Skip to content

chore(deps): bump the dev-dependencies group with 6 updates - #1910

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-cb808c8c63
Closed

chore(deps): bump the dev-dependencies group with 6 updates#1910
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-cb808c8c63

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 6 updates:

Package From To
@eslint/js 9.39.5 10.0.1
@mdx-js/mdx 3.1.0 3.1.1
@swc/core 1.16.18 1.16.20
@swc/core-linux-x64-gnu 1.16.18 1.16.20
eslint 9.39.5 10.13.0
jscpd 5.4.1 5.4.2

Updates @eslint/js from 9.39.5 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

  • c87d5bd fix: update eslint (#20531) (renovate[bot])
  • d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
  • 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
  • 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

  • 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
  • 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
  • b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

  • e5c281f chore: updates for v9.39.3 release (Jenkins)
  • 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
  • 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
  • 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
  • da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
  • 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
  • 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

  • f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
  • a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
  • c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
  • fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
  • 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
  • 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
  • ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
  • 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
  • c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
  • 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
  • a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
  • a89059d feat!: Program range span entire source text (#20133) (Pixel998)
  • 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
  • f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
  • aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
  • f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
  • 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
  • 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
  • 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
  • 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
  • f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
  • c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

  • bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
  • 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
  • 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits
  • 84fb885 chore: package.json update for @​eslint/js release
  • 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
  • f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
  • b4b3127 chore: package.json update for @​eslint/js release
  • 0b14059 chore: package.json update for @​eslint/js release
  • fa31a60 feat!: add name to configs (#20015)
  • 1e2cad5 chore: package.json update for @​eslint/js release
  • 454a292 feat!: update eslint:recommended configuration (#20210)
  • c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
  • See full diff in compare view

Updates @mdx-js/mdx from 3.1.0 to 3.1.1

Release notes

Sourced from @​mdx-js/mdx's releases.

3.1.1

Fix

Types

  • 933ab444 @mdx-js/mdx: add attributes to export/import declarations

Docs

Full Changelog: mdx-js/mdx@3.1.0...3.1.1

Commits

Updates @swc/core from 1.16.18 to 1.16.20

Changelog

Sourced from @​swc/core's changelog.

[1.16.20] - 2026-10-22

Bug Fixes

  • (es/codegen) Disambiguate TSX generic arrows (#12505) (2c9d198)

  • (es/codegen) Preserve non-null token boundaries (#12504) (410ae3a)

  • (es/codegen) Parenthesize typed arrow parameters (#12503) (aa1ffd6)

  • (es/codegen) Preserve TypeScript token boundaries (#12523) (9f36ae0)

  • (es/codegen) Emit space after div if rhs starts with a regex (#12544) (dddf716)

  • (es/codegen) Preserve optional call type arguments (#12549) (f7bef4d)

  • (es/compat) Scope private access modes to each member (#12526) (c0e3fa1)

  • (es/fixer) Preserve TypeScript expression grouping (#12518) (b9d3f8f)

  • (es/fixer) Preserve TypeScript operand grouping (#12539) (7c4a214)

  • (es/fixer) Avoid panicking on recovered parenthesized assignment targets (#12551) (ec34371)

  • (es/fixer) Preserve optional chain boundaries (#12550) (01d5630)

  • (es/fixer) Wrap function declarations in sloppy-mode loop bodies (#12567) (76ff943)

  • (es/minifier) Bound literal expressions copied by the sequential inliner (#12521) (60c700f)

  • (es/minifier) Preserve rest array identity when its reference runs more than once (#12546) (4768dbe)

  • (es/minifier) Keep trimLeft and trimRight on string literals (#12574) (663ffb0)

... (truncated)

Commits
  • 566c595 chore: Publish 1.16.20 with swc_core v82.2.0
  • 196ac57 chore: Publish 1.16.20-nightly-20261022.1 with swc_core v82.2.0
  • 6d71046 chore: Publish 1.16.19-nightly-20261015.1 with swc_core v82.1.1
  • See full diff in compare view

Updates @swc/core-linux-x64-gnu from 1.16.18 to 1.16.20

Changelog

Sourced from @​swc/core-linux-x64-gnu's changelog.

