This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
Avoid inlining using and await using declarations (#4482)
Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
using x = new Resource()
x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)
If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)
Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
Avoid inlining using and await using declarations (#4482)
Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
using x = new Resource()
x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)
If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)
Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.
v16.2.8
Release with no changes in an attempt to fix next@latest pointing at a prerelease version.
v16.2.7
[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.
Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)
Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/3248
**Author:** [@dependabot[bot]](https://github.com/apps/dependabot)
**Created:** 6/12/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `dependabot/npm_and_yarn/dev-patch-updates-3bdf28e2c2`
---
### 📝 Commits (1)
- [`062e741`](https://github.com/fosrl/pangolin/commit/062e741553b91da9cc515c028781f1f117652bf4) Bump the dev-patch-updates group across 1 directory with 6 updates
### 📊 Changes
**2 files changed** (+209 additions, -257 deletions)
<details>
<summary>View changed files</summary>
📝 `package-lock.json` (+202 -250)
📝 `package.json` (+7 -7)
</details>
### 📄 Description
Bumps the dev-patch-updates group with 6 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.1` | `25.9.3` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.0` | `0.28.1` |
| [eslint](https://github.com/eslint/eslint) | `10.4.0` | `10.4.1` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.6` | `16.2.9` |
| [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.3` | `4.22.4` |
Updates `@types/node` from 25.9.1 to 25.9.3
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li>
</ul>
</details>
<br />
Updates `esbuild` from 0.28.0 to 0.28.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p>
<blockquote>
<h2>v0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p>
<p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p>
<p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
using x = new Resource()
x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();</p>
<p></code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's changelog</a>.</em></p>
<blockquote>
<h2>0.28.1</h2>
<ul>
<li>
<p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p>
<p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p>
<p>Thanks to <a href="https://github.com/dellalibera"><code>@dellalibera</code></a> for reporting this issue.</p>
</li>
<li>
<p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p>
<p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p>
<p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p>
<p>Thanks to <a href="https://github.com/sondt99"><code>@sondt99</code></a> for reporting this issue.</p>
</li>
<li>
<p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p>
<p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p>
<pre lang="js"><code>// Original code
{
using x = new Resource()
x.activate()
}
<p>// Old output (with --minify)<br />
new Resource().activate();</p>
<p>// New output (with --minify)<br />
{using e=new Resource;e.activate()}<br />
</code></pre></p>
</li>
<li>
<p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p>
<p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p>
</li>
<li>
<p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p>
<p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p>
<pre lang="js"><code>// Original code
new (foo()`bar`)()
new (foo()?.bar)()
<p>// Old output<br />
new foo()<code>bar</code>();<br />
new (foo())?.bar();<br />
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/evanw/esbuild/commit/bb9db84c02433fbe37b3509f53f9f3e3cc48725e"><code>bb9db84</code></a> publish 0.28.1 to npm</li>
<li><a href="https://github.com/evanw/esbuild/commit/9ff053e53b8eeb990f59355dbea365277ac45ee2"><code>9ff053e</code></a> security: add integrity checks to the Deno API</li>
