chore(deps): bump the dependencies group across 1 directory with 12 updates by dependabot[bot] · Pull Request #679 · openfga/language

dependabot · 2026-09-03T07:34:34Z

Bumps the dependencies group with 11 updates in the /pkg/js directory:

Package	From	To
ajv	`8.18.0`	`8.20.0`
yaml	`2.8.3`	`2.9.0`
@jest/globals	`30.4.1`	`30.5.0`
@openfga/sdk	`0.9.3`	`0.9.7`
@types/node	`25.5.0`	`26.4.0`
@typescript-eslint/eslint-plugin	`8.57.1`	`8.68.0`
eslint-import-resolver-typescript	`4.4.4`	`4.4.5`
jest	`30.4.2`	`30.5.0`
prettier	`3.8.1`	`3.9.6`
ts-jest	`29.4.11`	`29.4.12`
typescript	`5.9.3`	`7.0.2`

Updates ajv from 8.18.0 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

fix: add support for node 22/24, drop node 16/21 by @jasoniangreen in ajv-validator/ajv#2580

fix: add ES2022.RegExp for RegExpIndicesArray by @SignpostMarv in ajv-validator/ajv#2604

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

v8.19.0

What's Changed

fix prototype pollution via format keyword using $data ref by @epoberezkin in ajv-validator/ajv#2607

Full Changelog: ajv-validator/ajv@v8.18.0...v8.19.0

Commits

0fba0b8 8.20.0
9caf8d6 fix: add ES2022.RegExp for RegExpIndicesArray; fixes ajv-validator/ajv#2603 (...
2065350 fix: add support for node 22/24, drop node 16/21 (#2580)
154b58d 8.19.0
e8d2bdc test/fix prototype pollution via $data ref with format keyword (#2607)
See full diff in compare view

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

fix: Avoid calling Array.prototype.push.apply() with large source array

fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

Disable alias resolution with maxAliasCount:0 (#677)

Handle invalid unicode escapes (e1a1a77)

Apply minFractionDigits only to decimal strings (#676)

Commits

ddb21b0 2.9.0
167365b docs: Clarify that not all errors can be avoided
6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
ccdf743 2.8.4
f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
e1a1a77 fix: Handle invalid unicode escapes
a163ea0 style: Satify Prettier
b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
93c951b chore: Bump JSR version to v2.8.3 (#673)
Additional commits viewable in compare view

Updates @jest/globals from 30.4.1 to 30.5.0

Release notes

Sourced from @jest/globals's releases.

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @timkindberg (#16053):
const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
fn.whenCalledWith('banana').mockReturnValue('yellow');
fn.whenCalledWith(expect.any(Number)).mockReturnValue('numeric');
fn('apple'); // 'red'
fn('banana'); // 'yellow'
fn(42); // 'numeric'
fn('grape'); // undefined
The returned object is a real Mock, so mockReturnValueOnce, mockResolvedValue, mockImplementation etc. all chain here too. Argument slots accept literals or any asymmetric matcher, with the same equality semantics as toHaveBeenCalledWith(). Calls that match nothing fall through to the base mock. See the Mock Functions docs for matching and precedence details.

Describe-level retries

jest.retryTimes() can now retry a whole describe block instead of a single test, contributed by @soltonigiri (#16322). Each attempt reruns the block's beforeAll/afterAll hooks, child tests and nested describes, which helps when tests in a block depend on shared state:
describe('workflow', () => {
  jest.retryTimes(3, {entireDescribe: true});
test('first step', () => {});
test('second step', () => {}); // a failure retries the entire block
});
New file watcher

The non-watchman path of jest-haste-map is rewritten. @parcel/watcher replaces the homegrown NodeWatcher and FSEventsWatcher (#16188), and fdir replaces the hand-rolled directory recursion in the crawler (#16187). A batch of fixes also makes watching and indexing survive locked files on Windows, watchman failures, and duplicate manual mocks (#16295, #16358, #16355, #16360).

If you can, please run your suite with --no-watchman (in and out of watch mode) to exercise the new crawler and watchers, and report anything odd 👍

Long-requested dependency updates

babel-plugin-istanbul is updated to v8 (#16049)

glob is updated to v13 (#16397)

... (truncated)

Changelog

Sourced from @jest/globals's changelog.

