chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@changesets/cli (source)	2.29.4 -> 2.29.6			devDependencies	patch
@eslint/js (source)	9.28.0 -> 9.34.0			devDependencies	minor
@types/compression (source)	1.8.0 -> 1.8.1			devDependencies	patch
@types/cors (source)	2.8.18 -> 2.8.19			devDependencies	patch
@types/express (source)	5.0.2 -> 5.0.3			devDependencies	patch
@types/express-serve-static-core (source)	5.0.6 -> 5.0.7			devDependencies	patch
@types/node (source)	20.19.0 -> 20.19.11			devDependencies	patch
compression	1.8.0 -> 1.8.1			devDependencies	patch
cspell (source)	9.0.2 -> 9.2.1			devDependencies	minor
eslint (source)	9.28.0 -> 9.34.0			devDependencies	minor
node (source)	22.16.0 -> 22.19.0				minor
prettier (source)	3.5.3 -> 3.6.2			devDependencies	minor
supertest	7.1.1 -> 7.1.4			devDependencies	patch
ts-jest (source)	29.3.4 -> 29.4.1			devDependencies	minor
typescript (source)	5.8.3 -> 5.9.2			devDependencies	minor
typescript-eslint (source)	8.33.1 -> 8.41.0			devDependencies	minor

---

Release Notes

changesets/changesets (@​changesets/cli)

v2.29.6

Compare Source

Patch Changes

• #​1712 a3563b0 Thanks @​benmccann! - Switch to maintained fork of external-editor

v2.29.5

Compare Source

Patch Changes

• #​1693 6352819 Thanks @​Andarist! - Fixed an issue with workspace:^ and workspace:~ dependency ranges not being semantically treated as, respectively, ^CURRENT_VERSION and ~CURRENT_VERSION. This led to dependent packages being, at times, bumped too often when their dependencies with those ranges were bumped.

• Updated dependencies [6352819]:

  • @​changesets/assemble-release-plan@​6.0.9
  • @​changesets/get-release-plan@​4.0.13

eslint/eslint (@​eslint/js)

v9.34.0

Compare Source

v9.33.0

Compare Source

v9.32.0

Compare Source

v9.31.0

Compare Source

v9.30.1

Compare Source

v9.30.0

Compare Source

v9.29.0

Compare Source

expressjs/compression (compression)

v1.8.1

Compare Source

==========

• deps: on-headers@~1.1.0
  • Fix CVE-2025-7339 (GHSA-76c9-3jph-rj3q)

streetsidesoftware/cspell (cspell)

v9.2.1

Compare Source

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#​7795)

fix: Workflow Bot -- Update Dictionaries (main) (#​7795)

v9.2.0

Compare Source

refactor: Support url based cache entries (#​7639)

refactor: Support url based cache entries (#​7639)

---

Features

fix: Support remote dependencies in cache (#​7642)

fix: Support remote dependencies in cache (#​7642)

---

Fixes

fix: Remove `flat-cache` dependency (#​7636)

fix: Remove flat-cache dependency (#​7636)

flat-cache v6 is not compatible with the cspell cache. Since flat-cache was mostly a pass through to flatted, it was better to just replace it.

---

refactor: move towards caching URLs (#​7634)

refactor: move towards caching URLs (#​7634)

---

fix: Support async cache (#​7631)

fix: Support async cache (#​7631)

---

fix: Replace file-entry-cache (#​6579)

fix: Replace file-entry-cache (#​6579)

Deprecating the use of file-entry-cache.

v10 of file-entry-cache breaks the spell checker and bloats the cache size.

This PR is the first step in reducing the dependency upon file-entry-cache and its dependencies.

