chore(deps): bump the node-dependencies group across 1 directory with 30 updates

[dependabot]

Bumps the node-dependencies group with 30 updates in the / directory:

Package	From	To
@biomejs/biome	2.3.10	2.5.10
@nx/js	22.5.2	23.1.1
@semantic-release/changelog	6.0.3	7.0.0
@semantic-release/git	10.0.1	11.0.1
@types/node	22.19.3	26.3.0
@vitest/coverage-v8	4.1.10	4.1.11
fast-check	4.5.2	4.9.0
nx	22.5.2	23.1.1
semantic-release	25.0.2	25.0.9
tsx	4.21.0	4.23.12
typedoc	0.28.15	0.28.20
typescript	5.9.3	7.0.2
vitest	4.1.10	4.1.11
@ai-sdk/mcp	1.0.1	2.0.37
@inquirer/prompts	8.1.0	8.6.0
@modelcontextprotocol/sdk	1.27.0	1.30.0
ai	6.0.3	7.0.79
commander	14.0.2	15.0.0
cosmiconfig	9.0.0	10.0.0
zod	4.2.1	4.4.3
@ai-sdk/anthropic	3.0.1	4.0.42
@actions/core	2.0.1	3.0.1
@ai-sdk/google	3.0.30	4.0.51
@linear/sdk	68.1.0	91.0.0
@playwright/mcp	0.0.68	0.0.79
ai-sdk-ollama	3.0.0	4.2.0
glob	13.0.0	13.0.6
@playwright/test	1.58.2	1.62.1
@astrojs/starlight	0.41.4	0.41.8
astro	7.1.3	7.2.6

Updates @biomejs/biome from 2.3.10 to 2.5.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

  <div /* block comment */ class="something"></div>
  <Component /* c */ client:load />

• #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

• #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

  <div>{/* a note */}</div>
  <div class={/* a note */}>x</div>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

  <div>{/* block comment */ x}</div>
  <div>{/* only a comment */}</div>

• #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

  <>
    <p>a</p>
  </>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

  ---
  const a = "</script>";
  // </script> in a comment
  ---

• #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

  <div /* block comment */ class="something"></div>
  <Component /* c */ client:load />

• #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

• #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

  <div>{/* a note */}</div>
  <div class={/* a note */}>x</div>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

  <div>{/* block comment */ x}</div>
  <div>{/* only a comment */}</div>

• #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

  <>
    <p>a</p>
  </>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

  ---
  const a = "</script>";
  // </script> in a comment
  ---

• #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

  <!-- c -->

... (truncated)

Commits

• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• e65f07e feat(lint): nursery useControlLabel (#11312)
• ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• Additional commits viewable in compare view

Updates @nx/js from 22.5.2 to 23.1.1

Release notes

Sourced from @​nx/js's releases.

23.1.1 (2026-07-30)

🚀 Features

• core: derive stable repo key from normalized remote and relative path (#36439)
• repo: add react + vite + vitest + playwright example (#35921)

