chore(deps): update deps:lib-non-major

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cantoo/pdf-lib (source)	2.6.5 → 2.7.1
@casualbot/jest-sonar-reporter	2.7.0 → 2.7.1
@fission-ai/openspec	1.3.1 → 1.4.1
@rollup/plugin-commonjs (source)	29.0.2 → 29.0.3
@rollup/plugin-swc (source)	0.4.0 → 0.4.1
@swc/core (source)	1.15.33 → 1.15.41
@types/google-apps-script (source)	2.0.8 → 2.0.11
@types/node (source)	24.12.3 → 24.13.2
@typescript-eslint/eslint-plugin (source)	8.59.2 → 8.61.1
@typescript-eslint/parser (source)	8.59.2 → 8.61.1
axios (source)	1.16.0 → 1.18.0
date-fns	4.1.0 → 4.4.0
eslint (source)	10.3.0 → 10.5.0
eslint-plugin-prettier	5.5.5 → 5.5.6
jscpd (source)	4.0.9 → 4.2.5
knip (source)	6.12.1 → 6.17.1
prettier (source)	3.8.3 → 3.8.4
release-please	17.6.0 → 17.9.0
rollup (source)	4.60.3 → 4.62.0
ts-jest (source)	29.4.9 → 29.4.11
type-fest	5.6.0 → 5.7.0
typescript-eslint (source)	8.59.2 → 8.61.1

---

Release Notes

cantoo-scribe/pdf-lib (@​cantoo/pdf-lib)

v2.7.1

Compare Source

v2.7.0

Compare Source

CasualBot/jest-sonar-reporter (@​casualbot/jest-sonar-reporter)

v2.7.1

Compare Source

What's Changed

• chore(deps-dev): bump @​babel/plugin-transform-modules-systemjs from 7.16.0 to 7.29.4 in the npm_and_yarn group across 1 directory by @​dependabot[bot] in #​47

Full Changelog: CasualBot/jest-sonar-reporter@v2.7.0...v2.7.1

Fission-AI/OpenSpec (@​fission-ai/openspec)

v1.4.1

Compare Source

Patch Changes

• #​1165 0a01146 Thanks @​TabishB! - Move beta workspace view state to .openspec-workspace/view.yaml, stop top-level openspec update from routing into workspace updates, and ignore foreign root workspace.yaml files so Dagster projects keep updating normally.

v1.4.0

Compare Source

Minor Changes

• #​1003 342ed43 Thanks @​Miss-you! - ### New Features

  • Kimi CLI support — OpenSpec can now initialize Kimi CLI as a supported skills-only tool using .kimi/skills/

Other

• Added Kimi-specific docs and init coverage aligned with skill-based /skill:openspec-* usage

• #​1154 aa16080 Thanks @​TabishB! - ### New Features

  • Mistral Vibe support — OpenSpec can now initialize Mistral Vibe as a supported skills-only tool using .vibe/skills/

Bug Fixes

• Case-insensitive requirement headers — Requirement headers are now parsed regardless of capitalization, so specs no longer fail to parse over header casing
• Zsh completions on oh-my-zsh — Fixed shell completion setup so tab completion installs correctly under oh-my-zsh's compinit

Other

• Clearer validation hints — When a requirement has SHALL/MUST only in its header, openspec validate now points you to move the keyword onto the requirement body line instead of showing the generic error

• #​1030 485c97e Thanks @​TabishB! - ### New Features

  • Include the sync workflow in the default core profile so new installs generate /opsx:sync skills and commands by default.

Patch Changes

• #​1111 7fdb177 Thanks @​TabishB! - ### Fixed

  • Preserve workspace planning detection when Windows short paths or symlink aliases resolve to a canonical workspace root.

rollup/plugins (@​rollup/plugin-commonjs)

v29.0.3

2026-05-29

Bugfixes

• commonjs: make #​1868 es5-compatible (#​1981)

rollup/plugins (@​rollup/plugin-swc)

v0.4.1

2026-05-29

Bugfixes

• fix: fix typings to match actual exports (#​1985)

swc-project/swc (@​swc/core)

v1.15.41

Compare Source

Bug Fixes

• (bindings/node) Preserve source context for AST transforms (#​11920) (b6dfa74)