---

fix: Clean cspell-lib type exports (#​7615)

fix: Clean cspell-lib type exports (#​7615)

---

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#​7618)

fix: Workflow Bot -- Update Dictionaries (main) (#​7618)

v9.1.5

Compare Source

Fixes

fix: Compile before publish (#​7610)

fix: Compile before publish (#​7610)

---

v9.1.3

Compare Source

Fixes

fix: Add toml config reader/writer (#​7565)

fix: Add toml config reader/writer (#​7565)

fixes #​7563

---

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#​7569)

fix: Workflow Bot -- Update Dictionaries (main) (#​7569)

v9.1.2

Compare Source

Fixes

fix: Do not double encode stdin urls (#​7536)

fix: Do not double encode stdin urls (#​7536)

fixes #​7517

---

fix: cspell trace output (#​7528)

fix: cspell trace output (#​7528)

It was incorrectly trimming ansi strings.

---

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#​7526)

fix: Workflow Bot -- Update Dictionaries (main) (#​7526)

v9.1.1

Compare Source

Changes

Fixes

fix: Use the native JSON parser if possible (#​7502)

fix: Use the native JSON parser if possible (#​7502)

Some of the cspell settings have grow large. The fix is to use the native JSON parser instead of one that accepts comments.

---

v9.1.0

Compare Source

Changes

Features

feat: Add command `dictionaries` (#​7445)

feat: Add command dictionaries (#​7445)

Add new dictionaries command to the cli

Usage: cspell dictionaries [options]

List dictionaries

Options:
  -c, --config <cspell.json>  Configuration file to use.  By default cspell
                              looks for cspell.json in the current directory.
  --path-format <format>      Configure how to display the dictionary path.
                              (choices: "hide", "short", "long", "full",
                              default: Display most of the path.)
  --color                     Force color.
  --no-color                  Turn off color.
  --no-default-configuration  Do not load the default configuration and
                              dictionaries.
  -h, --help                  display help for command

---

feat: Add lint option `--dictionary` (#​7441)

feat: Add lint option --dictionary (#​7441)

Add lint options:

• --dictionary - enable a dictionary by name
• --disable-dictionary - disable a dictionary by name

---

feat: Add init command to command-line. (#​7414)

feat: Add init command to command-line. (#​7414)

New command:

Usage: cspell init [options]

Initialize a CSpell configuration file.

Options:
  -o, --output <path>        Define where to write file.
  --format <format>          Define the format of the file. (choices: "yaml",
                             "yml", "json", "jsonc", default: "yaml")
  --import <path|package>    Import a configuration file or dictionary package.
  --locale <locale>          Define the locale to use when spell checking (e.g.,
                             en, en-US, de).
  --dictionary <dictionary>  Enable a dictionary.
  --no-comments              Do not add comments to the config file.
  --no-schema                Do not add the schema reference to the config file.
  -h, --help                 display help for command

---

feat: Add command line option to set reporting level (#​7380)

feat: Add command line option to set reporting level (#​7380)

eslint/eslint (eslint)

v9.34.0

Compare Source

v9.33.0

Compare Source

v9.32.0

Compare Source

v9.31.0

Compare Source

v9.30.1

Compare Source

v9.30.0

Compare Source

v9.29.0

Compare Source

nodejs/node (node)

v22.19.0

Compare Source

v22.18.0

Compare Source

v22.17.1

Compare Source

v22.17.0: 2025-06-24, Version 22.17.0 'Jod' (LTS), @​aduh95

Compare Source

Notable Changes

⚠️ Deprecations

Instantiating node:http classes without new

Constructing classes like IncomingMessage or ServerResponse without the new
keyword is now discouraged. This clarifies API expectations and aligns with standard
JavaScript behavior. It may warn or error in future versions.

Contributed by Yagiz Nizipli in #​58518.

options.shell = "" in node:child_process

Using an empty string for shell previously had undefined behavior. This change
encourages explicit choices (e.g., shell: true or a shell path) and avoids
relying on implementation quirks.

Contributed by Antoine du Hamel and Renegade334 #​58564.

HTTP/2 priority signaling

The HTTP/2 prioritization API (e.g., stream.priority) is now deprecated due to
poor real-world support. Applications should avoid using priority hints and expect future removal.

Contributed by Matteo Collina and Antoine du Hamel #​58313.

✅ Features graduated to stable

assert.partialDeepStrictEqual()

This method compares only a subset of properties in deep object comparisons,
useful for flexible test assertions. Its stabilization means it's now safe for
general use and won't change unexpectedly in future releases.

