⬆️ npm(deps-dev): Bump the npm-dev group with 5 updates

[dependabot]

Bumps the npm-dev group with 5 updates:

Package	From	To
eslint	10.6.0	10.8.0
globals	17.7.0	17.8.0
lint-staged	17.0.8	17.2.0
prettier	3.9.5	3.9.6
sinon	22.0.0	22.1.0

Updates eslint from 10.6.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

Commits

• 36c7659 17.8.0
• 7394811 Update globals (2026-07-01) (#347)
• See full diff in compare view

Updates lint-staged from 17.0.8 to 17.2.0

Release notes

Sourced from lint-staged's releases.

v17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

  Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

  Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.js": {
      title: "Log staged JS files to console",
      task: async (files) => {
        console.log("Staged JS files:", files);
      },
    },
  };

v17.1.1

Patch Changes

• #1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

v17.1.0

Minor Changes

• #1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

  Before:

  Size of node_modules/ after installing: 1561.7 kB with 29 packages.

  Fancy interactive spinners, but output dynamically changes:

  ✔ Backed up original state in git stash (0b191303)
  ✔ Running tasks for staged files...
  ✔ Staging changes from tasks...
  ✔ Cleaning up temporary files...

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

  Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

  Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.js": {
      title: "Log staged JS files to console",
      task: async (files) => {
        console.log("Staged JS files:", files);
      },
    },
  };

17.1.1

Patch Changes

• #1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.

17.1.0

Minor Changes

• #1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

  Before:

  Size of node_modules/ after installing: 1561.7 kB with 29 packages.

  Fancy interactive spinners, but output dynamically changes:

  ✔ Backed up original state in git stash (0b191303)
  ✔ Running tasks for staged files...

... (truncated)

Commits

• fb540fb Merge pull request #1824 from lint-staged/changeset-release/main
• dc0a738 chore(changeset): release
• 60cbb88 Merge pull request #1823 from lint-staged/reimplement-chunk-files
• 2354dc4 build(deps): update dependencies
• 0516e7f docs: adjust debug logs
• e22f6ed style: run oxfmt on README.md
• 37e8e1a fix: restore chunking of git add command after running tasks
• 2c75f1d chore: remove unused file
• ee156cc feat: add improved lazy-chunking of command strings
• baa7c98 feat: remove current chunkFiles implementation
• Additional commits viewable in compare view

Updates prettier from 3.9.5 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Updates sinon from 22.0.0 to 22.1.0

Changelog

Sourced from sinon's changelog.

22.1.0

• d36e921b fix: let returns override returnsArg (王胜)

  Signed-off-by: 王胜 2318857637@qq.com

• 40c4caa0 fix: align restoreObject docs test with idempotent behavior (#2745) (Julia Miller)

  restoreObject was made idempotent in #2737 — it no longer throws for objects with no restorable methods. Updates the docs page and its corresponding test to reflect this.

• a68dac19 fix: throw a clear error when throwArg index equals the argument count (#2743) (spokodev)

  • fix: throw a clear error when throwArg index equals the argument count

  spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it with pos equal to the number of recorded arguments slipped past the guard and reached throw this.args[pos], throwing undefined instead of the intended TypeError. A thrown undefined cannot be inspected as an Error and is reported by test frameworks as no exception thrown.

  Use >= to match ensureArgs in behavior.js and the sibling callArg helpers, which already reject an out-of-range index with a clear error.

• 9ea504e3 feat: make sinon.restoreObject idempotent (#2737) (Ilia Choly)

  Passing an object with no live fakes to restoreObject now restores nothing instead of throwing, giving it symmetry with sinon.restore() and sandbox.restore(). The strict "found no methods" check is retained for spy(object) and stub(object), which now use a dedicated walkObjectStrict export, while restoreObject uses the loose walkObject. Passing a falsy value still throws.

  Fixes #2736

• 4db4feff fix: preserve fake undefined argument validation (Vishal Kumar Singh)
• 755a40d7 fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

  The global callId counter in proxy-invoke.js caused calledImmediatelyBefore and calledImmediatelyAfter to fail when tests run in parallel with separate sandboxes. Each sandbox now maintains its own callId counter, passed through the spy/stub/fake creation chain via a context object.

  Fixes #2472

Released by Morgan Roderick on 2026-07-20.

Commits

• ab289e9 22.1.0
• bb3b75a chore: remove Jekyll steps from version hook
• bb38f25 chore: run docs tests in preversion hook
• d36e921 fix: let returns override returnsArg
• 11db213 ci: run docs tests on every PR (#2746)
• 40c4caa fix: align restoreObject docs test with idempotent behavior (#2745)
• 5ccb7fd build(deps): bump the action-deps group with 4 updates (#2744)
• a68dac1 fix: throw a clear error when throwArg index equals the argument count (#2743)
• 9ea504e feat: make sinon.restoreObject idempotent (#2737)
• cf5d9e8 fix: remove dead link and exclude code example URLs from link check
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions