chore(deps-dev): bump the dependencies group with 11 updates by dependabot[bot] · Pull Request #573 · openfga/vscode-ext

dependabot · 2026-07-28T19:43:52Z

Bumps the dependencies group with 11 updates:

Package	From	To
@eslint/js	`9.39.4`	`10.0.1`
@types/node	`25.9.2`	`26.1.2`
@vscode/test-web	`0.0.80`	`0.0.81`
eslint-plugin-import-x	`4.16.2`	`4.17.1`
globals	`15.15.0`	`17.8.0`
ovsx	`1.0.0`	`1.0.2`
prettier	`3.8.4`	`3.9.6`
ts-loader	`9.6.0`	`9.6.2`
typescript-eslint	`8.61.0`	`8.65.0`
webpack	`5.107.2`	`5.109.2`
webpack-cli	`7.0.3`	`7.2.2`

Updates @eslint/js from 9.39.4 to 10.0.1

Release notes

Sourced from @eslint/js's releases.

v10.0.1

Bug Fixes

c87d5bd fix: update eslint (#20531) (renovate[bot])

d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)

04c2147 fix: update error message for unused suppressions (#20496) (fnx)

38b089c fix: update dependency @eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)

6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)

b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

e5c281f chore: updates for v9.39.3 release (Jenkins)

8c3832a chore: update @typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)

8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)

37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)

da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)

84fb885 chore: package.json update for @eslint/js release (Jenkins)

1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)

a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)

c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)

fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)

3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)

501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])

ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)

96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)

c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)

208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)

a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)

a89059d feat!: Program range span entire source text (#20133) (Pixel998)

39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)

f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)

aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)

f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)

4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)

523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)

454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)

4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)

f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)

c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)

290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)

43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

84fb885 chore: package.json update for @eslint/js release
1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
b4b3127 chore: package.json update for @eslint/js release
0b14059 chore: package.json update for @eslint/js release
fa31a60 feat!: add name to configs (#20015)
1e2cad5 chore: package.json update for @eslint/js release
454a292 feat!: update eslint:recommended configuration (#20210)
c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
See full diff in compare view

Updates @types/node from 25.9.2 to 26.1.2

Commits

See full diff in compare view

Updates @vscode/test-web from 0.0.80 to 0.0.81

Release notes

Sourced from @vscode/test-web's releases.

v0.0.81

Changes:

#216: use ts-loader 9.6.1

#215: use ts-loader 9.6.1

#214: use ts-loader 9.6.1

#213: prepare 0.0.81

#212: handle download errors

#211: Run npm audit fix; add serialize-javascript override in sample

#210: Bump js-yaml from 4.1.1 to 4.2.0 in /sample

#209: fix: bump js-yaml 4.1.1 → 4.2.0 to resolve moderate DoS vulnerability

#207: chore: upgrade brace-expansion dependency

#205: Bump fast-uri from 3.1.0 to 3.1.2 in /sample

#202: fix: run npm audit fix to resolve security vulnerabilities

#199: Bump path-to-regexp from 8.3.0 to 8.4.0

#198: Bump picomatch from 2.3.1 to 2.3.2 in /sample

#197: Bump flatted from 3.3.1 to 3.4.2

#196: Bump minimatch from 10.1.1 to 10.2.3 in /fs-provider

#194: Bump minimatch from 9.0.5 to 9.0.9 in /sample

This list of changes was auto generated.

