Chore(deps): Bump the node-minor-patch group across 4 directories with 15 updates

[dependabot]

Bumps the node-minor-patch group with 7 updates in the /backend/compact-connect-ui-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.34.0
@aws-sdk/client-dynamodb	3.1029.0	3.1085.0
@aws-sdk/client-s3	3.1029.0	3.1085.0
@aws-sdk/util-dynamodb	3.996.2	3.996.6
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.7.0
mocha	11.7.5	11.7.6

Bumps the node-minor-patch group with 15 updates in the /backend/compact-connect/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.34.0
@aws-sdk/client-dynamodb	3.1045.0	3.1085.0
@aws-sdk/client-s3	3.1045.0	3.1085.0
@aws-sdk/util-dynamodb	3.996.2	3.996.6
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.7.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1085.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.63.0
@typescript-eslint/parser	8.58.1	8.63.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.0

Bumps the node-minor-patch group with 15 updates in the /backend/cosmetology-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.34.0
@aws-sdk/client-dynamodb	3.1045.0	3.1085.0
@aws-sdk/client-s3	3.1045.0	3.1085.0
@aws-sdk/util-dynamodb	3.996.2	3.996.6
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.7.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1085.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.63.0
@typescript-eslint/parser	8.58.1	8.63.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.0

Bumps the node-minor-patch group with 15 updates in the /backend/social-work-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.34.0
@aws-sdk/client-dynamodb	3.1045.0	3.1085.0
@aws-sdk/client-s3	3.1045.0	3.1085.0
@aws-sdk/util-dynamodb	3.996.2	3.996.6
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.7.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1085.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.63.0
@typescript-eslint/parser	8.58.1	8.63.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.0

Updates @aws-lambda-powertools/logger from 2.32.0 to 2.34.0

Release notes

Sourced from @​aws-lambda-powertools/logger's releases.

v.2.34.0

Summary

This release introduces two new utilities: Signer, for signing HTTP requests to AWS services with SigV4, and Data Masking, for encrypting, decrypting, or irreversibly erasing sensitive fields in your event data.

We've also fixed three bugs affecting Logger and Tracer under [Lambda Managed Instances](https://docs.aws.amazon.com/lambda/latest/dg/managed-instances.html(LMI) concurrency, where multiplexing several invocations into the same execution environment could cause log lines and X-Ray trace data from one invocation to leak into another.

On top of that, Metrics now supports automatic flushing via the using keyword, Parameters gained an opt-in throwOnMissing option to fail fast on missing values, and Idempotency now warns when a shared persistence layer instance receives a reconfiguration it silently ignores. We've also fixed a Metrics bug where a metric name colliding with a dimension or metadata key could silently corrupt the CloudWatch EMF payload, along with a couple of HTTP Router fixes: a crash affecting bundles that don't install Metrics, and unreachable routes caused by trailing slashes.

⭐ Congratulations to @​kimnamu for their first PR merged in the project and thank you to @​vishwakt and @​Zelys-DFKH for their contributions too. 🎉

Signer

The new @aws-lambda-powertools/signer package signs HTTP requests using AWS Signature Version 4 (SigV4), so you can call IAM-authenticated endpoints — API Gateway, Lambda function URLs, AppSync — from within your Lambda functions.

Signing and sending are kept separate: SigV4Signer signs a web-standard Request and performs no network I/O, while createSignedFetcher gives you a drop-in signed fetch for when you just want to sign and send in one step. By default, the signer reads credentials and region from the Lambda runtime environment, so no extra dependencies or configuration are required.

import { SigV4Signer } from '@aws-lambda-powertools/signer/sigv4';
const signer = new SigV4Signer({ service: 'execute-api' });
export const handler = async () => {
const signed = await signer.sign(
'https://example.execute-api.us-east-1.amazonaws.com/items'
);
// signed is a standard Request with the SigV4 headers added
const response = await fetch(signed);
await response.json();
};

Data Masking

The new @aws-lambda-powertools/data-masking package lets you encrypt, decrypt, or irreversibly erase sensitive fields within nested event data, using the AWS Encryption SDK and envelope encryption with AWS KMS for encrypt/decrypt operations.

import { DataMasking } from '@aws-lambda-powertools/data-masking';
const masker = new DataMasking();
export const handler = async (event: { body: Record<string, unknown> }) => {
const data = event.body;
return masker.erase(data, {
fields: ['email', 'address.street', 'company_address'],
});
};

... (truncated)

Changelog

Sourced from @​aws-lambda-powertools/logger's changelog.

