Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 13 updates #407

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): bump the minor-and-patch group across 1 directory with 13 updates #407

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 16, 2025 •
edited
Loading

Bumps the minor-and-patch group with 13 updates in the / directory:

Package From To
jsonwebtoken 9.0.2 9.0.3
lodash-es 4.17.21 4.17.22
zod 4.1.13 4.2.1
@biomejs/biome 2.3.8 2.3.9
@commitlint/cli 20.1.0 20.2.0
@commitlint/config-conventional 20.0.0 20.2.0
@typescript-eslint/eslint-plugin 8.48.1 8.50.0
@typescript-eslint/parser 8.48.1 8.50.0
dependency-cruiser 17.3.2 17.3.4
eslint 9.39.1 9.39.2
eslint-plugin-jsdoc 61.4.1 61.5.0
pnpm 10.24.0 10.26.0
prettier 3.7.3 3.7.4

Updates jsonwebtoken from 9.0.2 to 9.0.3

Changelog

Sourced from jsonwebtoken's changelog.

9.0.3 - 2025-12-04

  • updates jws version to 4.0.1.
Commits

Updates lodash-es from 4.17.21 to 4.17.22

Commits

Updates zod from 4.1.13 to 4.2.1

Release notes

Sourced from zod's releases.

v4.2.1

Commits:

  • 5b5b129315fbc94a3b0d6244185eaeefcbe438d1 4.2.1

v4.2.0

Features

Implement Standard JSON Schema

standard-schema/standard-schema#134

Implement z.fromJSONSchema()

const jsonSchema = {
  type: "object",
  properties: {
    name: { type: "string" },
    age: { type: "number" }
  },
  required: ["name"]
};
const schema = z.fromJSONSchema(jsonSchema);

Implement z.xor()

const schema = z.xor(
  z.object({ type: "user", name: z.string() }),
  z.object({ type: "admin", role: z.string() })
);
// Exactly one of the schemas must match

Implement z.looseRecord()

const schema = z.looseRecord(z.string(), z.number());
// Allows additional properties beyond those defined

Commits:

  • af49c084f66339110d00e37ff71dc7b3b9f2b7ef Update docs for JSON Schema conversion of z.undefined() (#5504)
  • 767f320318986e422f524b939f1a7174544fda2e Add .toJSONSchema() method (#5477)
  • e17dcb63573397063e87d7c7fe10a5a78968181a Add z.fromJSONSchema(), z.looseRecord(), z.xor() (#5534)
Commits

Updates @biomejs/biome from 2.3.8 to 2.3.9

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.3.9

2.3.9

Patch Changes

  • #8232 84c9e08 Thanks @​ruidosujeira! - Added the nursery rule noScriptUrl.

    This rule disallows the use of javascript: URLs, which are considered a form of eval and can pose security risks such as XSS vulnerabilities.

    <a href="javascript:alert('XSS')">Click me</a>

  • #8341 343dc4d Thanks @​arendjr! - Added the nursery rule useAwaitThenable, which enforces that await is only used on Promise values.

    Invalid

    await "value";
const createValue = () => "value";
await createValue();

    Caution

    This is a first iteration of the rule, and does not yet detect generic "thenable" values.

  • #8034 e7e0f6c Thanks @​Netail! - Added the nursery rule useRegexpExec. Enforce RegExp#exec over String#match if no global flag is provided.

  • #8137 d407efb Thanks @​denbezrukov! - Reduced the internal memory used by the Biome formatter.

  • #8281 30b046f Thanks @​tylersayshi! - Added the rule useRequiredScripts, which enforces presence of configurable entries in the scripts section of package.json files.

  • #8290 d74c8bd Thanks @​dyc3! - The HTML formatter has been updated to match Prettier 3.7's behavior for handling <iframe>'s allow attribute.