30.5.0

Features

[@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#16053)

[@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#16053)

[jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (#16259)

[jest-circus, jest-environment, jest-runtime, jest-types] Add describe-level retries via jest.retryTimes(..., {entireDescribe: true}) (#16322)

[jest-circus, jest-message-util, jest-reporters, jest-types] Add retryMessages to AssertionResult and export formatErrorStack, so the retry log renders nested cause and AggregateError sections with code frames instead of serialized [cause]:/[errors]: markers (#16316)

[jest-circus, jest-types] Add unhandledErrorsDetailed to Circus.RunResult, so an unhandled rejection reports its cause chain and AggregateError entries with code frames instead of a pre-serialized stack (#16316)

[jest-haste-map] Replace NodeWatcher and FSEventsWatcher with @parcel/watcher for the non-watchman watch path (#16188)

[jest-resolve] Bump unrs-resolver to 1.12.1, remove jest-pnp-resolver and unnecessary checks (#15721)

[jest-resolve] Honor Node's --preserve-symlinks / NODE_PRESERVE_SYMLINKS in the default resolver by passing symlinks: false to unrs-resolver (#16260)

[jest-runtime] Apply automocking and manual __mocks__ files to synchronously evaluable ESM graphs on Node 24.9+ - static imports, dynamic import() and require() of an ESM file now generate an automock from the real module's namespace instead of failing with "Attempting to import a mock without a factory". Graphs that need async evaluation (top-level await) or an async-only resolver or transformer still throw (#16391)

[jest-runtime] Route process.getBuiltinModule through the sandbox, so it returns the sandbox process and the hooked node:module instead of the host's (#16391)

[jest-runtime] Throw an actionable error from module.register() and module.registerHooks() inside a test - the hooks attached to the loader running Jest itself, never saw the sandboxed requires they were meant for, and stayed registered for every later test file in the worker (#16391)

[jest-runtime] Surface resolution and import-attribute errors in an ESM graph before executing any of its CJS dependencies on Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the legacy loader on older versions keeps its linking-time execution order (#16391)

[jest-runtime] Throw ERR_SOURCE_PHASE_NOT_DEFINED with an actionable message for import source and import.source(), instead of failing at instantiation with V8's bare "Source phase import object is not defined" (#16391)

[jest-runtime] Emit the JSON-without-import-attribute deprecation warning once per test file instead of once per worker, so it is no longer silently swallowed for every file after the first (#16391)

[jest-runtime] Set import.meta.main to true in the test file and false in every module it loads, matching Node 24+ (#16367)

[jest-runtime] Resolve the module-sync export condition, so a package that exposes its ESM entry point for require() loads the same file Node would (#16336)

[jest-snapshot] Add external snapshot paths to custom reporter failure details (#16374)

Fixes

[jest-console, jest-reporters] CustomConsole now buffers console output so TestResult.console is populated for reporters when verbose is enabled, while GitHubActionsReporter avoids replaying buffered output in verbose mode (#16155)

[expect, jest-message-util, jest-pattern, jest-regex-util, jest-util] Revert node: protocol imports to restore webpack/browser-bundle compatibility (#16167)

[expect] Widen toMatchObject and objectContaining parameter type from Record<string, unknown> to object so class instances are accepted (#16196)

[jest-circus] Call a generator test body with the shared test context, so this matches what a regular test function receives (#16347)

[jest-circus] Capture the error listeners of the parent process instead of the in-sandbox process, so listeners registered before the test file survive teardown and sandbox listeners no longer leak onto the parent (#16347)

[jest-circus] Clear currentlyRunningTest after skipped and todo tests (#16342)

[jest-circus] Prevent late done() callbacks from affecting later test or hook invocations (#16343)

[jest-circus, jest-jasmine2] Honor --expand when formatting node:assert failures, instead of always collapsing the diff (#16347)

[jest-circus, jest-jasmine2, jest-message-util] Serialize the inner errors of an AggregateError into failureMessages, retryReasons and unhandledErrors, so --json output and reporter annotations include them (#16316)