Contributed by Ruben Bridgewater in #​57370.

Miscellaneous

• dirent.parentPath
• filehandle.readableWebStream()
• fs.glob()
• fs.openAsBlob()
• node:readline/promises
• port.hasRef()
• readable.compose()
• readable.iterator()
• readable.readableAborted
• readable.readableDidRead
• Duplex.fromWeb()
• Duplex.toWeb()
• Readable.fromWeb()
• Readable.isDisturbed()
• Readable.toWeb()
• stream.isErrored()
• stream.isReadable()
• URL.createObjectURL()
• URL.revokeObjectURL()
• v8.setHeapSnapshotNearHeapLimit()
• Writable.fromWeb()
• Writable.toWeb()
• writable.writableAborted
• Startup Snapshot API
• ERR_INPUT_TYPE_NOT_ALLOWED
• ERR_UNKNOWN_FILE_EXTENSION
• ERR_UNKNOWN_MODULE_FORMAT
• ERR_USE_AFTER_CLOSE

Contributed by James M Snell in
#​57513 and
#​58541.

Semver-minor features

🔧 fs.FileHandle.readableWebStream gets autoClose option

This gives developers explicit control over whether the file descriptor should
be closed when the stream ends. Helps avoid subtle resource leaks.

Contributed by James M Snell in #​58548.

🔧 fs.Dir now supports explicit resource management

This improves ergonomics around async iteration of directories. Developers can
now manually control when a directory is closed using .close() or with Symbol.asyncDispose.

Contributed by Antoine du Hamel in #​58206.

📊 http2 gains diagnostics channel: http2.server.stream.finish

Adds observability support for when a stream finishes. Useful for logging,
monitoring, and debugging HTTP/2 behavior without patching internals.

Contributed by Darshan Sen in #​58560.

🔐 Permissions: implicit allow-fs-read to entrypoint

Node.js permissions model now allows read access to the entry file by default.
It makes running permission-restricted apps smoother while preserving security.

Contributed by Rafael Gonzaga in #​58579.

🎨 util.styleText() adds 'none' style

This lets developers remove styling cleanly without hacks. Useful for overriding
inherited terminal styles when composing styled strings.

Contributed by James M Snell in #​58437.

🧑‍💻 Community updates

• [0105c13556] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #​58499
• [3b857735ef] - doc: add JonasBa to collaborators (Jonas Badalic) #​58355
• [fdf7612735] - doc: add puskin to collaborators (Giovanni Bucci) #​58308