    - <iframe allow="layout-animations 'none'; unoptimized-images 'none'; oversized-images 'none'; sync-script 'none'; sync-xhr 'none'; unsized-media 'none';"></iframe>
+ <iframe
+ 	allow="
+ 		layout-animations 'none';
+ 		unoptimized-images 'none';
+ 		oversized-images 'none';
+ 		sync-script 'none';
+ 		sync-xhr 'none';
+ 		unsized-media 'none';
+ 	"
+ ></iframe>

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.3.9

Patch Changes

  • #8232 84c9e08 Thanks @​ruidosujeira! - Added the nursery rule noScriptUrl.

    This rule disallows the use of javascript: URLs, which are considered a form of eval and can pose security risks such as XSS vulnerabilities.

    <a href="javascript:alert('XSS')">Click me</a>

  • #8341 343dc4d Thanks @​arendjr! - Added the nursery rule useAwaitThenable, which enforces that await is only used on Promise values.

    Invalid

    await "value";
const createValue = () => "value";
await createValue();

    Caution

    This is a first iteration of the rule, and does not yet detect generic "thenable" values.

  • #8034 e7e0f6c Thanks @​Netail! - Added the nursery rule useRegexpExec. Enforce RegExp#exec over String#match if no global flag is provided.

  • #8137 d407efb Thanks @​denbezrukov! - Reduced the internal memory used by the Biome formatter.

  • #8281 30b046f Thanks @​tylersayshi! - Added the rule useRequiredScripts, which enforces presence of configurable entries in the scripts section of package.json files.

  • #8290 d74c8bd Thanks @​dyc3! - The HTML formatter has been updated to match Prettier 3.7's behavior for handling <iframe>'s allow attribute.

    - <iframe allow="layout-animations 'none'; unoptimized-images 'none'; oversized-images 'none'; sync-script 'none'; sync-xhr 'none'; unsized-media 'none';"></iframe>
+ <iframe
+ 	allow="
+ 		layout-animations 'none';
+ 		unoptimized-images 'none';
+ 		oversized-images 'none';
+ 		sync-script 'none';
+ 		sync-xhr 'none';
+ 		unsized-media 'none';
+ 	"
+ ></iframe>

  • #8302 d1d5014 Thanks @​mlafeldt! - Fixed #8109: return statements in Astro frontmatter no longer trigger "Illegal return statement" errors when using experimentalFullSupportEnabled.

... (truncated)

Commits

Updates @commitlint/cli from 20.1.0 to 20.2.0

Release notes

Sourced from @​commitlint/cli's releases.

v20.2.0

20.2.0 (2025-12-05)

Features

Chore, docs, etc

New Contributors

Full Changelog: conventional-changelog/commitlint@v20.1.0...v20.2.0

Changelog

Sourced from @​commitlint/cli's changelog.

20.2.0 (2025-12-05)

Note: Version bump only for package @​commitlint/cli

Commits

Updates @commitlint/config-conventional from 20.0.0 to 20.2.0

Release notes

Sourced from @​commitlint/config-conventional's releases.

v20.2.0

20.2.0 (2025-12-05)

Features

Chore, docs, etc

New Contributors

Full Changelog: conventional-changelog/commitlint@v20.1.0...v20.2.0

v20.1.0

20.1.0 (2025-09-30)

Features

Bug Fixes

New Contributors

Full Changelog: conventional-changelog/commitlint@v20.0.0...v20.1.0

Changelog

Sourced from @​commitlint/config-conventional's changelog.

20.2.0 (2025-12-05)

Note: Version bump only for package @​commitlint/config-conventional

Commits

Updates @typescript-eslint/eslint-plugin from 8.48.1 to 8.50.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

v8.49.0

8.49.0 (2025-12-08)

🚀 Features

  • eslint-plugin: use Intl.Segmenter instead of graphemer (#11804)

🩹 Fixes

  • deps: update dependency prettier to v3.7.2 (#11820)

❤️ Thank You

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

8.49.0 (2025-12-08)

🚀 Features

  • eslint-plugin: use Intl.Segmenter instead of graphemer (#11804)

🩹 Fixes

  • deps: update dependency prettier to v3.7.2 (#11820)

❤️ Thank You

You can read about our versioning strategy and releases on our website.