<li><a href="https://github.com/evanw/esbuild/commit/0a9bf2135b67c7e28989a5ba19f0f000805a5ab5"><code>0a9bf21</code></a> enforce non-negative size in gzip parser</li>
<li><a href="https://github.com/evanw/esbuild/commit/e2a1a7132058ee067fe736eac15f695861b8654e"><code>e2a1a71</code></a> security: forbid <code>\\</code> in local dev server requests</li>
<li><a href="https://github.com/evanw/esbuild/commit/83a2cbfc35809f4fd5152da59572d7bed7739d78"><code>83a2cbf</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>: don't inline <code>using</code> declarations</li>
<li><a href="https://github.com/evanw/esbuild/commit/308ad745d824c77bc607603451b257d0f2fd9a38"><code>308ad74</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>: renaming of nested <code>var</code> declarations</li>
<li><a href="https://github.com/evanw/esbuild/commit/f013f5f99a015bce92ec48d49181d4ad3177b29b"><code>f013f5f</code></a> fix some typos</li>
<li><a href="https://github.com/evanw/esbuild/commit/aafd6e48b1088336a5f5a17e930be7e840d43d8c"><code>aafd6e4</code></a> chore: fix some minor issues in comments (<a href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li>
<li><a href="https://github.com/evanw/esbuild/commit/15300c30b5e22f7cfcbed850c246d35095658386"><code>15300c3</code></a> follow up: cjs evaluation fixes</li>
<li><a href="https://github.com/evanw/esbuild/commit/1bda0c31d7697c0af44b3ab39b81e599e559a395"><code>1bda0c3</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, fix <a href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>: esm evaluation fixes</li>
<li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.28.0...v0.28.1">compare view</a></li>
</ul>
</details>
<br />
Updates `eslint` from 10.4.0 to 10.4.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/eslint/eslint/releases">eslint's releases</a>.</em></p>
<blockquote>
<h2>v10.4.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a href="https://github.com/eslint/eslint/commit/e557467db7496220eebcbe2ac5ea6d38c12bb1ec"><code>e557467</code></a> fix: update <code>@eslint/plugin-kit</code> version to 0.7.2 (<a href="https://redirect.github.com/eslint/eslint/issues/20930">#20930</a>) (Francesco Trotta)</li>
<li><a href="https://github.com/eslint/eslint/commit/d4ce898796ca22c3b96aa70d3014cb85f4bac1cd"><code>d4ce898</code></a> fix: propagate failures from delegated commands (<a href="https://redirect.github.com/eslint/eslint/issues/20917">#20917</a>) (Minh Vu)</li>
<li><a href="https://github.com/eslint/eslint/commit/f4f3507460bc016b5be979c05d2969793f570cbf"><code>f4f3507</code></a> fix: prefer-arrow-callback invalid autofix with newline after <code>async</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20916">#20916</a>) (kuldeep kumar)</li>
<li><a href="https://github.com/eslint/eslint/commit/c5bc78b37e08b9054a11f0cc2d81808bb24acb85"><code>c5bc78b</code></a> fix: false positive for reference in <code>finally</code> block (<a href="https://redirect.github.com/eslint/eslint/issues/20655">#20655</a>) (Tanuj Kanti)</li>
<li><a href="https://github.com/eslint/eslint/commit/27538c01f5df4e9306f6f4ba867b2dd6307fae59"><code>27538c0</code></a> fix: add missing CodePath and CodePathSegment types (<a href="https://redirect.github.com/eslint/eslint/issues/20853">#20853</a>) (Pixel998)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a href="https://github.com/eslint/eslint/commit/61b0add61ffc52665562be7bb96f526690a78b30"><code>61b0add</code></a> docs: remove deprecated rule from related rules of <code>max-params</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20921">#20921</a>) (Tanuj Kanti)</li>
<li><a href="https://github.com/eslint/eslint/commit/305d5b91aeac24d36fde42f75625a8f183d4ce43"><code>305d5b9</code></a> docs: remove deprecated rules from related rules section (<a href="https://redirect.github.com/eslint/eslint/issues/20911">#20911</a>) (Tanuj Kanti)</li>
<li><a href="https://github.com/eslint/eslint/commit/49b0202d01918b8061720d586dffd7c68047090c"><code>49b0202</code></a> docs: fix <code>display: none</code> of ad (<a href="https://redirect.github.com/eslint/eslint/issues/20901">#20901</a>) (Tanuj Kanti)</li>
<li><a href="https://github.com/eslint/eslint/commit/9067f9492ec998afc5b4f057a477ecf6ebd45e44"><code>9067f94</code></a> docs: switch build to Node.js 24 (<a href="https://redirect.github.com/eslint/eslint/issues/20893">#20893</a>) (Milos Djermanovic)</li>
<li><a href="https://github.com/eslint/eslint/commit/c91b0417e3420c76807ce1fa2aea76e2de87ab86"><code>c91b041</code></a> docs: Update README (GitHub Actions Bot)</li>
<li><a href="https://github.com/eslint/eslint/commit/e349265cb37f3ebc837e178e48a725bb782bd870"><code>e349265</code></a> docs: clarify semver strings in rule deprecation objects (<a href="https://redirect.github.com/eslint/eslint/issues/20885">#20885</a>) (Milos Djermanovic)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a href="https://github.com/eslint/eslint/commit/b0e466b6ab47bfc7de43d8de0c315d8ee83aa584"><code>b0e466b</code></a> test: add <code>data</code> property to invalid tests cases for rules (<a href="https://redirect.github.com/eslint/eslint/issues/20924">#20924</a>) (Tanuj Kanti)</li>
<li><a href="https://github.com/eslint/eslint/commit/f78838bc4c86d487e1bcc7cede260c4467721c46"><code>f78838b</code></a> test: add CodePath type coverage (<a href="https://redirect.github.com/eslint/eslint/issues/20904">#20904</a>) (Pixel998)</li>
<li><a href="https://github.com/eslint/eslint/commit/1daa4bd734b79a62e317d0394394a6b38cff49f9"><code>1daa4bd</code></a> chore: update <code>eslint-plugin-eslint-comments</code> test data to latest commit (<a href="https://redirect.github.com/eslint/eslint/issues/20922">#20922</a>) (Francesco Trotta)</li>
<li><a href="https://github.com/eslint/eslint/commit/002942ce988ea28b78e0a2f3b074081e638b552c"><code>002942c</code></a> ci: declare contents:read on update-readme workflow (<a href="https://redirect.github.com/eslint/eslint/issues/20919">#20919</a>) (Arpit Jain)</li>
<li><a href="https://github.com/eslint/eslint/commit/64bca24e7bed35bc3c864fc625cb2d89eca87d5b"><code>64bca24</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20912">#20912</a>) (ESLint Bot)</li>
<li><a href="https://github.com/eslint/eslint/commit/6d7c832950d5e92499d88e504080661f888f8f56"><code>6d7c832</code></a> chore: ignore fflate updates in renovate (<a href="https://redirect.github.com/eslint/eslint/issues/20908">#20908</a>) (Pixel998)</li>
<li><a href="https://github.com/eslint/eslint/commit/b2c86382164d87c6203b78d52068cd6a2a6ffe30"><code>b2c8638</code></a> ci: bump pnpm/action-setup from 6.0.7 to 6.0.8 (<a href="https://redirect.github.com/eslint/eslint/issues/20889">#20889</a>) (dependabot[bot])</li>
<li><a href="https://github.com/eslint/eslint/commit/a9b8d7f74c50211701cfc49710fa541fd91b2aa5"><code>a9b8d7f</code></a> chore: increase maxBuffer for ecosystem tests (<a href="https://redirect.github.com/eslint/eslint/issues/20881">#20881</a>) (sethamus)</li>
<li><a href="https://github.com/eslint/eslint/commit/b702ead5e1ed7cb9f28238a454797662efb37396"><code>b702ead</code></a> chore: update ecosystem update PR settings (<a href="https://redirect.github.com/eslint/eslint/issues/20884">#20884</a>) (Pixel998)</li>
<li><a href="https://github.com/eslint/eslint/commit/507f60e9a78c9a902bc8759f066ae17a1ea6cd81"><code>507f60e</code></a> chore: update ecosystem plugins (<a href="https://redirect.github.com/eslint/eslint/issues/20882">#20882</a>) (ESLint Bot)</li>
<li><a href="https://github.com/eslint/eslint/commit/92f5c5bb6bf3a5d167c8ee53a430833410295c6d"><code>92f5c5b</code></a> test: add unit test for message-count (<a href="https://redirect.github.com/eslint/eslint/issues/20878">#20878</a>) (kuldeep kumar)</li>
<li><a href="https://github.com/eslint/eslint/commit/df321080af5758b1fa25e4b9a40e26135642dd6e"><code>df32108</code></a> chore: add <code>@eslint/markdown</code> and typescript-eslint ecosystem tests (<a href="https://redirect.github.com/eslint/eslint/issues/20837">#20837</a>) (sethamus)</li>
<li><a href="https://github.com/eslint/eslint/commit/327f91d36aa49f2a50ded931d841a16374fd875f"><code>327f91d</code></a> chore: use includeIgnoreFile internally (<a href="https://redirect.github.com/eslint/eslint/issues/20876">#20876</a>) (Kirk Waiblinger)</li>
<li><a href="https://github.com/eslint/eslint/commit/f0dc4bd893fb3a9f44e4ddc3ad7063ffb0beacd3"><code>f0dc4bd</code></a> chore: pin fflate@0.8.2 (<a href="https://redirect.github.com/eslint/eslint/issues/20877">#20877</a>) (Milos Djermanovic)</li>
