build(deps-dev): Bump the npm-dev group with 12 updates

[dependabot]

Bumps the npm-dev group with 12 updates:

Package	From	To
eslint	10.11.0	10.12.0
eslint-plugin-jsdoc	65.0.1	65.2.0
knip	6.39.0	6.40.0
esmock	2.7.6	2.7.7
execa	10.0.1	10.1.0
testdouble	3.21.1	3.23.0
supertest	7.3.0	7.3.1
@types/node	26.6.3	26.6.4
cssnano	9.1.2	9.3.2
handlebars	4.7.9	4.7.10
postcss	8.5.28	8.5.29
traverse	0.6.11	0.6.14

Updates eslint from 10.11.0 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

Commits

• a438ec3 10.12.0
• 32a73f1 Build: changelog update for 10.12.0
• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
• 152067f chore: update ecosystem plugins (#21362)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
• 67eb586 docs: Update README
• bfaea12 perf: cache normalized config globals per languageOptions (#21364)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
• d166567 chore: update dependency prettier to v3.9.9 (#21371)
• Additional commits viewable in compare view

Updates eslint-plugin-jsdoc from 65.0.1 to 65.2.0

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v65.2.0

65.2.0 (2026-10-07)

Features

• check-alignment: add ignoreEmptyLines option; fixes #1789 (2095a3d)

v65.1.0

65.1.0 (2026-10-04)

Bug Fixes

• check-indentation: avoid resetting section indent with inline tags; fixes #1786 (c8bcbb7)

Features

• check-syntax: add enableFixer option to replace Closure-style optional types (5f15574)
• check-syntax: fix optional types on all tags and over several lines, address review (b5db366)

v65.0.2

65.0.2 (2026-10-02)

Bug Fixes

• check-indentation: report opening-line indentation on that line (#1785) (d2dfede)

Commits

• 2095a3d feat(check-alignment): add ignoreEmptyLines option; fixes #1789
• c8bcbb7 fix(check-indentation): avoid resetting section indent with inline tags; fi...
• b5db366 feat(check-syntax): fix optional types on all tags and over several lines, ...
• 5f15574 feat(check-syntax): add enableFixer option to replace Closure-style optio...
• 05e2ffe docs: fix wrong rule name and typos (#1787)
• d2dfede fix(check-indentation): report opening-line indentation on that line (#1785)
• 33203d2 chore(deps): bump serialize-javascript from 7.1.1 to 7.1.2 (#1784)
• 2f2c252 chore(deps): bump moment from 2.30.1 to 2.31.0 (#1783)
• See full diff in compare view

Updates knip from 6.39.0 to 6.40.0

Release notes

Sourced from knip's releases.

