Bump the npm-minor group with 7 updates by dependabot[bot] · Pull Request #3266 · github/codeql-action · GitHub

Bumps the npm-minor group with 7 updates:

Package	From	To
@octokit/request-error	7.0.1	7.0.2
octokit	5.0.4	5.0.5
@eslint/compat	1.4.0	1.4.1
@eslint/js	9.38.0	9.39.0
@typescript-eslint/eslint-plugin	8.46.2	8.46.3
@typescript-eslint/parser	8.46.2	8.46.3
esbuild	0.25.11	0.25.12

Updates @octokit/request-error from 7.0.1 to 7.0.2

Release notes

Sourced from @octokit/request-error's releases.

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

deps: update dependency @octokit/types to v16 (#533) (e5a75ef)

Commits

e5a75ef fix(deps): update dependency @octokit/types to v16 (#533)
e5d5de2 chore(deps): update dependency @types/node to v24 (#532)
8cc127b ci(action): update actions/setup-node action to v6 (#529)
b3a876b build(deps): lock file maintenance (#527)
cf1817b ci(action): update github/codeql-action action to v4 (#528)
61f1e87 chore(deps): update dependency tinybench to v5 (#519)
9e12ca9 chore(deps): update dependency prettier to v3.6.2 (#516)
9977ed5 build(deps): lock file maintenance (#524)
39fca6d ci(action): update actions/checkout action to v5 (#518)
daeef6b ci(action): update actions/setup-node action to v5 (#520)
See full diff in compare view

Updates octokit from 5.0.4 to 5.0.5

Release notes

Sourced from octokit's releases.

v5.0.5

5.0.5 (2025-10-31)

Bug Fixes

deps: update octokit monorepo (major) (#2903) (45c56ff)

Commits

45c56ff fix(deps): update octokit monorepo (major) (#2903)
823c506 chore(deps): update vitest monorepo to v4 (major) (#2900)
768ac1b build(deps): lock file maintenance (#2899)
dcca43c chore(deps): update dependency @types/node to v24 (#2901)
d1ddfe8 ci(action): update peter-evans/create-or-update-comment action to v5 (#2889)
791d318 chore(deps): update dependency prettier to v3.6.2 (#2863)
362cce8 build(deps): lock file maintenance (#2861)
See full diff in compare view

Updates @eslint/compat from 1.4.0 to 1.4.1

Release notes

Sourced from @eslint/compat's releases.

migrate-config: v1.4.1

1.4.1 (2025-04-01)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/compat bumped from ^1.2.7 to ^1.2.8

compat: v1.4.1

1.4.1 (2025-10-27)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.16.0 to ^0.17.0

Changelog

Sourced from @eslint/compat's changelog.

1.4.1 (2025-10-27)

Dependencies

The following workspace dependencies were updated

dependencies

@eslint/core bumped from ^0.16.0 to ^0.17.0

Commits

f5ecc7e chore: release main (#303)
760fb02 docs: Update README sponsors
da3838f build: add @types/node to compat and mcp (#295)
6030cad docs: Update README sponsors
f1f341d docs: Update README sponsors
See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @eslint/compat since your current version.

Updates @eslint/js from 9.38.0 to 9.39.0

Release notes

Sourced from @eslint/js's releases.

v9.39.0

Features

cc57d87 feat: update error loc to key in no-dupe-class-members (#20259) (Tanuj Kanti)

126552f feat: update error location in for-direction and no-dupe-args (#20258) (Tanuj Kanti)

167d097 feat: update complexity rule to highlight only static block header (#20245) (jaymarvelz)

Bug Fixes

15f5c7c fix: forward traversal step.args to visitors (#20253) (jaymarvelz)

5a1a534 fix: allow JSDoc comments in object-shorthand rule (#20167) (Nitin Kumar)

e86b813 fix: Use more types from @eslint/core (#20257) (Nicholas C. Zakas)