🩹 Fixes

• angular-rspack: speed up builds and align behavior with the esbuild application builder (#36268, #34936)
• bundling: support TypeScript esbuildConfig files in the esbuild executor (#36352, #36349)
• bundling: acknowledge @​swc/core build scripts when configuring rollup (#36412)
• core: speed up npm lockfile parsing (#36216)
• core: speed up lockfile parsing and catalog resolution (#36223)
• core: show performance report recommendations only when actionable (#36344)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)
• core: prevent shell injection in nx import (#36348)
• core: correct the 22.6.0 gitignore and analytics migration wiring (#36356)
• core: support npm 12 and pnpm in the package provenance check (#36354, #36338)
• core: honor pnpm minimumReleaseAge config on pnpm 11 (#36335, #36330)
• core: support pnpm 11 patched dependency hashes (#36360)
• core: resolve name refs copied into pattern-matched target arrays (#36359)
• core: resolve source-loaded plugin transitive workspace imports (#36296)
• core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#36302)
• core: include continuous and default-config dependencies in show target (#36374)
• core: make unit tests pass locally regardless of invoking package manager (#35994)
• core: respect --aiAgents none to skip AI agent file generation (#34944, #34692)
• core: use --config.frozen-lockfile=false for pnpm add during migrate (#36337)
• core: run selected projects with --exclude-task-dependencies (#35562)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: collect trickling watcher bursts fully on daemon force-flush (#36391)
• core: report tasks running in another Nx process in the inline TUI (#36341)
• core: stop ratatui cursor queries from racing the TUI event stream (#36318)
• core: render critical-path tasks as a nested list in the job summary (#36394)
• core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#36411)
• core: support multiple brace groups in workspace glob matching (#36395)
• core: handle CRLF line endings in pnpm multi-document lockfiles (#36419, #35828, #35840)
• core: correct glob pattern expansion for ZeroOrOne groups (#31857)
• core: stop re-querying confirmed cache misses in task orchestrator (#36301, #35632)
• core: sample project graph perf span telemetry per session at 10% (#36420)
• core: strip terminal query sequences when replaying task output (#36432)
• core: preserve FORCE_COLOR=0 intent for forked child tasks (#35293)
• core: handle colons in target name when resolving inputs to generate graph (#36429, #33710)
• core: merge default plugins through the source-map-aware merge path (#36257)
• core: keep nx migrate on the requested version when release-age gates interfere (#36444)
• core: avoid bogus duplicate project name errors when generating nested apps (#36458)
• core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#36497)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• core: parse pnpm lockfiles that omit the packages block (#36512)
• core: keep real dependencies when omitting peers from npm temp installs (#36518)

... (truncated)

Commits

• 82f3693 fix(js): resolve package and extension-less tsconfig extends read from the tr...
• d86441d fix(js): resolve the verdaccio bin through its package.json (#36479)
• df40b73 fix(linter): use projectService for typed linting in flat configs (#35727)
• 5b6abe1 fix(core): unbreak pnpm 11 installs by acknowledging build-script deps from g...
• b045079 fix(js): parse pnpm/npm publish JSON containing braces in file paths (#36241)
• 57e661b fix(js): support private methods and static blocks in babel preset (#36218)
• a88e494 chore(repo): migrate to nx 23.1.0-rc.2 (#36269)
• ba1d651 fix(js): bump @​swc/cli to 0.8.1 to patch critical decompress advisory (#36294)
• 03483ea fix(js): pin rootDir on composite tsconfigs for ts6 (ts-jest strips composite...
• 60ac6f3 fix(js): pin tsconfig root dir even when it matches the config directory (#36...
• Additional commits viewable in compare view

Updates @semantic-release/changelog from 6.0.3 to 7.0.0

Release notes

Sourced from @​semantic-release/changelog's releases.

v7.0.0

7.0.0 (2026-07-21)

Features

• ES Module (#414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

• Replaced xo with prettier with default configuration; following newly established convention
• Replaced nyc with c8 for code coverage
• Replaced lodash with lodash-es for proper esm support

Related Issue

• semantic-release/semantic-release#2133
• semantic-release/semantic-release#4032

v7.0.0-beta.1

7.0.0-beta.1 (2026-04-23)

Features

• ES Module (#414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

• b1044e1 chore(ci): update Node.js version requirements and test matrix configurations
• 0563e5d chore(deps): update to the latest semantic-release version (#417)
• e154214 feat: ES Module (#414)
• 15e48e4 chore(deps): update dependency sinon to v18.0.1 (#400)
• 1c48000 test: remove codecov (#399)
• 3be34e3 ci(action): update actions/setup-node action to v4.0.3 (#395)
• 854ffb6 ci(action): update actions/checkout action to v4.1.7 (#393)
• e7c79f8 chore(deps): update dependency nyc to v17 (#392)
• 171adfb ci(action): update actions/checkout action to v4.1.6 (#390)
• 13e3bf7 chore(deps): update dependency sinon to v18 (#389)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/changelog since your current version.

Updates @semantic-release/git from 10.0.1 to 11.0.1

Release notes

Sourced from @​semantic-release/git's releases.

v11.0.1

11.0.1 (2026-07-24)

Bug Fixes

• deps: update dependency execa to v10 (#564) (b39d5c6)

v11.0.0

11.0.0 (2026-07-21)

Features

• ES Module (#544) (4d704a2), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/git is now v20.1.0

v11.0.0-beta.2

11.0.0-beta.2 (2026-07-20)

Bug Fixes

• update Node.js engine version requirements in package.json and package-lock.json (ddf699e)

v11.0.0-beta.1

11.0.0-beta.1 (2026-07-17)

Features

• ES Module (#526) (e523946), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

• b39d5c6 fix(deps): update dependency execa to v10 (#564)
• 9dd61f1 chore(deps): lock file maintenance (#470)
• c5c6f06 chore(deps): update dependency lodash-es to v4.18.1 [security] (#545)
• b67458c ci(action): update actions/setup-node action to v6.5.0 (#557)
• d4990ff ci(action): update actions/checkout action to v6.1.0 (#556)
• 16d191f chore(deps): update dependency tempy to v3.2.0 (#448)
• 8efa7b7 chore(deps): update dependency sinon to v21.1.2 (#554)
• e53dc53 chore(deps): update dependency prettier to v3.9.5 (#552)
• 4c2f87f chore(deps): update dependency ls-engines to v0.10.1 (#551)
• 7685d83 chore(deps): update dependency ava to v6.4.1 (#548)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/git since your current version.

Updates @types/node from 22.19.3 to 26.3.0

Commits

• See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• See full diff in compare view

Updates fast-check from 4.5.2 to 4.9.0

Release notes

Sourced from fast-check's releases.

Shrinkable entityGraph and few performance chips

[Code][Diff]

Features

• (PR#7008) Towards shrinkable entityGraph thanks to chainUntil

Fixes

• (PR#7010) Bug: Fix latent state-sharing bug in entityGraph
• (PR#7063) Bug: Equiprobable alternatives in stringMatching
• (PR#6973) CI: Drop caches on push for build package flow
• (PR#6971) CI: Only mark fast-check's releases as latest
• (PR#6974) CI: Drop pull_request_target flows
• (PR#6975) CI: Drop discussion creation on release publish
• (PR#6976) CI: Drop caches from publication steps
• (PR#6977) CI: Revert "Drop caches from publication steps"
• (PR#6978) CI: Make zizmor audit a required status check
• (PR#6991) CI: Remove Claude Code workflow
• (PR#6994) CI: Replace pnpm dlx with pnpm exec for pkg-pr-new
• (PR#6995) CI: Inline zizmor ignores in workflow
• (PR#6996) CI: Move to devEngines.packageManager
• (PR#7005) CI: Update PULL_REQUEST_TEMPLATE.md
• (PR#7011) CI: Drop OTP prompt from npm publish
• (PR#7013) CI: Switch release jobs to npm stage publish
• (PR#7027) CI: Run benchmarks against main
• (PR#7037) CI: Use comparison mode for bench
• (PR#7069) CI: Run pnpm dedupe to deduplicate lockfile
• (PR#6959) CI: Announce releases on Bluesky
• (PR#7105) CI: Switch to actions/attest for attestations
• (PR#7117) CI: Use pnpm version in changelog script
• (PR#7120) CI: Allow unclean tree in changelog generation
• (PR#7125) CI: Stage publish using pnpm in publish jobs
• (PR#7065) Clean: Delete skills directory
• (PR#6983) Doc: Tweak PR Template to hint AI agents into revealing themselves
• (PR#7092) Doc: Add back skills directory
• (PR#7095) Doc: Add release notes for fast-check 4.8.0
• (PR#7104) Doc: Add makeeno as doc contributor
• (PR#7103) Doc: Fix info box in docs
• (PR#7108) Doc: Add jneidel as doc contributor
• (PR#7035) Performance: Faster fc.integer on generate
• (PR#7046) Performance: Faster fc.record on generate
• (PR#7047) Performance: Faster fc.dictionary on generate
• (PR#7048) Performance: Faster fc.webPath/fc.webUrl on generate
• (PR#7050) Performance: Faster fc.stringMatching for \W \D \S .
• (PR#7054) Performance: Faster fc.stringMatching on generate
• (PR#7049) Performance: Drop nested tuple on generate for fc.record
• (PR#7045) Performance: Faster fc.entityGraph on generate
• (PR#7071) Performance: Early exit on empty tuple in fc.entityGraph

... (truncated)

Changelog

Sourced from fast-check's changelog.

