chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@commitlint/cli (source)	20.3.0 → 20.3.1			devDependencies	patch
@commitlint/config-conventional (source)	20.3.0 → 20.3.1			devDependencies	patch
@types/express-serve-static-core (source)	5.1.0 → 5.1.1			devDependencies	patch
@types/node (source)	24.10.4 → 24.10.7			devDependencies	patch	24.10.9 (+1)
@typescript-eslint/eslint-plugin (source)	8.51.0 → 8.52.0			devDependencies	minor	8.53.0
@typescript-eslint/parser (source)	8.51.0 → 8.52.0			devDependencies	minor	8.53.0
node (source)	24.12.0 → 24.13.0			volta	minor
pnpm (source)	10.27.0 → 10.28.0			packageManager	minor
pnpm (source)	10.27.0 → 10.28.0			volta	minor
supertest	7.1.4 → 7.2.2			devDependencies	minor

---

Release Notes

conventional-changelog/commitlint (@​commitlint/cli)

v20.3.1

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v20.3.1

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.52.0

Compare Source

🚀 Features

• eslint-plugin-internal: [no-multiple-lines-of-errors] add rule (#​11899)

🩹 Fixes

• eslint-plugin: [no-base-to-string] detect @​@​toPrimitive and valueOf (#​11901)
• eslint-plugin: [no-useless-default-assignment] handle conditional initializer (#​11908)

❤️ Thank You

• Josh Goldberg ✨
• Ulrich Stark

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.52.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

nodejs/node (node)

v24.13.0: 2026-01-13, Version 24.13.0 'Krypton' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

lib:

• (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
• (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
  lib,permission:
• (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
  src:
• (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
  src,lib:
• (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
  tls:
• (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

Commits

• [2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #​60997
• [3e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #​61283
• [4ba536a5a6] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
• [89adaa21fd] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
• [7302b4dae1] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
• [ac030753c4] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
• [20075692fe] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
• [20591b0618] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

pnpm/pnpm (pnpm)

v10.28.0

Compare Source

ladjs/supertest (supertest)

v7.2.2

Compare Source

• fix: replace 'should' dependency with native assertions in cookies module 1954bcf

---

v7.2.1

Compare Source

• fix: correct case-sensitive require path for assertion module d4f04fb

---

v7.2.0

Compare Source

• fix: fixed package lock c4b08a6
• fix: drop v14 and v16 from tests d084ce2
• Merge pull request #​872 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.14.2 61f3ddf
• Merge pull request #​873 from forwardemail/dependabot/npm_and_yarn/multi-6d05d0e569 bd2fe45
• chore(deps): bump qs, body-parser and express 07bf4fb
• Merge pull request #​866 from SchroederSteffen/use-lowercase-header-name 0666797
• Merge pull request #​868 from dmurvihill/cookie-assertions 953eca7
• chore(deps-dev): bump js-yaml from 3.14.1 to 3.14.2 81ab94c
• Merge pull request #​870 from kudlav/patch-1 14d905d
• Update links to documentation in README f508b30
• feat(cookies): add cookie assertions 4f89680
• chore(readme): use lower-case header name 1e642b0

---

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.