Commits

• [ffe7e1ace0] - (SEMVER-MINOR) assert: mark partialDeepStrictEqual() as stable (Ruben Bridgewater) #​57370
• [269931f289] - async_hooks: ensure AsyncLocalStore instances work isolated (Gerhard Stöbich) #​58149
• [9e0746a4ff] - benchmark: fix broken fs.cpSync benchmark (Dario Piotrowicz) #​58472
• [dee8cb5bcb] - benchmark: add more options to cp-sync (Sonny) #​58278
• [e840fd5b85] - benchmark: fix typo in method name for error-stack (Miguel Marcondes Filho) #​58128
• [b9a16e97e0] - buffer: give names to Buffer.prototype.*Write() functions (Livia Medeiros) #​58258
• [d56a5e40af] - buffer: use constexpr where possible (Yagiz Nizipli) #​58141
• [215587feca] - build: add support for OpenHarmony operating system (hqzing) #​58350
• [9bcef6821c] - build: fix uvwasi pkgname (Antoine du Hamel) #​58270
• [7c3883c2ae] - build: search for libnode.so in multiple places (Jan Staněk) #​58213
• [3f954accb3] - build: fix pointer compression builds (Joyee Cheung) #​58171
• [04c8f59f84] - build: use FILE_OFFSET_BITS=64 esp. on 32-bit arch (RafaelGSS) #​58090
• [8c2cf3a372] - build: use //third_party/simdutf by default in GN (Shelley Vohr) #​58115
• [cff8006792] - child_process: give names to ChildProcess functions (Livia Medeiros) #​58370
• [6816d779b6] - child_process: give names to promisified exec() and execFile() (LiviaMedeiros) #​57916
• [5572cecca4] - crypto: expose crypto.constants.OPENSSL_IS_BORINGSSL (Shelley Vohr) #​58387
• [d6aa02889c] - deps: use proper C standard when building libuv (Yaksh Bariya) #​58587
• [375a6413d5] - deps: update simdjson to 3.12.3 (Node.js GitHub Bot) #​57682
• [e0cd138e52] - deps: update googletest to e9092b1 (Node.js GitHub Bot) #​58565
• [31e592631f] - deps: update corepack to 0.33.0 (Node.js GitHub Bot) #​58566
• [386c24260b] - deps: update sqlite to 3.50.0 (Node.js GitHub Bot) #​58272
• [f84998d40b] - deps: update OpenSSL gen container to Ubuntu 22.04 (Michaël Zasso) #​58432
• [d49fd29859] - deps: update llhttp to 9.3.0 (Fedor Indutny) #​58144
• [e397980a1a] - deps: update libuv to 1.51.0 (Node.js GitHub Bot) #​58124
• [a28c33645c] - dns: fix dns query cache implementation (Ethan Arrowood) #​58404
• [6939b0c624] - doc: fix the order of process.md sections (Allon Murienik) #​58403
• [1ca253c363] - doc: add support link for panva (Filip Skokan) #​58591
• [8319edbcf6] - doc: update metadata for _transformState deprecation (James M Snell) #​58530
• [697d258136] - doc: deprecate passing an empty string to options.shell (Antoine du Hamel) #​58564
• [132fc804e8] - doc: correct formatting of example definitions for --test-shard (Jacob Smith) #​58571
• [7d0df646f6] - doc: clarify DEP0194 scope (Antoine du Hamel) #​58504
• [1e6d7da0ce] - doc: deprecate HTTP/2 priority signaling (Matteo Collina) #​58313
• [5a917bc1d0] - doc: explain child_process code and signal null values everywhere (Darshan Sen) #​58479
• [0105c13556] - doc: add Filip Skokan to TSC (Rafael Gonzaga) #​58499
• [2bdc87cd64] - doc: update git node release example (Antoine du Hamel) #​58475
• [28f9b43186] - doc: add missing options.info for ZstdOptions (Jimmy Leung) #​58360
• [e19496dfc1] - doc: add missing options.info for BrotliOptions (Jimmy Leung) #​58359
• [7f905863db] - doc: clarify x509.checkIssued only checks metadata (Filip Skokan) #​58457
• [5cc97df637] - doc: add links to parent class for node:zlib classes (Antoine du Hamel) #​58433
• [36e0d5539b] - doc: remove remaining uses of @@​wellknown syntax (René) #​58413
• [2f36f8e863] - doc: clarify behavior of --watch-path and --watch flags (Juan Ignacio Benito) #​58136
• [3b857735ef] - doc: add JonasBa to collaborators (Jonas Badalic) #​58355
• [9d5e969bb6] - doc: add latest security release steward (Rafael Gonzaga) #​58339