• (es/codegen) Emit export as namespace correctly (#​11923) (4e1f832)

• (es/codegen) Emit export as namespace minified correctly (#​11924) (7157499)

• (es/compat) Rewrite this in destructuring defaults (#​11909) (68af779)

• (es/decorators) Delay 2022 decorator initializers after private fields (#​11847) (3f1a4f5)

• (es/decorators) Handle import types in decorator metadata (#​11916) (f411429)

• (es/fixer) Preserve new tagged template callee parens (#​11922) (242a03a)

• (es/minifier) Handle unknown member props (#​11927) (e59ba68)

• (es/parser) Handle Flow async generic arrows (#​11926) (b9b8993)

• (es/renamer) Avoid duplicate mangled names across eval scope boundaries (#​11913) (4a1af84)

• (plugin) Avoid importing __free from env (#​11908) (4584296)

• (swc) Preserve plugin error context (#​11904) (4e2e9fc)

• (swc_common) Fix sourcemap panic for multibyte mapping positions (#​11918) (40c1601)

Documentation

• Fix architecture fixer link (#​11911) (51cbc8c)

Performance

• Lazily compute source file hashes (#​11879) (a3cfbd7)

• Optimize Atom equality (#​11902) (c6f8cb0)

Revert

• (es/decorators) Revert decorator initializer ordering (#​11901) (a3f23b1)

• (swc_common) Revert sourcemap multibyte mapping clamp (#​11919) (08b4200)

v1.15.40

Compare Source

Bug Fixes

• (es/minifier) Preserve args for destructured callbacks (#​11830) (21873b0)

• (es/minifier) Avoid generating mangled property names that collide with existing properties (#​11839) (9b4fab5)

• (es/minifier) Respect ecma for iife temp vars (#​11873) (e481934)

• (es/minifier) Preserve default parameter object props (#​11884) (71ff84f)

• (es/parser) Reject object-rest assignment to array/object literal (#​11875) (7b57d1f)

• (es/parser) Reject object rest assignment to literals (#​11881) (4ec2eaf)

• (es/react) Exclude self-recursive hooks from refresh dependency array (#​11838) (9101c71)

• (ts/fast-dts) Strip definite assertions in dts (#​11858) (2ab1b8a)

• (ts/fast-strip) Reject unsafe assertion erasure in binary expressions (#​11828) (aa5b539)

• (typescript) Strip parameter binding defaults in dts (#​11857) (800bc17)

Documentation

• Update agent guidance (#​11842) (bf2d015)

• Add security policy (#​11876) (6c43c2d)

• Clarify security scope for npm packages (#​11877) (4662db8)

• Clarify untrusted input security model (#​11882) (5463777)

Features

• (es/minifier) Fine grained effect analysis of class (#​11814) (c9058ad)

• (swc_cli) Implement all features for swc_cli (#​11797) (9300ede)

Miscellaneous Tasks

• (es/minifier) Fix typo in debug log (#​11866) (3de0254)

• (html) Add webcontainer fallback for @swc/html (#​11860) (7692eed)

Performance

• (ecma) Reduce transformer compat overhead (#​11856) (d03cb71)

• (es/codegen) Speed up JsWriter position and srcmap tracking (#​11867) (dbceade)

• (es/codegen) Remove JsWriter last_srcmap cache (#​11869) (3bc1c2b)

• (es/minifier) Reduce minifier profiling hotspots (#​11853) (28c1091)

• Optimize es parser comment finalization (#​11852) (2959ddf)

Testing

• (es/minifier) Move issue_11835 fixture out of terser folder (#​11840) (3dd3431)

Ci

• Update corepack in publish docker jobs (#​11885) (9a7d954)

• Pass publish docker env explicitly (#​11888) (c5f7547)

• Lock issues closed by merged prs (#​11887) (6bd74e5)

• Provide aarch64 musl linker in publish job (#​11889) (20234fd)

• Fix publish musl linker and windows tests (#​11890) (a798a23)

• Make minifier test path explicit (#​11891) (e7cba97)

Security

• Save CI caches only on main (#​11848) (7582529)

