chore: Bump the "dependencies" group with 2 updates across multiple ecosystems by dependabot[bot] · Pull Request #26 · OrcaCD/deploy-action

dependabot · 2026-10-14T16:10:53Z

Bumps the dependencies group with 5 updates:

Package	From	To
@types/node	`26.6.4`	`26.6.5`
oxfmt	`0.71.0`	`0.72.0`
oxlint	`1.86.0`	`1.87.0`
oxlint-tsgolint	`7.0.2003`	`7.0.2004`
rolldown	`1.2.12`	`1.2.13`

Updates @types/node from 26.6.4 to 26.6.5

Commits

See full diff in compare view

Updates oxfmt from 0.71.0 to 0.72.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.72.0

💥 BREAKING CHANGES

e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)

7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)

e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#27326) (leaysgur)

df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#27325) (leaysgur)

7f65b75 formatter: Format assignment target property as assignment-like (#27289) (leaysgur)

6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#27288) (leaysgur)

1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#27283) (leaysgur)

2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#27278) (leaysgur)

dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#27277) (leaysgur)

1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#27275) (leaysgur)

fd4ddce formatter_json: Flatten block comment only array|object (#27274) (leaysgur)

267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#27241) (leaysgur)

2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#27237) (Nicolas Le Cam)

c2de02b formatter: Decide embedded template layout from AST, not source shape (#27218) (leaysgur)

c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#27216) (leaysgur)

36e14df formatter: Keep comments between callee and its opener on the callee side (#27172) (leaysgur)

6da7657 oxfmt: Render diagnostics with source in Stdin mode (#27130) (leaysgur)

e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#27129) (leaysgur)

30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#27128) (leaysgur)

⚡ Performance

72f42a3 formatter_markdown: Pre-allocate the IR buffer (#27333) (leaysgur)

cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#27211) (leaysgur)

0aba566 oxfmt: Do not resolve root js config from nested context (#27147) (leaysgur)

📚 Documentation

51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#27327) (leaysgur)

656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#27279) (leaysgur)

66545bf formatter_markdown: Record setext heading wrap divergence (#27221) (leaysgur)

af4b269 oxfmt: Document why format() API does not take cwd (#27131) (leaysgur)

Commits

2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
See full diff in compare view

Updates oxlint from 1.86.0 to 1.87.0

Release notes

Sourced from oxlint's releases.

oxlint v1.87.0

🚀 Features

42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)

cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)

1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)

7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)

4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)

7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)

e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)

3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)

f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)

7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)

ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#26925) (camc314)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.88.0] - 2026-10-13

🚀 Features

3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

Commits

2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
See full diff in compare view

Updates oxlint-tsgolint from 7.0.2003 to 7.0.2004

Release notes

Sourced from oxlint-tsgolint's releases.

v7.0.2004

What's Changed

chore(deps): update taiki-e/install-action action to v2.87.20 by @renovate[bot] in oxc-project/tsgolint#1246

chore(deps): update dependency dprint-json to v0.25.0 by @renovate[bot] in oxc-project/tsgolint#1247

fix(no-unsafe-return): preserve deferred indexed return type by @camc314 in oxc-project/tsgolint#1248

chore(deps): update crate-ci/typos action to v1.50.3 by @renovate[bot] in oxc-project/tsgolint#1250

fix(no-misused-promises): don't report comma expressions as conditionals by @geniusmonir in oxc-project/tsgolint#1254

chore(deps): update gomod by @renovate[bot] in oxc-project/tsgolint#1257

chore(deps): update dprint plugins by @renovate[bot] in oxc-project/tsgolint#1256

chore(deps): update taiki-e/install-action action to v2.87.22 by @renovate[bot] in oxc-project/tsgolint#1258

chore(deps): update npm packages by @renovate[bot] in oxc-project/tsgolint#1259

fix(no-floating-promises): respect safe-call declaration sources by @camc314 in oxc-project/tsgolint#1261

fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns by @camc314 in oxc-project/tsgolint#1264

fix(no-deprecated): include reasons for variable declarations by @camc314 in oxc-project/tsgolint#1266

fix(no-unnecessary-type-parameters): parenthesize constraint in optional tuple elements by @baevm in oxc-project/tsgolint#1267

chore(deps): update crate-ci/typos action to v1.51.0 by @renovate[bot] in oxc-project/tsgolint#1268

chore(deps): update crate-ci/typos action to v1.51.1 by @renovate[bot] in oxc-project/tsgolint#1269

fix: restore line disable comments for type-aware diagnostics by @camc314 in oxc-project/tsgolint#1271