<li><a href="https://github.com/eslint/eslint/commit/0f4bd257a67a082b756de746d9e0c4842ab764ca"><code>0f4bd25</code></a> ci: run Discord alert for ecosystem test failures (<a href="https://redirect.github.com/eslint/eslint/issues/20873">#20873</a>) (Copilot)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/eslint/eslint/commit/4a3d15a99c452c4db2fd56b577fa7597e98ab0c2"><code>4a3d15a</code></a> 10.4.1</li>
<li><a href="https://github.com/eslint/eslint/commit/43e7e2bdc5c6cacc535446b7d23c10f780384ba8"><code>43e7e2b</code></a> Build: changelog update for 10.4.1</li>
<li><a href="https://github.com/eslint/eslint/commit/e557467db7496220eebcbe2ac5ea6d38c12bb1ec"><code>e557467</code></a> fix: update <code>@eslint/plugin-kit</code> version to 0.7.2 (<a href="https://redirect.github.com/eslint/eslint/issues/20930">#20930</a>)</li>
<li><a href="https://github.com/eslint/eslint/commit/b0e466b6ab47bfc7de43d8de0c315d8ee83aa584"><code>b0e466b</code></a> test: add <code>data</code> property to invalid tests cases for rules (<a href="https://redirect.github.com/eslint/eslint/issues/20924">#20924</a>)</li>
<li><a href="https://github.com/eslint/eslint/commit/d4ce898796ca22c3b96aa70d3014cb85f4bac1cd"><code>d4ce898</code></a> fix: propagate failures from delegated commands (<a href="https://redirect.github.com/eslint/eslint/issues/20917">#20917</a>)</li>
<li><a href="https://github.com/eslint/eslint/commit/f4f3507460bc016b5be979c05d2969793f570cbf"><code>f4f3507</code></a> fix: prefer-arrow-callback invalid autofix with newline after <code>async</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20916">#20916</a>)</li>
<li><a href="https://github.com/eslint/eslint/commit/f78838bc4c86d487e1bcc7cede260c4467721c46"><code>f78838b</code></a> test: add CodePath type coverage (<a href="https://redirect.github.com/eslint/eslint/issues/20904">#20904</a>)</li>
<li><a href="https://github.com/eslint/eslint/commit/61b0add61ffc52665562be7bb96f526690a78b30"><code>61b0add</code></a> docs: remove deprecated rule from related rules of <code>max-params</code> (<a href="https://redirect.github.com/eslint/eslint/issues/20921">#20921</a>)</li>
<li><a href="https://github.com/eslint/eslint/commit/1daa4bd734b79a62e317d0394394a6b38cff49f9"><code>1daa4bd</code></a> chore: update <code>eslint-plugin-eslint-comments</code> test data to latest commit (<a href="https://redirect.github.com/eslint/eslint/issues/20">#20</a>...</li>
<li><a href="https://github.com/eslint/eslint/commit/002942ce988ea28b78e0a2f3b074081e638b552c"><code>002942c</code></a> ci: declare contents:read on update-readme workflow (<a href="https://redirect.github.com/eslint/eslint/issues/20919">#20919</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/eslint/eslint/compare/v10.4.0...v10.4.1">compare view</a></li>
</ul>
</details>
<br />
Updates `eslint-config-next` from 16.2.6 to 16.2.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">eslint-config-next's releases</a>.</em></p>
<blockquote>
<h2>v16.2.9</h2>
<p>Empty release to ensure <code>next@latest</code> points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.</p>
<h2>v16.2.8</h2>
<p>Release with no changes in an attempt to fix <code>next@latest</code> pointing at a prerelease version.</p>
<h2>v16.2.7</h2>
<blockquote>
<p>[!NOTE]
This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p>
</blockquote>
<h3>Core Changes</h3>
<ul>
<li>Backport documentation fixes for v16.2 (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93804">#93804</a>)</li>
<li>[backport] Patch <code>playwright-core</code> to resolve <code>_finishedPromise</code> on <code>requestFailed</code> (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93920">#93920</a>)</li>
<li>[backport] Fix dev mode hydration failure when page is served from HTTP cache (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93492">#93492</a>)</li>
<li>[backport] Fix catch-all <code>router.query</code> corruption with <code>basePath</code> + <code>rewrites</code> (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93917">#93917</a>)</li>