Commits

a70d9be use ts-loader 9.6.1 (#216)
1cd066a use ts-loader 9.6.1 (#215)
dfd90d5 use ts-loader 9.6.1 (#214)
5aaf071 prepare 0.0.81 (#213)
fd6ea1c handle download errors (#212)
57dbba8 Run npm audit fix; add serialize-javascript override in sample (#211)
fc2162a Bump js-yaml from 4.1.1 to 4.2.0 in /sample (#210)
ce51767 fix: bump js-yaml 4.1.1 → 4.2.0 to resolve moderate DoS vulnerability (#209)
0867d1e chore: upgrade brace-expansion dependency (#207)
311e34f Bump fast-uri from 3.1.0 to 3.1.2 in /sample (#205)
Additional commits viewable in compare view

Updates eslint-plugin-import-x from 4.16.2 to 4.17.1

Release notes

Sourced from eslint-plugin-import-x's releases.

v4.17.1

Patch Changes

#498 cf25a01 Thanks @marcalexiei! - fix(extensions): don't require an extension for package subpaths that resolve to a .d.ts (e.g. vitest/config)

v4.17.0

Minor Changes

#474 4b2c0c5 Thanks @regseb! - Support RegExp in the import-x/ignore setting and the ignore option of the no-unresolved rule.

Patch Changes

#494 1c84235 Thanks @morgan-coded! - Fixed no-unresolved crashing when case-sensitive path checks encounter EACCES or EPERM on an ancestor directory.

#481 3e13121 Thanks @B4nan! - fix: memoize legacyNodeResolve resolver to avoid native memory leak

#484 9a07009 Thanks @sairus2k! - Make the extensions rule check Node.js subpath imports (specifiers starting with #, e.g. #utils/helper). Previously parsePath treated a leading # as a URL hash fragment, so the rule skipped extension validation for these imports.

Note: single-segment subpath imports without a slash (e.g. #dep) are still skipped by the existing external-root-module classification; fixing that is deferred to avoid expanding scope.

#468 240ed58 Thanks @silverwind! - Make extensions handle .d.ts correctly

#479 e3cc7e4 Thanks @mrginglymus! - fix: strip querystrings and hash fragments when checking for file existence

#476 fce29b1 Thanks @nbouvrette! - fix(deps): replace @package-json/types with an inline minimal type

Changelog

Sourced from eslint-plugin-import-x's changelog.

4.17.1

Patch Changes

#498 cf25a01 Thanks @marcalexiei! - fix(extensions): don't require an extension for package subpaths that resolve to a .d.ts (e.g. vitest/config)

4.17.0

Minor Changes

#474 4b2c0c5 Thanks @regseb! - Support RegExp in the import-x/ignore setting and the ignore option of the no-unresolved rule.

Patch Changes

#494 1c84235 Thanks @morgan-coded! - Fixed no-unresolved crashing when case-sensitive path checks encounter EACCES or EPERM on an ancestor directory.

#481 3e13121 Thanks @B4nan! - fix: memoize legacyNodeResolve resolver to avoid native memory leak

#484 9a07009 Thanks @sairus2k! - Make the extensions rule check Node.js subpath imports (specifiers starting with #, e.g. #utils/helper). Previously parsePath treated a leading # as a URL hash fragment, so the rule skipped extension validation for these imports.

Note: single-segment subpath imports without a slash (e.g. #dep) are still skipped by the existing external-root-module classification; fixing that is deferred to avoid expanding scope.

#468 240ed58 Thanks @silverwind! - Make extensions handle .d.ts correctly

#479 e3cc7e4 Thanks @mrginglymus! - fix: strip querystrings and hash fragments when checking for file existence

#476 fce29b1 Thanks @nbouvrette! - fix(deps): replace @package-json/types with an inline minimal type

Commits

b767b8c chore: release eslint-plugin-import-x (#499)
cf25a01 fix(extensions): don't require extension for package subpaths resolving to .d...
b543300 docs: document the esmodule option for no-dynamic-require rule (#496)
7578513 chore: release eslint-plugin-import-x (#472)
e3cc7e4 fix: strip querystrings and hash fragments when checking for file existence (...
9a07009 fix: make extensions rule check Node.js subpath imports (#484)
3e13121 fix: memoize legacyNodeResolve resolver to avoid native memory leak (#481)
fce29b1 fix(deps): replace @package-json/types with an inline minimal type (#476)
1c84235 fix: handle access errors during case checks (#494)
96222bf chore: drop unused tmp (#487)
Additional commits viewable in compare view

