build(deps-dev): Bump cspell from 10.3.5 to 10.3.6

[dependabot]

Bumps cspell from 10.3.5 to 10.3.6.

Release notes

Sourced from cspell's releases.

v10.3.6

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

cspell lint reports unknown in-document directives again, such as cspell:bad-dir, when --validate-directives or validateDirectives: true in the config asks for them. Since 9.1.0 they were found but never shown or counted.

• --validate-directives and --no-validate-directives override the config setting.
• An unknown directive counts as an issue, so cspell lint exits with an error, as it did before 9.1.0.
• The JSON reporter, @cspell/cspell-json-reporter, includes them in its output again.

• The default reporter and the JSON reporter now ask to receive directive issues. Other reporters still only get them if they ask for them.
• The command-line flag is now applied as a setting, like --report, so it controls what is shown as well as what is checked.

---

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

createRedirectProvider in cspell-io now only serves requests that map to a location under its private root. A request that would resolve outside the private root is refused with VFSErrorUnsupportedRequest, the same error as a request outside the public root.

• Refused: a path that starts with a separator (/, \, %2F, %5C) right after the public root.
• Now served from inside the private root: file names that look like a URL scheme or a drive, such as a:b.txt or C|. They used to resolve to a different URL.

cspell itself does not use createRedirectProvider. This affects projects that use cspell-io directly.

• The part of the URL after the public root is resolved as a relative path under the private root, and the result is checked to be under the private root: same protocol, same host, and the same path prefix.
• Results coming back from the private file system are checked the same way before they are shown under the public root.
• The change is in commit 25359026e1.

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.3.6 (2026-09-29)

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

cspell lint reports unknown in-document directives again, such as cspell:bad-dir, when --validate-directives or validateDirectives: true in the config asks for them. Since 9.1.0 they were found but never shown or counted.

• --validate-directives and --no-validate-directives override the config setting.
• An unknown directive counts as an issue, so cspell lint exits with an error, as it did before 9.1.0.
• The JSON reporter, @cspell/cspell-json-reporter, includes them in its output again.

• The default reporter and the JSON reporter now ask to receive directive issues. Other reporters still only get them if they ask for them.
• The command-line flag is now applied as a setting, like --report, so it controls what is shown as well as what is checked.

---

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

createRedirectProvider in cspell-io now only serves requests that map to a location under its private root. A request that would resolve outside the private root is refused with VFSErrorUnsupportedRequest, the same error as a request outside the public root.

• Refused: a path that starts with a separator (/, \, %2F, %5C) right after the public root.
• Now served from inside the private root: file names that look like a URL scheme or a drive, such as a:b.txt or C|. They used to resolve to a different URL.

cspell itself does not use createRedirectProvider. This affects projects that use cspell-io directly.

• The part of the URL after the public root is resolved as a relative path under the private root, and the result is checked to be under the private root: same protocol, same host, and the same path prefix.
• Results coming back from the private file system are checked the same way before they are shown under the public root.
• The change is in commit 25359026e1.

... (truncated)

Commits

• 8559198 v10.3.6
• 72e1be3 chore: Prepare Release v10.3.6 (auto-deploy) (#9305)
• e230ca0 test: Give time-limited RPC and worker tests room on slow runners (#9330)
• 8eae6b6 fix: Report unknown CSpell directives again (#9319)
• a5f5111 fix: Don't reuse cached results made with different command-line options (#9318)
• 2f897be fix: --show-perf-summary shows where all of the run's time goes (#9307)
• fe37b7b chore: Label per package, and bugs links to its open issues (#9309)
• See full diff in compare view

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (4455b85) to head (23a1d7f).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #360   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           40        40           
  Lines         1213      1213           
  Branches       247       247           
=========================================
  Hits          1213      1213           

Flag	Coverage Δ
bun-canary	100.00% <ø> (ø)
bun-latest	100.00% <ø> (ø)
node22	100.00% <ø> (ø)
node24	100.00% <ø> (ø)
node25	100.00% <ø> (ø)
node26	100.00% <ø> (ø)

Components	Coverage Δ
docmark	100.00% <ø> (ø)
docmark-factory-block	100.00% <ø> (ø)
docmark-factory-identifier	100.00% <ø> (ø)
docmark-factory-line	100.00% <ø> (ø)
docmark-factory-markers	100.00% <ø> (ø)
docmark-factory-space	100.00% <ø> (ø)
docmark-grammar	100.00% <ø> (ø)
docmark-util-combine-extensions	100.00% <ø> (ø)
docmark-util-subtokenize	100.00% <ø> (ø)
docmark-util-symbol	100.00% <ø> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4455b85...23a1d7f. Read the comment docs.

[flex-development]

lgtm 👍🏾