[jest-circus, jest-snapshot] Keep snapshot state and counts correct when a test retries (#16344)

[@jest/create-cache-key-function] Include the caller support flags in the generated key, so a transformer that emits ESM or CJS based on them no longer shares one cache entry between the two (#16331)

[@jest/create-cache-key-function] Include the stringified project config in the generated key, so editing a transformer's own settings invalidates what it cached (#16331)

[@jest/transform] Include the caller support flags in a transform's cache key, so a file transformed both as ESM and as CJS no longer serves one shape's output for the other (#16331)

[jest-config] Add missing findRelatedTests, outputFile, and replname entries to ValidConfig so they no longer trigger spurious "Unknown option" warnings (#16224)

[jest-config] Use --config for the global config when multiple --projects are specified (#16273)

[jest-core] Serialize bigint values in --json and --outputFile output as their literal form (4n), instead of failing the run with TypeError: Do not know how to serialize a BigInt (#16338)

[jest-core] Do not report a CustomGC async resource (used by N-API addons such as napi-rs for per-isolate GC bookkeeping) as an open handle, since it is napi_unref'd by the addon and can never keep the event loop alive (#16379)

[jest-each] Keep a $&, $`, $' or $$ inside a %p param value out of the replacement, so the title shows the value instead of the text around it (#16338)

[jest-each] Interpolate a bigint into a %j title as its literal form ("4n") at any depth, instead of throwing TypeError: Do not know how to serialize a BigInt while collecting the tests (#16338)

[jest-environment, jest-runtime] Bind sandboxInjectedGlobals to the right values when injectGlobals is false, instead of shifting every one of them by a position (#16377)

[jest-environment-node, jest-util] Only warn about a conflicting globalsCleanup mode when one was explicitly configured, and follow the mode that is actually in effect (#16323)

[jest-environment-node, jest-util] Stop resolving lazy globals when setting up an environment, so Node 26's builtin module globals are no longer loaded (and no longer emit their deprecation warnings) for every test file (#16324)

[jest-haste-map] Keep watch mode alive when an outside process briefly makes a file unreadable on Windows, instead of tearing the watcher down on EPERM (#16295)

[jest-haste-map] Keep indexing when an outside process holds a file open on Windows, instead of failing the whole crawl on EPERM (#16358)

[jest-haste-map] Keep a duplicated manual mock resolving when the file it pointed at is deleted in watch mode (#16360)

... (truncated)

Commits

912baa3 v30.5.0
b91717a chore: refresh coding agent instructions (#16182)
See full diff in compare view

Updates @openfga/sdk from 0.9.3 to 0.9.7

Release notes

Sourced from @openfga/sdk's releases.

v0.9.7

Changed

rework how nock is setup and used to harden tests (#395) (0d20683)

Documentation

update stated node version support (#468) (8ea3346)

What's Changed

chore: pin reusable release please/ pr validator workflows by @SoulPancake in openfga/js-sdk#442

chore(ci): fix npm audit by @SoulPancake in openfga/js-sdk#449

chore(deps): bump the dependencies group across 1 directory with 8 updates by @dependabot[bot] in openfga/js-sdk#444

chore(deps): bump the dependencies group across 1 directory with 4 updates by @dependabot[bot] in openfga/js-sdk#445

chore(ci): group dependabot updates for example projects by @SoulPancake in openfga/js-sdk#450

chore(deps): bump the dependencies group in /example/opentelemetry with 3 updates by @dependabot[bot] in openfga/js-sdk#451

chore(deps): bump the dependencies group with 5 updates by @dependabot[bot] in openfga/js-sdk#453

chore(deps): bump the dependencies group with 5 updates by @dependabot[bot] in openfga/js-sdk#457

chore(deps): bump the dependencies group with 6 updates by @dependabot[bot] in openfga/js-sdk#459

refactor: rework how nock is setup and used to harden tests by @kamilogorek in openfga/js-sdk#395

chore: sync generated code with sdk-generator by @SoulPancake in openfga/js-sdk#454

chore(deps): bump the dependencies group across 1 directory with 3 updates by @dependabot[bot] in openfga/js-sdk#460