Updates globals from 15.15.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

Update globals (2026-07-01) (#347) 7394811

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

Update globals (2026-06-22) (#345) 33b75f9

sindresorhus/globals@v17.6.0...v17.7.0

v17.6.0

Update globals (2026-05-01) (#343) 00a4dd9

sindresorhus/globals@v17.5.0...v17.6.0

v17.5.0

Update globals (2026-04-12) (#342) 5d84602

sindresorhus/globals@v17.4.0...v17.5.0

v17.4.0

Update globals (2026-03-01) (#338) d43a051

sindresorhus/globals@v17.3.0...v17.4.0

v17.3.0

Update globals (2026-02-01) (#336) 295fba9

sindresorhus/globals@v17.2.0...v17.3.0

v17.2.0

jasmine: Add throwUnless and throwUnlessAsync globals (#335) 97f23a7

sindresorhus/globals@v17.1.0...v17.2.0

v17.1.0

... (truncated)

Commits

36c7659 17.8.0
7394811 Update globals (2026-07-01) (#347)
a19670c 17.7.0
9611620 Update actions (#346)
33b75f9 Update globals (2026-06-22) (#345)
887dd52 Fix build script (#344)
6b15870 17.6.0
00a4dd9 Update globals (2026-05-01) (#343)
b8170c8 17.5.0
5d84602 Update globals (2026-04-12) (#342)
Additional commits viewable in compare view

Updates ovsx from 1.0.0 to 1.0.2

Release notes

Sourced from ovsx's releases.

CLI v1.0.2

Dependencies

Bump tmp from 0.2.6 to 0.2.7 (#1903)

Bump tar from 7.5.11 to 7.5.16 (#1911)

Bump form-data from 4.0.4 to 4.0.6 (#1910)

Bump js-yaml from 4.1.1 to 4.2.0 (#1912)

Bump markdown-it from 14.1.1 to 14.2.0 (#1913)

Frontend Library v1.0.2

Changed

Migrate unit test framework from mocha to vitest

Dependencies

Bump tar from 7.5.11 to 7.5.16 (#1907)

Bump js-yaml from 4.1.1 to 4.2.0 (#1908)

Bump vite from 7.3.2 to 7.3.5 (#1905)

Bump dompurify from 3.4.0 to 3.4.11 (#1920)

Bump markdown-it from 14.1.1 to 14.2.0 (#1904)

Bump @babel/core from 7.29.0 to 7.29.7 (#1909)

v1.0.2

This release of Open VSX consists of:

ovsx CLI

openvsx-webui frontend library

openvsx-server Docker image

openvsx-webui Docker image

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

Change: switch from mocha to vitest by @netomi in eclipse-openvsx/openvsx#1914

Change: add check for unsafe paths to MaliciousZipCheckService by @netomi in eclipse-openvsx/openvsx#1915

Fix: add consistent and strict http headers when serving files inside extensions by @netomi in eclipse-openvsx/openvsx#1922

👒 Dependencies

build(deps): bump tmp from 0.2.6 to 0.2.7 in /cli by @dependabot[bot] in eclipse-openvsx/openvsx#1903

build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in eclipse-openvsx/openvsx#1902

build(deps): bump tar from 7.5.11 to 7.5.16 in /webui by @dependabot[bot] in eclipse-openvsx/openvsx#1907

build(deps): bump js-yaml from 4.1.1 to 4.2.0 in /webui by @dependabot[bot] in eclipse-openvsx/openvsx#1908

build(deps-dev): bump vite from 7.3.2 to 7.3.5 in /webui by @dependabot[bot] in eclipse-openvsx/openvsx#1905

build(deps): bump dompurify from 3.4.0 to 3.4.9 in /webui by @dependabot[bot] in eclipse-openvsx/openvsx#1906

build(deps): bump markdown-it from 14.1.1 to 14.2.0 in /webui by @dependabot[bot] in eclipse-openvsx/openvsx#1904

build(deps): bump tar from 7.5.11 to 7.5.16 in /cli by @dependabot[bot] in eclipse-openvsx/openvsx#1911

build(deps): bump @babel/core from 7.29.0 to 7.29.7 in /webui by @dependabot[bot] in eclipse-openvsx/openvsx#1909

build(deps): bump form-data from 4.0.4 to 4.0.6 in /cli by @dependabot[bot] in eclipse-openvsx/openvsx#1910

... (truncated)

Changelog

Sourced from ovsx's changelog.

[v1.0.2] (23/06/2026)

Dependencies

Bump tmp from 0.2.6 to 0.2.7 (#1903)

Bump tar from 7.5.11 to 7.5.16 (#1911)

Bump form-data from 4.0.4 to 4.0.6 (#1910)

Bump js-yaml from 4.1.1 to 4.2.0 (#1912)

Bump markdown-it from 14.1.1 to 14.2.0 (#1913)

[v1.0.1] (11/06/2026)

Fixes

Properly encode path segments in getUrl method (#1893)

Commits

7cdc854 chore: prepare cli 1.0.2 release
787c45c build(deps): bump markdown-it from 14.1.1 to 14.2.0 in /cli (#1913)
9d61e9b build(deps): bump js-yaml from 4.1.1 to 4.2.0 in /cli (#1912)
03399e4 build(deps): bump form-data from 4.0.4 to 4.0.6 in /cli (#1910)
2acaf8e build(deps): bump tar from 7.5.11 to 7.5.16 in /cli (#1911)
48cdde2 build(deps): bump tmp from 0.2.6 to 0.2.7 in /cli (#1903)
724dea0 chore: prepare cli 1.0.1 release
19442b0 Fix: properly encode path segments in getUrl (#1893)
See full diff in compare view

Updates prettier from 3.8.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

Preserve quotes for methods named new (prettier/prettier#19621 by @kovsu)

Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @fisker)

Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @fisker)

🔗 Changelog

3.9.3

Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @seiyab)

TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @evoactivity)

🔗 Changelog

3.9.1

CLI: Fix ignored file has been cached incorrectly (#19483 by @kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

Fix Flow variance annotation print (#19022 by @marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @kovsu)
// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}
TypeScript: Support import defer (#19624, #19675 by @fisker)
// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";
JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:
Install the plugin:
yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

8f0c950 Release 3.9.6
e910764 Update changelog
ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
73d2efc Update Yuku parser to v0.7.0 (#19664)
dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
b74dd53 Update Yuku parser to v0.6.5 (#19654)
f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
3bbb815 Remove typescript-only directory (#19636)
Additional commits viewable in compare view

Updates ts-loader from 9.6.0 to 9.6.2

Release notes

Sourced from ts-loader's releases.

v9.6.2

chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micromatch → picomatch - thanks @johnnyreilly

Officially ts-loader has supported 3.6.3+ versions of TypeScript. This change means that certain scenarios with older versions of TS will now certainly fail. If anyone is actually using these versions it would be surprising.

v9.6.1

fix: rspack support - thanks @johnnyreilly and @bhollis

Changelog

Sourced from ts-loader's changelog.

9.6.2

chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micromatch → picomatch - thanks @johnnyreilly

Officially ts-loader has supported 3.6.3+ versions of TypeScript. This change means that certain scenarios with older versions of TS will now certainly fail. If anyone is actually using these versions it would be surprising.

9.6.1

fix: rspack support - thanks @johnnyreilly and @bhollis

Commits

b347bb7 chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micro...
32d82e6 fix: rspack support (#1699)
6bd992e chore: Update GitHub Actions workflow for release
See full diff in compare view

Updates typescript-eslint from 8.61.0 to 8.65.0

Release notes

Sourced from typescript-eslint's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

add warning when TS 7 is detected (#12529)

eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)

eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)

parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)

eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)

eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

Evyatar Daud @StyleShit

Josh Goldberg ✨

Kirk Waiblinger @kirkwaiblinger

Serhii Leniv @Serhii-Leniv

송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

support parsing import defer (#12513)

eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)

typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

Evyatar Daud @StyleShit

송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.65.0 (2026-07-20)