Commits
  • c62e858 chore(release): publish 8.50.0
  • 1301f79 feat(eslint-plugin): [no-useless-default-assignment] add rule (#11720)
  • 864595a chore(release): publish 8.49.0
  • 32b7e89 chore(deps): update dependency @​vitest/eslint-plugin to v1.5.1 (#11816)
  • 56149a2 feat(eslint-plugin): use Intl.Segmenter instead of graphemer (#11804)
  • 34a49a4 fix(deps): update dependency prettier to v3.7.2 (#11820)
  • d2d7ace docs: fixes bad link to jest docs in unbound-method rule page (#11823)
  • See full diff in compare view

Updates @typescript-eslint/parser from 8.48.1 to 8.50.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

  • eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

  • Josh Goldberg ✨
  • Ulrich Stark

You can read about our versioning strategy and releases on our website.

v8.49.0

8.49.0 (2025-12-08)

🚀 Features

  • eslint-plugin: use Intl.Segmenter instead of graphemer (#11804)

🩹 Fixes

  • deps: update dependency prettier to v3.7.2 (#11820)

❤️ Thank You

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.50.0 (2025-12-15)

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

8.49.0 (2025-12-08)

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

Updates dependency-cruiser from 17.3.2 to 17.3.4

Release notes

Sourced from dependency-cruiser's releases.

v17.3.4

🐛 fixes

  • 2415f0c8 fix(extract): ensures we work again when typescript isn't installed (#1033)

👷 maintenance

  • d75e4d3b fix: small consistency & performance improvements
  • 66b25b65 chore(depsDev): bump actions/cache from 4 to 5 in the all-the-things group (#1032)

v17.3.3

🚀 refactorings to make dependency-cruiser run a little more efficient

  • 749e6ca8/ 85890667 perf(main|schema|tools): pre-compiles json schemas at build time - removes ajv as a runtime dependency (#1029) relevant for everyone; the validation step now takes 10x less time and we could drop ajv as a runtime dependency, which makes for a faster install as well as a reduction in dependency management.
  • be411750/ 9ea64053 perf(derive/reachable): simplifies & cleans up the algorithm (#1030/ #1031) I have the feeling I'm not done there yet, but this already makes the algo run 1.3 - 1.5x faster, so if something with reachables in your rule set you might notice an improvement.
  • 9ea64053 (#1031) also caches regex compilations throughout dependency-cruiser making the validation 1.5x - 2.5x faster (it already didn't take that much time, but every 10ms counts).
  • c558d426 perf(extract/typescript): adds various performance optimizations (#1026) relevant if you use dependency-cruiser on typescript sources; should make running it a bit faster
  • 2bab7b4e refactor(extract|graph-utl): replaces fixed arrays with sets (#1027)
  • 3dbdc5cc refactor(extract|graph-utl): replaces two leftover forEach'es with for .. of loops Both theoretically more efficient on processor & memory - couldn't measure improvements on my 'practice' repos, though. The resulting code is more readable though, so kept it in nonetheless.

👷 maintenance

  • 6293a6d0 build(npm): updates external dependencies
  • d7f08244 refactor(main/options): uses more correct .test a.o.t. .match for checking collapse pattern
  • 7fa5523d refactor(report/anon): simplifies wordlist sanitization function
  • da7de5df chore(rule-set): adds logging statements to sub steps of the rule set validation

🧹 chores

  • e875b880 chore: uses tabs in stead of spaces in distributed npm package
  • 1a9f2f94 chore: fixes some lint issues
  • 34ca1a1c chore(ci): run on node 20 & 25 instead of on node 20 & 24
  • edc4a7d7 chore(npm): updates external devDependencies
  • cf87e057 doc: revises comments

v17.3.3-beta-4

new in v17.3.3-beta-4 a.c.t. beta-3:

  • 1a9f2f94 chore: fixes some lint issues
  • 9ea64053 perf: refactors reachable algorithm's 'isModuleInRuleFrom' & caches regex compilations (#1031)

new in v17.3.3-beta-3 a.c.t. beta-2:

  • be411750 perf(derive/reachable): simplifies and cleans up the algorithm (#1030)
  • d7f08244 refactor(main/options): uses more correct .test a.o.t. .match for checking collapse pattern
  • 7fa5523d refactor(report/anon): simplifies wordlist sanitization function

also in v17.3.3-beta-2:

... (truncated)

Commits
  • 2836fc0 17.3.4
  • d75e4d3 fix: small consistency & performance improvments
  • 2415f0c fix(extract): ensures we work again when typescript isn't installed (#1033)
  • 66b25b6 ci(deps): bump actions/cache from 4 to 5 in the all-the-things group (#1032)
  • a84ffdd 17.3.3
  • 6293a6d build(npm): updates external dependencies
  • 1a9f2f9 chore: fixes some lint issues
  • 9ea6405 perf: refactors reachable algorithm's 'isModuleInRuleFrom' & caches regex com...
  • be41175 perf(derive/reachable): simplifies and cleans up the algorithm (#1030)
  • d7f0824 refactor(main/options): uses more correct .test a.o.t. .match for checking co...
  • Additional commits viewable in compare view

Updates eslint from 9.39.1 to 9.39.2

Release notes

Sourced from eslint's releases.

v9.39.2

Bug Fixes

  • 5705833 fix: warn when eslint-env configuration comments are found (#20381) (sethamus)

Build Related

  • 506f154 build: add .scss files entry to knip (#20391) (Milos Djermanovic)

Chores

  • 7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#20394) (Francesco Trotta)
  • c43ce24 chore: package.json update for @​eslint/js release (Jenkins)
  • 4c9858e ci: add v9.x-dev branch (#20382) (Milos Djermanovic)
Commits

Updates eslint-plugin-jsdoc from 61.4.1 to 61.5.0

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v61.5.0

61.5.0 (2025-12-07)

Features

  • check-tag-names, require-template, check-template-names: make typeParam a non-preferred alias for template (3cd7cbd)

v61.4.2

61.4.2 (2025-12-06)

Bug Fixes

  • require-rejects: reflect proper tag name in error message (44b2631)
Commits
  • 3cd7cbd feat(check-tag-names, require-template, check-template-names): make `ty...
  • 44b2631 fix(require-rejects): reflect proper tag name in error message
  • See full diff in compare view

Updates pnpm from 10.24.0 to 10.26.0

Release notes

Sourced from pnpm's releases.

pnpm 10.26

Minor Changes

  • Semi-breaking. Block git-hosted dependencies from running prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.

  • Semi-breaking. Compute integrity hash for HTTP tarball dependencies when fetching, storing it in the lockfile to prevent servers from serving altered content on subsequent installs #10287.

  • Added a new setting blockExoticSubdeps that prevents the resolution of exotic protocols in transitive dependencies.

    When set to true, direct dependencies (those listed in your root package.json) may still use exotic sources, but all transitive dependencies must be resolved from a trusted source. Trusted sources include the configured registry, local file paths, workspace links, trusted GitHub repositories (node, bun, deno), and custom resolvers.

    This helps to secure the dependency supply chain. Packages from trusted sources are considered safer, as they are typically subject to more reliable verification and scanning for malware and vulnerabilities.

    Exotic sources are dependency locations that bypass the usual trusted resolution process. These protocols are specifically targeted and blocked: Git repositories (git+ssh://...) and direct URL links to tarballs (https://.../package.tgz).

    Related PR: #10265.

  • Added support for allowBuilds, which is a new field that can be used instead of onlyBuiltDependencies and ignoredBuiltDependencies. The new allowBuilds field in your pnpm-workspace.yaml uses a map of package matchers to explicitly allow (true) or disallow (false) script execution. This allows for a single, easy-to-manage source of truth for your build permissions.

    Example Usage. To explicitly allow all versions of esbuild to run scripts and prevent core-js from running them:

    allowBuilds:
  esbuild: true
  core-js: false

    The example above achieves the same result as the previous configuration:

    onlyBuiltDependencies:
  - esbuild
ignoredBuiltDependencies:
  - core-js

    Related PR: #10311

  • Added support for --dry-run to the pack command #10301.

Patch Changes

  • Show deprecation in table/list formats when latest version is deprecated #8658.
  • Remove the injectWorkspacePackages setting from the lockfile on the deploy command #10294.
  • Normalize the tarball URLs before saving them to the lockfile. URLs should not contain default ports, like :80 for http and :443 for https #10273.
  • When a dependency is installed via a direct URL that redirects to another URL and is immutable, the original URL is normalized and saved to package.json #10197.

Platinum Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.26.0

Minor Changes

  • Semi-breaking. Block git-hosted dependencies from running prepare scripts unless explicitly allowed in onlyBuiltDependencies #10288.

  • Semi-breaking. Compute integrity hash for HTTP tarball dependencies when fetching, storing it in the lockfile to prevent servers from serving altered content on subsequent installs #10287.

  • Added a new setting blockExoticSubdeps that prevents the resolution of exotic protocols in transitive dependencies.

    When set to true, direct dependencies (those listed in your root package.json) may still use exotic sources, but all transitive dependencies must be resolved from a trusted source. Trusted sources include the configured registry, local file paths, workspace links, trusted GitHub repositories (node, bun, deno), and custom resolvers.

    This helps to secure the dependency supply chain. Packages from trusted sources are considered safer, as they are typically subject to more reliable verification and scanning for malware and vulnerabilities.

    Exotic sources are dependency locations that bypass the usual trusted resolution process. These protocols are specifically targeted and blocked: Git repositories (git+ssh://...) and direct URL links to tarballs (https://.../package.tgz).

    Related PR: #10265.

  • Added support for allowBuilds, which is a new field that can be used instead of onlyBuiltDependencies and ignoredBuiltDependencies. The new allowBuilds field in your pnpm-workspace.yaml uses a map of package matchers to explicitly allow (true) or disallow (false) script execution. This allows for a single, easy-to-manage source of truth for your build permissions.

    Example Usage. To explicitly allow all versions of esbuild to run scripts and prevent core-js from running them:

    allowBuilds:
  esbuild: true
  core-js: false

    The example above achieves the same result as the previous configuration:

    onlyBuiltDependencies:
  - esbuild
ignoredBuiltDependencies:
  - core-js

    Related PR: #10311

  • Added support for --dry-run to the pack command #10301.

Patch Changes

  • Show deprecation in table/list formats when latest version is deprecated #8658.
  • Remove the injectWorkspacePackages setting from the lockfile on the deploy command #10294.
  • Normalize the tarball URLs before saving them to the lockfile. URLs should not contain default ports, like :80 for http and :443 for https #10273.
  • When a dependency is installed via a direct URL that redirects to another URL and is immutable, the original URL is normalized and saved to package.json #10197.

10.25.0

Minor Changes

... (truncated)

Commits

Updates prettier from 3.7.3 to 3.7.4

Release notes

Sourced from prettier's releases.

3.7.4

What's Changed

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.7.4

diff

LWC: Avoid quote around interpolations (#18383 by @​kovsu)

<!-- Input -->
<div foo={bar}>   </div>
<!-- Prettier 3.7.3 (--embedded-language-formatting off) -->
<div foo="{bar}"></div>
<!-- Prettier 3.7.4 (--embedded-language-formatting off) -->
<div foo={bar}></div>

TypeScript: Fix comment inside union type gets duplicated (#18393 by @​fisker)

// Input
type Foo = (/** comment */ a | b) | c;
// Prettier 3.7.3
type Foo = /** comment / (/* comment */ a | b) | c;
// Prettier 3.7.4
type Foo = /** comment */ (a | b) | c;