2.34.0 (2026-07-10)

Improvements

• commons extract shared isRunningInLambda helper (#5424) (aec888b)
• logger remove unsafe context cast in createChild (#5443) (ac97f52)
• event-handler extract shared IP-extraction util for HTTP middleware (#5346) (3230ca7)

Maintenance

• commons bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)
• commons guard UA string against duplicate PTEnv suffix (#5311) (6b59973)
• logger bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)
• metrics bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)
• tracer bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)
• idempotency bump @​aws/durable-execution-sdk-js to ^1.1.6 (#5298) (dbc07c7)
• batch bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)

Bug Fixes

• commons clear LRUCache pointers on eviction of last item (#5295) (acf1ba1)
• logger scope lambda context per invocation under LMI concurrency (#5430) (e5d2e69)
• metrics detect key collisions between dimensions, metrics, and metadata (#5240) (c1e62a6)
• tracer isolate active segment per invocation under LMI concurrency (#5446) (5890d94)
• tracer scope middy middleware segments per invocation (#5444) (14f68b1)
• idempotency recompute key prefix from base on each configure call (#5442) (a739c36)
• event-handler preserve original string for invalid Bedrock Agent number params (#5363) (9cce9f9)
• event-handler avoid runtime import of metrics package in HTTP metrics middleware (#5310) (f4a6752)
• event-handler correct InvalidHttpMethodError name (#5254) (7d410fc)
• event-handler normalize trailing slashes in HTTP Router prefix joining (#5255) (7a500a1)

Features

• metrics add Disposable support for automatic flushing via using (#5349) (e1cc0e1)
• parameters add throwOnMissing option to fail fast on missing values (#5343) (f81d247)
• idempotency warn when persistence layer reconfiguration is ignored (#5422) (6a113b1)
• parser add errorHandler option for inline parse error handling (#5352) (de752b9)
• event-handler add HTTP request/response data to tracer subsegment (#5338) (e1202b0)
• event-handler warn when AppSync Events payload exceeds 240 KB per-event limit (#5339) (2e7850d)
• data-masking add Data Masking utility (#5143) (bae72dd)
• signer add SigV4 request signing utility (#5344) (d5dce6d)

2.33.1 (2026-05-25)

Bug Fixes

• commons prevent deepMerge from mutating source objects (#5202) (9994787)
• commons correctly handle shared references in deepMerge (#5195) (6b1a811)
• logger flush log buffer on critical() when flushOnErrorLog is e… (#5227) (853b44f)

... (truncated)

Commits

• e8cff7f chore(ci): bump version to 2.34.0 (#5448)
• 47bbb3b chore(testing): use stackEventPollingInterval option, drop CDK patch (#5447)
• 5890d94 fix(tracer): isolate active segment per invocation under LMI concurrency (#5446)
• a739c36 fix(idempotency): recompute key prefix from base on each configure call (#5442)
• 14f68b1 fix(tracer): scope middy middleware segments per invocation (#5444)
• de752b9 feat(parser): add errorHandler option for inline parse error handling (#5352)
• ac97f52 refactor(logger): remove unsafe context cast in createChild (#5443)
• 6a113b1 feat(idempotency): warn when persistence layer reconfiguration is ignored (#5...
• 2143417 chore(skills): make create-issue checkbox handling template-driven (#5439)
• e5d2e69 fix(logger): scope lambda context per invocation under LMI concurrency (#5430)
• Additional commits viewable in compare view

Updates @aws-sdk/client-dynamodb from 3.1029.0 to 3.1085.0

Release notes

Sourced from @​aws-sdk/client-dynamodb's releases.

v3.1085.0

3.1085.0(2026-07-10)

