Skip to content

deps: bump the minor-and-patch group with 4 updates - #83

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/minor-and-patch-74480d899a
Closed

deps: bump the minor-and-patch group with 4 updates#83
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/minor-and-patch-74480d899a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 4 updates: @codemirror/view, @types/node, oxlint and undici.

Updates @codemirror/view from 6.43.6 to 6.43.7

Commits

Updates @types/node from 26.1.1 to 26.1.2

Commits

Updates oxlint from 1.74.0 to 1.76.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

  • 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
  • 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
  • bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
  • 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
  • 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
  • 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
  • ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

  • 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
  • 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
  • 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
  • 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
  • a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
  • ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
  • 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
  • ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
  • e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
  • 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
  • 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
  • fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
  • ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
  • dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
  • 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
  • cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

  • 25d577e language_server: Start tools in parallel (#15500) (Sysix)
  • 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
  • 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
  • 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
  • 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
  • 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

  • 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
  • 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
  • a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
  • 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
  • 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
  • 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.76.0] - 2026-07-27

🚀 Features

  • 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)
  • 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)
  • 016cf2a linter/oxc: Add bad-match-all-arg rule (#24900) (camc314)
  • cdc941e linter/n: Implement exports-style rule (#24087) (Mikhail Baev)
  • 1ad6f6c linter/eslint: Implement id-denylist rule (#24632) (Mikhail Baev)

📚 Documentation

  • 3ff2e0e linter: Clarify config extends types (#24936) (Boshen)

[1.75.0] - 2026-07-20

🚀 Features

  • dd18383 linter/node: Implement no-top-level-await rule (#24634) (Connor Shea)
  • 16a65f2 linter/react: Implement function-component-definition rule (#24471) (Cole Ellison)
  • 7f1f585 linter: Reuse jest/padding-around-test-blocks for vitest/padding-around-test-blocks (#24519) (Mikhail Baev)
  • 99978a8 linter/import/consistent-type-specifier-style: Support prefer-top-level-if-only-type-imports option (#24502) (camc314)

🐛 Bug Fixes

  • 8694167 linter/eslint/prefer-destructuring: Handle typed declarations (#24616) (camc314)
Commits
  • 65fe65d release(apps): oxlint v1.76.0 && oxfmt v0.61.0 (#24976)
  • 3ff2e0e docs(linter): clarify config extends types (#24936)
  • 8d31dfa feat(linter): verify eslint/no-restricted-globals config schema (#24598)
  • 7069621 feat(linter): verify jest/vitest prefer-lowercase-title config schema (#24724)
  • 016cf2a feat(linter/oxc): add bad-match-all-arg rule (#24900)
  • cdc941e feat(linter/n): implement exports-style rule (#24087)
  • 1ad6f6c feat(linter/eslint): implement id-denylist rule (#24632)
  • 83abe3b release(apps): oxlint v1.75.0 && oxfmt v0.60.0 (#24713)
  • 6ce51d3 chore(deps): update dependency oxlint-tsgolint to v7.0.2000 (#24763)
  • dd18383 feat(linter/node): implement no-top-level-await rule (#24634)
  • Additional commits viewable in compare view

Updates undici from 8.8.0 to 8.9.0

Release notes

Sourced from undici's releases.

v8.9.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

Commits
  • 21a8e1e Bumped v8.9.0 (#5589)
  • 7d3cf92 fix: validate blob body content type
  • c601fff fix(cache): harden cache directive parsing
  • 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
  • e11a68e fix(retry): reject partial content length mismatch
  • 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
  • 4fe5bc5 fix: handle empty qualified private cache directive
  • 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
  • a17e301 Ignore auto-generated .npmrc on Windows (#5583)
  • a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 4 updates: [@codemirror/view](https://github.com/codemirror/view), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) and [undici](https://github.com/nodejs/undici).


Updates `@codemirror/view` from 6.43.6 to 6.43.7
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `oxlint` from 1.74.0 to 1.76.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.76.0/npm/oxlint)

Updates `undici` from 8.8.0 to 8.9.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.8.0...v8.9.0)

---
updated-dependencies:
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.76.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: undici
  dependency-version: 8.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 3 package(s) with unknown licenses.
See the Details below.

License Issues

pnpm-lock.yaml

PackageVersionLicenseIssue Type
@codemirror/view6.43.7NullUnknown License
@types/node26.1.2NullUnknown License

packages/fetch/package.json

PackageVersionLicenseIssue Type
undici^8.9.0NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@codemirror/view 6.43.7 UnknownUnknown
npm/@oxlint/binding-android-arm-eabi 1.76.0 UnknownUnknown
npm/@oxlint/binding-android-arm64 1.76.0 UnknownUnknown
npm/@oxlint/binding-darwin-arm64 1.76.0 UnknownUnknown
npm/@oxlint/binding-darwin-x64 1.76.0 UnknownUnknown
npm/@oxlint/binding-freebsd-x64 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-arm-gnueabihf 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-arm-musleabihf 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-arm64-gnu 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-arm64-musl 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-ppc64-gnu 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-riscv64-gnu 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-riscv64-musl 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-s390x-gnu 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-x64-gnu 1.76.0 UnknownUnknown
npm/@oxlint/binding-linux-x64-musl 1.76.0 UnknownUnknown
npm/@oxlint/binding-openharmony-arm64 1.76.0 UnknownUnknown
npm/@oxlint/binding-win32-arm64-msvc 1.76.0 UnknownUnknown
npm/@oxlint/binding-win32-ia32-msvc 1.76.0 UnknownUnknown
npm/@oxlint/binding-win32-x64-msvc 1.76.0 UnknownUnknown
npm/@types/node 26.1.2 UnknownUnknown
npm/oxlint 1.76.0 UnknownUnknown
npm/undici 8.9.0 🟢 7.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Security-Policy🟢 10security policy file detected
Code-Review🟢 7Found 20/27 approved changesets -- score normalized to 7
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 46 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Packaging🟢 10packaging workflow detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1023 out of 23 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 71 contributing companies or organizations
npm/@types/node ^26.1.2 UnknownUnknown
npm/undici ^8.9.0 UnknownUnknown

Scanned Files

  • packages/eslint-config/package.json
  • packages/fetch/package.json
  • pnpm-lock.yaml

@github-actions

Copy link
Copy Markdown
Contributor

Dependency Blast Radius

Base ref: origin/develop

Touched packages: @studnicky/eslint-config, @studnicky/fetch

Impacted packages: @studnicky/eslint-config, @studnicky/fetch, @studnicky/request-executor

Package test signal: 3/3 impacted package(s) have package tests

flowchart LR
classDef added fill:#d4edda,stroke:#28a745,color:#155724
classDef modified fill:#fff3cd,stroke:#856404,color:#664d03
classDef deleted fill:#f8d7da,stroke:#dc3545,color:#842029,stroke-dasharray:5 5
classDef impacted_1 fill:#e28c36,stroke:#ad661f,color:#000000
p__studnicky_eslint_config["@studnicky/eslint-config"]
p__studnicky_fetch["@studnicky/fetch"]
p__studnicky_request_executor["@studnicky/request-executor"]
p__studnicky_request_executor --> p__studnicky_fetch
class p__studnicky_eslint_config modified
class p__studnicky_fetch modified
class p__studnicky_request_executor impacted_1
subgraph Legend
  legend_modified["Package contains modified files"]:::modified
  legend_impacted_1["Impacted 1 hop away"]:::impacted_1
end
Loading

@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 10, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-74480d899a branch August 10, 2026 23:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants