Skip to content

chore(deps): bump the npm-deps group with 7 updates - #66

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-47da59bdc9
Open

chore(deps): bump the npm-deps group with 7 updates#66
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-47da59bdc9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-deps group with 7 updates:

Package From To
hono 4.13.0 4.13.1
pg 8.22.0 8.23.0
@commitlint/cli 21.2.1 21.2.2
@commitlint/config-conventional 21.2.0 21.2.2
eslint 10.8.0 10.8.1
fallow 3.14.0 3.15.0
globals 17.9.0 17.11.0

Updates hono from 4.13.0 to 4.13.1

Release notes

Sourced from hono's releases.

v4.13.1

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.13.0...v4.13.1

Commits

Updates pg from 8.22.0 to 8.23.0

Changelog

Sourced from pg's changelog.

pg@8.23.0

Commits

Updates @commitlint/cli from 21.2.1 to 21.2.2

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.2

21.2.2 (2026-08-13)

Bug Fixes

Chore, docs, etc.

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.2.1...v21.2.2

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.2 (2026-08-13)

Note: Version bump only for package @​commitlint/cli

Commits

Updates @commitlint/config-conventional from 21.2.0 to 21.2.2

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.2

21.2.2 (2026-08-13)

Bug Fixes

Chore, docs, etc.

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.2.1...v21.2.2

v21.2.1

21.2.0 (2026-06-30)

Features

  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

Chore, doc, etc.

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.2.0...v21.2.1

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.2 (2026-08-13)

Note: Version bump only for package @​commitlint/config-conventional

Commits

Updates eslint from 10.8.0 to 10.8.1

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

  • 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
  • 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
  • 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
  • ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
  • f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
  • 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
  • d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
  • 65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
  • 22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
  • 55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
  • 7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
  • eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
  • 60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
  • f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
  • d086293 test: add error locations to no-undef (#21147) (JIYEON)
  • cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
  • 688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
  • 7c1e175 test: add error locations to require-await (#21145) (Grit)
  • 588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
  • 059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
  • 5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)
Commits

Updates fallow from 3.14.0 to 3.15.0

Release notes

Sourced from fallow's releases.

v3.15.0: near-miss clone detection, diagnosable threshold overrides, community bug fixes

Highlights

Near-miss clone detection and smarter duplicate triage

fallow dupes --near (config duplicates.near) now also detects function-scoped clones with small structural edits, reported with a similarity score. Every clone-group finding carries a new spread field, and --top ranking boosts clones scattered across distant files above local ones, so the duplicates worth consolidating first rise to the top. A new duplicates.ignoredClones list ("dup:<fingerprint>:<instance_count>") silences clone groups a reviewer has accepted; fingerprints hash the normalized token sequence, so formatting-only edits keep a reviewed clone recognized.

Threshold overrides are finally diagnosable (health schema 10)

A health.thresholdOverrides entry that did not silence a finding now tells you why: every override row carries a required dimension (complexity or crap), a new insufficient status marks an override that raises a ceiling the code still exceeds, and an optional outstanding[] lists the dimensions a matched unit still breaches. Overrides now also apply to synthetic \<template> findings in Svelte, Vue, and Astro single-file components, and those findings get a framework-correct suppression hint (<!-- fallow-ignore-next-line complexity --> on the line above the reported line) instead of Angular decorator advice. A follow-up pass made the override rows agree with their findings everywhere: the <component> rollup consults the override resolver, outstanding no longer swaps dimensions between same-named units, status is scored across ceilings, and CodeClimate plus GitHub annotations quote the effective threshold instead of the run-global one. Standalone health and combined output move to schema_version 10; audit output does not embed the health contract and stays at 9. Thanks @​lcestou for the report.