<li>[backport] Encode non-ASCII characters in cache tags at construction (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93918">#93918</a>)</li>
<li>[backport] Fix server action forwarding loop with middleware rewrites (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93919">#93919</a>)</li>
<li>[backport] Turbopack: switch from base40 to base38 hash encoding (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/93932">#93932</a>)</li>
<li>[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/94164">#94164</a>)</li>
<li>[backport] Fix "type: module" in project dir when using standalone or adapters (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/94050">#94050</a>)</li>
<li>[backport] Propagate adapter preferred regions (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/94200">#94200</a>)</li>
<li>[16.2.x] Don't drop <code>FormData</code> entries (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/94240">#94240</a>)</li>
<li>[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (<a href="https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next/issues/94284">#94284</a>)</li>
</ul>
<h3>Credits</h3>
<p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/icyJoseph"><code>@icyJoseph</code></a>, <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>, <a href="https://github.com/mischnic"><code>@mischnic</code></a>, <a href="https://github.com/bgw"><code>@bgw</code></a>, <a href="https://github.com/timneutkens"><code>@timneutkens</code></a>, and <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> for helping!</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/vercel/next.js/commit/f37fad940522e000af5498209fd237d863b4fa16"><code>f37fad9</code></a> v16.2.9</li>
<li><a href="https://github.com/vercel/next.js/commit/6f1680448c81904efcd36704edf01a6b7323abbf"><code>6f16804</code></a> v16.2.8</li>
<li><a href="https://github.com/vercel/next.js/commit/411c455dcdec630b9e2e83d24e27b0f9e05927b6"><code>411c455</code></a> v16.2.7</li>
<li>See full diff in <a href="https://github.com/vercel/next.js/commits/v16.2.9/packages/eslint-config-next">compare view</a></li>
</ul>
</details>
<br />
Updates `prettier` from 3.8.3 to 3.8.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/prettier/prettier/releases">prettier's releases</a>.</em></p>
<blockquote>
<h2>3.8.4</h2>
<ul>
<li>Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (<a href="https://redirect.github.com/prettier/prettier/pull/17746">prettier/prettier#17746</a> by <a href="https://github.com/byplayer"><code>@byplayer</code></a>)</li>
</ul>
<p>🔗 <a href="https://github.com/prettier/prettier/blob/3.8.4/CHANGELOG.md#384">Changelog</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/prettier/prettier/blob/main/CHANGELOG.md">prettier's changelog</a>.</em></p>
<blockquote>
<h1>3.8.4</h1>
<p><a href="https://github.com/prettier/prettier/compare/3.8.3...3.8.4">diff</a></p>
<h4>Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (<a href="https://redirect.github.com/prettier/prettier/pull/17746">#17746</a> by <a href="https://github.com/byplayer"><code>@byplayer</code></a>)</h4>
<p>Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.</p>
<!-- raw HTML omitted -->
<pre lang="markdown"><code><!-- Input -->
- a
<ul>
<li>
<p>b</p>
</li>
<li>
<p>c</p>
<ul>
<li>d</li>
</ul>
</li>
</ul>
<p><!-- Prettier 3.8.3 --></p>
<ul>
<li>a
<ul>
<li>b</li>
</ul>
</li>
<li>c
<ul>
<li>d</li>
</ul>
</li>
</ul>
<p><!-- Prettier 3.8.4 --></p>
<ul>
<li>
<p>a</p>
<ul>
<li>b</li>
</ul>
</li>
<li>
<p>c</p>
<ul>
<li>d<br />
</code></pre></li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/prettier/prettier/commit/1c6ba5539141552e0e8e22d401ea620d8fdff468"><code>1c6ba55</code></a> Release 3.8.4</li>
<li><a href="https://github.com/prettier/prettier/commit/4a673dc9b59ddf7296bbab9822093d2971da84a8"><code>4a673dc</code></a> Fix blank lines between list items and nested sub-lists being removed in Mark...</li>
<li><a href="https://github.com/prettier/prettier/commit/074aaedbb052a288e89d15eb0a4214de37a08866"><code>074aaed</code></a> Replace <code>main</code> branch in changelog link with tags (<a href="https://redirect.github.com/prettier/prettier/issues/19054">#19054</a>)</li>