🚀 Features

add warning when TS 7 is detected (#12529)

❤️ Thank You

Josh Goldberg ✨

Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

remove redundant package.json "files" (#12444)

❤️ Thank You

Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

... (truncated)

Commits

63ba81b chore(release): publish 8.65.0
eaf4576 feat: add warning when TS 7 is detected (#12529)
0d06406 chore: add attw validation to repo (#12437)
c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)

Bumps the dependencies group with 11 updates: | Package | From | To | | --- | --- | --- | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.1.2` | | [@vscode/test-web](https://github.com/microsoft/vscode-test-web) | `0.0.80` | `0.0.81` | | [eslint-plugin-import-x](https://github.com/un-ts/eslint-plugin-import-x) | `4.16.2` | `4.17.1` | | [globals](https://github.com/sindresorhus/globals) | `15.15.0` | `17.8.0` | | [ovsx](https://github.com/eclipse-openvsx/openvsx/tree/HEAD/cli) | `1.0.0` | `1.0.2` | | [prettier](https://github.com/prettier/prettier) | `3.8.4` | `3.9.6` | | [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.6.0` | `9.6.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.61.0` | `8.65.0` | | [webpack](https://github.com/webpack/webpack) | `5.107.2` | `5.109.2` | | [webpack-cli](https://github.com/webpack/webpack-cli) | `7.0.3` | `7.2.2` | Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@types/node` from 25.9.2 to 26.1.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vscode/test-web` from 0.0.80 to 0.0.81 - [Release notes](https://github.com/microsoft/vscode-test-web/releases) - [Changelog](https://github.com/microsoft/vscode-test-web/blob/main/CHANGELOG.md) - [Commits](microsoft/vscode-test-web@v0.0.80...v0.0.81) Updates `eslint-plugin-import-x` from 4.16.2 to 4.17.1 - [Release notes](https://github.com/un-ts/eslint-plugin-import-x/releases) - [Changelog](https://github.com/un-ts/eslint-plugin-import-x/blob/master/CHANGELOG.md) - [Commits](un-ts/eslint-plugin-import-x@v4.16.2...v4.17.1) Updates `globals` from 15.15.0 to 17.8.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v15.15.0...v17.8.0) Updates `ovsx` from 1.0.0 to 1.0.2 - [Release notes](https://github.com/eclipse-openvsx/openvsx/releases) - [Changelog](https://github.com/eclipse-openvsx/openvsx/blob/main/cli/CHANGELOG.md) - [Commits](https://github.com/eclipse-openvsx/openvsx/commits/v1.0.2/cli) Updates `prettier` from 3.8.4 to 3.9.6 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.4...3.9.6) Updates `ts-loader` from 9.6.0 to 9.6.2 - [Release notes](https://github.com/TypeStrong/ts-loader/releases) - [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md) - [Commits](TypeStrong/ts-loader@v9.6.0...v9.6.2) Updates `typescript-eslint` from 8.61.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) Updates `webpack` from 5.107.2 to 5.109.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.107.2...v5.109.2) Updates `webpack-cli` from 7.0.3 to 7.2.2 - [Release notes](https://github.com/webpack/webpack-cli/releases) - [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md) - [Commits](https://github.com/webpack/webpack-cli/compare/webpack-cli@7.0.3...webpack-cli@7.2.2) --- updated-dependencies: - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: "@types/node" dependency-version: 26.1.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: "@vscode/test-web" dependency-version: 0.0.81 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: eslint-plugin-import-x dependency-version: 4.17.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: globals dependency-version: 17.8.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: ovsx dependency-version: 1.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: ts-loader dependency-version: 9.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: webpack dependency-version: 5.109.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: webpack-cli dependency-version: 7.2.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-28T19:44:22Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
ovsx@1.0.0 ⏵ 1.0.2			⁺¹
typescript-eslint@8.61.0 ⏵ 8.65.0		⁺¹
@types/node@25.9.2 ⏵ 26.1.2	^-11	⁺¹
webpack@5.107.2 ⏵ 5.109.2	⁺¹		⁺¹
globals@15.15.0 ⏵ 17.8.0		⁺¹
eslint-plugin-import-x@4.16.2 ⏵ 4.17.1			^-2
@eslint/js@10.0.1
ts-loader@9.6.0 ⏵ 9.6.2	⁺¹		^-1
@vscode/test-web@0.0.80 ⏵ 0.0.81	⁺¹	⁺¹
webpack-cli@7.0.3 ⏵ 7.2.2			⁺²
prettier@3.8.4 ⏵ 3.9.6	⁺¹	⁺¹

View full report

socket-security · 2026-07-28T19:44:24Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `ovsx` under EPL-2.0 License: EPL-2.0 - The applicable license policy does not permit this license (5) (npm metadata) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/check-license.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/check-license.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/create-namespace.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-pat.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/main.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/main.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/util.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/util.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/get.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/main.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/util.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/check-license.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace-options.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/create-namespace-options.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/create-namespace-options.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/login-options.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/logout.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/store.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/zip.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/login-options.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/login.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/logout.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/store.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/zip.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat-options.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/verify-pat-options.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/verify-pat-options.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/publish.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/index.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get-options.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/get-options.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/publish-options.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry-options.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry-options.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/get-options.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/publish-options.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/registry-options.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/pat.d.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/pat.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/index.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/index.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/publish.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/src/registry.ts) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/lib/registry.js) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/package.json) License: EPL-2.0 - The applicable license policy does not permit this license (5) (package/LICENSE) From: package-lock.json → `npm/ovsx@1.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/ovsx@1.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `webpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/webpack@5.109.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/webpack@5.109.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 28, 2026

dependabot Bot requested a review from a team as a code owner July 28, 2026 19:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump the dependencies group with 11 updates - #573

chore(deps-dev): bump the dependencies group with 11 updates#573
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-871d5192f4

dependabot Bot commented on behalf of github Jul 28, 2026

Uh oh!

socket-security Bot commented Jul 28, 2026

Uh oh!

socket-security Bot commented Jul 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 28, 2026

v10.0.1

Bug Fixes

Documentation

Chores

v10.0.0

Breaking Changes

Features

v0.0.81

Changes:

v4.17.1

Patch Changes

v4.17.0

Minor Changes

Patch Changes

4.17.1

Patch Changes

4.17.0

Minor Changes

Patch Changes

v17.8.0

v17.7.0

v17.6.0

v17.5.0

v17.4.0

v17.3.0

v17.2.0

v17.1.0

CLI v1.0.2

Dependencies

Frontend Library v1.0.2

Changed

Dependencies

v1.0.2

What's Changed

🏕 Features

👒 Dependencies

[v1.0.2] (23/06/2026)

Dependencies

[v1.0.1] (11/06/2026)

Fixes

3.9.6

What's Changed

3.9.5

3.9.4

3.9.3

3.9.1

3.9.0

3.8.5

3.9.6

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

TypeScript: Support import defer (#19624, #19675 by @​fisker)

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

v9.6.2

v9.6.1

9.6.2

9.6.1

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

🩹 Fixes

❤️ Thank You

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

🩹 Fixes

❤️ Thank You

8.65.0 (2026-07-20)

🚀 Features

❤️ Thank You

8.64.0 (2026-07-13)

8.63.0 (2026-07-06)

8.62.1 (2026-06-29)

8.62.0 (2026-06-22)

🚀 Features

❤️ Thank You

Uh oh!

socket-security Bot commented Jul 28, 2026

TypeScript: Preserve quotes for methods named `new` (#19621 by `@kovsu`)

TypeScript: Support `import defer` (#19624, #19675 by `@fisker`)

JavaScript: Added a new official plugin `@prettier/plugin-yuku` (#19628, #19629 by `@fisker`)