Bump the npm-minor group with 4 updates by dependabot[bot] · Pull Request #3379 · github/codeql-action · GitHub

Bumps the npm-minor group with 4 updates: @typescript-eslint/eslint-plugin, @typescript-eslint/parser, esbuild and sinon.

Updates @typescript-eslint/eslint-plugin from 8.49.0 to 8.50.0

Release notes

Sourced from @typescript-eslint/eslint-plugin's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

Josh Goldberg ✨

Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/eslint-plugin's changelog.

8.50.0 (2025-12-15)

🚀 Features

eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

Josh Goldberg ✨

Ulrich Stark

You can read about our versioning strategy and releases on our website.

Commits

c62e858 chore(release): publish 8.50.0
1301f79 feat(eslint-plugin): [no-useless-default-assignment] add rule (#11720)
See full diff in compare view

Updates @typescript-eslint/parser from 8.49.0 to 8.50.0

Release notes

Sourced from @typescript-eslint/parser's releases.

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

eslint-plugin: [no-useless-default-assignment] add rule (#11720)

❤️ Thank You

Josh Goldberg ✨

Ulrich Stark

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @typescript-eslint/parser's changelog.

8.50.0 (2025-12-15)

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

Commits

c62e858 chore(release): publish 8.50.0
See full diff in compare view

Updates esbuild from 0.27.1 to 0.27.2

Release notes

Sourced from esbuild's releases.

v0.27.2
Allow import path specifiers starting with #/ (#4361)

Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

This change was contributed by @hybrist.
Automatically add the -webkit-mask prefix (#4357, #4358)

This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:
/* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}
This change was contributed by @BPJEnnova.
Additional minification of switch statements (#4176, #4359)

This release contains additional minification patterns for reducing switch statements. Here is an example:
// Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
// Old output (with --minify)
switch(x){case 0:foo();break;case 1:default:bar()}
// New output (with --minify)

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.27.2
Allow import path specifiers starting with #/ (#4361)

Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

This change was contributed by @hybrist.
Automatically add the -webkit-mask prefix (#4357, #4358)

This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:
/* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}
This change was contributed by @BPJEnnova.
Additional minification of switch statements (#4176, #4359)

This release contains additional minification patterns for reducing switch statements. Here is an example:
// Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
// Old output (with --minify)
switch(x){case 0:foo();break;case 1:default:bar()}

... (truncated)

Commits

cd83297 publish 0.27.2 to npm
2759721 additional tests for switch with break
fd2b4b3 update release notes
c8d93a7 fix #4357: -webkit- prefix for mask shorthand (#4358)
92ff12c compat table: update @types/node
a35eceb compat table: fix a type error with the new types
f598984 fix make compat-table to install dependencies
f7f6df0 release notes for #4361
6f8ec15 fix: allow subpath imports that start with #/ (#4361)
f7ae61f minify some switch statements to if-else statement
Additional commits viewable in compare view

Updates sinon from 21.0.0 to 21.0.1

Changelog

Sourced from sinon's changelog.

21.0.1

456a65c2 Update dependencies - except @sinonjs/samsam (#2669) (Carl-Erik Kopseng)

f04f3eb1 Fix issue 2618 - Remove browserify in favor of esbuild (#2661) (Artur Parkhisenko)

48b69df2 fix(docs): remove assert.failException from documentation (#2666) (Steffen Schroeder)

13b27ccc Fix sandbox restore not handling stubbed functions (#2667) (thamion)

ae9e09ac Update compatibility target to ES2023 (Carl-Erik Kopseng)

Updated compatibility target from ES2017 to ES2023 and clarified the note on breaking changes.

26055043 Improve error message for immutable descriptors (#2664) (Stuart Dotson)

80fa9a5b Also mirror the calledOnceWith assertion (#2660) (Benedikt Meurer)

Released by Carl-Erik Kopseng on 2025-12-19.