[1.16.20] - 2026-10-22

Bug Fixes

  • (es/codegen) Disambiguate TSX generic arrows (#12505) (2c9d198)

  • (es/codegen) Preserve non-null token boundaries (#12504) (410ae3a)

  • (es/codegen) Parenthesize typed arrow parameters (#12503) (aa1ffd6)

  • (es/codegen) Preserve TypeScript token boundaries (#12523) (9f36ae0)

  • (es/codegen) Emit space after div if rhs starts with a regex (#12544) (dddf716)

  • (es/codegen) Preserve optional call type arguments (#12549) (f7bef4d)

  • (es/compat) Scope private access modes to each member (#12526) (c0e3fa1)

  • (es/fixer) Preserve TypeScript expression grouping (#12518) (b9d3f8f)

  • (es/fixer) Preserve TypeScript operand grouping (#12539) (7c4a214)

  • (es/fixer) Avoid panicking on recovered parenthesized assignment targets (#12551) (ec34371)

  • (es/fixer) Preserve optional chain boundaries (#12550) (01d5630)

  • (es/fixer) Wrap function declarations in sloppy-mode loop bodies (#12567) (76ff943)

  • (es/minifier) Bound literal expressions copied by the sequential inliner (#12521) (60c700f)

  • (es/minifier) Preserve rest array identity when its reference runs more than once (#12546) (4768dbe)

  • (es/minifier) Keep trimLeft and trimRight on string literals (#12574) (663ffb0)

... (truncated)

Commits
  • 566c595 chore: Publish 1.16.20 with swc_core v82.2.0
  • 799713d chore: Update changelog
  • 196ac57 chore: Publish 1.16.20-nightly-20261022.1 with swc_core v82.2.0
  • 9c5b1df docs: Add CodSpeed sponsor logo to README (#12590)
  • ee2cd8a ci: require changesets for crate changes (#12583)
  • 1744d5f chore: Publish crates with swc_core v82.2.0
  • b5a52b9 fix(es/minifier): release utils API required by registry builds (#12582)
  • f5e8a35 chore: Publish crates with swc_core v82.1.2
  • 8f06994 fix(es/minifier): Preserve new async and generator (#12558)
  • fd0edaf fix(es/minifier): keep directive prologue when merging if returns (#12580)
  • Additional commits viewable in compare view

Updates eslint from 9.39.5 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

  • b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
  • 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
  • 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
  • b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
  • 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
  • e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

v10.12.0

Features

  • 4618052 feat: handle astral letters in new-cap (#21357) (sary)
  • 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
  • efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
  • 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
  • 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
  • b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
  • 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
  • 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

  • 67eb586 docs: Update README (GitHub Actions Bot)
  • 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
  • 8816c1d docs: Update README (GitHub Actions Bot)
  • 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

  • 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
  • bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
  • d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
  • 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
  • 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])

... (truncated)

Commits

Updates jscpd from 5.4.1 to 5.4.2

Release notes

Sourced from jscpd's releases.

Release v5.4.2

The post What's new in jscpd 5.4.2 shows the new features with commands and real output.

New Features

  • Boundaries keep the code of a module inside it. The new boundaries key of the config file lists rules. A rule names the code it protects (code: a folder, a file, a glob, or a method as path#name), where copies of it must not show up (notIn, or every file outside code when it is left out) and where they may after all (allow). Every clone run checks the rules, and a copy of protected code outside its boundary fails the run with exit code 1. Import linters miss such copies, because a copied function imports nothing.