chore(deps): bump the dependencies group with 5 updates by @dependabot[bot] in openfga/js-sdk#463

fix(ci): resolve npm audit vulnerabilities by @Siddhant-K-code in openfga/js-sdk#464

chore(deps): bump the dependencies group across 1 directory with 9 updates by @dependabot[bot] in openfga/js-sdk#462

docs: update stated node version support by @ewanharris in openfga/js-sdk#468

chore: replace Jest with Node test runner by @Siddhant-K-code in openfga/js-sdk#466

chore(deps-dev): bump the dependencies group with 4 updates by @dependabot[bot] in openfga/js-sdk#469

release: v0.9.7 by @openfga-releaser-bot[bot] in openfga/js-sdk#470

Full Changelog: openfga/js-sdk@v0.9.7-beta.1...v0.9.7

v0.9.7-beta.1

⚠ BREAKING CHANGES

The $response property type changes from AxiosResponse<T> to FgaResponse<T>. The constructor now accepts an optional HttpClient instead of AxiosInstance. baseOptions.httpAgent/httpsAgent are no longer applicable as fetch handles connection pooling natively.

Changed

replace axios with native fetch (#366) (1af0efd)

What's Changed

chore: update bootstrap sha by @SoulPancake in openfga/js-sdk#419

chore(ci): force tag creation in release config for draft releases by @SoulPancake in openfga/js-sdk#422

chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in openfga/js-sdk#424

... (truncated)

Changelog

Sourced from @openfga/sdk's changelog.

0.9.7 (2026-08-18)

Changed

rework how nock is setup and used to harden tests (#395) (0d20683)

Documentation

update stated node version support (#468) (8ea3346)

0.9.6 (2026-05-11)

Fixed

correctly set default retry params (#394) (6b03882) , Thanks @kamilogorek

prevent token refresh thundering herd (#333) (025346f)

stop mutating token refresh errors into auth errors (#329) (d5cbccb)

0.9.5 (2026-04-10)

Fixed

Correctly set authorization model id when calling batch checks (#372) (bbc8bde)

v0.9.4

v0.9.4 (2026-03-31)

fix(deps): pin axios to 1.14.0 and fix brace-expansion audit vulnerability (#363) - details

Commits

ff0a9f5 release: v0.9.7 (#470)
2978621 chore(deps-dev): bump the dependencies group with 4 updates (#469)
39be98a chore: replace Jest with Node test runner (#466)
8ea3346 docs: update stated node version support (#468)
ad7a03d chore(deps): bump the dependencies group across 1 directory with 9 updates (#...
36497d6 fix(ci): resolve npm audit vulnerabilities (#464)
8d4cfdd chore(deps): bump the dependencies group with 5 updates (#463)
a301a25 chore(deps): bump the dependencies group across 1 directory with 3 updates (#...
acd4913 chore: sync generated code with sdk-generator (#454)
0d20683 refactor: rework how nock is setup and used to harden tests (#395)
Additional commits viewable in compare view

Updates @types/node from 25.5.0 to 26.4.0

Commits

See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.57.1 to 8.68.0

Release notes

Sourced from @typescript-eslint/eslint-plugin's releases.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

eslint-plugin: [strict-void-return] add fix suggestions (#12086)

utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

eslint-plugin: [unified-signatures] deduplicate types in report (#12656)

eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)

eslint-plugin: [unified-signatures] report identical signatures (#12678)

eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)

eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)

eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)

website: playground crashes on extends configs (#12608)

website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

Evyatar Daud @StyleShit

Hugo @hugop95

Josh Goldberg ✨

Niki @phaux

Thiago Barbosa

Younsang Na @nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

Evyatar Daud @StyleShit

Josh Goldberg ✨

Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

... (truncated)

Changelog

Sourced from @typescript-eslint/eslint-plugin's changelog.

8.68.0 (2026-08-24)

🚀 Features

eslint-plugin: [strict-void-return] add fix suggestions (#12086)

🩹 Fixes

eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)

eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)

eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)

eslint-plugin: [unified-signatures] report identical signatures (#12678)

eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)

eslint-plugin: [unified-signatures] deduplicate types in report (#12656)

❤️ Thank You

Evyatar Daud @StyleShit

Hugo @hugop95

Niki @phaux

Younsang Na @nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.67.0 (2026-08-10)

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.66.0 (2026-08-03)

🩹 Fixes

eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)

eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)

eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)

eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)

eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)

❤️ Thank You

Evyatar Daud @StyleShit

송재욱

See GitHub Releases for more information.

... (truncated)

Commits

8f4e00a chore(release): publish 8.68.0
db30514 feat(eslint-plugin): [strict-void-return] add fix suggestions (#12086)
9690339 test(eslint-plugin): [prefer-optional-chain] use createRuleTesterWithTypes ...
abe9011 fix(eslint-plugin): [no-empty-object-type] ignore suggestions that result in ...
79c16e7 chore(eslint-plugin): extract FunctionSignature and enum comparison utils (#1...
2442e30 test(eslint-plugin): [no-floating-promises] format test snippets (#12723)
3596323 fix(eslint-plugin): [no-floating-promises] setting ignoreVoid: false result...
956a339 fix(eslint-plugin): [no-unnecessary-type-assertion] prevent stack overflow in...
55f6d5d chore: enable source maps (#12677)
3aefb6a test: improve vitest performance with isolate: false (#12703)
Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.57.1 to 8.68.0

Release notes

Sourced from @typescript-eslint/parser's releases.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

eslint-plugin: [strict-void-return] add fix suggestions (#12086)

utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

eslint-plugin: [unified-signatures] deduplicate types in report (#12656)

eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)

eslint-plugin: [unified-signatures] report identical signatures (#12678)

eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)

eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)

eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)

website: playground crashes on extends configs (#12608)

website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

Evyatar Daud @StyleShit

Hugo @hugop95

Josh Goldberg ✨

Niki @phaux

Thiago Barbosa

Younsang Na @nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

Evyatar Daud @StyleShit

Josh Goldberg ✨

Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

... (truncated)

Changelog

Sourced from @typescript-eslint/parser's changelog.

8.68.0 (2026-08-24)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.67.0 (2026-08-10)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.66.0 (2026-08-03)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.65.0 (2026-07-20)

🚀 Features

add warning when TS 7 is detected (#12529)

parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

Evyatar Daud @StyleShit

Josh Goldberg ✨

Kirk Waiblinger @kirkwaiblinger

송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

... (truncated)

Commits

8f4e00a chore(release): publish 8.68.0
55f6d5d chore: enable source maps (#12677)
20a261f chore(release): publish 8.67.0
3b155bb chore: use typescript 7 for typechecking (#12601)
e51b11b chore(release): publish 8.66.0
63ba81b chore(release): publish 8.65.0
eaf4576 feat: add warning when TS 7 is detected (#12529)
d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
0d06406 chore: add attw validation to repo (#12437)
c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
Additional commits viewable in compare view

Updates eslint-import-resolver-typescript from 4.4.4 to 4.4.5

Release notes

Sourced from eslint-import-resolver-typescript's releases.

v4.4.5

Patch Changes

#473 32c61ab Thanks @leey0818! - fix: check tsconfig matching before using resolver

Changelog

Sourced from eslint-import-resolver-typescript's changelog.

4.4.5

Patch Changes

#473 32c61ab Thanks @leey0818! - fix: check tsconfig matching before using resolver

Commits

724c47d chore: release eslint-import-resolver-typescript (#480)
32c61ab fix: check tsconfig matching before using resolver (#473)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-import-resolver-typescript since your current version.

Updates jest from 30.4.2 to 30.5.0

Release notes

Sourced from jest's releases.

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @timkindberg (#16053):
const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
fn.whenCalledWith('banana').mockReturnValue('yellow');
fn.whenCalledWith(expect.any(Number)).mockReturnValue('numeric');
fn('apple'); // 'red'
fn('banana'); // 'yellow'
fn(42); // 'numeric'
fn('grape'); // undefined
The returned object is a real Mock, so mockReturnValueOnce, mockResolvedValue, mockImplementation etc. all chain here too. Argument slots accept literals or any asymmetric matcher, with the same equality semantics as toHaveBeenCalledWith(). Calls that match nothing fall through to the base mock. See the Mock Functions docs for matching and precedence details.

