Lockfile maintenance

[lockfile-maintenance]

Update selected lockfiles with a minimum release age of 3 days.

The package managers' native exceptions still apply. Validate updates with the repository's PR CI.

Version changes

Versions are grouped by package name. — means the package was not present.

package-lock.json

Package	Before	After	Change	History
@azure/msal-browser	5.23.0	5.24.0	minor	Release history
@azure/msal-common	16.14.1	16.14.1, 16.14.2	added version	—
@typescript-eslint/eslint-plugin	8.71.0	8.71.1	patch	Release history
@typescript-eslint/parser	8.71.0	8.71.1	patch	Release history
@typescript-eslint/project-service	8.71.0	8.71.1	patch	Release history
@typescript-eslint/scope-manager	8.71.0	8.71.1	patch	Release history
@typescript-eslint/tsconfig-utils	8.71.0	8.71.1	patch	Release history
@typescript-eslint/type-utils	8.71.0	8.71.1	patch	Release history
@typescript-eslint/types	8.71.0	8.71.1	patch	Release history
@typescript-eslint/typescript-estree	8.71.0	8.71.1	patch	Release history
@typescript-eslint/utils	8.71.0	8.71.1	patch	Release history
@typescript-eslint/visitor-keys	8.71.0	8.71.1	patch	Release history
acorn	8.18.0	8.19.0	minor	Release history
enhanced-resolve	5.25.1	5.26.0	minor	Release history
eslint	10.11.0	10.12.0	minor	Release history
follow-redirects	1.16.0	1.16.1	patch	—
ignore	5.3.2, 7.0.10	5.3.2, 7.0.12	patch	Release history
marked	18.0.14	18.1.0	minor	Release history
node-abi	3.96.0	3.97.0	minor	Release history
shell-quote	1.11.0	1.12.0	minor	—
tar-stream	2.2.0, 3.2.1	2.2.0, 3.2.2	patch	Release history
typescript-eslint	8.71.0	8.71.1	patch	Release history

@azure/msal-browser — 5.23.0 → 5.24.0 (1 release)

Back to version changes · Compare · Releases

msal-browser-v5.24.0

5.24.0

Fri, 02 Oct 2026 19:03:42 GMT

Minor changes

• Bump @​azure/msal-browser to match @​azure/msal-browser-1p (msaljsbuilds@​microsoft.com)
• Bump @​azure/msal-common to v16.14.2 (beachball)

Patches

• Validate cache broadcast context and reload values from persistent storage #8869 (spingale@​microsoft.com)
• Add observability across extension and DOM platform broker flows #8824 (lalimasharda@​microsoft.com)
• Allow platform broker token requests with empty scopes #8863 (lalima.sharda@​gmail.com)

@typescript-eslint/eslint-plugin — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/parser — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/project-service — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/scope-manager — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/tsconfig-utils — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/type-utils — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/types — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/typescript-estree — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/utils — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/visitor-keys — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

acorn — 8.18.0 → 8.19.0 (0 releases)

Back to version changes · Compare · Releases

No published release notes found. See the links above.

enhanced-resolve — 5.25.1 → 5.26.0 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v5.26.0

Minor Changes

• Add experimental support for Node.js package maps through a new packageMap option, which takes the path of the configuration file (or a file: URL) or an already-parsed packages object. When it is set, a bare specifier is resolved through the importing package's dependencies table and the target package's location is handed to the regular pipeline, instead of walking node_modules; relative and absolute requests and node: builtins are unaffected. Because several package entries may share one url, the package a request resolved into is exposed as packageId on the result and can be passed back in as context.packageId to resolve from that package unambiguously. Package maps are stability 1 (experimental) in Node.js, and this option tracks that specification and may change with it. (by @​alexander-akait in #667)