Release 6.40.0

• Resolve local and scope-only extends in commitlint plugin (#2079) (e667552d4e7122094565d3ad9ae407acfc0ac684) - thanks @​giaBaoJS!
• Clarify worktree guides and plugin review preparation (dd02baf020d23af1d47c44c1a726a61014b270bd)
• Document stale cache results and workarounds (#2078) (3573749a5d5bbee6305f207cc7d1b72c200c8c9b)
• Exclude test files from package entries in production mode (resolve #2082) (b86f45f9d38d4b83baad98e43983e08910e00c78) - thanks @​jonathanong!
• Resolve Serverless file variables in plugins and functions (resolve #2074) (99cac789694ea8d76cd38184d2d7c95f34315224) - thanks @​SwastikTripathi!
• Preserve locally referenced namespace members (resolve #2070) (f0f36df766cd74ad7ae03fbf8940bdeb792439be) - thanks @​MFA-G!
• fix: add the commitlint-plugin prefix to Commitlint plugin names (#2096) (3decd35ff0a4220c7cd2c9142dc69c89794b3927) - thanks @​devYRPauli!
• fix: match .mjs config files in the simple-git-hooks plugin (#2097) (79a87d92396c2444ae4ef3c780c0d2e18cd73e4c) - thanks @​devYRPauli!
• fix: match capacitor.config.js in the Capacitor plugin (#2098) (4a5ec96d818117a7f2eafa027e3b707bc97573a8) - thanks @​devYRPauli!
• fix(typescript): ArrayExpression (#2099) (#2100) (87fea9f201c2fd864eafa31bdad68910a8a177ba) - thanks @​DreamLongYT!
• Preserve development entry pattern groups (7c229f4e1918075d801ed3b046fa022b1d3bcc41)
• Resolve null package exports to the files they hide (resolve #2084, close #2085) (5bd46260feb60b957c2631bc72375ef192e441e0)
• Pin InvokeAI ecosystem test (4e0a3432eb35e3f628f6d3b7fcd14b942de343d0)
• fix(utils): add jsx extension to source mapping (#2087) (eaa353b5fc30c2f12cdf2c29e6dd68e0d0950062) - thanks @​DreamLongYT!
• fix(serverless-framework): handle explicit extensions in handler paths (#2091) (e9393965be7563640921e3f20c946fcb9132e1cb) - thanks @​DreamLongYT!
• Annotate published manifest return type (d95a8310a0d0dca8f23d8dd3f83e7b0a1909d038)
• Add Jasmine plugin (#2105) (9ed14911d5c5752aef36878ab3d515c35d1ac6bc) - thanks @​SulimanAbdulrazzaq!
• fix: resolve workspace exports with fallback arrays (#2088) (49c2aaeaba4544f25cc02c19d5da5152a8ef68c3) - thanks @​DreamLongYT!
• fix(postcss): ignore disabled plugins in object configs (#2092) (b84fdf8a8ee676ee45f4313009ebfe969d034a88) - thanks @​DreamLongYT!
• Resolve webServer commands in Playwright plugin (#2110) (1af96bce36b0d0d07791de100c7f2ea5672a478c) - thanks @​everton-dgn!
• Cache config file inputs per plugin (#2109) (01cb43267ca5dc03a2cbcba0a19fd891d4ed1f37) - thanks @​everton-dgn!
• fix: include custom compiler extensions in source path mapping (#2090) (dc3a47e2d810808314454b8f5c23070f136d15d3) - thanks @​DreamLongYT!
• Don't let a self-closing swallow the next (#2113) (989fdadde0a068d1d1c52e26a8327b99c5de0668) - thanks @​maniflopi!
• fix(oxlint): resolve lint from loaded Vite config (#2108) (6d44e532ed6320cdf4f4c3253b26e155c4d26ba7) - thanks @​everton-dgn!
• fix: resolve Jest module names without the jest-* prefix (#2095) (a5f4cfbff7f263a0ea8d5461a3f9216cbef38602) - thanks @​devYRPauli!
• Resolve Vitest paths from the top-level root (resolve #2114) (#2119) (8a495d424cf60cab502c5c5ea476a3c761a9da6d) - thanks @​SwastikTripathi!
• fix(rsbuild): detect config from tools.rspack inside rsbuild config (#2077) (c4ed619d5352b1d7b9ffaacc8c75d247eef39517) - thanks @​TkDodo!
• Add osls plugin (#2104) (a8bf4bfaeba2ee0aaf756b343789de9fff75a1fa) - thanks @​bytedoe!
• Explain why types in signatures of used exports are not reported (61f5cc02e6b4e895dbd8507ab845ae30f073211b)
• Update sponsors page (7ea33fa2c116c29e2c131bda900aaf7b9073a3ff)
• Edit docs (b459d7c3ad6d5535fd7646d93022a2974641ccd9)

Commits

• dd6d422 Release knip@6.40.0
• a8bf4bf Add osls plugin (#2104)
• c4ed619 fix(rsbuild): detect config from tools.rspack inside rsbuild config (#2077)
• 8a495d4 Resolve Vitest paths from the top-level root (resolve #2114) (#2119)
• a5f4cfb fix: resolve Jest module names without the jest-* prefix (#2095)
• 6d44e53 fix(oxlint): resolve lint from loaded Vite config (#2108)
• 989fdad Don't let a self-closing <script /> swallow the next <script> (#2113)
• dc3a47e fix: include custom compiler extensions in source path mapping (#2090)
• 01cb432 Cache config file inputs per plugin (#2109)
• 1af96bc Resolve webServer commands in Playwright plugin (#2110)
• Additional commits viewable in compare view

Updates esmock from 2.7.6 to 2.7.7

Release notes

Sourced from esmock's releases.

prefer registerHooks over deprecated register

This release fixes a deprecation warning notice for module.register calls; recommended module.registerHooks is called when the environment defines that.

