ts 74.8% 100.0% 58.8%
src/middlewares/guardrail/guards/canary-tracker.ts 98.0% 80.0% 66.7%
src/middlewares/guardrail/guards/content-moderation.ts 78.4% 100.0% 90.6%
src/middlewares/guardrail/guards/sensitive-paths.ts 94.1% 100.0% 77.3%
src/middlewares/guardrail/scanners/HeuristicScanner.ts 100.0% 100.0% 75.0%
src/middlewares/guardrail/scanners/RegexScanner.ts 90.3% 100.0% 78.6%
src/middlewares/guardrail/storage/ConfigStore.ts 88.0% 71.4% 80.0%
src/middlewares/guardrail/storage/DecisionLog.ts 70.3% 40.0% 100.0%
src/middlewares/hitl/Interceptor.ts 89.8% 83.3% 75.7%
src/middlewares/hitl/index.ts 85.8% 54.5% 66.7%
src/middlewares/hitl/script-content-loader.ts 47.8% 0.0% 100.0%
src/middlewares/hitl/tool-interceptor.ts 89.5% 100.0% 70.9%
src/middlewares/hitl/approval/ApprovalQueue.ts 79.7% 81.3% 78.6%
src/middlewares/hitl/approval/Arbitrator.ts 36.1% 25.0% 91.7%
src/middlewares/hitl/approval/TotpManager.ts 93.9% 87.5% 71.4%
src/middlewares/hitl/approval/approval-commands.ts 84.8% 100.0% 72.7%
src/middlewares/hitl/scoring/IrreversibilityScorer.ts 95.6% 100.0% 75.0%
src/middlewares/hitl/storage/BrowserSessionStore.ts 94.7% 100.0% 72.5%
src/middlewares/hitl/storage/DecisionLog.ts 70.6% 25.0% 100.0%
src/middlewares/hitl/storage/PolicyStore.ts 89.4% 85.7% 64.3%
src/middlewares/hitl/storage/StatsTracker.ts 91.2% 71.4% 80.0%
src/middlewares/pii-sanitizer/PiiSanitizerMiddleware.ts 75.7% 58.3% 74.2%
src/middlewares/pii-sanitizer/PolicyEngine.ts 96.6% 100.0% 70.6%
src/middlewares/pii-sanitizer/ScannerEngine.ts 70.0% 85.7% 87.5%
src/middlewares/pii-sanitizer/storage/DlpStore.ts 70.6% 18.2% 100.0%
src/middlewares/tool-call-limit/ToolCallLimitMiddleware.ts 86.8% 72.2% 86.4%
src/middlewares/tool-call-limit/storage/LimitPolicyStore.ts 74.6% 50.0% 75.0%

Generated by CI on commit 8906378

@dependabot @github

dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-d4f17b31e4 branch July 29, 2026 07:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mfurqanazhar92 mfurqanazhar92 Awaiting requested review from mfurqanazhar92 mfurqanazhar92 is a code owner
@sshariqali sshariqali Awaiting requested review from sshariqali sshariqali is a code owner
@sapience-tholken sapience-tholken Awaiting requested review from sapience-tholken sapience-tholken is a code owner
@frankdsai frankdsai Awaiting requested review from frankdsai frankdsai is a code owner
@clee-sai clee-sai Awaiting requested review from clee-sai clee-sai is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mfurqanazhar92