    • jscpd looks for copies three ways, and a rule can set its own bars in thresholds. Token clones find copy-paste, the structure comparison of --similarity finds an edited copy, and the --semantic model finds the same logic written again, often in another language. disable turns kinds off by their --kind names. Without a downloaded model, jscpd prints a warning and checks the rules without the semantic search.
    • A mistake in a rule, such as an unknown key or a glob that doesn't compile, stops the run with an error that names the rule. A rule that checks nothing in a run, after a typo in a path or a method name for example, gets a warning.
    • The console, console-full, ai and json reporters show the violations, the json one under boundaries. Baselines and --changed don't apply to violations yet, and SARIF, the language server and the MCP server don't report them.
    • fixtures/boundaries-demo is a small shop whose web app copies the backend's pricing and loan code. (#1225, #1227)

  • --ignore-identifiers pairs a name with one name. Every name used to match every other name, so x = x + x * x was a clone of d = a + b * c, although its data flows another way. Now a name on one side has to stand for the same name on the other side every time, and two names can't stand for one, as in Baker's parameterized matching and NiCad's consistent renaming. On 24 projects in 11 languages, 6,942 of the 14,501 renamed clones that the old matching reported had no such mapping.

    • jscpd cuts a clone where a name starts to stand for two and still reports every part of --min-tokens tokens or more.
    • A name reached as a member, after . or ?., and after -> in C, C++, PHP and Perl, is another name than a local of the same text. A constructor that sets this.url = url still matches its copy that sets this.url = link (#1220).
    • --ignore-identifiers and --ignore-identifiers=consistent give the new matching, --ignore-identifiers=blind the old one. The config takes "ignoreIdentifiers": true, "consistent" or "blind", and the Action input takes consistent or blind. The value goes after = only, so --ignore-identifiers src/ still scans src/.
    • fixtures/type2-demo has the consistent and members examples. (#1217, #1218)

  • --similarity pairs a name with one name too. The fingerprint of a subtree now records how its names repeat, so x = x + x * x no longer scores 1.0 against d = a + b * c, and a renamed copy still does. Members, labels such as keyword arguments and object keys, and types each have names of their own, so self.url = url still matches self.url = link. A function's own name matches any name. Kotlin's true, false and null and Clojure's true, false and nil are literals now. On the same 24 projects, 15 of 23,530 pairs fell below 0.8, and runs take 2 to 9% longer. --ignore-identifiers=blind brings back the old scores and also turns on renamed token clones. fixtures/similarity-demo/names scores a renamed copy at 1.00 and a mirrored function at 0.74. (#1219)

  • --history tracks the health score, and a bare --history walks the last 30 commits. Every commit of the series gets the score that jscpd --health gives its tree. The console draws a health chart under the duplication chart and adds HEALTH and CHANGE columns, and every point of the JSON report has health. --health and --dashboard take --history now: the badge or the dashboard comes first, then the series, in the markdown and html reports too.

    • jscpd --history used to fail with "a value is required". Without a value the flag takes the config's history, or else the newest 30 commits of HEAD (--history-limit). --history-every N spaces them N commits apart, and the Action's history input takes true.
    • jscpd scans a commit the way it scans the working tree: --ignore and --pattern see its files at their working-tree paths, and the checkout runs none of the repository's hooks. A walk that stops at the edge of a shallow clone prints a warning that names the commit.
    • The last 30 commits of axios take about 5.4 seconds, against 4.9 without the health score. (#1199)

  • jscpd knows 73 more formats by extension, and files by name. 94 of 224 formats had no built-in extension, a gap that came from v4, so jscpd . skipped Dockerfiles, Makefiles, go.mod, Elixir and Nix files unless you mapped them. The new extensions come from GitHub Linguist, and a table of file names maps Dockerfile, Containerfile, Makefile, go.mod, CMakeLists.txt, Gemfile, Jenkinsfile and others. Existing formats got more suffixes, such as .zsh, .jsonc, .tfvars and .sbt. A Markdown fence such as ```dockerfile takes its format from the same table, and --formats-exts and --formats-names still win over every built-in mapping. FORMATS.md lists the file names too. (#1174, #1192)