• [b22bb03167] - doc: fix CryptoKey.algorithm type and other interfaces in webcrypto.md (Filip Skokan) #​58294
• [670f31060b] - doc: mark the callback argument of crypto.generatePrime as mandatory (Allon Murienik) #​58299
• [39d9a61239] - doc: remove comma delimiter mention on permissions doc (Rafael Gonzaga) #​58297
• [573b0b7bfe] - doc: make Stability labels not sticky in Stability index (Livia Medeiros) #​58291
• [a5a686a3ae] - doc: update commit-queue documentation (Dario Piotrowicz) #​58275
• [fdf7612735] - doc: add puskin to collaborators (Giovanni Bucci) #​58308
• [be492a1708] - doc: update stability status for diagnostics_channel to experimental (Idan Goshen) #​58261
• [7d00fc2206] - doc: clarify napi_get_value_string_* for bufsize 0 (Tobias Nießen) #​58158
• [c8500a2c4a] - doc: fix typo of file http.md, outgoingMessage.setTimeout section (yusheng chen) #​58188
• [34a9b856c3] - doc: update return types for eventNames method in EventEmitter (Yukihiro Hasegawa) #​58083
• [faedee59d2] - doc: fix typo in benchmark script path (Miguel Marcondes Filho) #​58129
• [570d8d3f10] - doc: clarify future Corepack removal in v25+ (Trivikram Kamat) #​57825
• [a71b9fc2ff] - doc: mark multiple APIs stable (James M Snell) #​57513
• [73a97d47f3] - doc,lib: update source map links to ECMA426 (Chengzhong Wu) #​58597
• [8b41429499] - doc,src,test: fix typos (Noritaka Kobayashi) #​58477
• [0cea14ec7f] - errors: show url of unsupported attributes in the error message (Aditi) #​58303
• [b9586bf898] - (SEMVER-MINOR) fs: add autoClose option to FileHandle readableWebStream (James M Snell) #​58548
• [72a1b061f3] - fs: unexpose internal constants (Chengzhong Wu) #​58327
• [5c36510dec] - fs: add support for URL for fs.glob's cwd option (Antoine du Hamel) #​58182
• [3642b0d944] - fs: improve cpSync no-filter copyDir performance (Dario Piotrowicz) #​58461
• [24865bc7e8] - fs: improve cpSync dest overriding performance (Dario Piotrowicz) #​58160
• [1b3847694d] - (SEMVER-MINOR) fs: add to Dir support for explicit resource management (Antoine du Hamel) #​58206
• [cff62e3265] - fs: ensure dir.read() does not throw synchronously (Antoine du Hamel) #​58228
• [cb39e4ca1f] - fs: glob is stable, so should not emit experimental warnings (Théo LUDWIG) #​58236
• [597bfefbe1] - http: deprecate instantiating classes without new (Yagiz Nizipli) #​58518
• [5298da0102] - http: remove unused functions and add todos (Yagiz Nizipli) #​58143
• [cff440e0fa] - http,https: give names to anonymous or misnamed functions (Livia Medeiros) #​58180
• [43bf1f619a] - http2: add raw header array support to h2Session.request() (Tim Perry) #​57917
• [e8a0f5b063] - http2: add lenient flag for RFC-9113 (Carlos Fuentes) #​58116
• [49cb90d4a5] - (SEMVER-MINOR) http2: add diagnostics channel 'http2.server.stream.finish' (Darshan Sen) #​58560
• [6a56c68728] - http2: add diagnostics channel 'http2.server.stream.error' (Darshan Sen) #​58512
• [59806b41d3] - http2: add diagnostics channel 'http2.server.stream.start' (Darshan Sen) #​58449
• [d3d662ae47] - http2: remove no longer userful options.selectPadding (Jimmy Leung) #​58373
• [dec6c9af8c] - http2: add diagnostics channel 'http2.server.stream.created' (Darshan Sen) #​58390
• [9e98899986] - http2: add diagnostics channel 'http2.client.stream.close' (Darshan Sen) #​58329
• [86610389d8] - http2: add diagnostics channel 'http2.client.stream.finish' (Darshan Sen) #​58317
• [2d3071671e] - http2: add diagnostics channel 'http2.client.stream.error' (Darshan Sen) #​58306
• [6c3e426d6f] - http2: add diagnostics channel 'http2.client.stream.start' (Darshan Sen) #​58292
• [b99d131a61] - http2: add diagnostics channel 'http2.client.stream.created' (Darshan Sen) #​58246
• [b0644330f5] - http2: give name to promisified connect() (LiviaMedeiros) #​57916
