fix(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/config-helpers (source)	0.4.2 → 0.5.5
@fastly/js-compute	3.35.2 → 3.39.4
@semantic-release/npm	13.1.1 → 13.1.5
dotenv	17.2.3 → 17.4.1
form-data	4.0.4 → 4.0.5
fs-extra	11.3.2 → 11.3.4
lint-staged	16.2.6 → 16.4.0
semantic-release	25.0.2 → 25.0.3

---

Release Notes

eslint/rewrite (@​eslint/config-helpers)

v0.5.5

Compare Source

Bug Fixes

• revert re-export ESM types in CommonJS (#​427) (9b16fe1)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

v0.5.4

Compare Source

Bug Fixes

• re-export ESM types in CommonJS (#​416) (ef16f80)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.1.1 to ^1.2.0

v0.5.3

Compare Source

Bug Fixes

• tighten extends typing in config-helpers (#​385) (939bc32)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.1.0 to ^1.1.1

v0.5.2

Compare Source

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.0.1 to ^1.1.0

v0.5.1

Compare Source

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.0.0 to ^1.0.1

v0.5.0

Compare Source

⚠ BREAKING CHANGES

• Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#​297)

Features

• Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#​297) (acc623c)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.17.0 to ^1.0.0

fastly/js-compute-runtime (@​fastly/js-compute)

v3.39.4

Compare Source

Fixed

• Body truncation error in chained extract_body requests (#​1310) (b929648)

v3.39.3

Compare Source

Fixed

• Don't throw from event.client.geo or event.client.address on hostcall error (#​1306) (471b112)

v3.39.2

Compare Source

Fixed

• NPM publication (f80c089)

v3.39.1

Compare Source

Fixed

• For now, go back to old behavior for default exported types. (#​1298) (e6d96d4)
• TransformStream shortcutting fixes (#​1301) (51369ae)

v3.39.0

Compare Source

Added

• Add isBot support to device detection (#​1287) (fe079b1)
• Implement firstByteTimeout for shielding (#​1286) (ad445b7)
• Map the FastlyStatus values into KVStoreError values the same way the Rust SDK does (#​1280) (726f4e2)

Fixed

• Correct default export (#​1269) (58d872e)
• suppress sourcemap for bundle() step when --enable-stack-traces is not set (#​1277) (ab8c12e)

v3.38.4

Compare Source

Fixed

• Don't shortcut transform too early (#​1281) (291814e)

v3.38.3

Compare Source

Fixed

• clean script to include TypeScript output directory (#​1270) (015e40c)
• pin lol_html to 2.7.0 (#​1276) (363550a)
• Rename shielding docs (#​1272) (e12ab47)
• Try and shortcut transform stream reading before doing a regular read (#​1279) (6b9b939)

v3.38.2

Compare Source

Fixed

• Handle cross-volume renames of intermediate files (#​1264) (94e5671)

v3.38.1

Compare Source

Fixed

• Build CLI in npm publish (#​1262) (2fe6e2d)

v3.38.0

Compare Source

Added

• config: add support for config store buffers longer than 8k (#​1181) (da4c169)
• inspect: add support for NGWAF inspect api (#​1212) (98f45e4)

Fixed

• Correct behaviour of chained body proxy streams in some circumstances (#​1259) (11f9a4b)
• make shielding.d.ts ambient (#​1256) (7a0e987)

v3.37.0

Compare Source

Added

• Add client fingerprint properties (tlsJA4, h2Fingerprint, ohFingerprint) (#​1248) (9390e8c)
• Shielding support (#​1241) (985c55e)

v3.36.0

Compare Source

Added

• Image Optimizer support (#​1224) (c3dd3de)
• Implement 103 Early Hints (#​1217) (fda6ad3)

Fixed

• fanout: commit request headers before fanout handoff (#​1222) (8dfefad)
• Fix broken KVStore test (#​1223) (6055d88)

semantic-release/npm (@​semantic-release/npm)

v13.1.5

Compare Source

Bug Fixes

• deps: update dependency normalize-url to v9 (#​1095) (daec492)

v13.1.4

Compare Source

Bug Fixes

• deps: update dependency @​actions/core to v3 (#​1085) (17abfe1)

v13.1.3

Compare Source

Bug Fixes

• deps: update dependency @​actions/core to v2 (#​1055) (fa4a3ab)

v13.1.2

Compare Source

Bug Fixes

• deps: update dependency read-pkg to v10 (#​1032) (f3f1a00)

motdotla/dotenv (dotenv)

v17.4.1

Compare Source

v17.4.0

Compare Source

v17.3.1

Compare Source

Changed

• Fix as2 example command in README and update spanish README

v17.3.0

Compare Source

Added

• Add a new README section on dotenv’s approach to the agentic future.

Changed

• Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

v17.2.4

Compare Source

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#​915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

form-data/form-data (form-data)

v4.0.5

Compare Source

Commits

• [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
• [Dev Deps] update @ljharb/eslint-config, eslint 5822467
• [Fix] set Symbol.toStringTag in the proper place 76d0dee

jprichardson/node-fs-extra (fs-extra)

v11.3.4

Compare Source

• Fix bug where calling ensureSymlink/ensureSymlinkSync with a relative srcPath would fail if the symlink already existed (#​1038, #​1064)

v11.3.3

Compare Source

• Fix copying symlink when destination is a symlink to the same target (#​1019, #​1060)

lint-staged/lint-staged (lint-staged)

v16.4.0

Compare Source

Minor Changes

• #​1739 687fc90 Thanks @​hyperz111! - Replace micromatch with picomatch to reduce dependencies.

v16.3.4

Compare Source

Patch Changes

• #​1742 9d6e827 Thanks @​iiroj! - Update dependencies, including tinyexec@1.0.4 to make sure local node_modules/.bin are preferred to global locations (released in tinyexec@1.0.3).

v16.3.3

Compare Source

Patch Changes

• #​1740 0109e8d Thanks @​iiroj! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash.

v16.3.2

Compare Source

Patch Changes

• #​1735 2adaf6c Thanks @​iiroj! - Hide the extra cmd window on Windows by spawning tasks without the detached option.

v16.3.1

Compare Source

Patch Changes

• #​1729 cd5d762 Thanks @​iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

v16.3.0

Compare Source

Minor Changes

• #​1698 feda37a Thanks @​iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

• #​1699 1346d16 Thanks @​iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

• #​1726 87467aa Thanks @​iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

v16.2.7

Compare Source

Patch Changes

• #​1711 ef74c8d Thanks @​iiroj! - Do not display a "failed to spawn" error message when a task fails normally. This message is reserved for when the task didn't run because spawning it failed.

semantic-release/semantic-release (semantic-release)

v25.0.3

Compare Source

Bug Fixes

• deps: remove deprecated semver-diff (#​3980) (f404124)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

This PR will trigger a patch release when merged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!