New Features

• clients: update client endpoints as of 2026-07-10 (dffbeab0)
• client-quicksight: Provides CreateKnowledgeBase and UpdateKnowledgeBase APIs (42de5523)
• client-inspector2: Support for 3 day and 7 day ECR re-scan durations (4b0b5c86)
• client-lambda: Added TelemetryConfig support for Managed Instances Capacity Provider, enabling customers to configure system log level and custom log group for managed instance logging. (63388139)
• client-sagemaker: Release support for g4d, c6g, c7g, c8g instance types for SageMaker HyperPod (800976de)
• client-ec2: New Amazon EC2 instances. M9g, M9gd, C9g, and C9gd on AWS Graviton5. C8in, M8in, and R8in add 600 Gbps network. C8ib, M8ib, and R8ib add 300 Gbps EBS. C8ine, M8ine, M8idn, R8idn, M8idb, and R8idb round out Intel Xeon 6. Mac-m3ultra with Apple M3 Ultra. G7 with NVIDIA RTX PRO 4500 Blackwell GPUs. (35aaf387)
• client-license-manager: Added the ResetUsage field to the CreateLicenseVersion API. When set to true, the entitlement usage counts for the license are reset to 0. If it is false or not specified, entitlement usage is left unchanged. (52f1c9c0)
• client-cloudwatch: CloudWatch now assigns a unique identifier to each anomaly detector. PutAnomalyDetector and DescribeAnomalyDetectors return this AnomalyDetectorId, which you can use to describe or delete a specific anomaly detector directly. (36fc0ee5)

---

For list of updated packages, view updated-packages.md in assets-3.1085.0.zip

v3.1084.0

3.1084.0(2026-07-09)

New Features

• client-connect: Amazon Connect - Added DeleteContactData API to support PII deletion of customer endpoint, additional email recipients and email subject. (87f4ae0e)
• client-guardduty: Adding "AI Analyst" enum value for detector (20518a4f)
• client-synthetics: CloudWatch Synthetics adds support for customer managed KMS keys for canary environment variables. Customers can now encrypt their canary's Lambda function environment variables at rest using their own AWS KMS key, providing additional control over data protection. (c7379151)
• client-ec2: Added support for additional override parameters in CreateFleet, including LaunchTemplateSpecificationUserData, KeyName, IamInstanceProfile, and MetadataOptions. The CreateFleet response now also includes SubnetId, AvailabilityZone, and AvailabilityZoneId for launched instances. (6fcc95d1)
• client-ivs: adds support for AWS IVS ad configuration APIs to allow for a postRollConfiguration object on the ad configuration resource (7dd93c48)

Tests

• client-kinesis: aggregate HTTP/2 sessions across all endpoint pools (#8181) (84b2b62c)

---

For list of updated packages, view updated-packages.md in assets-3.1084.0.zip

v3.1083.0

3.1083.0(2026-07-08)

Chores

• core/client: remove TypeScript version user-agent metric (#8177) (9d72bc29)

New Features

• client-signin: Adds support for OAuth 2.0 token operations in AWS Sign-In, CreateOAuth2TokenWithIAM (client credentials flow), IntrospectOAuth2TokenWithIAM (token inspection), and RevokeOAuth2TokenWithIAM (token revocation). (bc64f6b2)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-dynamodb's changelog.

3.1085.0 (2026-07-10)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1084.0 (2026-07-09)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1083.0 (2026-07-08)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1082.0 (2026-07-08)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1081.0 (2026-07-07)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1080.0 (2026-07-06)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1079.0 (2026-07-02)

... (truncated)

Commits

• 8d0b498 Publish v3.1085.0
• c34ce8a Publish v3.1084.0
• ceb9aee Publish v3.1083.0
• 9d72bc2 chore(core/client): remove TypeScript version user-agent metric (#8177)
• afc3740 Publish v3.1082.0
• f8b4987 chore(codegen): sync for isolatedModules tsconfig and server metrics recorder...
• 8f43c79 chore(deps): bump '@​smithy/core' to ^3.29.1 (#8167)
• 02d5abf Publish v3.1081.0
• be034d9 Publish v3.1080.0
• 74dc940 Publish v3.1079.0
• Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1029.0 to 3.1085.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1085.0

3.1085.0(2026-07-10)