Describe-level retries

jest.retryTimes() can now retry a whole describe block instead of a single test, contributed by @soltonigiri (#16322). Each attempt reruns the block's beforeAll/afterAll hooks, child tests and nested describes, which helps when tests in a block depend on shared state:
describe('workflow', () => {
  jest.retryTimes(3, {entireDescribe: true});
test('first step', () => {});
test('second step', () => {}); // a failure retries the entire block
});
New file watcher

The non-watchman path of jest-haste-map is rewritten. @parcel/watcher replaces the homegrown NodeWatcher and FSEventsWatcher (#16188), and fdir replaces the hand-rolled directory recursion in the crawler (#16187). A batch of fixes also makes watching and indexing survive locked files on Windows, watchman failures, and duplicate manual mocks (#16295, #16358, #16355, #16360).

If you can, please run your suite with --no-watchman (in and out of watch mode) to exercise the new crawler and watchers, and report anything odd 👍

Long-requested dependency updates

babel-plugin-istanbul is updated to v8 (#16049)

glob is updated to v13 (#16397)

... (truncated)

Changelog

Sourced from jest's changelog.

30.5.0

Features

[@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for confi...
Description has been truncated

…pdates Bumps the dependencies group with 11 updates in the /pkg/js directory: | Package | From | To | | --- | --- | --- | | [ajv](https://github.com/ajv-validator/ajv) | `8.18.0` | `8.20.0` | | [yaml](https://github.com/eemeli/yaml) | `2.8.3` | `2.9.0` | | [@jest/globals](https://github.com/jestjs/jest/tree/HEAD/packages/jest-globals) | `30.4.1` | `30.5.0` | | [@openfga/sdk](https://github.com/openfga/js-sdk) | `0.9.3` | `0.9.7` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.5.0` | `26.4.0` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.57.1` | `8.68.0` | | [eslint-import-resolver-typescript](https://github.com/import-js/eslint-import-resolver-typescript) | `4.4.4` | `4.4.5` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.4.2` | `30.5.0` | | [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.9.6` | | [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.11` | `29.4.12` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `ajv` from 8.18.0 to 8.20.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v8.18.0...v8.20.0) Updates `yaml` from 2.8.3 to 2.9.0 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.3...v2.9.0) Updates `@jest/globals` from 30.4.1 to 30.5.0 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.0/packages/jest-globals) Updates `@openfga/sdk` from 0.9.3 to 0.9.7 - [Release notes](https://github.com/openfga/js-sdk/releases) - [Changelog](https://github.com/openfga/js-sdk/blob/main/CHANGELOG.md) - [Commits](openfga/js-sdk@v0.9.3...v0.9.7) Updates `@types/node` from 25.5.0 to 26.4.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@typescript-eslint/eslint-plugin` from 8.57.1 to 8.68.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.57.1 to 8.68.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/parser) Updates `eslint-import-resolver-typescript` from 4.4.4 to 4.4.5 - [Release notes](https://github.com/import-js/eslint-import-resolver-typescript/releases) - [Changelog](https://github.com/import-js/eslint-import-resolver-typescript/blob/master/CHANGELOG.md) - [Commits](import-js/eslint-import-resolver-typescript@v4.4.4...v4.4.5) Updates `jest` from 30.4.2 to 30.5.0 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.0/packages/jest) Updates `prettier` from 3.8.1 to 3.9.6 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.1...3.9.6) Updates `ts-jest` from 29.4.11 to 29.4.12 - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](kulshekhar/ts-jest@v29.4.11...v29.4.12) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) --- updated-dependencies: - dependency-name: ajv dependency-version: 8.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: yaml dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@jest/globals" dependency-version: 30.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@openfga/sdk" dependency-version: 0.9.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@types/node" dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.68.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@typescript-eslint/parser" dependency-version: 8.68.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: eslint-import-resolver-typescript dependency-version: 4.4.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: jest dependency-version: 30.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: ts-jest dependency-version: 29.4.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-09-03T07:35:04Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance	License
npm/@jest/globals@30.4.1 ⏵ 30.5.0
npm/jest@30.4.2 ⏵ 30.5.0
npm/@typescript-eslint/parser@8.57.1 ⏵ 8.68.0		⁺¹
npm/@typescript-eslint/eslint-plugin@8.57.1 ⏵ 8.68.0		⁺¹
npm/@types/node@25.5.0 ⏵ 26.4.0	⁺¹	⁺¹
npm/yaml@2.8.3 ⏵ 2.9.0	⁺¹
npm/ajv@8.18.0 ⏵ 8.20.0	⁺¹
npm/eslint-import-resolver-typescript@4.4.4 ⏵ 4.4.5	⁺¹	⁺¹	⁺⁴
npm/typescript@5.9.3 ⏵ 7.0.2		^-1		⁺¹⁰
npm/ts-jest@29.4.11 ⏵ 29.4.12	⁺¹	⁺¹
npm/@openfga/sdk@0.9.3 ⏵ 0.9.7	⁺¹	⁺¹	⁺⁵
npm/prettier@3.8.1 ⏵ 3.9.6		⁺¹