927272d fix: correct Scope typings (#20198) (jaymarvelz)

37f76d9 fix: use AST.Program type for Program node (#20244) (Francesco Trotta)

ae07f0b fix: unify timing report for concurrent linting (#20188) (jaymarvelz)

b165d47 fix: correct Rule typings (#20199) (jaymarvelz)

fb97cda fix: improve error message for missing fix function in suggestions (#20218) (jaymarvelz)

Documentation

d3e81e3 docs: Always recommend to include a files property (#20158) (Percy Ma)

0f0385f docs: use consistent naming recommendation (#20250) (Alex M. Spieslechner)

a3b1456 docs: Update README (GitHub Actions Bot)

cf5f2dd docs: fix correct tag of no-useless-constructor (#20255) (Tanuj Kanti)

10b995c docs: add TS options and examples for nofunc in no-use-before-define (#20249) (Tanuj Kanti)

2584187 docs: remove repetitive word in comment (#20242) (reddaisyy)

637216b docs: update CLI flags migration instructions (#20238) (jaymarvelz)

e7cda3b docs: Update README (GitHub Actions Bot)

7b9446f docs: handle empty flags sections on the feature flags page (#20222) (sethamus)

Chores

dfe3c1b chore: update @eslint/js version to 9.39.0 (#20270) (Francesco Trotta)

2375a6d chore: package.json update for @eslint/js release (Jenkins)

a1f4e52 chore: update @eslint dependencies (#20265) (Francesco Trotta)

c7d3229 chore: update dependency @eslint/core to ^0.17.0 (#20256) (renovate[bot])

27549bc chore: update fuzz testing to not error if code sample minimizer fails (#20252) (Milos Djermanovic)

a1370ee ci: bump actions/setup-node from 5 to 6 (#20230) (dependabot[bot])

9e7fad4 chore: add script to auto-generate eslint:recommended configuration (#20208) (唯然)

Commits

2375a6d chore: package.json update for @eslint/js release
9e7fad4 chore: add script to auto-generate eslint:recommended configuration (#20208)
See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.46.2 to 8.46.3

Release notes

Sourced from @typescript-eslint/eslint-plugin's releases.

v8.46.3

8.46.3 (2025-11-03)

🩹 Fixes

eslint-plugin: [no-misused-promises] expand union type to retrieve target property (#11706)

eslint-plugin: [no-duplicate-enum-values] support signed numbers (#11722, #11723)

❤️ Thank You

Evgeny Stepanovych @undsoft

tao

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/eslint-plugin's changelog.

8.46.3 (2025-11-03)

🩹 Fixes

eslint-plugin: [no-duplicate-enum-values] support signed numbers (#11722, #11723)

eslint-plugin: [no-misused-promises] expand union type to retrieve target property (#11706)

❤️ Thank You

Evgeny Stepanovych @undsoft

tao

You can read about our versioning strategy and releases on our website.

Commits

d9f3497 chore(release): publish 8.46.3
26a9f94 fix(eslint-plugin): [no-duplicate-enum-values] support signed numbers (#11722...
b8219d1 fix(eslint-plugin): [no-misused-promises] expand union type to retrieve targe...
See full diff in compare view

Updates @typescript-eslint/parser from 8.46.2 to 8.46.3

Release notes

Sourced from @typescript-eslint/parser's releases.

v8.46.3

8.46.3 (2025-11-03)

🩹 Fixes

eslint-plugin: [no-misused-promises] expand union type to retrieve target property (#11706)

eslint-plugin: [no-duplicate-enum-values] support signed numbers (#11722, #11723)

❤️ Thank You

Evgeny Stepanovych @undsoft

tao

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/parser's changelog.