Commits

a8bebe0 21.0.1
456a65c Update dependencies - except @sinonjs/samsam (#2669)
f04f3eb Fix issue 2618 - Remove browserify in favor of esbuild (#2661)
48b69df fix(docs): remove assert.failException from documentation (#2666)
13b27cc Fix sandbox restore not handling stubbed functions (#2667)
ae9e09a Update compatibility target to ES2023
2605504 Improve error message for immutable descriptors (#2664)
6d48f12 Update text to emphasise that the target is moving
3d852ae Remember to quit on first error
43c88c9 Add some output
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-minor group with 4 updates: [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin), [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser), [esbuild](https://github.com/evanw/esbuild) and [sinon](https://github.com/sinonjs/sinon). Updates `@typescript-eslint/eslint-plugin` from 8.49.0 to 8.50.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.49.0 to 8.50.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.50.0/packages/parser) Updates `esbuild` from 0.27.1 to 0.27.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.1...v0.27.2) Updates `sinon` from 21.0.0 to 21.0.1 - [Release notes](https://github.com/sinonjs/sinon/releases) - [Changelog](https://github.com/sinonjs/sinon/blob/main/docs/changelog.md) - [Commits](sinonjs/sinon@v21.0.0...v21.0.1) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.50.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: "@typescript-eslint/parser" dependency-version: 8.50.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: esbuild dependency-version: 0.27.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor - dependency-name: sinon dependency-version: 21.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Pushed a commit to rebuild the Action. Please mark the PR as ready for review to trigger PR checks.

Pull request overview

This PR updates four npm development dependencies to their latest minor versions as part of a grouped dependency update. The changes include updates to TypeScript ESLint tooling, the esbuild bundler, and the Sinon test mocking library.

Key Changes:

TypeScript ESLint plugin updated to add new linting rule support
esbuild updated with improved CSS prefixing and switch statement minification
Sinon updated with bug fixes for sandbox restoration and improved error messages

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates versions for @typescript-eslint/eslint-plugin (8.49.0→8.50.0), esbuild (0.27.1→0.27.2), and sinon (21.0.0→21.0.1)
package-lock.json	Reflects dependency version updates including transitive dependencies; removes lodash.get as it's no longer needed by @sinonjs/samsam
lib/*.js	Auto-generated JavaScript files containing embedded package.json content (not reviewed per coding guidelines)

dependabot Bot added the Rebuild Re-transpile JS & re-generate workflows label Dec 22, 2025

dependabot Bot requested a review from a team as a code owner December 22, 2025 17:01

dependabot Bot added the Rebuild Re-transpile JS & re-generate workflows label Dec 22, 2025

github-actions Bot added size/XS Should be very easy to review and removed Rebuild Re-transpile JS & re-generate workflows labels Dec 22, 2025

Rebuild

60b2ba3

github-actions Bot marked this pull request as draft December 22, 2025 17:03

mbg marked this pull request as ready for review January 5, 2026 11:56

Copilot AI review requested due to automatic review settings January 5, 2026 11:56

Copilot started reviewing on behalf of mbg January 5, 2026 11:57 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

Comment thread package.json

henrymercer approved these changes Jan 5, 2026

View reviewed changes

henrymercer merged commit 3fd7db8 into main Jan 5, 2026
242 checks passed

henrymercer deleted the dependabot/npm_and_yarn/npm-minor-1607f6c1cd branch January 5, 2026 13:41

This was referenced Jan 12, 2026

Merge main into releases/v4 #3394

Merged

Merge releases/v4 into releases/v3 #3396

Merged

Bump the npm-minor group with 4 updates by dependabot[bot] · Pull Request #3379 · github/codeql-action · GitHub

Uh oh!

Bump the npm-minor group with 4 updates - #3379

Bump the npm-minor group with 4 updates#3379
henrymercer merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-1607f6c1cd

dependabot Bot commented on behalf of github Dec 22, 2025 •
edited
Loading

Uh oh!

Uh oh!

github-actions Bot commented Dec 22, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump the npm-minor group with 4 updates by dependabot[bot] · Pull Request #3379 · github/codeql-action · GitHub

Uh oh!

Bump the npm-minor group with 4 updates - #3379

Bump the npm-minor group with 4 updates#3379henrymercer merged 2 commits intomaingithub/codeql-action:mainfrom dependabot/npm_and_yarn/npm-minor-1607f6c1cdgithub/codeql-action:dependabot/npm_and_yarn/npm-minor-1607f6c1cdCopy head branch name to clipboard

Conversation

dependabot Bot commented on behalf of github Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

❤️ Thank You

8.50.0 (2025-12-15)

🚀 Features

❤️ Thank You

v8.50.0

8.50.0 (2025-12-15)

🚀 Features

❤️ Thank You

8.50.0 (2025-12-15)

v0.27.2

0.27.2

21.0.1

Uh oh!

github-actions Bot commented Dec 22, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump the npm-minor group with 4 updates#3379
henrymercer merged 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-1607f6c1cd

dependabot Bot commented on behalf of github Dec 22, 2025 •
edited
Loading