Actual changes are small. For registerHooks, deprecated module.register functions were copy-pasted and converted to sync from async,

• update github ci actions
• use module.registerHooks when defined, resolves module.register deprecation warning
• increment eslint and lint-related

Changelog

Sourced from esmock's changelog.

changelog

• 2.7.9 Oct.08.2026
  • include esmockLoader.deprecated.js in published src directory as esbuild output to provide full import tree for that module
• 2.7.8 Oct.08.2026
  • unpublished version 2.7.7
  • include esmockLoader.deprecated.js in published src directory
• 2.7.7 Oct.06.2026
  • update github ci actions
  • use module.registerHooks when defined, resolves module.register deprecation warning
  • increment eslint and lint-related
• 2.7.6 May.27.2026
  • update test-coverage badge to reference "main" branch,
  • specify node v24 at build+publish ci-job
  • increment eslint and lint-related
  • increment resolvewithplus, resolves wildcard-export-related issue. see iambumblehead/resolvewithplus#76
• 2.7.5 May.09.2026
  • migrate to eslint 10
  • migrate to @​eslint/markdown
  • remove c8 test-coverage package, use node's --test-cover
• 2.7.4 May.04.2026
  • update tests to resolve tests that began to fail,
  • add suuport for typescript modules, no tests, thanks @​mbrevda,
  • add node 25.x to test matrix,
  • disable tests using node-ts (seems un-maintained),
  • windows tests are disabled for "tests-node", lacking windows env to resolve
• 2.7.3 Sep.12.2025
  • drop node version 18 and 20 from tests.
  • increment some dependencies and reduce audit warnings.
  • restore ava and all other disabled test-runner tests
• 2.7.2 Sep.01.2025
  • increment resolvewithplus, match exact export paths, thanks @​matz3
• 2.7.1 Jul.01.2025
  • added node v24 to test matrix
• 2.7.0 Jan.24.2025
  • update resolver to correctly resolve openai package
  • update typescript-eslint
• 2.6.9 Oct.18.2024
  • added --glob option for rimraf usage removing un-used sources
  • added node v23 to test matrix
  • resolve v23-related error when module.exports is exported
• 2.6.8 Oct.17.2024
  • added pnpm unit-test, thanks @​darcyrush
  • resolve issue for pnpm by escaping '+' char in regexp
  • add log utility function for debugging loader
  • dropped ava and jest from test sequence, node v22 --loader issues
• 2.6.7 Jul.16.2024
  • add swc tests and remove swc caution from README thanks @​Brooooooklyn
  • unpin node 22.1 at test CI and use latest 22.x
• 2.6.6 Jun.15.2024

... (truncated)

Commits

• 5493dff Merge pull request #344 from iambumblehead/update-eslint
• 35f2dfa increment eslint and related
• b22e0d8 Merge pull request #343 from iambumblehead/use-module-registerhooks-when-defined
• 4f75191 remove unused export initialize from new esmockLoader.js
• bb5c19f remove nextResolve wrapper at newer esmockLoader.js, call nextResolve directly
• 07867a3 update condition
• 6dcf614 update link at CHANGELOG
• fe4b1f7 use module.registerHooks when defined
• 5cb8265 Merge pull request #341 from iambumblehead/update-ci-actions
• e7010cd update changelog
• Additional commits viewable in compare view

Updates execa from 10.0.1 to 10.1.0

Release notes

Sourced from execa's releases.

v10.1.0

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

• extendEnv: false without the env option no longer inherits process.env, per docs 67acf60
• Windows: Arguments of .cmd and .bat files are now escaped like Rust does, which fixes batch files reading %~1 (#1261) 93bddc4
• Invalid stdio values, such as negative file descriptors, now throw c6bd387
• Using the same file as input and output now throws, even when the paths are written differently 587045a
• Synchronous methods now enforce per-file-descriptor maxBuffer values 9547e51
• Synchronous methods now throw on the signal option, like asynchronous methods 59de065
• Synchronous methods now write the raw output bytes to files, like asynchronous methods af6264a

Fixes

• Fix subprocess.kill() signaling the current process group when the subprocess failed to spawn 5464d43
• Fix crashes when spawning fails with EMFILE/ENFILE (#1262), or when a file target cannot be opened 15c46cd 1cee524
• Fix error.stdout and error.stderr being undefined when synchronous methods fail to spawn (#1263) bfe4633
• Fix the subprocess promise hanging until an output stream is read 004f3b3
• Fix subprocess.pipe() with the stdio option, and destination subprocesses left running 8d3f0a9 ecda56b
• Fix result.all when only some file descriptors are buffered or split into lines 758768f
• Fix the encoding option and line splitting in transforms 6adb3c3
• Fix input and output transforms with synchronous methods 516a5e2 e0b5dbc
• Fix template strings with emojis and line continuations b67f199
• Fix killDescendants signaling unrelated processes on Windows 9c5c71c
• Fix IPC with serialization: 'json', strict: true and the verbose option 9842f1a 698a1b8 b548d8b
• Fix the subprocess error being hidden when the current directory was deleted 91d9ded
• Fix shebang scripts on Windows when the file is small 7c1a631