8.46.3 (2025-11-03)

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

d9f3497 chore(release): publish 8.46.3
See full diff in compare view

Updates esbuild from 0.25.11 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;

... (truncated)

Commits

208f539 publish 0.25.12 to npm
5f03afd update release notes
6b2ee78 minify: remove css rules containing empty :is()
f361deb add some additional known static methods
07aa646 automatically mark "RegExp.escape()" calls as pure
9039c46 simplify some call expression checks
188944d add some additional known static methods
d3c67f9 fix #4310: add Iterator and other known globals
4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
26b29ed fix #4315: @media deduplication bug edge case
Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
@eslint/compat	[>= 1.2.a, < 1.3]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

Pull Request Overview

This PR updates several npm package dependencies to their latest patch and minor versions, including production dependencies (octokit, @octokit/request-error) and development dependencies (eslint tooling, esbuild).

Key changes:

Updates production dependencies: @octokit/request-error (^7.0.1 → ^7.0.2) and octokit (^5.0.4 → ^5.0.5)
Updates dev dependencies: @eslint/compat, @eslint/js, @typescript-eslint/eslint-plugin, and esbuild to their latest patch/minor versions
Corresponding package-lock.json updates with transitive dependencies

Reviewed Changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated no comments.

File	Description
package.json	Updates dependency versions for octokit, eslint, and build tooling packages
package-lock.json	Reflects updated package versions and their transitive dependencies, including @octokit, @esbuild, @eslint, and @typescript-eslint packages
lib/*.js	Auto-generated JavaScript files reflecting the package.json dependency updates

@dependabot rebase

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@dependabot recreate

Bumps the npm-minor group with 7 updates: | Package | From | To | | --- | --- | --- | | [@octokit/request-error](https://github.com/octokit/request-error.js) | `7.0.1` | `7.0.2` | | [octokit](https://github.com/octokit/octokit.js) | `5.0.4` | `5.0.5` | | [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat) | `1.4.0` | `1.4.1` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.38.0` | `9.39.0` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.46.2` | `8.46.3` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.46.2` | `8.46.3` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.11` | `0.25.12` | Updates `@octokit/request-error` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/octokit/request-error.js/releases) - [Commits](octokit/request-error.js@v7.0.1...v7.0.2) Updates `octokit` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/octokit/octokit.js/releases) - [Commits](octokit/octokit.js@v5.0.4...v5.0.5) Updates `@eslint/compat` from 1.4.0 to 1.4.1 - [Release notes](https://github.com/eslint/rewrite/releases) - [Changelog](https://github.com/eslint/rewrite/blob/main/packages/compat/CHANGELOG.md) - [Commits](https://github.com/eslint/rewrite/commits/compat-v1.4.1/packages/compat) Updates `@eslint/js` from 9.38.0 to 9.39.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v9.39.0/packages/js) Updates `@typescript-eslint/eslint-plugin` from 8.46.2 to 8.46.3 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.3/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.46.2 to 8.46.3 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.46.3/packages/parser) Updates `esbuild` from 0.25.11 to 0.25.12 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.25.11...v0.25.12) --- updated-dependencies: - dependency-name: "@octokit/request-error" dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: octokit dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@eslint/compat" dependency-version: 1.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@eslint/js" dependency-version: 9.39.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.46.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: "@typescript-eslint/parser" dependency-version: 8.46.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: esbuild dependency-version: 0.25.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

dependabot Bot added the Rebuild Re-transpile JS & re-generate workflows label Nov 3, 2025

dependabot Bot requested a review from a team as a code owner November 3, 2025 17:20

dependabot Bot added the Rebuild Re-transpile JS & re-generate workflows label Nov 3, 2025

github-actions Bot added size/XS Should be very easy to review and removed Rebuild Re-transpile JS & re-generate workflows labels Nov 3, 2025

github-actions Bot marked this pull request as draft November 3, 2025 17:21

henrymercer marked this pull request as ready for review November 3, 2025 17:56

Copilot AI review requested due to automatic review settings November 3, 2025 17:56

henrymercer previously approved these changes Nov 3, 2025

View reviewed changes

henrymercer enabled auto-merge November 3, 2025 17:56

Copilot AI reviewed Nov 3, 2025

View reviewed changes

dependabot Bot dismissed henrymercer’s stale review via a3ea4ef November 3, 2025 18:47