New Contributors

@geniusmonir made their first contribution in oxc-project/tsgolint#1254

Full Changelog: oxc-project/tsgolint@v7.0.2003...v7.0.2004

Commits

a612891 fix: restore line disable comments for type-aware diagnostics (#1271)
fc7068f chore(deps): update crate-ci/typos action to v1.51.1 (#1269)
8d4c05c chore(deps): update crate-ci/typos action to v1.51.0 (#1268)
6d20f35 fix(no-unnecessary-type-parameters): parenthesize constraint in optional tupl...
322b385 fix(no-deprecated): include reasons for variable declarations (#1266)
db76296 fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns (#1264)
24b18b4 fix(no-floating-promises): respect safe-call declaration sources (#1261)
c8f5cbc chore(deps): update npm packages (#1259)
93fe3a5 chore(deps): update taiki-e/install-action action to v2.87.22 (#1258)
dd0a306 chore(deps): update dprint plugins (#1256)
Additional commits viewable in compare view

Updates rolldown from 1.2.12 to 1.2.13

Release notes

Sourced from rolldown's releases.

v1.2.13

[1.2.13] - 2026-10-07

🚀 Features

rolldown_plugin_vite_import_glob: follow file creation and deletion via hotUpdate (#10550) by @shulaoda

inline-common-chunks: deduplicate shared code along known loading paths (#11093) by @hyfdev

rolldown_plugin_vite_import_glob: record a matcher per glob call in dev (#10592) by @shulaoda

rolldown_plugin_vite_import_glob: watch the directory each glob reads (#10549) by @shulaoda

watch: hand watch.exclude to notify as its ignore filter (#11008) by @shulaoda

dev: add experimental.devMode.hotUpdate option (#11123) by @h-a-n-a

🐛 Bug Fixes

renamer: check the printed name of namespace-alias imports for captures (#11129) by @IWANABETHATGUY

devtools: honor devtools.sessionId by @Brooooooklyn

renamer: keep a renamed nested binding off its module's top-level bindings (#11128) by @IWANABETHATGUY

dev: keep this undefined when calling an imported function in HMR patches and lazy chunks (#11126) by @h-a-n-a

dev: read string-named imports correctly in HMR patches and lazy chunks (#11127) by @h-a-n-a

sanitize preserveModules chunk names after resolving the relative path (#11087) by @waltuov

keep the with clause on bare external imports (#11100) by @IWANABETHATGUY

generator: filter DISABLE_JS_HOOK bits from generated HookUsage (#10346) by @Brooooooklyn

dev: make the module factory async for top-level await (#11118) by @h-a-n-a

node: give each renderChunk call its own meta object (#11115) by @Brooooooklyn

honor externalLiveBindings for imported exports (#11048) by @camc314

dev: keep a late payload from replacing newer module code (#11030) by @h-a-n-a

binding: use-after-free in async transform with a TsconfigCache (#11080) by @shulaoda

fail on chunk syntax errors and escape export names once (#11051) by @hyfdev

dev: ship newly imported modules the client never received (#11029) by @h-a-n-a

code-splitting: avoid cycles from redundant re-export initialization (#11073) by @hyfdev

link: treat re-exports of the same external binding as one export (#11069) by @IWANABETHATGUY

escape namespace properties in IIFE and UMD output (#11085) by @hyfdev

escape dependency paths in CJS and UMD output (#11084) by @hyfdev

use computed access for arbitrary import names (#11083) by @hyfdev

generate valid bindings for shimmed exports (#11082) by @hyfdev

dev: reload the page when an HMR update fails after merging its edit (#11031) by @h-a-n-a