---

sindresorhus/execa@v10.0.1...v10.1.0

Commits

• 63ddae6 10.1.0
• cfac59f Fix CI
• 1cee524 Fix an uncaught error when a file target cannot be opened and the subprocess ...
• 15c46cd Fix execa() crashing when spawning fails with EMFILE or ENFILE
• 54d7404 Tweaks
• bfe4633 Fix execaSync() returning undefined output when the subprocess fails to s...
• 93bddc4 Fix arguments of Windows batch files that read them with %~1
• af6264a Fix execaSync() writing decoded text instead of the output's bytes to files
• ecda56b Report null pipe options as a rejection
• 698a1b8 Tweaks
• Additional commits viewable in compare view

Updates testdouble from 3.21.1 to 3.23.0

Changelog

Sourced from testdouble's changelog.

3.23.0

• Add support for replacing third-party ES modules under pnpm by updating quibble to 0.12.1. td.replaceEsm('some-package') used to look the package up from quibble's own directory. Under pnpm, that lookup either couldn't find the package (Cannot find package 'some-package') or found a different copy than the one the test imports, and replaced that copy instead #546 quibble#123 quibble#84
• Fix td.replaceEsm('some-package') of a CommonJS package failing on Node 24+ with SyntaxError: Unexpected token '.' quibble#125
• Behavior change: td.replaceEsm() now looks up a package by name from the test file that calls it, the same way it already resolved relative paths. When the test file and testdouble.js see different copies of a package, the test file's copy is now the one replaced. A package the test file can't resolve can no longer be replaced by name

3.22.0

• Fix unbounded memory growth when replacing ES modules by updating quibble to 0.11.0. Quibble used to re-evaluate, and permanently retain, every module imported after a td.replaceEsm() call, including modules that had nothing to do with the replacement. It now only does that for modules that are replaced or that import one that is, so memory plateaus instead of growing with every test #534 quibble#122
• Behavior change: an ES module that nothing replaced can reach is now a single instance for the life of the process, where it used to get a fresh one after every td.replaceEsm() or td.reset(). Module-level state in such a module (counters, caches, singletons) now persists between tests. Modules that are replaced, or that import a replaced module, are still re-evaluated against each new replacement, so the documented td.replaceEsm() then import() pattern works as before

Commits

• c415c49 3.23.0
• 805e5c5 Add changelog entry for 3.23.0
• e75a031 Merge pull request #546 from testdouble/pnpm
• 2f5bb31 Bump quibble to 0.12.1
• 4bcfdf9 Add a pnpm example that replaces a third-party ES module
• bc8cb18 Bump version in example lock files
• 2b14484 3.22.0
• aa54585 Add changelog entry for 3.22.0
• bed2b61 Bump quibble to 0.11.0
• 3a9f2f1 Bump version in example lock files
• See full diff in compare view

Updates supertest from 7.3.0 to 7.3.1

Release notes

Sourced from supertest's releases.

v7.3.1

• Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind 884cd26
• fix: bind ephemeral server to the loopback address it connects to e74a1e0

---

forwardemail/supertest@v7.3.0...v7.3.1

Commits

• 3634bdd 7.3.1
• 884cd26 Merge pull request #907 from JH8459/fix/ephemeral-loopback-bind
• e74a1e0 fix: bind ephemeral server to the loopback address it connects to
• See full diff in compare view

Updates @types/node from 26.6.3 to 26.6.4

Commits

• See full diff in compare view

Updates cssnano from 9.1.2 to 9.3.2

Release notes

Sourced from cssnano's releases.

v9.3.2

What's Changed

• fix: merge long selectors by @​ludofischer in cssnano/cssnano#2024
• fix(postcss-ordered-values): improve box-shadow and animation by @​ludofischer in cssnano/cssnano#2025
• fix: relist dev dependency as direct dependency by @​robmisasi in cssnano/cssnano#2027

New Contributors

• @​robmisasi made their first contribution in cssnano/cssnano#2027

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.3.1...cssnano@9.3.2

v9.3.1

What's Changed

Bug Fixes

Fix a crash because of a dependency on an unpublished version of cssnano-utils

• Publish cssnano 9.3.1 in cssnano/cssnano#2023

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.3.0...cssnano@9.3.1

v9.3.0

What's Changed

New Features

• feat: merge non-adjacent rules in cssnano/cssnano#2016

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.2.2...cssnano@9.3.0

v9.2.2

What's Changed

Bug Fixes

• fix(postcss-merge-rules): avoid infinite loop in cssnano/cssnano#2013

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.2.1...cssnano@9.2.2

v9.2.1

What's Changed

• fix(postcss-discard-duplicates): remove redundant sibling at-rules in cssnano/cssnano#2010

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.2.0...cssnano@9.2.1

v9.2.0

Features

• Merge box alignment properties into the place-content, place-items and place-self shorthands, such as align-items:center;justify-items:start into place-items:center start. This only happens when every browser in your Browserslist targets supports the shorthands, because a browser that does not would ignore both alignments. The defaults query includes browsers with unknown support, such as Opera Mini and UC Browser, so it keeps the longhands. Values that use safe, unsafe or last baseline merge only when both values use the same keywords. postcss-merge-longhand now accepts the Browserslist options overrideBrowserslist, stats, path and env.

