Skip to content

deps(client)(deps-dev): bump the all-deps group across 1 directory with 9 updates - #199

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/client/all-deps-c3ae668eab
Closed

deps(client)(deps-dev): bump the all-deps group across 1 directory with 9 updates#199
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/client/all-deps-c3ae668eab

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-deps group with 9 updates in the /packages/client directory:

Package From To
@microsoft/api-extractor 7.58.9 7.58.12
@types/node 25.9.3 26.1.2
@typescript-eslint/parser 8.61.0 8.65.0
eslint 10.5.0 10.8.0
prettier 3.8.4 3.9.6
rollup 4.62.0 4.62.3
swagger-typescript-api 12.0.4 13.12.6
ts-jest 29.4.11 29.4.12
typescript 6.0.3 7.0.2

Updates @microsoft/api-extractor from 7.58.9 to 7.58.12

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.58.12

Tue, 21 Jul 2026 02:53:22 GMT

Patches

  • Improve the performance of the internal excerpt token condensing algorithm from O(n^2) to O(n) by eliminating repeated array splicing and per-merge bookkeeping.

7.58.11

Fri, 17 Jul 2026 00:15:59 GMT

Version update only

7.58.10

Thu, 16 Jul 2026 00:16:13 GMT

Version update only

Commits
  • f1c7396 Bump versions [skip ci]
  • 75089a6 Update changelogs [skip ci]
  • a0f04af [api-extractor] Fix O(n^2) condenseTokens cost (#5878)
  • 99e0e61 Forbid private static members and refactor existing usages to module scope ...
  • 5e32c62 chore: bump decoupled local dependencies (#5879)
  • 6bb6a2b Bump versions [skip ci]
  • b1b4b14 Update changelogs [skip ci]
  • ddfc8af chore: bump decoupled local dependencies (#5873)
  • 3cde295 Bump versions [skip ci]
  • 65b8144 Update changelogs [skip ci]
  • Additional commits viewable in compare view

Updates @types/node from 25.9.3 to 26.1.2

Commits

Updates @typescript-eslint/parser from 8.61.0 to 8.65.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
  • typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

  • support parsing import defer (#12513)
  • eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
  • typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

  • eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

  • remove redundant package.json "files" (#12444)

❤️ Thank You

... (truncated)

Commits
  • 63ba81b chore(release): publish 8.65.0
  • eaf4576 feat: add warning when TS 7 is detected (#12529)
  • d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
  • 0d06406 chore: add attw validation to repo (#12437)
  • c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
  • 414d9ab chore(release): publish 8.64.0
  • 290cf6c chore(release): publish 8.63.0
  • 3ea32f4 chore(release): publish 8.62.1
  • 54e2857 chore(release): publish 8.62.0
  • 81e4c26 feat: remove redundant package.json "files" (#12444)
  • Additional commits viewable in compare view

Updates eslint from 10.5.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

  • 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

  • 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
  • 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
  • e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
  • 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
  • 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
  • b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

  • 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
  • 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
  • 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
  • 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
  • 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
  • d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
  • eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
  • c5963f7 docs: Update README (GitHub Actions Bot)

Chores

  • 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
  • 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
  • eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
  • e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
  • e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
  • ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
  • 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
  • fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
  • 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
  • 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
  • a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
  • 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
  • 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
  • a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
  • c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
  • 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
  • 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
  • dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
  • 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
  • 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
  • d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
  • bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

  • cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
  • f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits

Updates prettier from 3.8.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

  • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

🔗 Changelog

3.9.1

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Updates rollup from 4.62.0 to 4.62.3

Release notes

Sourced from rollup's releases.

v4.62.3

4.62.3

2026-07-26

Bug Fixes

  • Sanitize illegal characters preserved modules input base (#6439)

Pull Requests

v4.62.2

4.62.2

2026-06-19

Bug Fixes

  • Do not add spurious side-effect-free external imports to chunks when using minChunkSize (#6411)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.62.3

2026-07-26

Bug Fixes

  • Sanitize illegal characters preserved modules input base (#6439)