4.9.0

Shrinkable entityGraph and few performance chips [Code][Diff]

Features

• (PR#7008) Towards shrinkable entityGraph thanks to chainUntil

Fixes

• (PR#7010) Bug: Fix latent state-sharing bug in entityGraph
• (PR#7063) Bug: Equiprobable alternatives in stringMatching
• (PR#6973) CI: Drop caches on push for build package flow
• (PR#6971) CI: Only mark fast-check's releases as latest
• (PR#6974) CI: Drop pull_request_target flows
• (PR#6975) CI: Drop discussion creation on release publish
• (PR#6976) CI: Drop caches from publication steps
• (PR#6977) CI: Revert "Drop caches from publication steps"
• (PR#6978) CI: Make zizmor audit a required status check
• (PR#6991) CI: Remove Claude Code workflow
• (PR#6994) CI: Replace pnpm dlx with pnpm exec for pkg-pr-new
• (PR#6995) CI: Inline zizmor ignores in workflow
• (PR#6996) CI: Move to devEngines.packageManager
• (PR#7005) CI: Update PULL_REQUEST_TEMPLATE.md
• (PR#7011) CI: Drop OTP prompt from npm publish
• (PR#7013) CI: Switch release jobs to npm stage publish
• (PR#7027) CI: Run benchmarks against main
• (PR#7037) CI: Use comparison mode for bench
• (PR#7069) CI: Run pnpm dedupe to deduplicate lockfile
• (PR#6959) CI: Announce releases on Bluesky
• (PR#7105) CI: Switch to actions/attest for attestations
• (PR#7117) CI: Use pnpm version in changelog script
• (PR#7120) CI: Allow unclean tree in changelog generation
• (PR#7125) CI: Stage publish using pnpm in publish jobs
• (PR#7065) Clean: Delete skills directory
• (PR#6983) Doc: Tweak PR Template to hint AI agents into revealing themselves
• (PR#7092) Doc: Add back skills directory
• (PR#7095) Doc: Add release notes for fast-check 4.8.0
• (PR#7104) Doc: Add makeeno as doc contributor
• (PR#7103) Doc: Fix info box in docs
• (PR#7108) Doc: Add jneidel as doc contributor
• (PR#7035) Performance: Faster fc.integer on generate
• (PR#7046) Performance: Faster fc.record on generate
• (PR#7047) Performance: Faster fc.dictionary on generate
• (PR#7048) Performance: Faster fc.webPath/fc.webUrl on generate
• (PR#7050) Performance: Faster fc.stringMatching for \W \D \S .
• (PR#7054) Performance: Faster fc.stringMatching on generate
• (PR#7049) Performance: Drop nested tuple on generate for fc.record
• (PR#7045) Performance: Faster fc.entityGraph on generate

... (truncated)

Commits

• 0d3c254 🔖 Update CHANGELOG.md for fast-check@4.9.0, @​fast-check/packaged@​0.7.1 (#7124)
• bd85efe ⬆️ Update dependency @​types/node to ^24.13.3 (#7118)
• a0596ab ⬆️ Update dependency vitest to ^4.1.10 (#7119)
• 3c085da ⬆️ Update dependency prettier to v3.9.4 (#7114)
• 6538ff0 👥 Add jneidel as doc contributor (#7108)
• 8096ab0 👥 Add makeeno as doc contributor (#7104)
• 13fd4a6 ✏️ Typo in type EntityGraphContraints (#7088)
• 36e70d2 ⬆️ Update dependency @​microsoft/api-extractor to ^7.58.9 (#7080)
• 451ede0 ⬆️ Update dependency vitest to ^4.1.8 (#7074)
• 949564d ⚡️ Early exit on empty tuple in fc.entityGraph (#7071)
• Additional commits viewable in compare view

Updates nx from 22.5.2 to 23.1.1

Release notes

Sourced from nx's releases.