... (truncated)

Commits

• d07961e Publish cssnano 9.3.1
• eff21d3 chore: add changeset
• 34817fa chore: enforce stricter dependency hoisting
• a92478d Update CONTRIBUTORS.
• 6d8c2a7 Relist dev dependency as direct dependency.
• aa293b8 fix(postcss-ordered-values): improve box-shadow and animation
• 7da50e7 fix(postcss-merge-rules): attempt to merge larger rules
• 4bf193e fix(postcss-merge-longhand): handle column-width 0
• e23f6f1 Publish cssnano 9.3.1
• 73f9166 chore: update pnpm to 12.9.1
• Additional commits viewable in compare view

Updates handlebars from 4.7.9 to 4.7.10

Release notes

Sourced from handlebars's releases.

v4.7.10

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

• security: Sanitize the source map URL when minifying - f37c599
• security: Iterate lazily in #each and strip whitespace in linear time - 812c226
• security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
• security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
• security: Only compile partials that are template strings - c28ee7a
• security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
• security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
• Clarify that --root does not restrict filesystem access - 0fcf25c
• Bump minimist to ^1.2.8 - ea8ed82
• Fix Ruby component publishing documentation - d069c1c
• Fix Composer component definition - 6714e07

Compatibility notes:

• {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Commits

• 45ce152 v4.7.10
• e47b236 Update release notes
• f37c599 Sanitize the source map URL when minifying
• 812c226 Iterate lazily in #each and strip whitespace in linear time
• 609d1b1 Escape <!-- and <script in precompiled output
• ceec388 Don't trust special properties on context data
• c28ee7a Only compile partials that are template strings
• 7d501a5 Only dispatch known node types in the Compiler and Visitor
• 703fdcc Validate AST values in the compiler instead of the parser
• 0fcf25c Clarify that --root does not restrict filesystem access
• Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.29

Release notes

Sourced from postcss's releases.

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• 7ac9026 Do not split list.comma() and list.space() on separators inside comments (#2162)
• ebffa97 Add postcss-smooth-corners plugin
• 57d6401 Speed up source map cleaning
• 7e46a03 Speed up parser
• 7f5c417 Improve </style> protection for the case when beffore nodes have different parts
• 7ba9051 Fix useless ESLint warning
• 12b4161 Update dependencies
• Additional commits viewable in compare view

Updates traverse from 0.6.11 to 0.6.14

Changelog

Sourced from traverse's changelog.

v0.6.14 - 2026-10-05

Commits

• [Fix] an undefined or null options argument is the same as none e3bb15c
• [Fix] get, has: a null or undefined node along the path means the path does not exist eacd4ab

v0.6.13 - 2026-10-05

Commits

• [Fix] set: convert path segments with es-to-primitive c46f7e7

v0.6.12 - 2026-10-05

Fixed

• [Fix] remove, delete: visit every remaining sibling exactly once [#18](https://github.com/ljharb/js-traverse/issues/18)

Commits

• [Fix] set: only follow and create own properties; never write to a built-in prototype 81ccab4
• [Fix] clone, map, immutable forEach: copy an own __proto__ key as an own property 770d9fc
• [Fix] clone, map, immutable forEach: copy boxed primitives instead of sharing them 3e03610
• [Dev Deps] update eslint dabef68
• [Fix] set: do not descend into a property that could not be created as an own property 37a9ebd
• [Fix] remove: a repeated remove() removes the element that took the node's place 940f4d7
• [actions] update workflows 95382f8
• [Tests] clone, map: add a test for a Buffer 3631118
• [Dev Deps] update @ljharb/eslint-config, eslint 5691345
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, es-value-fixtures, eslint, npmignore, tape 3a92419
• [Tests] avoid an io.js 1.x bug with index-like keys in object literals ee21263
• [Refactor] avoid use of a dep e07218c
• [meta] omit some files 60be911
• [Dev Deps] update auto-changelog; remove encoding 79fe607
• [Dev Deps] update eslint f131e8b
• [Deps] update typedarray.p...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.