dev/lazy: ship the deps of a module that a patch shipped but never ran (#11028) by @h-a-n-a

code-splitting: don't move init calls in front of unwrapped JSON modules (#11062) by @IWANABETHATGUY

escape export names in defineProperty calls (#11047) by @camc314

📚 Documentation

say the CLI bundles multiple configs one after another (#11111) by @Brooooooklyn

add renderChunk hook filter docs (#11065) by @sapphi-red

⚡ Performance

use concat_string! instead of format! for plain string joins (#11139) by @IWANABETHATGUY

utils: evaluate each concat_string! argument once (#11105) by @IWANABETHATGUY

json: escape JSON.parse string with json-escape-simd (#11104) by @IWANABETHATGUY

... (truncated)

Changelog

Sourced from rolldown's changelog.

[1.2.13] - 2026-10-07

🚀 Features

rolldown_plugin_vite_import_glob: follow file creation and deletion via hotUpdate (#10550) by @shulaoda

inline-common-chunks: deduplicate shared code along known loading paths (#11093) by @hyfdev

rolldown_plugin_vite_import_glob: record a matcher per glob call in dev (#10592) by @shulaoda

rolldown_plugin_vite_import_glob: watch the directory each glob reads (#10549) by @shulaoda

watch: hand watch.exclude to notify as its ignore filter (#11008) by @shulaoda

dev: add experimental.devMode.hotUpdate option (#11123) by @h-a-n-a

🐛 Bug Fixes

renamer: check the printed name of namespace-alias imports for captures (#11129) by @IWANABETHATGUY

devtools: honor devtools.sessionId by @Brooooooklyn

renamer: keep a renamed nested binding off its module's top-level bindings (#11128) by @IWANABETHATGUY

dev: keep this undefined when calling an imported function in HMR patches and lazy chunks (#11126) by @h-a-n-a

dev: read string-named imports correctly in HMR patches and lazy chunks (#11127) by @h-a-n-a

sanitize preserveModules chunk names after resolving the relative path (#11087) by @waltuov

keep the with clause on bare external imports (#11100) by @IWANABETHATGUY

generator: filter DISABLE_JS_HOOK bits from generated HookUsage (#10346) by @Brooooooklyn

dev: make the module factory async for top-level await (#11118) by @h-a-n-a

node: give each renderChunk call its own meta object (#11115) by @Brooooooklyn

honor externalLiveBindings for imported exports (#11048) by @camc314

dev: keep a late payload from replacing newer module code (#11030) by @h-a-n-a

binding: use-after-free in async transform with a TsconfigCache (#11080) by @shulaoda

fail on chunk syntax errors and escape export names once (#11051) by @hyfdev

dev: ship newly imported modules the client never received (#11029) by @h-a-n-a

code-splitting: avoid cycles from redundant re-export initialization (#11073) by @hyfdev

link: treat re-exports of the same external binding as one export (#11069) by @IWANABETHATGUY

escape namespace properties in IIFE and UMD output (#11085) by @hyfdev

escape dependency paths in CJS and UMD output (#11084) by @hyfdev

use computed access for arbitrary import names (#11083) by @hyfdev

generate valid bindings for shimmed exports (#11082) by @hyfdev

dev: reload the page when an HMR update fails after merging its edit (#11031) by @h-a-n-a

dev/lazy: ship the deps of a module that a patch shipped but never ran (#11028) by @h-a-n-a

code-splitting: don't move init calls in front of unwrapped JSON modules (#11062) by @IWANABETHATGUY

escape export names in defineProperty calls (#11047) by @camc314

📚 Documentation

say the CLI bundles multiple configs one after another (#11111) by @Brooooooklyn

add renderChunk hook filter docs (#11065) by @sapphi-red

⚡ Performance

use concat_string! instead of format! for plain string joins (#11139) by @IWANABETHATGUY

utils: evaluate each concat_string! argument once (#11105) by @IWANABETHATGUY

json: escape JSON.parse string with json-escape-simd (#11104) by @IWANABETHATGUY

unwrap JSON modules with a non-object root (#11066) by @IWANABETHATGUY

... (truncated)