<li><a href="https://github.com/prettier/prettier/commit/c22a003ae97917c5043e8685b4fdff0f93e978f9"><code>c22a003</code></a> Bump Prettier dependency to 3.8.3</li>
<li><a href="https://github.com/prettier/prettier/commit/07bad1f04536e9799927007baf466e67151576f0"><code>07bad1f</code></a> Clean changelog_unreleased</li>
<li>See full diff in <a href="https://github.com/prettier/prettier/compare/3.8.3...3.8.4">compare view</a></li>
</ul>
</details>
<br />
Updates `tsx` from 4.22.3 to 4.22.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/privatenumber/tsx/releases">tsx's releases</a>.</em></p>
<blockquote>
<h2>v4.22.4</h2>
<h2><a href="https://github.com/privatenumber/tsx/compare/v4.22.3...v4.22.4">4.22.4</a> (2026-05-31)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>resolve CommonJS directory requires inside dependencies (<a href="https://redirect.github.com/privatenumber/tsx/issues/803">#803</a>) (<a href="https://github.com/privatenumber/tsx/commit/1ce846335b7c445a3328c7d27f06424949356d97">1ce8463</a>)</li>
</ul>
<hr />
<p>This release is also available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/tsx/v/4.22.4"><code>npm package (@latest dist-tag)</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/privatenumber/tsx/commit/1ce846335b7c445a3328c7d27f06424949356d97"><code>1ce8463</code></a> fix: resolve CommonJS directory requires inside dependencies (<a href="https://redirect.github.com/privatenumber/tsx/issues/803">#803</a>)</li>
<li>See full diff in <a href="https://github.com/privatenumber/tsx/compare/v4.22.3...v4.22.4">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
</details>
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/3248
Author: @dependabot[bot]
Created: 6/12/2026
Status: 🔄 Open
Base:
main← Head:dependabot/npm_and_yarn/dev-patch-updates-3bdf28e2c2📝 Commits (1)
062e741Bump the dev-patch-updates group across 1 directory with 6 updates📊 Changes
2 files changed (+209 additions, -257 deletions)
View changed files
📝
package-lock.json(+202 -250)📝
package.json(+7 -7)📄 Description
Bumps the dev-patch-updates group with 6 updates in the / directory:
25.9.125.9.30.28.00.28.110.4.010.4.116.2.616.2.93.8.33.8.44.22.34.22.4Updates
@types/nodefrom 25.9.1 to 25.9.3Commits
Updates
esbuildfrom 0.28.0 to 0.28.1Release notes
Sourced from esbuild's releases.
... (truncated)
Changelog
Sourced from esbuild's changelog.
... (truncated)
Commits
bb9db84publish 0.28.1 to npm9ff053esecurity: add integrity checks to the Deno API0a9bf21enforce non-negative size in gzip parsere2a1a71security: forbid\\in local dev server requests83a2cbffix #4482: don't inlineusingdeclarations308ad74fix #4471: renaming of nestedvardeclarationsf013f5ffix some typosaafd6e4chore: fix some minor issues in comments (#4462)15300c3follow up: cjs evaluation fixes1bda0c3fix #4461, fix #4467: esm evaluation fixesUpdates
eslintfrom 10.4.0 to 10.4.1Release notes
Sourced from eslint's releases.
Commits
4a3d15a10.4.143e7e2bBuild: changelog update for 10.4.1e557467fix: update@eslint/plugin-kitversion to 0.7.2 (#20930)b0e466btest: adddataproperty to invalid tests cases for rules (#20924)d4ce898fix: propagate failures from delegated commands (#20917)f4f3507fix: prefer-arrow-callback invalid autofix with newline afterasync(#20916)f78838btest: add CodePath type coverage (#20904)61b0adddocs: remove deprecated rule from related rules ofmax-params(#20921)1daa4bdchore: updateeslint-plugin-eslint-commentstest data to latest commit (#20...002942cci: declare contents:read on update-readme workflow (#20919)Updates
eslint-config-nextfrom 16.2.6 to 16.2.9Release notes
Sourced from eslint-config-next's releases.
Commits
f37fad9v16.2.96f16804v16.2.8411c455v16.2.7Updates
prettierfrom 3.8.3 to 3.8.4Release notes
Sourced from prettier's releases.
Changelog
Sourced from prettier's changelog.
Commits
1c6ba55Release 3.8.44a673dcFix blank lines between list items and nested sub-lists being removed in Mark...074aaedReplacemainbranch in changelog link with tags (#19054)c22a003Bump Prettier dependency to 3.8.307bad1fClean changelog_unreleasedUpdates
tsxfrom 4.22.3 to 4.22.4Release notes
Sourced from tsx's releases.
Commits
1ce8463fix: resolve CommonJS directory requires inside dependencies (#803)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.