View full report

socket-security · 2026-09-03T07:35:06Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		License policy violation: npm `@typescript/typescript-aix-ppc64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-aix-ppc64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-darwin-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-darwin-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-darwin-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-darwin-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-freebsd-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-freebsd-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-freebsd-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-freebsd-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-arm` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-arm@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-loong64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-loong64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-mips64el` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-mips64el@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-ppc64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-ppc64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-riscv64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-riscv64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-s390x` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-s390x@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-linux-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-netbsd-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-netbsd-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-netbsd-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-netbsd-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-netbsd-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-netbsd-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-openbsd-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-openbsd-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-openbsd-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-openbsd-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-openbsd-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-openbsd-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-sunos-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-sunos-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-sunos-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-win32-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-win32-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-win32-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `@typescript/typescript-win32-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-win32-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-win32-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `typescript` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: pkg/js/package-lock.json → `npm/typescript@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 3, 2026

dependabot Bot requested review from a team as code owners September 3, 2026 07:34

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 3, 2026

Navigation Menu

Uh oh!

chore(deps): bump the dependencies group across 1 directory with 12 updates - #679

chore(deps): bump the dependencies group across 1 directory with 12 updates#679
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/pkg/js/dependencies-9c8bbc3567

dependabot Bot commented on behalf of github Sep 3, 2026

Uh oh!

socket-security Bot commented Sep 3, 2026

Uh oh!

socket-security Bot commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 3, 2026

v8.20.0

What's Changed

v8.19.0

What's Changed

v2.9.0

v2.8.4

v30.5.0

Highlights

whenCalledWith

Describe-level retries

New file watcher

Long-requested dependency updates

30.5.0

Features

Fixes

v0.9.7

Changed

Documentation

What's Changed

v0.9.7-beta.1

⚠ BREAKING CHANGES

Changed

What's Changed

0.9.7 (2026-08-18)

Changed

Documentation

0.9.6 (2026-05-11)

Fixed

0.9.5 (2026-04-10)

Fixed

v0.9.4

v0.9.4 (2026-03-31)

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

🩹 Fixes

❤️ Thank You

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

❤️ Thank You

v8.66.0

8.68.0 (2026-08-24)

🚀 Features

🩹 Fixes

❤️ Thank You

8.67.0 (2026-08-10)

8.66.0 (2026-08-03)

🩹 Fixes

❤️ Thank You

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

🩹 Fixes

❤️ Thank You

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

❤️ Thank You

v8.66.0

8.68.0 (2026-08-24)

8.67.0 (2026-08-10)

8.66.0 (2026-08-03)

8.65.0 (2026-07-20)

🚀 Features

❤️ Thank You

8.64.0 (2026-07-13)

v4.4.5

Patch Changes

4.4.5

Patch Changes

v30.5.0

Highlights

whenCalledWith

Describe-level retries

New file watcher

Long-requested dependency updates

`whenCalledWith`

`whenCalledWith`