New Features

• clients: update client endpoints as of 2026-07-10 (dffbeab0)
• client-quicksight: Provides CreateKnowledgeBase and UpdateKnowledgeBase APIs (42de5523)
• client-inspector2: Support for 3 day and 7 day ECR re-scan durations (4b0b5c86)
• client-lambda: Added TelemetryConfig support for Managed Instances Capacity Provider, enabling customers to configure system log level and custom log group for managed instance logging. (63388139)
• client-sagemaker: Release support for g4d, c6g, c7g, c8g instance types for SageMaker HyperPod (800976de)
• client-ec2: New Amazon EC2 instances. M9g, M9gd, C9g, and C9gd on AWS Graviton5. C8in, M8in, and R8in add 600 Gbps network. C8ib, M8ib, and R8ib add 300 Gbps EBS. C8ine, M8ine, M8idn, R8idn, M8idb, and R8idb round out Intel Xeon 6. Mac-m3ultra with Apple M3 Ultra. G7 with NVIDIA RTX PRO 4500 Blackwell GPUs. (35aaf387)
• client-license-manager: Added the ResetUsage field to the CreateLicenseVersion API. When set to true, the entitlement usage counts for the license are reset to 0. If it is false or not specified, entitlement usage is left unchanged. (52f1c9c0)
• client-cloudwatch: CloudWatch now assigns a unique identifier to each anomaly detector. PutAnomalyDetector and DescribeAnomalyDetectors return this AnomalyDetectorId, which you can use to describe or delete a specific anomaly detector directly. (36fc0ee5)

---

For list of updated packages, view updated-packages.md in assets-3.1085.0.zip

v3.1084.0

3.1084.0(2026-07-09)

New Features

• client-connect: Amazon Connect - Added DeleteContactData API to support PII deletion of customer endpoint, additional email recipients and email subject. (87f4ae0e)
• client-guardduty: Adding "AI Analyst" enum value for detector (20518a4f)
• client-synthetics: CloudWatch Synthetics adds support for customer managed KMS keys for canary environment variables. Customers can now encrypt their canary's Lambda function environment variables at rest using their own AWS KMS key, providing additional control over data protection. (c7379151)
• client-ec2: Added support for additional override parameters in CreateFleet, including LaunchTemplateSpecificationUserData, KeyName, IamInstanceProfile, and MetadataOptions. The CreateFleet response now also includes SubnetId, AvailabilityZone, and AvailabilityZoneId for launched instances. (6fcc95d1)
• client-ivs: adds support for AWS IVS ad configuration APIs to allow for a postRollConfiguration object on the ad configuration resource (7dd93c48)

Tests

• client-kinesis: aggregate HTTP/2 sessions across all endpoint pools (#8181) (84b2b62c)

---

For list of updated packages, view updated-packages.md in assets-3.1084.0.zip

v3.1083.0

3.1083.0(2026-07-08)

Chores

• core/client: remove TypeScript version user-agent metric (#8177) (9d72bc29)

New Features

• client-signin: Adds support for OAuth 2.0 token operations in AWS Sign-In, CreateOAuth2TokenWithIAM (client credentials flow), IntrospectOAuth2TokenWithIAM (token inspection), and RevokeOAuth2TokenWithIAM (token revocation). (bc64f6b2)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1085.0 (2026-07-10)

Note: Version bump only for package @​aws-sdk/client-s3

3.1084.0 (2026-07-09)

Note: Version bump only for package @​aws-sdk/client-s3

3.1083.0 (2026-07-08)

Note: Version bump only for package @​aws-sdk/client-s3

3.1082.0 (2026-07-08)

Note: Version bump only for package @​aws-sdk/client-s3

3.1081.0 (2026-07-07)

Note: Version bump only for package @​aws-sdk/client-s3

3.1080.0 (2026-07-06)

Note: Version bump only for package @​aws-sdk/client-s3

3.1079.0 (2026-07-02)

... (truncated)

Commits

• 8d0b498 Publish v3.1085.0
• c34ce8a Publish v3.1084.0
• ceb9aee Publish v3.1083.0
• 9d72bc2 chore(core/client): remove TypeScript version user-agent metric (#8177)
• afc3740 Publish v3.1082.0
• f8b4987 chore(codegen): sync for isolatedModules tsconfig and server metrics recorder...
• 8f43c79 chore(deps): bump '@​smithy/core' to ^3.29.1 (#8167)
• 02d5abf Publish v3.1081.0
• be034d9 Publish v3.1080.0
• 74dc940 Publish v3.1079.0
• Additional commits viewable in compare view

Updates @aws-sdk/util-dynamodb from 3.996.2 to 3.996.6

Commits

• See full diff in compare view

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates eslint from 10.2.1 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

... (truncated)

Commits

Description has been truncated