• Update rkyv and Rust dependencies (#​11851) (20d92eb)

• Harden PR workflow permissions (#​11849) (e199564)

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.61.1

Compare Source

🩹 Fixes

• eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#​12388)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#​12413)
• eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#​12394, #​12393)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#​12281)
• eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#​12396, #​10577)

❤️ Thank You

• Anas @​anasm266
• Deftera @​Deftera186
• Kirk Waiblinger @​kirkwaiblinger
• lumir
• Sarath Francis @​sarathfrancis90

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.0

Compare Source

🚀 Features

• ast-spec: change type of UnaryExpression.prefix to always true (#​12372)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.1

Compare Source

🩹 Fixes

• eslint-plugin: [no-shadow] correct rule to match ESLint v10 handling (#​12182)
• eslint-plugin: respect ECMAScript line terminators in ts-comment rules (#​12352)

❤️ Thank You

• lumir
• Nevette Bailey @​nevette-bailey

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.0

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.4

Compare Source

🩹 Fixes

• eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#​12294)

❤️ Thank You

• Evyatar Daud @​StyleShit

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.61.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.4

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

axios/axios (axios)

v1.18.0

Compare Source

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

v1.17.0

Compare Source

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

v1.16.1

Compare Source

This release ships a defence-in-depth fix for prototype pollution in formDataToJSON, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements.

date-fns/date-fns (date-fns)

v4.4.0

Compare Source

This release revisits the approach to CDN usage and introduces a new package, @date-fns/cdn and deprecates the date-fns CDN scripts. It allowed reducing the zipped package size from 5.83 MB down to 3.96 MB without introducing any breaking changes.

In v5.0.0-alpha.0 where CDN scripts are completely removed from date-fns the change is more significant and brings the zipped package size down to 2.89 MB.

It is just the first step in optimizing the package size. Expect further size reduction in the future v4 and v5 versions.

Changed

• DEPRECATED: The date-fns CDN scripts are now deprecated and will be removed in the next major release. Please switch to the new @date-fns/cdn package for CDN usage.

• Removed CDN source maps to reduce the package size. If you rely on them, please switch to the new @date-fns/cdn package that still includes them.

v4.3.0

Compare Source

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

• Fixed missing modularized optimization fallback (for Next.js and others). See #​4193.

• Fixed pt locale first day of week to be Sunday. See #​4195 by @​ImRodry.

• Fixed zh-CN, zh-HK, and zh-TW locale month parsing for October, November, and December. See #​4194 by @​puneetdixit200.

v4.2.1

Compare Source

Fixed

• Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

Compare Source

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed

• Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.

eslint/eslint (eslint)

v10.5.0

Compare Source

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#​20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#​20971) (Pixel998)
• 2ce032f feat: report max-lines-per-function violations at function head (#​20966) (Pixel998)
• 732cb3e feat: report max-nested-callbacks violations at function head (#​20967) (Pixel998)
• f9c138a feat: report max-depth violations on keywords (#​20943) (Pixel998)
• bdb496c feat: correct max-depth handling for else-if chains (#​20944) (Pixel998)
• c296873 feat: update error loc in max-statements to function header (#​20907) (Taejin Kim)

Documentation

• 8ae1b5b docs: Update README (GitHub Actions Bot)
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#​20962) (Francesco Trotta)
• f99b47a docs: Update README (GitHub Actions Bot)
• acf03d4 docs: clarify precedence of parserOptions over languageOptions (#​20926) (sethamus)

Chores

• b18bf58 chore: update ecosystem plugins (#​20959) (ESLint Bot)
• c2d1444 refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#​20951) (Taejin Kim)
• 243b8c5 chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#​20788) (kuldeep kumar)
• 217b2a9 test: add unit tests for ParserService (#​20949) (Taejin Kim)
• 72003e7 test: add location information to error messages in max-statements (#​20945) (lumir)
• 7797c26 refactor: deduplicate isAnySegmentReachable across rules (#​20890) (Taejin Kim)
• 67c46fa chore: update ecosystem plugins (#​20938) (ESLint Bot)
• 95d8c7a chore: update dependency @​eslint/json to v2 (#​20934) (renovate[bot])
• cf9e496 chore: update @​arethetypeswrong/cli to 0.18.3 (#​20933) (Pixel998)
• fb6d396 test: run type tests with TypeScript 7 (#​20868) (sethamus)

v10.4.1

Compare Source

Bug Fixes

• e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#​20930) (Francesco Trotta)
• d4ce898 fix: propagate failures from delegated commands (#​20917) (Minh Vu)
• f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#​20916) (kuldeep kumar)
• c5bc78b fix: false positive for reference in finally block (#​20655) (Tanuj Kanti)
• 27538c0 fix: add missing CodePath and CodePathSegment types (#​20853) (Pixel998)