Pull Requests

4.62.2

2026-06-19

Bug Fixes

  • Do not add spurious side-effect-free external imports to chunks when using minChunkSize (#6411)

Pull Requests

... (truncated)

Commits
  • a80a197 4.62.3
  • e87e19b Update audit resolve
  • 72f98e9 Fix build:docs after rollup update (#6460)
  • e3821cd fix: make isLegal idempotent by not using a global-flag regex (#6432)
  • db0c477 Sanitize input base before computing preserved module chunk names (#6439)
  • a65f21c chore(deps): update dependency magic-string to v1 (#6457)
  • a43aae4 docs: fix broken commonjs namedExports link in troubleshooting (#6455)
  • 41c28d7 chore(deps): lock file maintenance (#6459)
  • 894136e chore(deps): update dtolnay/rust-toolchain digest to 4cda84d (#6446)
  • fad0ba3 fix(deps): update swc monorepo (major) (#6458)
  • Additional commits viewable in compare view

Updates swagger-typescript-api from 12.0.4 to 13.12.6

Release notes

Sourced from swagger-typescript-api's releases.

v13.12.6

Patch Changes

v13.12.5

Patch Changes

v13.12.4

Patch Changes

v13.12.3

Patch Changes

v13.12.2

Patch Changes

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped enum string values in generated TypeScript enums

    Malicious OpenAPI specs could embed arbitrary JavaScript in components.schemas.*.enum string values. Ts.StringValue wrapped values in double quotes without escaping, allowing attackers to break out of generated enum declarations and inject code that executes at module load when consumers import the generated client. Enum string values are now properly escaped.

    Reported by @​thegr1ffyn: GHSA-5f94-x226-ccpm.

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped servers[0].url in generated axios and fetch HTTP clients

    Malicious OpenAPI specs could embed arbitrary JavaScript in servers[0].url. The value was interpolated raw into string literals in generated client constructors, allowing computed-property-key injection and arbitrary code execution when consumers instantiated HttpClient or Api (axios) or imported the generated module (fetch). apiConfig.baseUrl is now escaped once at the source before template rendering.

    Reported by @​thegr1ffyn: GHSA-38c3-wv3c-v3xj (axios), GHSA-hqj5-cw9f-rx67 (fetch).

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped OpenAPI path strings in generated method bodies

    Malicious OpenAPI specs could embed arbitrary JavaScript in path keys. Values were interpolated raw into template literals in generated API methods, so ${…} expressions ran with full process privileges on every call to the affected method. Route paths are now escaped for template-literal insertion while preserving deliberate ${paramName} interpolations for declared path parameters.

    Reported by @​thegr1ffyn: GHSA-w284-33mx-6g9v.

  • #1779 306d59a Thanks @​js2me! - Fix authorization-token exfiltration and SSRF via spec $ref during remote schema resolution

    When generating from a remote OpenAPI spec, the generator walked every external $ref and fetched any http(s):// URL without validating the target. A malicious spec could force HTTP requests to loopback, RFC-1918, link-local (including cloud metadata at 169.254.169.254), or internal hostnames reachable from the generator process. Redirect chains were also followed without re-validation.

    Remote schema fetches now enforce a defense-in-depth policy:

    • Block private, link-local, and loopback addresses (IPv4 and IPv6), including localhost

... (truncated)

Changelog

Sourced from swagger-typescript-api's changelog.

13.12.6

Patch Changes

13.12.5

Patch Changes

13.12.4

Patch Changes

13.12.3

Patch Changes

13.12.2

Patch Changes

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped enum string values in generated TypeScript enums

    Malicious OpenAPI specs could embed arbitrary JavaScript in components.schemas.*.enum string values. Ts.StringValue wrapped values in double quotes without escaping, allowing attackers to break out of generated enum declarations and inject code that executes at module load when consumers import the generated client. Enum string values are now properly escaped.

    Reported by @​thegr1ffyn: GHSA-5f94-x226-ccpm.