23.1.1 (2026-07-30)

🚀 Features

• core: derive stable repo key from normalized remote and relative path (#36439)
• repo: add react + vite + vitest + playwright example (#35921)

🩹 Fixes

• angular-rspack: speed up builds and align behavior with the esbuild application builder (#36268, #34936)
• bundling: support TypeScript esbuildConfig files in the esbuild executor (#36352, #36349)
• bundling: acknowledge @​swc/core build scripts when configuring rollup (#36412)
• core: speed up npm lockfile parsing (#36216)
• core: speed up lockfile parsing and catalog resolution (#36223)
• core: show performance report recommendations only when actionable (#36344)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)
• core: prevent shell injection in nx import (#36348)
• core: correct the 22.6.0 gitignore and analytics migration wiring (#36356)
• core: support npm 12 and pnpm in the package provenance check (#36354, #36338)
• core: honor pnpm minimumReleaseAge config on pnpm 11 (#36335, #36330)
• core: support pnpm 11 patched dependency hashes (#36360)
• core: resolve name refs copied into pattern-matched target arrays (#36359)
• core: resolve source-loaded plugin transitive workspace imports (#36296)
• core: unbreak pnpm 11 installs by acknowledging build-script deps from generators (#36302)
• core: include continuous and default-config dependencies in show target (#36374)
• core: make unit tests pass locally regardless of invoking package manager (#35994)
• core: respect --aiAgents none to skip AI agent file generation (#34944, #34692)
• core: use --config.frozen-lockfile=false for pnpm add during migrate (#36337)
• core: run selected projects with --exclude-task-dependencies (#35562)
• core: stop passing git revisions through a shell in affected commands (#36379)
• core: collect trickling watcher bursts fully on daemon force-flush (#36391)
• core: report tasks running in another Nx process in the inline TUI (#36341)
• core: stop ratatui cursor queries from racing the TUI event stream (#36318)
• core: render critical-path tasks as a nested list in the job summary (#36394)
• core: keep pnpm-workspace.yaml comments and read package.json as jsonc (#36411)
• core: support multiple brace groups in workspace glob matching (#36395)
• core: handle CRLF line endings in pnpm multi-document lockfiles (#36419, #35828, #35840)
• core: correct glob pattern expansion for ZeroOrOne groups (#31857)
• core: stop re-querying confirmed cache misses in task orchestrator (#36301, #35632)
• core: sample project graph perf span telemetry per session at 10% (#36420)
• core: strip terminal query sequences when replaying task output (#36432)
• core: preserve FORCE_COLOR=0 intent for forked child tasks (#35293)
• core: handle colons in target name when resolving inputs to generate graph (#36429, #33710)
• core: merge default plugins through the source-map-aware merge path (#36257)
• core: keep nx migrate on the requested version when release-age gates interfere (#36444)
• core: avoid bogus duplicate project name errors when generating nested apps (#36458)
• core: pin typescript in preset dependencies so npm cannot hoist typescript 7 (#36497)
• core: bump pinned axios and brace-expansion past vulnerable versions (#36507, #36474)
• core: parse pnpm lockfiles that omit the packages block (#36512)
• core: keep real dependencies when omitting peers from npm temp installs (#36518)

... (truncated)

Commits

• 8841f1c fix(core): keep real dependencies when omitting peers from npm temp installs ...
• 86dbded fix(core): parse pnpm lockfiles that omit the packages block (#36512)
• cff77e2 fix(core): bump pinned axios and brace-expansion past vulnerable versions (#3...
• a2e6ac4 chore(repo): stop eslint linting json files with no applicable rules (#36454)
• dd97e9c fix(core): avoid bogus duplicate project name errors when generating nested a...
• 50f61ef feat(core): derive stable repo key from normalized remote and relative path (...
• 9d51f0a fix(core): keep nx migrate on the requested version when release-age gates in...