Commits

f7de35f release: v1.2.13 (#11144)
4229721 chore(deps): upgrade oxc to 0.153.0 (#11109)
0f60926 fix(devtools): honor devtools.sessionId
f918ebb feat(inline-common-chunks): deduplicate shared code along known loading paths...
047cec1 fix: sanitize preserveModules chunk names after resolving the relative path (...
37f4b00 fix(generator): filter DISABLE_JS_HOOK bits from generated HookUsage (#10346)
d0e7203 feat(dev): add experimental.devMode.hotUpdate option (#11123)
4f53338 fix(node): give each renderChunk call its own meta object (#11115)
fdd3604 docs: say the CLI bundles multiple configs one after another (#11111)
ddabe04 chore(deps): update napi (#11108)
Additional commits viewable in compare view

Bumps the dependencies group with 3 updates: github/codeql-action/init, github/codeql-action/analyze and actions/setup-node.

Updates github/codeql-action/init from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.38.2 to 4.38.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.3

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205

4.38.3 - 08 Oct 2026

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188

Update default CodeQL bundle version to 2.27.2. #4203

Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124

The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072

Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

24c5418 Merge pull request #4214 from github/update-v4.38.3-e0b52dbdc
69e87c5 Add changelog note for #4184
23b6828 Update changelog for v4.38.3
e0b52db Merge pull request #4210 from github/henrymercer/pin-python-for-older-clis-in-ci
6b99698 Pin Python 3.13.15 for older CLI versions in multi-language check
63d3d63 Merge pull request #4203 from github/update-bundle/codeql-bundle-v2.27.2
7377a10 Add changelog note
c1a30cd Update default bundle to codeql-bundle-v2.27.2
d208ec7 Merge pull request #4200 from github/mbg/esm/migrate-pr-checks
a71b0c6 Replace __dirname in sync.ts
Additional commits viewable in compare view

Updates actions/setup-node from 7.0.0 to 7.1.0

Release notes

Sourced from actions/setup-node's releases.

v7.1.0

What's Changed

Enhancements:

Add support for mise.toml file by @gperdomor in actions/setup-node#1421

Support absolute paths in node-version-file by @v-mahabaleshwars in actions/setup-node#1633

Bug fixes:

Add Node version validation and manifest fetch retry by @v-jitenderpalsingh in actions/setup-node#1580

Documentation updates:

README.md: bump actions/checkout to latest version 7 by @deining in actions/setup-node#1578

docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by @v-gowridurgad in actions/setup-node#1593

Fixed cache recommendation syntax by @SubJunk in actions/setup-node#1603

Dependency updates:

Update workflow pins and migrate Node matrices to modern versions by @v-HarithaVattikuti in actions/setup-node#1583

Upgrade @actions/cache to 6.2.0 by @philip-gai in actions/setup-node#1584

Pin @types/node to v24 by @v-priyagupta108 in actions/setup-node#1585

Override brace-expansion to 5.0.8 by @v-priyagupta108 with @Copilot in actions/setup-node#1599

Upgrade actions/checkout from 7.0.0 to 7.0.1 by @dependabot in actions/setup-node#1598

Upgrade prettier from 3.8.4 to 3.9.6 by @dependabot in actions/setup-node#1590

Upgrade @vercel/ncc from 0.44.0 to 0.45.0 by @dependabot in actions/setup-node#1610

Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot in actions/setup-node#1602

Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by @dependabot in actions/setup-node#1629

Upgrade @types/semver from 7.7.1 to 7.8.0 by @dependabot in actions/setup-node#1616

Upgrade @typescript-eslint/parser from 8.62.0 to 8.70.0 by @dependabot in actions/setup-node#1615

Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot in actions/setup-node#1631

Upgrade jest-each from 30.4.1 to 30.5.2 by @dependabot in actions/setup-node#1636

Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by @dependabot in actions/setup-node#1638

Update dependencies and add license files by @v-HarithaVattikuti in actions/setup-node#1642

Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 by @dependabot in actions/setup-node#1635