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-29e8df1594 branch from 2da4f78 to a3ea4ef Compare November 3, 2025 18:47

henrymercer added the Rebuild Re-transpile JS & re-generate workflows label Nov 4, 2025

github-actions Bot removed the Rebuild Re-transpile JS & re-generate workflows label Nov 4, 2025

Rebuild

85eb524

github-actions Bot marked this pull request as draft November 4, 2025 10:35

auto-merge was automatically disabled November 4, 2025 10:35
Pull request was converted to draft

henrymercer marked this pull request as ready for review November 4, 2025 10:46

henrymercer approved these changes Nov 4, 2025

View reviewed changes

henrymercer enabled auto-merge November 4, 2025 10:49

henrymercer merged commit 98e0ffe into main Nov 4, 2025

henrymercer deleted the dependabot/npm_and_yarn/npm-minor-29e8df1594 branch November 4, 2025 11:09

github-actions Bot mentioned this pull request Nov 13, 2025

Merge main into releases/v4 #3293

Merged

6 of 8 tasks

github-actions Bot mentioned this pull request Nov 13, 2025

Merge releases/v4 into releases/v3 #3295

Merged

7 of 8 tasks

Bump the npm-minor group with 7 updates by dependabot[bot] · Pull Request #3266 · github/codeql-action · GitHub

Repository navigation

Bump the npm-minor group with 7 updates - #3266

Bump the npm-minor group with 7 updates#3266
henrymercer merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-29e8df1594

dependabot Bot commented on behalf of github Nov 3, 2025 •
edited
Loading

Uh oh!

Uh oh!

github-actions Bot commented Nov 3, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

henrymercer commented Nov 3, 2025

Uh oh!

dependabot Bot commented on behalf of github Nov 3, 2025

Uh oh!

henrymercer commented Nov 3, 2025

Uh oh!

github-actions Bot commented Nov 4, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump the npm-minor group with 7 updates by dependabot[bot] · Pull Request #3266 · github/codeql-action · GitHub

Repository navigation

Bump the npm-minor group with 7 updates - #3266

Bump the npm-minor group with 7 updates#3266henrymercer merged 2 commits intomaingithub/codeql-action:mainfrom dependabot/npm_and_yarn/npm-minor-29e8df1594github/codeql-action:dependabot/npm_and_yarn/npm-minor-29e8df1594Copy head branch name to clipboard

Conversation

dependabot Bot commented on behalf of github Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

v5.0.5

5.0.5 (2025-10-31)

Bug Fixes

migrate-config: v1.4.1

1.4.1 (2025-04-01)

Dependencies

compat: v1.4.1

1.4.1 (2025-10-27)

Dependencies

1.4.1 (2025-10-27)

Dependencies

v9.39.0

Features

Bug Fixes

Documentation

Chores

v8.46.3

8.46.3 (2025-11-03)

🩹 Fixes

❤️ Thank You

8.46.3 (2025-11-03)

🩹 Fixes

❤️ Thank You

v8.46.3

8.46.3 (2025-11-03)

🩹 Fixes

❤️ Thank You

8.46.3 (2025-11-03)

v0.25.12

0.25.12

Uh oh!

github-actions Bot commented Nov 3, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

henrymercer commented Nov 3, 2025

Uh oh!

dependabot Bot commented on behalf of github Nov 3, 2025

Uh oh!

henrymercer commented Nov 3, 2025

Uh oh!

github-actions Bot commented Nov 4, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump the npm-minor group with 7 updates#3266
henrymercer merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-29e8df1594

dependabot Bot commented on behalf of github Nov 3, 2025 •
edited
Loading