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped servers[0].url in generated axios and fetch HTTP clients

    Malicious OpenAPI specs could embed arbitrary JavaScript in servers[0].url. The value was interpolated raw into string literals in generated client constructors, allowing computed-property-key injection and arbitrary code execution when consumers instantiated HttpClient or Api (axios) or imported the generated module (fetch). apiConfig.baseUrl is now escaped once at the source before template rendering.

    Reported by @​thegr1ffyn: GHSA-38c3-wv3c-v3xj (axios), GHSA-hqj5-cw9f-rx67 (fetch).

  • #1779 306d59a Thanks @​js2me! - Fix code injection via unescaped OpenAPI path strings in generated method bodies

    Malicious OpenAPI specs could embed arbitrary JavaScript in path keys. Values were interpolated raw into template literals in generated API methods, so ${…} expressions ran with full process privileges on every call to the affected method. Route paths are now escaped for template-literal insertion while preserving deliberate ${paramName} interpolations for declared path parameters.

    Reported by @​thegr1ffyn: GHSA-w284-33mx-6g9v.

  • #1779 306d59a Thanks @​js2me! - Fix authorization-token exfiltration and SSRF via spec $ref during remote schema resolution

... (truncated)Description has been truncated

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 1, 2026
@dependabot
deps(client)(deps-dev): bump the all-deps group across 1 directory wi…
5770864 
…th 9 updates

Bumps the all-deps group with 9 updates in the /packages/client directory:

| Package | From | To |
| --- | --- | --- |
| [@microsoft/api-extractor](https://github.com/microsoft/rushstack/tree/HEAD/apps/api-extractor) | `7.58.9` | `7.58.12` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.3` | `26.1.2` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.61.0` | `8.65.0` |
| [eslint](https://github.com/eslint/eslint) | `10.5.0` | `10.8.0` |
| [prettier](https://github.com/prettier/prettier) | `3.8.4` | `3.9.6` |
| [rollup](https://github.com/rollup/rollup) | `4.62.0` | `4.62.3` |
| [swagger-typescript-api](https://github.com/acacode/swagger-typescript-api) | `12.0.4` | `13.12.6` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.11` | `29.4.12` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |



Updates `@microsoft/api-extractor` from 7.58.9 to 7.58.12
- [Changelog](https://github.com/microsoft/rushstack/blob/main/apps/api-extractor/CHANGELOG.md)
- [Commits](https://github.com/microsoft/rushstack/commits/@microsoft/api-extractor_v7.58.12/apps/api-extractor)

Updates `@types/node` from 25.9.3 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@typescript-eslint/parser` from 8.61.0 to 8.65.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser)

Updates `eslint` from 10.5.0 to 10.8.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.5.0...v10.8.0)

Updates `prettier` from 3.8.4 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.4...3.9.6)

Updates `rollup` from 4.62.0 to 4.62.3
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.62.0...v4.62.3)

Updates `swagger-typescript-api` from 12.0.4 to 13.12.6
- [Release notes](https://github.com/acacode/swagger-typescript-api/releases)
- [Changelog](https://github.com/acacode/swagger-typescript-api/blob/main/CHANGELOG.md)
- [Commits](acacode/swagger-typescript-api@12.0.4...v13.12.6)

Updates `ts-jest` from 29.4.11 to 29.4.12
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.4.11...v29.4.12)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: "@microsoft/api-extractor"
  dependency-version: 7.58.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-deps
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-deps
- dependency-name: eslint
  dependency-version: 10.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-deps
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-deps
- dependency-name: rollup
  dependency-version: 4.62.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: swagger-typescript-api
  dependency-version: 13.12.6
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-deps
- dependency-name: ts-jest
  dependency-version: 29.4.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-deps
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/packages/client/all-deps-c3ae668eab branch from 98c96d9 to 5770864 Compare August 1, 2026 16:01
@brianhdk brianhdk closed this Aug 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@brianhdk
brianhdk deleted the dependabot/npm_and_yarn/packages/client/all-deps-c3ae668eab branch August 1, 2026 16:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@brianhdk