Changes

  • jscpd . scans more files. On 22 repositories the new file associations picked up 1 to 5 more files each, mostly Dockerfiles, .editorconfig, .jsonc, Makefiles and go.mod, and jscpd scans the .rst files of Sphinx docs like Markdown. The duplication percentage can move, and a --threshold gate can fail. (#1192)

  • --ignore-identifiers reports fewer renamed clones, and some of them are shorter. A baseline that 5.4 made with --ignore-identifiers is a blind one. Keep --ignore-identifiers=blind with it or update the baseline, or --fail-on-new-clones reports the cut clones as new. (#1218)

  • --history walks first parents. A merged branch counts as its merge commit, so a range across merged branches gives fewer points than before. jscpd builds a series only when a reporter shows it (console, console-full, ai or json, and markdown or html with --health or --dashboard), so a badge-only --health job no longer walks the range. The ai lines read 37be780 2026-08-08 2/1/47.6 +47.6 health 72 -2 now, and a wrong health or dead-code option no longer fails a clone run. (#1199)

Bug Fixes

  • jscpd aborted on a Markdown page whose front matter ran into a code fence. A page that opens with a horizontal rule and later shows a Python stub had front matter from the rule down to the stub's ..., across the fence, and the scan panicked: jscpd exited with 134, and jscpd --mcp and jscpd --lsp died. A --- on the first line now opens front matter only when the next line isn't blank, as Pandoc reads it, and only a --- or ... line before the first code fence closes it. The frontmatter of an Astro component follows the same rule. A page of code fences that never close used to take quadratic time, 3.9 seconds for 100 KB, and takes 0.04 seconds now. (#1223, #1226)

  • A Razor view was read out of order. jscpd tokenized the HTML of a whole view and then the C# of its blocks, so a clone across that seam ended before it started: release builds printed ranges such as [48:48 - 5:35], and debug builds panicked. A view is now one stream in the order of its text. Two identical views count as duplicated from the first line to the last, and markup in an @if or @foreach block matches the same markup outside one. (#1221, #1222)

  • The MCP server's check_duplication never matched a Vue, Svelte or Astro snippet. It tokenized a snippet as one stream, while a scan splits a component into its blocks and a Markdown file into its prose and fences. A component snippet met only the components inside Markdown fences, by meaning it found nothing, and the fences of a Markdown snippet matched nothing either. The server now splits a snippet the way a scan splits a file of its format. Each match has format and lines, and the note names every block too short to match. #1228 also fixed how jscpd counts the duplicated lines of a clone whose two fragments swap places, so the statistics of a --cross-formats run can change a little. (#1224, #1228, #1229)

  • --history failed when git's log.showSignature was on. git printed the signature check of each signed commit before the commit, and jscpd took that line for a commit hash. jscpd now passes --no-show-signature and reads only lines that start with a commit hash. Reported with an exact reproduction by @​vitorcsbrito. (#1195, #1196)

  • --compare paired a function with every near-best lookalike. It took the rule of --semantic, where a group of near-equal functions all pair with each other, but in a port a function has one counterpart. A pair now stays only when it is the best match of one of its two functions, and a near tie goes to the partner in a file of the same name. On the analysis modules of Lucene and Lucene.NET the pairs went from 2,219 to 1,392, and the share of pairs between files of the same name from 46% to 73%. Analysis and numbers by @​MysterionRise. (#1162, #1194)

  • --semantic reported a page and the component it renders as a clone. It skips a pair when one function calls the other, but it didn't count a JSX element such as <EditUserForm /> as a call. It does now, and so does the call graph of --compare. Reported by @​Rosenblad, fixed by @​cristianchiriac. (#1210, #1211)

  • Reports named a clone in a Markdown block or a component like guide.md:markup. The VS Code extension opened that name as a file and failed. The JSON name, the language server's jscpd/clones and jscpd/semantic, the XML path and the xcode location now name the file, and the JSON keeps the block's language in format. The console, ai and HTML reports still name the block. (#1200)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the dev-dependencies group with 6 updates
d04091c 
Bumps the dev-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.5` | `10.0.1` |
| [@mdx-js/mdx](https://github.com/mdx-js/mdx/tree/HEAD/packages/mdx) | `3.1.0` | `3.1.1` |
| [@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core) | `1.16.18` | `1.16.20` |
| [@swc/core-linux-x64-gnu](https://github.com/swc-project/swc) | `1.16.18` | `1.16.20` |
| [eslint](https://github.com/eslint/eslint) | `9.39.5` | `10.13.0` |
| [jscpd](https://github.com/kucherenko/jscpd/tree/HEAD/rust/jscpd) | `5.4.1` | `5.4.2` |


Updates `@eslint/js` from 9.39.5 to 10.0.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js)

Updates `@mdx-js/mdx` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/mdx-js/mdx/releases)
- [Changelog](https://github.com/mdx-js/mdx/blob/main/changelog.md)
- [Commits](https://github.com/mdx-js/mdx/commits/3.1.1/packages/mdx)

Updates `@swc/core` from 1.16.18 to 1.16.20
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/swc-project/swc/commits/v1.16.20/packages/core)

Updates `@swc/core-linux-x64-gnu` from 1.16.18 to 1.16.20
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](swc-project/swc@v1.16.18...v1.16.20)

Updates `eslint` from 9.39.5 to 10.13.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.5...v10.13.0)

Updates `jscpd` from 5.4.1 to 5.4.2
- [Release notes](https://github.com/kucherenko/jscpd/releases)
- [Commits](https://github.com/kucherenko/jscpd/commits/v5.4.2/rust/jscpd)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 10.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: "@mdx-js/mdx"
  dependency-version: 3.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@swc/core"
  dependency-version: 1.16.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@swc/core-linux-x64-gnu"
  dependency-version: 1.16.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 10.13.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: jscpd
  dependency-version: 5.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 25, 2026
@netlify

netlify Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

❌ Deploy Preview for endusers failed. Why did it fail? →

Name Link
🔨 Latest commit d04091c
🔍 Latest deploy log https://app.netlify.com/projects/endusers/deploys/6ade59555d3c769a2c7b5b2b

@hivecommons-hive hivecommons-hive Bot mentioned this pull request Oct 25, 2026
Open
@hivecommons-hive

hivecommons-hive Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor
d04091c

ℹ️ Sentinel notice — informational; author is trusted (allow-listed bot), merge is not blocked

Hive flagged this PR (author @dependabot[bot], head d04091c6e915) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

  • sensitive_path — changes 2 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
    • package-lock.json
    • package.json

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

@hivecommons-hive

hivecommons-hive Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Root cause of the all-red checks: the group bumps eslint 9.39.5 → 10.13.0, but eslint-plugin-jsx-a11y@6.10.2 (latest release, last published 2024-10-26) declares peer eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9 — no eslint 10 support. npm install fails with ERESOLVE in every job, so Lint/Validate/e2e/mutation/Netlify all fail identically.

npm error While resolving: eslint-plugin-jsx-a11y@6.10.2
npm error Found: eslint@10.13.0
npm error Could not resolve dependency:
npm error peer eslint@"^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9" from eslint-plugin-jsx-a11y@6.10.2

This is PR-local (main is green). Until jsx-a11y ships an eslint-10-compatible release, the eslint and @eslint/js major bumps can't land. Recommend closing this group and adding a dependabot ignore for eslint/@eslint/js >=10; I'll open a PR for the ignore rule.

🐝 Hive Agent: scanner | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88

This was referenced Oct 25, 2026
Closed
Merged
@mrbobbytables

mrbobbytables commented Oct 25, 2026

Copy link
Copy Markdown
Member

Closing: this group is uninstallable while eslint-plugin-jsx-a11y peers eslint ^3–^9 (see #1915). #1916 holds the eslint/@eslint/js major line in dependabot.yml; Dependabot will re-open the dev-dependencies group without those two on the next run.

@dependabot @github

dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-cb808c8c63 branch October 25, 2026 20:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mrbobbytables