Documentation

• 61b0add docs: remove deprecated rule from related rules of max-params (#​20921) (Tanuj Kanti)
• 305d5b9 docs: remove deprecated rules from related rules section (#​20911) (Tanuj Kanti)
• 49b0202 docs: fix display: none of ad (#​20901) (Tanuj Kanti)
• 9067f94 docs: switch build to Node.js 24 (#​20893) (Milos Djermanovic)
• c91b041 docs: Update README (GitHub Actions Bot)
• e349265 docs: clarify semver strings in rule deprecation objects (#​20885) (Milos Djermanovic)

Chores

• b0e466b test: add data property to invalid tests cases for rules (#​20924) (Tanuj Kanti)
• f78838b test: add CodePath type coverage (#​20904) (Pixel998)
• 1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#​20922) (Francesco Trotta)
• 002942c ci: declare contents:read on update-readme workflow (#​20919) (Arpit Jain)
• 64bca24 chore: update ecosystem plugins (#​20912) (ESLint Bot)
• 6d7c832 chore: ignore fflate updates in renovate (#​20908) (Pixel998)
• b2c8638 ci: bump pnpm/action-setup from 6.0.7 to 6.0.8 (#​20889) (dependabot[bot])
• a9b8d7f chore: increase maxBuffer for ecosystem tests (#​20881) (sethamus)
• b702ead chore: update ecosystem update PR settings (#​20884) (Pixel998)
• 507f60e chore: update ecosystem plugins (#​20882) (ESLint Bot)
• 92f5c5b test: add unit test for message-count (#​20878) (kuldeep kumar)
• df32108 chore: add @​eslint/markdown and typescript-eslint ecosystem tests (#​20837) (sethamus)
• 327f91d chore: use includeIgnoreFile internally (#​20876) (Kirk Waiblinger)
• f0dc4bd chore: pin fflate@​0.8.2 (#​20877) (Milos Djermanovic)
• 0f4bd25 ci: run Discord alert for ecosystem test failures (#​20873) (Copilot)

v10.4.0

Compare Source

Features

• 1a45ec5 feat: check sequence expressions in for-direction (#​20701) (kuldeep kumar)
• 450040b feat: add includeIgnoreFile() to eslint/config (#​20735) (Kirk Waiblinger)

Bug Fixes

• 544c0c3 fix: escape code path DOT labels in debug output (#​20866) (Pixel998)
• 6799431 fix: update dependency @​eslint/config-helpers to ^0.6.0 (#​20850) (renovate[bot])
• f078fef fix: handle non-array deprecated rule replacements (#​20825) (xbinaryx)

Documentation

• 7e52a71 docs: add mention of @eslint-react/eslint-plugin (#​20869) (Pavel)
• db3468b docs: tweak wording around ambiguous CJS-vs-ESM config (#​20865) (Kirk Waiblinger)
• 9084664 docs: Update README (GitHub Actions Bot)
• 9cc7387 docs: Update README (GitHub Actions Bot)
• 3d7b548 docs: Update README (GitHub Actions Bot)
• 191ec3c docs: Update README (GitHub Actions Bot)

Chores

• 6616856 chore: upgrade knip to v6 (#​20875) (Pixel998)
• d13b084 ci: ensure auto-created PRs run CI (#​20860) (lumir)
• e71c7af ci: bump pnpm/action-setup from 6.0.5 to 6.0.7 (#​20862) (dependabot[bot])
• d84393d test: add unit tests for SuppressionsService.applySuppressions() (#​20863) (kuldeep kumar)
• [24db8cb](https://re

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.