Bug fixes

  • Type-aware analysis respects an explicit "private-type-leaks": "off". Enabling typeAware force-enabled the opt-in rule regardless of config, which also made the api-surface sidecar capability mandatory. The explicit setting now wins; unset configs keep the default-on behavior. Thanks @​thewirv.
  • cacheMaxAgeDays and FALLOW_AUDIT_CACHE_MAX_AGE_DAYS actually reclaim audit caches now. The base-snapshot cache GC only visited entries under the current repo's hash prefix, so caches from linked worktrees accumulated forever. Abandoned entries from other repo identities now age out, live owners are skipped (a repo's own 0 cannot be defeated from outside), and invalid env values warn instead of silently falling back. Thanks @​EvanAgee.
  • --gate new-only no longer fails clone-removal refactors. Extracting a shared helper and deleting duplicate instances shifted the clone group's attribution key and made the surviving duplication look introduced. Groups whose instances contain no added line are now demoted to inherited, while a genuinely pasted clone still fails the gate. Thanks @​devmax128.
  • Framework template findings show which conditions caused them. A \<template> complexity finding in Vue, Angular, Svelte, or Astro now reports each decision point at its own line and column with the weight it added, so the VS Code inline breakdown and health --complexity-breakdown work in templates too. Thanks @​Ericlm.
  • Windows: added-line attribution now sees untracked files. Native backslash paths passed to the untracked-file diff meant every added-line check on an untracked file silently missed on Windows.
  • Svelte await-block complexity labels match the source. {#await} / {:then} contributions were labeled if; they now use explicit await and then kinds, including inline then/catch continuations.
  • Malformed config shapes fail loud. A malformed extends value, an unknown key in an overrides entry, or an unknown key in an ignoreExports rule now fails config load with a named error instead of silently disabling the rule it was meant to configure. Run fallow config before upgrading to surface rejected shapes ahead of CI.
  • Resolver fixes: .js specifiers resolve to declaration-only .d.ts modules; ignoreUnresolvedImports entries with a leading ./ match again; multi-binding re-exports from a missing module produce one finding anchored on the specifier instead of one per binding.
  • Plus: fallow --help lists every subcommand again, fallow setup-hooks can no longer duplicate a hand-edited managed block, audit read failures no longer fabricate weakening signals, a malformed pnpm-workspace.yaml warns instead of silently disabling catalog resolution, MCP workspace comma lists work on API-backed tool paths, untrusted values are escaped in github-summary tables, fallow-ignore-next-line inside multi-line block comments anchors correctly, VS Code binary downloads can no longer hang LSP startup, and LSP analysis no longer blocks the dispatch loop.

Performance

Module resolution and graph build got faster: resolve fallback paths reuse the session canonicalize cache, dynamic-import pattern matching memoizes compiled glob matchers, and reference attachment on high-fan-in modules replaces two quadratic rescans with indexed lookups.

Compatibility

  • Health and combined JSON output move to schema_version 10 (required dimension on threshold_overrides[] rows, new insufficient status, optional outstanding[]). Audit output stays at 9.
  • Two --format compact health line grammars gained fields (exceeded= on high-complexity:, a dimension segment and optional outstanding= on threshold-override:); key=value consumers are unaffected.
  • Three previously-tolerated malformed config shapes are now load errors (see above).
  • TypeScript consumers: each output field references its own exact version alias (CheckSchemaVersion, HealthSchemaVersion, ...); the legacy SchemaVersion export remains an alias of CheckSchemaVersion.

Full Changelog: fallow-rs/fallow@v3.14.0...v3.15.0

Commits
  • 66ae724 fix(napi): keep the node-binding manifests at the last published version unti...
  • 4b48d65 ci: retry the ecosystem project clone (#2206)
  • 1c59d2d fix(health): make threshold-override rows agree with their findings (#2207)
  • 1e09e51 fix: sync the npm package versions with the 3.15.0 workspace (#2208)
  • eaaeb4a chore: release v3.15.0
  • 4dadd30 fix(engine): pass forward-slashed paths to the untracked-file diff on Windows
  • b204805 chore(deps-dev): bump rolldown from 1.2.0 to 1.2.2 in /viz-frontend (#2181)
  • a6848ae test(vscode): pin combined and health envelopes at schema 10 (#2205)
  • 54082f0 chore(deps): move the Oxc tooling to oxlint 1.78 and oxfmt 0.63 (#2204)
  • 303c667 chore(deps): bump http from 1.4.2 to 1.5.0 (#2187)
  • Additional commits viewable in compare view

Updates globals from 17.9.0 to 17.11.0

Release notes

Sourced from globals's releases.

v17.11.0

  • Add react-native globals (#337) 61eafbf

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

  • Add GM_cookie to Greasemonkey globals (#349) f468407

sindresorhus/globals@v17.9.0...v17.10.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-deps group with 7 updates
25a1adb 
Bumps the npm-deps group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [hono](https://github.com/honojs/hono) | `4.13.0` | `4.13.1` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `21.2.1` | `21.2.2` |
| [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `21.2.0` | `21.2.2` |
| [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` |
| [fallow](https://github.com/fallow-rs/fallow) | `3.14.0` | `3.15.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.11.0` |


Updates `hono` from 4.13.0 to 4.13.1
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.0...v4.13.1)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `@commitlint/cli` from 21.2.1 to 21.2.2
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/cli)

Updates `@commitlint/config-conventional` from 21.2.0 to 21.2.2
- [Release notes](https://github.com/conventional-changelog/commitlint/releases)
- [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md)
- [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.2/@commitlint/config-conventional)

Updates `eslint` from 10.8.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.0...v10.8.1)

Updates `fallow` from 3.14.0 to 3.15.0
- [Release notes](https://github.com/fallow-rs/fallow/releases)
- [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml)
- [Commits](fallow-rs/fallow@v3.14.0...v3.15.0)

Updates `globals` from 17.9.0 to 17.11.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.9.0...v17.11.0)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@commitlint/cli"
  dependency-version: 21.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 21.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: fallow
  dependency-version: 3.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: globals
  dependency-version: 17.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants