chore(deps): bump the all-packages group across 1 directory with 10 updates

[dependabot]

Bumps the all-packages group with 10 updates in the / directory:

Package	From	To
eslint-plugin-import-next	2.7.3	2.8.2
eslint-plugin-maintainability	3.2.2	3.2.10
eslint-plugin-modularity	2.5.2	2.5.3
eslint-plugin-react-a11y	2.5.1	2.5.2
eslint-plugin-react-features	1.7.2	1.7.6
oxlint	1.81.0	1.83.0
prettier	3.9.6	3.9.8
@supabase/supabase-js	2.115.0	2.116.0
posthog-js	1.426.4	1.434.0
tailwind-merge	3.6.0	3.7.0

Updates eslint-plugin-import-next from 2.7.3 to 2.8.2

Release notes

Sourced from eslint-plugin-import-next's releases.

eslint-plugin-import-next@2.8.2

Patch Changes

• 🐛 Fix — extensions now checks the specifier of a dynamic import(). The rule visited ImportDeclaration, ExportNamedDeclaration and ExportAllDeclaration but not ImportExpression, so the identical specifier string was reported on a static import and silent on an await import(...) in the same file — leaving the file less consistent after --fix than before it, the exact defect the export-from forms were added to remove. A non-literal specifier (template or variable) is still left alone. Surfaces 6 previously-missed findings in the burgee corpus.
• 🐛 Fix — consistent-type-specifier-style no longer emits a Fix: instruction that drops type from every specifier but the first. The type marker sat outside the {{name}} interpolation while the data bound a comma-joined list, so an import of more than one name rendered as import { type A, B } — following it demotes every later specifier to a value import, which under verbatimModuleSyntax is emitted verbatim and throws at runtime. The autofix was already correct; only the emitted guidance disagreed with it.

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-import-next@2.8.2

Pull requests since 2.8.1

• fix(rules): FP/FN sweep 2026-09-15 — 3 findings — ofri-peretz/eslint#1050
• fix(rules): FP/FN sweep 2026-09-14 — 3 findings — ofri-peretz/eslint#1039

eslint-plugin-import-next@2.8.1

Patch Changes

• 🐛 Fix — extensions checks export … from and export * from

  The rule registered only an ImportDeclaration visitor, so the same specifier string got opposite verdicts one line apart: import { Argument } from './argument.js' reported, export { Argument } from './argument.js' stayed silent. For a rule whose contract is "ensure consistent use of file extensions", --fix left the file less consistent than it found it.

  Both export-from forms now route through the same check. Sibling rules in this package (no-unresolved, no-internal-modules) already treated "imports" as meaning module specifiers rather than the ImportDeclaration node type.

• 🐛 Fix — no-unused-modules's allowImportOnly exempts only modules that import

  The option is documented — in its schema, its JSDoc, and the generated docs — as "Allow modules that only contain imports", but the implementation read it as a plain if (!hasExports && !allowImportOnly). Every export-less module was exempted, imports or not, which made the option a rule-level off switch rather than the narrow exemption its name and description promise.

  Imports are now tracked, so the exemption needs one. A module with no imports at all does not "only contain imports" under any reading, and still reports.

• 🐛 Fix — consistent-type-specifier-style stops rebuilding away parts of the import

  Two losses from the same whole-statement rebuild.

  A string-literal imported name was read through imported.value, which drops the quotes:

... (truncated)

Changelog

Sourced from eslint-plugin-import-next's changelog.

2.8.2

Patch Changes

• 🐛 Fix — extensions now checks the specifier of a dynamic import(). The rule visited ImportDeclaration, ExportNamedDeclaration and ExportAllDeclaration but not ImportExpression, so the identical specifier string was reported on a static import and silent on an await import(...) in the same file — leaving the file less consistent after --fix than before it, the exact defect the export-from forms were added to remove. A non-literal specifier (template or variable) is still left alone. Surfaces 6 previously-missed findings in the burgee corpus.
• 🐛 Fix — consistent-type-specifier-style no longer emits a Fix: instruction that drops type from every specifier but the first. The type marker sat outside the {{name}} interpolation while the data bound a comma-joined list, so an import of more than one name rendered as import { type A, B } — following it demotes every later specifier to a value import, which under verbatimModuleSyntax is emitted verbatim and throws at runtime. The autofix was already correct; only the emitted guidance disagreed with it.

2.8.1

Patch Changes

• 🐛 Fix — extensions checks export … from and export * from

  The rule registered only an ImportDeclaration visitor, so the same specifier string got opposite verdicts one line apart: import { Argument } from './argument.js' reported, export { Argument } from './argument.js' stayed silent. For a rule whose contract is "ensure consistent use of file extensions", --fix left the file less consistent than it found it.

  Both export-from forms now route through the same check. Sibling rules in this package (no-unresolved, no-internal-modules) already treated "imports" as meaning module specifiers rather than the ImportDeclaration node type.

• 🐛 Fix — no-unused-modules's allowImportOnly exempts only modules that import

  The option is documented — in its schema, its JSDoc, and the generated docs — as "Allow modules that only contain imports", but the implementation read it as a plain if (!hasExports && !allowImportOnly). Every export-less module was exempted, imports or not, which made the option a rule-level off switch rather than the narrow exemption its name and description promise.

  Imports are now tracked, so the exemption needs one. A module with no imports at all does not "only contain imports" under any reading, and still reports.

• 🐛 Fix — consistent-type-specifier-style stops rebuilding away parts of the import

  Two losses from the same whole-statement rebuild.

  A string-literal imported name was read through imported.value, which drops the quotes: import type { 'a-b' as AB } was rewritten to import { type a-b as AB }, output that no longer parses. The specifier's own source text is read instead.

  An import attribute is not a specifier, so rebuilding from namedSpecifiers deleted it — with { type: 'json' } silently gone, which is TS1543 at compile time and ERR_IMPORT_ATTRIBUTE_MISSING at runtime. The preference still reports; only the rewrite stops, the same guard the default-binding case already had.

2.8.0

Minor Changes

... (truncated)

Commits

• 71e7cf4 chore(release): version packages (#1049)
• 6d57c49 fix(rules): FP/FN sweep 2026-09-15 — 3 findings (#1050)
• 7612d8a fix(rules): FP/FN sweep 2026-09-14 — 3 findings (#1039)
• 31945cd chore(release): version packages (#1000)
• 5c98a77 fix(rules): FP/FN sweep 2026-09-13 — 6 findings (#997)
• 8408e94 chore(release): version packages (#989)
• 88dfc07 fix(rules): FP/FN sweep 2026-09-13 — 3 findings (#983)
• 84e7037 fix(rules): FP/FN sweep 2026-09-13 — 4 findings (#985)
• 7a04432 feat(supabase-security): the SDK we use ourselves, and did not lint (#960)
• b261c35 chore(release): version packages (#968)
• Additional commits viewable in compare view

Updates eslint-plugin-maintainability from 3.2.2 to 3.2.10

Release notes

Sourced from eslint-plugin-maintainability's releases.

eslint-plugin-maintainability@3.2.10

Patch Changes

• 🐛 Fix — cognitive-complexity charges a homogeneous run of logical operators once, not once per operator. The docs' Complexity Factors table scores logical operators "+1 | &&, || (sequence breaks)" — a run costs one point and only a break in the run starts the next — but every LogicalExpression node was charged, so a && b && c && d cost 3 where the table says 1. That inflated every &&-heavy function against an unchanged Sonar-default threshold of 15. Mixed runs such as a && b || c still cost 2, as two sequences should.
• 🐛 Fix — identical-functions no longer groups a function with a closure nested inside it. An outer function whose body is largely one call taking an inline callback shares almost all its text with that callback, so the pair cleared the similarity threshold by construction — but they are one implementation, and "extract to a reusable function" is impossible advice, because lifting a closure out of its own parent removes no code. A triple-nested forEach was reported as "3 duplicates" of itself. Removes 6 of burgee's 24 findings for this rule.

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-maintainability@3.2.10

Pull requests since 3.2.9

• fix(rules): FP/FN sweep 2026-09-15 — 3 findings — ofri-peretz/eslint#1050
• fix(rules): FP/FN sweep 2026-09-15 — 3 findings — ofri-peretz/eslint#1047

eslint-plugin-maintainability@3.2.9

Patch Changes

• 🐛 Fix — FP/FN sweep against the burgee corpus — three confirmed rule defects.

  • no-silent-errors (maintainability + reliability): allowWithComment only examined comments above the catch keyword, so the canonical placement — the explanation inside the block — could not satisfy it. The above-the-catch window is kept and a range-scoped scan of the block is added beside it.
  • consistent-existence-index-check (conventions): an undocumented parent-type allowlist withheld the one autofix the docs promise whenever the call was nested (under !, inside &&, as an argument, array element, or conditional branch). Recovers 14 withheld autofixes on the corpus.
  • no-unnecessary-rerenders (react-features): a multi-line prop was interpolated raw into the message, breaking the documented first line down to the bare token ⚡ {. Whitespace is now collapsed before truncation.

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-maintainability@3.2.9

Pull requests since 3.2.8

• fix(rules): FP/FN sweep 2026-09-14 — 3 findings — ofri-peretz/eslint#1040

eslint-plugin-maintainability@3.2.8

Patch Changes

... (truncated)

Changelog

Sourced from eslint-plugin-maintainability's changelog.

3.2.10

Patch Changes

• 🐛 Fix — cognitive-complexity charges a homogeneous run of logical operators once, not once per operator. The docs' Complexity Factors table scores logical operators "+1 | &&, || (sequence breaks)" — a run costs one point and only a break in the run starts the next — but every LogicalExpression node was charged, so a && b && c && d cost 3 where the table says 1. That inflated every &&-heavy function against an unchanged Sonar-default threshold of 15. Mixed runs such as a && b || c still cost 2, as two sequences should.
• 🐛 Fix — identical-functions no longer groups a function with a closure nested inside it. An outer function whose body is largely one call taking an inline callback shares almost all its text with that callback, so the pair cleared the similarity threshold by construction — but they are one implementation, and "extract to a reusable function" is impossible advice, because lifting a closure out of its own parent removes no code. A triple-nested forEach was reported as "3 duplicates" of itself. Removes 6 of burgee's 24 findings for this rule.

3.2.9

Patch Changes

• 🐛 Fix — FP/FN sweep against the burgee corpus — three confirmed rule defects.

  • no-silent-errors (maintainability + reliability): allowWithComment only examined comments above the catch keyword, so the canonical placement — the explanation inside the block — could not satisfy it. The above-the-catch window is kept and a range-scoped scan of the block is added beside it.
  • consistent-existence-index-check (conventions): an undocumented parent-type allowlist withheld the one autofix the docs promise whenever the call was nested (under !, inside &&, as an argument, array element, or conditional branch). Recovers 14 withheld autofixes on the corpus.
  • no-unnecessary-rerenders (react-features): a multi-line prop was interpolated raw into the message, breaking the documented first line down to the bare token ⚡ {. Whitespace is now collapsed before truncation.

3.2.8

Patch Changes

• 🐛 Fix — consistent-function-scoping no longer reports a function that captures a sibling function declared in the same scope. Hoisting makes the sibling reachable from the outer scope, so the inner function cannot be moved there without breaking the reference — the rule was recommending a move that does not compile.

3.2.7

Patch Changes

• 🐛 Fix — no-silent-errors's allowWithComment no longer disarms the rest of the file

  The proximity check had no lower bound: for a comment below the catch, catchStart.line - comment.loc.end.line is negative, which satisfies <= 2 at any distance. One stray // TODO or // legacy anywhere later in the file silenced every empty catch above it — two of them 988 lines up, in the case that surfaced this.

  The window is now bounded at both ends, matching the sibling no-unsafe-type-narrowing fix. Distance 0 is kept, so a comment trailing the catch's own line still counts. Both copies of the rule carried the identical expression; both are fixed.

3.2.6

Patch Changes

... (truncated)

Commits

• 71e7cf4 chore(release): version packages (#1049)
• 6d57c49 fix(rules): FP/FN sweep 2026-09-15 — 3 findings (#1050)
• 55a679d fix(rules): FP/FN sweep 2026-09-15 — 3 findings (#1047)
• 9a9cc27 chore(release): version packages (#1043)
• 7b17c9e fix(rules): FP/FN sweep 2026-09-14 — 3 findings (#1040)
• bddb2c9 chore(release): version packages (#1022)
• 176cf9c fix(rules): FP/FN sweep 2026-09-14 — 1 finding (#1019)
• 31945cd chore(release): version packages (#1000)
• 5c98a77 fix(rules): FP/FN sweep 2026-09-13 — 6 findings (#997)
• 7a04432 feat(supabase-security): the SDK we use ourselves, and did not lint (#960)
• Additional commits viewable in compare view

Updates eslint-plugin-modularity from 2.5.2 to 2.5.3

Release notes

Sourced from eslint-plugin-modularity's releases.

eslint-plugin-modularity@2.5.3

Patch Changes

• 🐛 Fix — The README logo now links to the plugin's own documentation.

  Every plugin README opens with the Interlace logo, and it linked to the site root — so the most obvious thing to click on the npm page dropped the reader on a landing page and left them looking for the plugin they were already reading about. Both the header and footer logos now point at that plugin's docs page.

  The oxlint and ESLint logos still link to oxc.rs and eslint.org, which is where those belong.

  No rule behaviour changes.

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-modularity@2.5.3

Pull requests since 2.5.2

• docs(workspace): the README logo links to the plugin's own docs — ofri-peretz/eslint#884
• fix(workspace): five plugins had no coverage config and reported none — ofri-peretz/eslint#873
• fix(workspace): the probe only rewrote calls — 22 member-read blind spots, and the API-surface table that was never measured — ofri-peretz/eslint#824

Changelog

Sourced from eslint-plugin-modularity's changelog.

2.5.3

Patch Changes

• 🐛 Fix — The README logo now links to the plugin's own documentation.

  Every plugin README opens with the Interlace logo, and it linked to the site root — so the most obvious thing to click on the npm page dropped the reader on a landing page and left them looking for the plugin they were already reading about. Both the header and footer logos now point at that plugin's docs page.

  The oxlint and ESLint logos still link to oxc.rs and eslint.org, which is where those belong.

  No rule behaviour changes.

Commits

• 3ff92a3 chore(release): version packages (#886)
• a6f284d docs(workspace): the README logo links to the plugin's own docs (#884)
• 1600825 fix(workspace): five plugins had no coverage config and reported none (#873)
• 814667f fix(workspace): the probe only rewrote calls — 22 member-read blind spots, an...
• See full diff in compare view

Updates eslint-plugin-react-a11y from 2.5.1 to 2.5.2

Changelog

Sourced from eslint-plugin-react-a11y's changelog.

2.5.2

Patch Changes

• 🐛 Fix — The README logo now links to the plugin's own documentation.

  Every plugin README opens with the Interlace logo, and it linked to the site root — so the most obvious thing to click on the npm page dropped the reader on a landing page and left them looking for the plugin they were already reading about. Both the header and footer logos now point at that plugin's docs page.

  The oxlint and ESLint logos still link to oxc.rs and eslint.org, which is where those belong.

  No rule behaviour changes.

Commits

• 3ff92a3 chore(release): version packages (#886)
• a6f284d docs(workspace): the README logo links to the plugin's own docs (#884)
• 814667f fix(workspace): the probe only rewrote calls — 22 member-read blind spots, an...
• 58b841f fix(deps): @​typescript-eslint 8.68.0, and the template quasis it stopped cook...
• See full diff in compare view

Updates eslint-plugin-react-features from 1.7.2 to 1.7.6

Release notes

Sourced from eslint-plugin-react-features's releases.

eslint-plugin-react-features@1.7.6

Patch Changes

• 🐛 Fix — require-render-return now requires every path through an if to return, rather than any path. A render() whose only return sits in an if with no else falls through and renders nothing — the shape the rule's own docs print under "❌ Incorrect" — and was silently accepted. if/else where both branches return, and a trailing return after the if, remain valid.

  switch is now judged the same way. The check asked only whether any clause contained a return, so switch (k) { case 1: return <A/>; } passed while an unmatched k fell straight out and rendered nothing, and a clause ending in break did the same. A switch now counts as returning only when a default exists and every clause ends in a return — its own, or one it falls through into. Empty fallthrough clauses and clauses returning via if/else remain valid; no clause is required to carry a bare return of its own.

• 🐛 Fix — FP/FN sweep against the burgee corpus — three confirmed rule defects.

  • no-silent-errors (maintainability + reliability): allowWithComment only examined comments above the catch keyword, so the canonical placement — the explanation inside the block — could not satisfy it. The above-the-catch window is kept and a range-scoped scan of the block is added beside it.
  • consistent-existence-index-check (conventions): an undocumented parent-type allowlist withheld the one autofix the docs promise whenever the call was nested (under !, inside &&, as an argument, array element, or conditional branch). Recovers 14 withheld autofixes on the corpus.
  • no-unnecessary-rerenders (react-features): a multi-line prop was interpolated raw into the message, breaking the documented first line down to the bare token ⚡ {. Whitespace is now collapsed before truncation.

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

npm install --save-dev eslint-plugin-react-features@1.7.6

Pull requests since 1.7.5

• fix(rules): FP/FN sweep 2026-09-14 — 3 findings — ofri-peretz/eslint#1040
• fix(rules): FP/FN sweep 2026-09-14 — 3 findings — ofri-peretz/eslint#1039
• fix(rules): FP/FN sweep 2026-09-14 — 6 findings — ofri-peretz/eslint#1037
• feat(supabase-security): the SDK we use ourselves, and did not lint — ofri-peretz/eslint#960

eslint-plugin-react-features@1.7.5

Patch Changes

• 🐛 Fix — two rules that could not report anything

  react-features/static-property-placement now works. Its grouping check ended in an empty if — the context.report had been deleted alongside a genuinely unreachable branch beside it, leaving a condition whose answer nobody used. The rule ships under two export names, so a config that enables every rule of every plugin got it at error and never heard from it. Its 21 valid cases all passed, and none of them could have failed: a rule with no context.report satisfies every valid case ever written for it.

  The question it asked was wrong too. Two adjacent static properties from different groups is what correct grouping looks like; the defect is a group resuming after another group came between it and its earlier members. That is now what it reports. A static property belonging to no configured group does not break a group — nothing says it does not belong there. static [propTypes] = {} is also no longer read as the property propTypes; a computed key is whatever the variable holds.

  reliability/no-jsdoc-terminator-in-example is deprecated. It looks for */ inside a JSDoc @example, and a block comment ends at its first */ — so a comment's value can never contain one. Constructing the case produces a parse error, not a finding. Nothing you can write will make this rule fire, which is why it has no defect cases. Remove it from your config; findTerminatorsInExamples remains exported and unit-tested.

---

✅ Safe to upgrade. No breaking changes: existing configs keep working as-is.

... (truncated)

Changelog

Sourced from eslint-plugin-react-features's changelog.

1.7.6

Patch Changes

• 🐛 Fix — require-render-return now requires every path through an if to return, rather than any path. A render() whose only return sits in an if with no else falls through and renders nothing — the shape the rule's own docs print under "❌ Incorrect" — and was silently accepted. if/else where both branches return, and a trailing return after the if, remain valid.

  switch is now judged the same way. The check asked only whether any clause contained a return, so switch (k) { case 1: return <A/>; } passed while an unmatched k fell straight out and rendered nothing, and a clause ending in break did the same. A switch now counts as returning only when a default exists and every clause ends in a return — its own, or one it falls through into. Empty fallthrough clauses and clauses returning via if/else remain valid; no clause is required to carry a bare return of its own.

• 🐛 Fix — FP/FN sweep against the burgee corpus — three confirmed rule defects.

  • no-silent-errors (maintainability + reliability): allowWithComment only examined comments above the catch keyword, so the canonical placement — the explanation inside the block — could not satisfy it. The above-the-catch window is kept and a range-scoped scan of the block is added beside it.
  • consistent-existence-index-check (conventions): an undocumented parent-type allowlist withheld the one autofix the docs promise whenever the call was nested (under !, inside &&, as an argument, array element, or conditional branch). Recovers 14 withheld autofixes on the corpus.
  • no-unnecessary-rerenders (react-features): a multi-line prop was interpolated raw into the message, breaking the documented first line down to the bare token ⚡ {. Whitespace is now collapsed before truncation.

1.7.5

Patch Changes

• 🐛 Fix — two rules that could not report anything

  react-features/static-property-placement now works. Its grouping check ended in an empty if — the context.report had been deleted alongside a genuinely unreachable branch beside it, leaving a condition whose answer nobody used. The rule ships under two export names, so a config that enables every rule of every plugin got it at error and never heard from it. Its 21 valid cases all passed, and none of them could have failed: a rule with no context.report satisfies every valid case ever written for it.

  The question it asked was wrong too. Two adjacent static properties from different groups is what correct grouping looks like; the defect is a group resuming after another group came between it and its earlier members. That is now what it reports. A static property belonging to no configured group does not break a group — nothing says it does not belong there. static [propTypes] = {} is also no longer read as the property propTypes; a computed key is whatever the variable holds.

  reliability/no-jsdoc-terminator-in-example is deprecated. It looks for */ inside a JSDoc @example, and a block comment ends at its first */ — so a comment's value can never contain one. Constructing the case produces a parse error, not a finding. Nothing you can write will make this rule fire, which is why it has no defect cases. Remove it from your config; findTerminatorsInExamples remains exported and unit-tested.

1.7.4

Patch Changes

• 🐛 Fix — void-dom-elements-no-children no longer reports <Link>, <Img>, <Input> and other capitalized components

  <Link href="/docs">Read the floor</Link> from next/link was reported as "<link> is a void element and cannot have children". The tag-name check lower-cased the JSX name before looking it up, so any component whose name differed from a void element only by case was treated as that element.

  JSX resolves a capitalized name to a binding, never to a DOM tag. Only a lowercase JSXIdentifier (link, img, br, …) can be a void DOM element, and that is now the only thing the rule matches.

1.7.3

... (truncated)

Commits

• 9a9cc27 chore(release): version packages (#1043)
• 09397ed fix(rules): FP/FN sweep 2026-09-14 — 6 findings (#1037)
• 7b17c9e fix(rules): FP/FN sweep 2026-09-14 — 3 findings (#1040)
• 7612d8a fix(rules): FP/FN sweep 2026-09-14 — 3 findings (#1039)
• 7a04432 feat(supabase-security): the SDK we use ourselves, and did not lint (#960)
• b261c35 chore(release): version packages (#968)
• 096a852 fix: two rules that could not report, found by the case ledger (#966)
• ef9c878 chore(release): version packages (#902)
• 3dce21f fix(eslint-rules): two false positives found by dogfooding the cli repo (#903)
• 3ff92a3 chore(release): version packages (#886)
• Additional commits viewable in compare view

Updates oxlint from 1.81.0 to 1.83.0

Release notes

Sourced from oxlint's releases.

oxlint v1.83.0 & oxfmt v0.68.0

Table of Contents

• Oxlint v1.83.0
• Oxfmt v0.68.0

Oxlint v1.83.0

🚀 Features

• afe950d linter/react: Update lint rules to accomodate changes in React 19.3 (#26571) (Connor Shea)

🐛 Bug Fixes

• fb87ed7 linter/unicorn/prefer-array-flat-map: Report .filter().flatMap() chains (#26626) (camc314)
• 336b654 linter/unicorn/prefer-at: Report single-character substring calls (#26623) (camc314)
• a5bba6d linter/eslint/no-unused-vars: Respect rest params after-used option (#26579) (Bartok)
• c1470a2 linter/eslint/no-unused-vars: Preserve ambient implicit exports (#26582) (Dex Hunter)
• 9a469d2 linter/unicorn/prefer-global-this: Preserve window event method references (#26611) (Dex Hunter)
• aaff758 linter/unicorn/prefer-default-parameters: Report violation for ??= and ||= (#26607) (Bartok)
• 2bed25a linter/unicorn/prefer-array-flat: Skip plain concat normalization (#26604) (im10furry)
• 72bc7f2 oxlint: Replace backlashes path for "no js runtime" diagnostic (#26599) (Sysix)
• 1aa5ec1 linter/typescript/prefer-for-of: Handle computed collections (#26584) (camc314)
• 1e90019 linter/typescript: Mark no-unnecessary-type-parameters and prefer-find suggestions as implemented (#26586) (Mikhail Baev)
• 4231536 linter: Compare label text in runtime optimization assertion (#26526) (camc314)
• 36d5534 linter: Include file path in diagnostic assertion (#26525) (camc314)
• 31508b1 parser: Reject return types on constructor overloads (#26523) (camc314)

⚡ Performance

• 1d681b0 linter/react/jsx-pascal-case: Avoid temporary name segment vector (#26531) (camc314)
• 2ad7d49 linter/promise/catch-or-return: Avoid temporary formatting vectors (#26505) (camc314)
• 203235b linter/jsx-a11y/no-static-element-interactions: Avoid role vector (#26504) (camc314)
• 2e95167 linter/jsx-a11y/anchor-is-valid: Avoid temporary attribute vector (#26501) (camc314)
• deafdba linter/react/exhaustive-deps: Avoid temporary dependency vector (#26502) (camc314)
• 4f1627f linter/oxc/branches-sharing-code: Compute deletion spans lazily (#26500) (camc314)
• c068fd2 linter/react/jsx-curly-brace-presence: Avoid newline position allocation (#26499) (camc314)
• ed4357c linter/eslint/no-restricted-properties: Skip empty configurations (#26497) (camc314)
• 92e41b7 linter/oxc/no-barrel-file: Iterate module requests directly (#26498) (camc314)
• 5255ee3 linter/unicorn/prefer-single-call: Avoid temporary argument vector (#26494) (camc314)
• 96ef365 linter/unicorn/prefer-includes: Reduce suggestion allocations (#26492) (camc314)
• a71fd7f linter/unicorn/no-new-buffer: Avoid temporary argument vector (#26491) (camc314)
• 11085e7 linter/jsdoc/require-yields: Short-circuit JSDoc checks (#26488) (camc314)
• 9b1aff8 linter/unicorn/no-useless-undefined: Skip calls without trailing undefined (#26481) (camc314)
• 1e5d5d7 linter/eslint/no-unused-vars: Skip absent global declaration checks (#26457) (camc314)
• 403f899 linter/eslint/no-undef: Check globals once per unresolved name (#26456) (camc314)
• 118adb0 linter/eslint/no-restricted-imports: Avoid redundant import scans (#26455) (camc314)
• ab848f2 linter/eslint/no-useless-assignment: Skip tracking exported symbols (#26449) (camc314)
• 1b6e409 linter/unicorn/prefer-object-from-entries: Avoid allocating configured paths (#26448) (camc314)
• 2206875 linter/eslint/new-cap: Avoid unnecessary callee name allocations (#26447) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

Commits

• 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
• 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
• See full diff in compare view

Updates prettier from 3.9.6 to 3.9.8

Release notes

Sourced from prettier's releases.

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
  second paragraph at six spaces that wraps
  onto another line here.

<!-- Prettier 3.9.6 -->

 
short first line.
second paragraph at six spaces that wraps
    onto another line here.



<!-- Prettier 3.9.7 -->

 
short first line.
second paragraph at six spaces that wraps
onto another line here.

JavaScript: Fix embedded template literal idempotency (#19725 by @​fisker)

... (truncated)

Commits

• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• 0df8eb8 Bump Prettier dependency to 3.9.7
• 3cf6c8c Clean changelog_unreleased
• 0449af3 Release 3.9.7
• 43cd5b0 Allow verify markdown test with mdx parser
• ab8c911 Fix test on Node.js v26 (#19927)
• 4a5adf9 Fix tests
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.115.0 to 2.116.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

• auth: add MFA recovery codes API (#2676)
• storage: add bucket lifecycle configuration (#2659)
• storage: topk 10k support (#2667)
• storage: add versionId support to create URL methods (#2678)

🩹 Fixes

• auth: silence commit-guard-discarded refresh in initial session (#2668)
• storage: drop legacy prefix from lifecycles (#2674)
• supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

• fadymak
• Ferhat Elmas
• Katerina Skroumpelou @​mandarini
• Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

• auth: add MFA recovery codes API (#2676)
• storage: add versionId support to create URL methods (#2678)

❤️ Thank You

• fadymak
• Katerina Skroumpelou
• Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

• storage: topk 10k support (#2667)

🩹 Fixes

• storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.116.0 (2026-09-07)

🚀 Features

• auth: add MFA recovery codes API (#2676)

🩹 Fixes

• supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

• fadymak
• Katerina Skroumpelou @​mandarini

Commits

• 5aedaab feat(auth): add MFA recovery codes API (#2676)
• e4f675a fix(supabase): warn when schema is passed outside db options (#2663)
• dbe7679 chore(release): version 2.115.0 changelogs (#2664)
• See full diff in compare view

Updates posthog-js from 1.426.4 to 1.434.0

Release notes

Sourced from posthog-js's releases.

posthog-js@1.434.0

1.434.0

Minor Changes

• #5014 5e86154 Thanks @​pauldambra! - Rename the metrics.network default attributes to the OTel HTTP client semantic conventions: http.request.method, server.address, server.port, url.scheme, url.template, http.response.status_code and error.type replace method, host, path and status_class. (2026-09-17)

Patch Changes

• Updated dependencies [5e86154]:
  • @​posthog/types@​1.412.2

posthog-js@1.433.10

1.433.10

Patch Changes

• #4960 c8e53fa Thanks @​posthog! - Log a console warning when session replay stops capturing canvas frames (browser without OffscreenCanvas, a CSP that blocks blob: workers, or a failing canvasCapture.maskRegionsFn), and stop changing WebGL and WebGPU canvas settings when canvas capture fails to start (2026-09-17)

• #4977 0257a29 Thanks

[dependabot]

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.