• Explain an exports/imports field whose conditions wrap subpaths, instead of failing with a message that points at the request. A field shaped like { "import": { ".": "./esm/index.js", "./*": "./esm/*.js" }, "require": "./build/bundle.js" } is not supported by Node.js: the subpaths inside a condition are read as condition names, so they match nothing, and every request into the package failed as "./foo" is not exported under the conditions [...] — which reads as though the package forgot to export ./foo. Such a failure now names the offending keys and shows the arrangement that works, with the subpaths at the top level and the conditions nested inside them. Resolution itself is unchanged: the diagnosis runs only on a request that has already failed, so nothing that resolves today starts failing, and a successful resolve does no extra work. Errors raised while processing either field also name the package.json they came from, which previously only appeared in the resolver log. (by @​alexander-akait in #676)

• Generate the published type declarations with TypeScript instead of webpack/tooling, which is no longer a dependency. Every name the package exported before is still exported, and types.d.ts is still the entry point, but the declarations themselves now live in types/ and are emitted by tsc from the JSDoc in lib/. Two shapes follow the sources more closely than the previous generator did: the object form of Plugin no longer declares this: Resolver on apply (it is called as plugin.apply(resolver), so this is the plugin), and the entries of ResolveContext.stack declare name: string | undefined rather than an optional name. Class fields that the old generator dropped, such as the cache backends on CachedInputFileSystem, are now part of the declarations. (by @​alexander-akait in #675)

Patch Changes

• Size the ancestor path and segment arrays that getPathsCached keeps to what they actually hold: a push-built store keeps room for 17 entries while a path has a handful, and the cache holds these for the filesystem's lifetime. (by @​alexander-akait in #681)

eslint — 10.11.0 → 10.12.0 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

ignore — 5.3.2, 7.0.10 → 5.3.2, 7.0.12 (0 releases)

Back to version changes · Compare · Releases

No published release notes found. See the links above.

marked — 18.0.14 → 18.1.0 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v18.1.0

18.1.0 (2026-10-05)

Bug Fixes

• avoid cubic backtracking on unicode whitespace in a link destination (#4106) (0d20220)
• load CLI configs with top-level await (#4100) (c61543e)
• reject unbalanced parentheses in link destinations (#4107) (3363c99)

Features

• add linkParenPossible to lexer state to fail fast for link token generation (#4070) (4ee44f7)

node-abi — 3.96.0 → 3.97.0 (1 release)

Back to version changes · Compare · Releases

v3.97.0

3.97.0 (2026-10-05)

Features

• update ABI registry (#309) (a870716)

tar-stream — 2.2.0, 3.2.1 → 2.2.0, 3.2.2 (0 releases)

Back to version changes · Compare · Releases

No published release notes found. See the links above.

typescript-eslint — 8.71.0 → 8.71.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Rebase

• Rebase this PR by regenerating lockfiles from the latest base branch.

Check the box above or post a new PR comment with /lockfile rebase on its own line. Requires repository write access.

Workflow requirements and manual fallback

Enable App-based rebase handling with rebase: true in .github/lockfile-maintenance-auth.yml, or configure an Actions request handler as described below.

For Actions-based handling, the workflow must subscribe to pull_request_target: types: [edited] for the checkbox and issue_comment: types: [created] for comments, and configure the request-rebase job.
If these handlers are not configured, open the maintenance workflow and select Run workflow on the branch used for maintenance. This requires workflow_dispatch.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-09 18:13 UTC · Rule: dependency-updates · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #42 on main (9b746e8) #43
• ✅ Merged — 2026-10-09 18:27 UTC · at 3e92b76b63980ee8a4b866fd37e3023663b73fce · merge-batch via merge queue: checking #42 on main (9b746e8) #43

This pull request spent 14 minutes 53 seconds in the queue, including 2 minutes 52 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1
  • Lockfile maintenance #42
• github-review-approved [🛡 GitHub repository ruleset rule main]
  • Lockfile maintenance #42
• any of [🛡 GitHub repository ruleset rule main]:
  • check-success = @github-actions/Test
  • check-neutral = @github-actions/Test
  • check-skipped = @github-actions/Test