TypeScript: Fix unstable comment print in union type comments (#18395 by @​fisker)

// Input
type X = (A | B) & (
  // comment
  A | B
);
// Prettier 3.7.3 (first format)
type X = (A | B) &
(// comment
A | B);
// Prettier 3.7.3 (second format)
type X = (
| A
</tr></table>

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 1…
246f890 
…3 updates

Bumps the minor-and-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) | `9.0.2` | `9.0.3` |
| [lodash-es](https://github.com/lodash/lodash) | `4.17.21` | `4.17.22` |
| [zod](https://github.com/colinhacks/zod) | `4.1.13` | `4.2.1` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.3.8` | `2.3.9` |
| [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `20.1.0` | `20.2.0` |
| [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `20.0.0` | `20.2.0` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.48.1` | `8.50.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.48.1` | `8.50.0` |
| [dependency-cruiser](https://github.com/sverweij/dependency-cruiser) | `17.3.2` | `17.3.4` |
| [eslint](https://github.com/eslint/eslint) | `9.39.1` | `9.39.2` |
| [eslint-plugin-jsdoc](https://github.com/gajus/eslint-plugin-jsdoc) | `61.4.1` | `61.5.0` |
| [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) | `10.24.0` | `10.26.0` |
| [prettier](https://github.com/prettier/prettier) | `3.7.3` | `3.7.4` |



Updates `jsonwebtoken` from 9.0.2 to 9.0.3
- [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jsonwebtoken@v9.0.2...v9.0.3)

Updates `lodash-es` from 4.17.21 to 4.17.22
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/commits)

Updates `zod` from 4.1.13 to 4.2.1
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.1.13...v4.2.1)

Updates `@biomejs/biome` from 2.3.8 to 2.3.9
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.3.9/packages/@biomejs/biome)

Updates `@commitlint/cli` from 20.1.0 to 20.2.0
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.2.0/@commitlint/cli)

Updates `@commitlint/config-conventional` from 20.0.0 to 20.2.0
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v20.2.0/@commitlint/config-conventional)

Updates `@typescript-eslint/eslint-plugin` from 8.48.1 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.48.1 to 8.50.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/parser)

Updates `dependency-cruiser` from 17.3.2 to 17.3.4
- [Release notes](https://github.com/sverweij/dependency-cruiser/releases)
- [Changelog](https://github.com/sverweij/dependency-cruiser/blob/main/CHANGELOG.md)
- [Commits](sverweij/dependency-cruiser@v17.3.2...v17.3.4)

Updates `eslint` from 9.39.1 to 9.39.2
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.1...v9.39.2)

Updates `eslint-plugin-jsdoc` from 61.4.1 to 61.5.0
- [Release notes](https://github.com/gajus/eslint-plugin-jsdoc/releases)
- [Commits](gajus/eslint-plugin-jsdoc@v61.4.1...v61.5.0)

Updates `pnpm` from 10.24.0 to 10.26.0
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.26.0/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.26.0/pnpm)

Updates `prettier` from 3.7.3 to 3.7.4
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.7.3...3.7.4)

---
updated-dependencies:
- dependency-name: jsonwebtoken
  dependency-version: 9.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lodash-es
  dependency-version: 4.17.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: zod
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@biomejs/biome"
  dependency-version: 2.3.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@commitlint/cli"
  dependency-version: 20.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 20.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: dependency-cruiser
  dependency-version: 17.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 9.39.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: eslint-plugin-jsdoc
  dependency-version: 61.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pnpm
  dependency-version: 10.26.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.7.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added automated Automated pull requests (e.g., Dependabot) dependencies Pull requests that update a dependency file labels Dec 16, 2025
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 9, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Jan 9, 2026
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/minor-and-patch-1051516568 branch January 9, 2026 22:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@mherod mherod

Labels

automated Automated pull requests (e.g., Dependabot) dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mherod