• [4092d3611a] - inspector: add mimeType and charset support to Network.Response (Shima Ryuhei) #​58192
• [d7d8599f7c] - inspector: add protocol method Network.dataReceived (Chengzhong Wu) #​58001
• [aabafbc28f] - inspector: support for worker inspection in chrome devtools (Shima Ryuhei) #​56759
• [20d978de9a] - lib: make ERM functions into wrappers returning undefined (Livia Medeiros) #​58400
• [13567eac5f] - (SEMVER-MINOR) lib: graduate error codes that have been around for years (James M Snell) #​58541
• [342b5a0d7a] - lib: remove no-mixed-operators eslint rule (Ruben Bridgewater) #​58375
• [af7baef75a] - lib: fix sourcemaps with ts module mocking (Marco Ippolito) #​58193
• [8f73f42d4e] - meta: bump github/codeql-action from 3.28.16 to 3.28.18 (dependabot[bot]) #​58552
• [5dfedbeb86] - meta: bump codecov/codecov-action from 5.4.2 to 5.4.3 (dependabot[bot]) #​58551
• [53c50f66f5] - meta: bump step-security/harden-runner from 2.11.0 to 2.12.0 (dependabot[bot]) #​58109
• [a1a7024831] - meta: bump ossf/scorecard-action from 2.4.1 to 2.4.2 (dependabot[bot]) #​58550
• [a379988ef6] - meta: bump rtCamp/action-slack-notify from 2.3.2 to 2.3.3 (dependabot[bot]) #​58108
• [f6a46c87f2] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #​58456
• [98b6aa0dcd] - meta: bump github/codeql-action from 3.28.11 to 3.28.16 (dependabot[bot]) #​58112
• [5202b262e3] - meta: bump codecov/codecov-action from 5.4.0 to 5.4.2 (dependabot[bot]) #​58110
• [d97616ac6e] - meta: bump actions/download-artifact from 4.2.1 to 4.3.0 (dependabot[bot]) #​58106
• [f4065074cf] - meta: ignore mailmap changes in linux ci (Jonas Badalic) #​58356
• [e6d1224e54] - meta: bump actions/setup-node from 4.3.0 to 4.4.0 (dependabot[bot]) #​58111
• [26da160ab2] - meta: bump actions/setup-python from 5.5.0 to 5.6.0 (dependabot[bot]) #​58107
• [4cc4195493] - module: handle instantiated async module jobs in require(esm) (Joyee Cheung) #​58067
• [72fac71b92] - module: clarify cjs global-like error on ModuleJobSync (Carlos Espa) #​56491
• [fecd841c93] - net: always publish to 'net.client.socket' diagnostics channel (Darshan Sen) #​58349
• [25ee328d2b] - path: improve path.resolve() performance when used as process.cwd() (Ruben Bridgewater) #​58362
• [6fd1b23260] - permission: remove useless conditional (Juan José) #​58514
• [5b2cca51a3] - report: use uv_getrusage_thread in report (theanarkh) #​58405
• [63ec23e84b] - sqlite: add build option to build without sqlite (Michael Dawson) #​58122
• [9d8677bff5] - sqlite: handle thrown errors in result callback (Colin Ihrig) #​58426
• [3490c75760] - sqlite: set name and length on sqlite.backup() (Livia Medeiros) #​58251
• [50bdd94e0b] - src: update std::vector<v8::Local<T>> to use v8::LocalVector<T> (Aditi) #​58500
• [7de58417cc] - src: env_vars caching and local variable scope optimization (Mert Can Altin) #​57624
• [6d99ec33a4] - src: fix FIPS init error handling (Tobias Nießen) #​58379
• [4c23a9575e] - src: fix possible dereference of null pointer (Eusgor) #​58459
• [eb143e902b] - src: fix -Wreturn-stack-address error (Shelley Vohr) #​58439
• [31058b8785] - src: reorganize ContextifyFunction methods (Chengzhong Wu) #​58434
• [7521077299] - src: improve CompileFunctionAndCacheResult error handling (Chengzhong Wu) #​58434
• [0c9efccb12] - src: fix build when using shared simdutf (Antoine du Hamel) #​58407
• [aa00f5946f] - src: add a variant of ToV8Value() for primitive arrays (Aditi) #​57576
• [29a11506fc] - src: remove unused checkMessagePort internal binding (Dario Piotrowicz) #​58267
• [0ce3feed5b] - src: remove unused shouldRetryAsESM internal binding (Dario Piotrowicz) #​58265
• [517219613d] -

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.