New Contributors

@v-jitenderpalsingh made their first contribution in actions/setup-node#1580

@philip-gai made their first contribution in actions/setup-node#1584

@gperdomor made their first contribution in actions/setup-node#1421

@SubJunk made their first contribution in actions/setup-node#1603

Full Changelog: actions/setup-node@v7.0.0...v7.1.0

Commits

949feb2 Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0 (#1635)
7207c4f chore: update dependencies and add license files (#1642)
54337e0 Bump eslint-plugin-n from 18.1.0 to 18.3.0 (#1638)
fb54fa8 Bump jest-each from 30.4.1 to 30.5.2 (#1636)
7f84f1d Bump pnpm/action-setup from 6.0.10 to 6.1.0 (#1631)
0c54c7b Bump @typescript-eslint/parser from 8.62.0 to 8.70.0 (#1615)
a829419 Bump @types/semver from 7.7.1 to 7.8.0 (#1616)

Bumps the dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.71.0` | `0.72.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.86.0` | `1.87.0` | | [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) | `7.0.2003` | `7.0.2004` | | [rolldown](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.2.12` | `1.2.13` | Updates `@types/node` from 26.6.4 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `oxfmt` from 0.71.0 to 0.72.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.72.0/npm/oxfmt) Updates `oxlint` from 1.86.0 to 1.87.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.87.0/npm/oxlint) Updates `oxlint-tsgolint` from 7.0.2003 to 7.0.2004 - [Release notes](https://github.com/oxc-project/tsgolint/releases) - [Commits](oxc-project/tsgolint@v7.0.2003...v7.0.2004) Updates `rolldown` from 1.2.12 to 1.2.13 - [Release notes](https://github.com/rolldown/rolldown/releases) - [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rolldown/rolldown/commits/v1.2.13/packages/rolldown) chore: Bump the dependencies group with 3 updates Bumps the dependencies group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [actions/setup-node](https://github.com/actions/setup-node). Updates `github/codeql-action/init` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@2892aa5...24c5418) Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: oxfmt dependency-version: 0.72.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: oxlint dependency-version: 1.87.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: oxlint-tsgolint dependency-version: 7.0.2004 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: rolldown dependency-version: 1.2.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

codecov · 2026-10-14T16:11:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026

alex289 approved these changes Oct 14, 2026

View reviewed changes

alex289 merged commit 4c0760c into main Oct 14, 2026
8 checks passed

alex289 deleted the dependabot/dependencies-024aadd993 branch October 14, 2026 16:58

Navigation Menu

Repository navigation

chore: Bump the "dependencies" group with 2 updates across multiple ecosystems - #26

chore: Bump the "dependencies" group with 2 updates across multiple ecosystems#26
alex289 merged 1 commit into
mainfrom
dependabot/dependencies-024aadd993

dependabot Bot commented on behalf of github Oct 14, 2026

Uh oh!

codecov Bot commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026

oxfmt v0.72.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

⚡ Performance

📚 Documentation

oxlint v1.87.0

🚀 Features

🐛 Bug Fixes

Changelog

[1.88.0] - 2026-10-13

🚀 Features

v7.0.2004

What's Changed

New Contributors

v1.2.13

[1.2.13] - 2026-10-07

🚀 Features

🐛 Bug Fixes

📚 Documentation

⚡ Performance

[1.2.13] - 2026-10-07

🚀 Features

🐛 Bug Fixes

📚 Documentation

⚡ Performance

v4.38.3

CodeQL Action Changelog

[UNRELEASED]

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

v4.38.3

CodeQL Action Changelog

[UNRELEASED]

4.38.3 - 08 Oct 2026

4.38.2 - 24 Sept 2026

4.38.1 - 18 Sept 2026

4.38.0 - 09 Sept 2026

4.37.9 - 26 Aug 2026

4.37.8 - 21 Aug 2026

4.37.7 - 13 Aug 2026

4.37.6 - 04 Aug 2026

4.37.5 - 03 Aug 2026

4.37.4 - 29 Jul 2026

v7.1.0

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency updates:

New Contributors

Uh oh!

codecov Bot commented Oct 14, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant