[dependabot]

Bumps the dev-dependencies group with 9 updates in the / directory:

Package	From	To
@cloudflare/vitest-pool-workers	0.20.2	0.23.0
@cloudflare/workers-types	5.20260804.1	5.20261024.1
@fedify/fedify	2.3.8	2.4.5
@fedify/vocab	2.3.8	2.4.5
@types/node	26.6.3	26.6.5
eslint	10.11.0	10.13.0
prettier	3.9.9	3.9.10
typescript-eslint	8.70.1	8.72.0
wrangler	4.119.0	4.152.0

Updates @cloudflare/vitest-pool-workers from 0.20.2 to 0.23.0

Commits

• bfcc442 [vitest-plugin] Rename package for v1 (#15074)
• 99a1f49 Miniflare config followups (#15130)
• d81fae7 [codemod] Add migration CLI (#14690)
• 8ee43f6 Version Packages (#15175)
• 3ddd3ce Fix module resolution for relative require() inside CJS deps when the proje...
• 1f79ace Use a fixed default compatibility date derived from the pinned workerd (#15185)
• 2cf3143 [vitest-pool-workers] Restore typed inject() keys (#15150)
• 49d4e00 [vitest-pool-workers] Adopt @​msw/cloudflare and remove MSW workarounds (#13830)
• c576a82 Version Packages (#15154)
• e5d56e9 Version Packages (#15145)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260804.1 to 5.20261024.1

Commits

• See full diff in compare view

Updates @fedify/fedify from 2.3.8 to 2.4.5

Release notes

Sourced from @​fedify/fedify's releases.

Fedify 2.4.5

Released on October 24, 2026.

@​fedify/fedify

• Fixed DNS rebinding bypassing the SSRF protection on Node.js and Bun. Deno requires a separate deployment mitigation, described below, and remains vulnerable without it. getAuthenticatedDocumentLoader(), outbound activity delivery (sendActivity()), and the NodeInfo client (getNodeInfo()) resolved a hostname once to check that it was public, and then let fetch() resolve it again to connect, so a hostname answering with a public address for the check and a private one for the connection could reach internal services. On Node.js and Bun, connections are now made only to the addresses that passed the check. Bun deployments that set the HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables should use Bun 1.4.3 or later, since earlier versions ignore the option to connect directly and send the requests through the proxy; see Bun behind an HTTP proxy for mitigations. On Bun versions before 1.3.11, requests to HTTPS servers on non-default ports now fail, since those versions cannot verify the certificate of a pinned connection against the original hostname; see HTTPS servers on non-default ports with Bun. [GHSA-r48c-xx2h-fv4g]
• On Deno, fetch() offers no way to choose the addresses it connects to, so Fedify cannot close the gap above. Run Deno 2.8.1 or later with --deny-net listing private IPv4 ranges, [::1], and [::], and listen on a Unix domain socket. IPv6 private ranges cannot be listed in --deny-net and need to be blocked at the network layer. See Restricting outbound connections on Deno for details. For new and long-lived deployments, we recommend Node.js or Bun instead of Deno, since the Deno team has announced that it will end its development of the Deno runtime after a year of bug-fix and security releases. [GHSA-r48c-xx2h-fv4g]
• Fixed FedifySpanExporter.getRecentTraces()'s activityCount drifting from the number of records getActivitiesByTraceId() actually returns for a trace when a span was re-exported, and a trace becoming permanently undiscoverable through getRecentTraces() if the separate summary entry it depended on was never successfully written. Both problems shared the same cause: counting and discovery depended on a separately maintained counter instead of the records that are actually stored. getRecentTraces() now computes every summary it returns directly from the activity records currently retained for each trace. This costs a scan of every retained record on each call, so its cost grows with the total number of retained records rather than with how much changed since the previous call, and limit does not reduce that cost; a deployment that retains many traces and polls getRecentTraces() should size its polling interval, TTL, and KvStore choice accordingly. [#1257, #1322 by Yujin Jung]
• Fixed installation failures with strict peer dependency checks by keeping the OpenTelemetry API dependency within the range supported by the OpenTelemetry SDK. [#1324 by Jiwon Kwon]
• Fixed repeated HTTP signature verification and signing-key owner lookups when a request context was checked concurrently with the same document and context loaders. null key-verification and owner-lookup results are now reused for those loaders within the request; checks that reject can still be retried. An owner result of null caused by an unverified key is not retained, allowing an owner lookup after another loader verifies the key. [#1313, #1315]
• Fixed incoming requests failing to reach dispatchers when Mastodon decoded percent-encoded colons in path identifiers. Generated URIs and HTTP signature verification retain their existing behavior. [#1325]

@​fedify/cli

• Fixed fedify nodeinfo fetching remote page and favicon URLs that lead to private network addresses. The command now skips the favicon when the page, icon, or a redirect points to a private address, while still showing the NodeInfo document. Upgrade @fedify/cli to protect the machine running the command. Reported by Zachariah Mithani. [GHSA-cj5r-cw77-6gwp]

@​fedify/postgres

• PostgresKvStore no longer scans the entire table for expired entries after every write. Cleanup now deletes up to 1,000 rows per batch, including across partitioned or inherited tables, with a delay between attempts that shortens after a full batch. Store instances sharing a table do not sweep it concurrently. With a pooled client, writes no longer wait for cleanup, and a cleanup failure no longer fails the write. Caller-owned transactions and reserved connections still await cleanup and propagate its errors to avoid hiding a rollback. Reads continue to exclude expired entries before physical deletion. [#1308, #1314]
• Fixed PostgresKvStore.set() retaining an old creation time when replacing an existing key. TTLs are now measured from the SQL statement clock on both insert and update, and expiration checks use that same clock inside caller-owned transactions. Replacing an expired value works before its row is physically deleted, and a replacement written with a zero TTL still reads as absent. [#1308, #1314]

@​fedify/testing

• Fixed createFederation() ignoring allowPrivateAddress: true. Received activities and federation-created contexts now use document loaders that allow local servers, so calls such as follow.getActor() can resolve localhost actors in inbox listeners. [#1302, #1306]
• Fixed missing runtime dependencies in the npm package. @fedify/vocab and @js-temporal/polyfill are now installed automatically so importing @fedify/testing works even when dependency hoisting is disabled on Node.js and Bun. [#1305, #1307]

@​fedify/uri-template

• Added the allowUnencodedColon option to Router.route() for matching HTTP request paths containing decoded colons in variable values. Exact matches take precedence, and matching remains strict by default. [#1325]
• Reduced excessive routing work on paths containing many colons, including paths with invalid percent encoding. Candidate traversal avoids repeated states, and matching rejects output that the template cannot produce while preserving route priority and colon compatibility. [#1325]

@​fedify/vocab-runtime

• Fixed DNS rebinding bypassing the SSRF protection of getDocumentLoader() on Node.js and Bun. Deno requires a separate deployment mitigation, described in the @fedify/fedify section above, and remains vulnerable without it. The document loader resolved a hostname once to check that it was public, and then let fetch() resolve it again to connect. On Node.js and Bun, connections are now made only to the addresses that passed the check. The behavior of allowPrivateAddress is unchanged. [GHSA-r48c-xx2h-fv4g]
• Added undici ^7.30.1 as a dependency, which is used on Node.js to connect only to validated addresses. [GHSA-r48c-xx2h-fv4g]
• Documented that validatePublicUrl() only checks the addresses a hostname currently resolves to and does not pin the connection, so it alone does not prevent DNS rebinding. [GHSA-r48c-xx2h-fv4g]

@​fedify/webfinger

• Fixed DNS rebinding bypassing the SSRF protection of lookupWebFinger() on Node.js and Bun. Deno requires a separate deployment mitigation, described in the @fedify/fedify section above, and remains vulnerable without it. [GHSA-r48c-xx2h-fv4g]

Fedify 2.4.4

Released on October 12, 2026.

@​fedify/fedify

• Fixed getAuthenticatedDocumentLoader() accepting URLs with a username or password. Such URLs now throw UrlError before fetching on all runtimes, including redirect and alternate document targets, regardless of allowPrivateAddress. [#1294, #1295]
• Fixed key ownership checks accepting another actor's document when resolving an actor ID. When an actor ID redirected to, or directly served, the document of a different actor, keys listed by that other actor were attributed to the requested one, so an attacker whose actor document was reached through a victim's actor ID could sign activities that passed authentication as the victim's. This affected HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs. Fetched actor documents are now accepted only when their id is exactly the requested actor ID. [GHSA-8863-8468-7hq7]
• As a consequence of the above fix, an actor whose ID redirects to a document with a different id, even on the same origin and for the same account, can no longer have its keys confirmed through that redirect. Servers that normalize actor URLs should use the canonical actor ID, which responds without redirecting, as the owner or controller of their keys and as the actor of their activities. [GHSA-8863-8468-7hq7]
• The built-in KvStore-backed key cache now uses a new generation, so keys cached under the weaker check are fetched and verified again after upgrading. Applications with a custom KeyCache implementation should clear it once when upgrading. [GHSA-8863-8468-7hq7]

... (truncated)

Changelog

Sourced from @​fedify/fedify's changelog.

Version 2.4.5

Released on October 24, 2026.

@​fedify/fedify

• Fixed DNS rebinding bypassing the SSRF protection on Node.js and Bun. Deno requires a separate deployment mitigation, described below, and remains vulnerable without it. getAuthenticatedDocumentLoader(), outbound activity delivery (sendActivity()), and the NodeInfo client (getNodeInfo()) resolved a hostname once to check that it was public, and then let fetch() resolve it again to connect, so a hostname answering with a public address for the check and a private one for the connection could reach internal services. On Node.js and Bun, connections are now made only to the addresses that passed the check. Bun deployments that set the HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables should use Bun 1.4.3 or later, since earlier versions ignore the option to connect directly and send the requests through the proxy; see [Bun behind an HTTP proxy] for mitigations. On Bun versions before 1.3.11, requests to HTTPS servers on non-default ports now fail, since those versions cannot verify the certificate of a pinned connection against the original hostname; see [HTTPS servers on non-default ports with Bun]. [[GHSA-r48c-xx2h-fv4g]]
• On Deno, fetch() offers no way to choose the addresses it connects to, so Fedify cannot close the gap above. Run Deno 2.8.1 or later with --deny-net listing private IPv4 ranges, [::1], and [::], and listen on a Unix domain socket. IPv6 private ranges cannot be listed in --deny-net and need to be blocked at the network layer. See [Restricting outbound connections on Deno] for details. For new and long-lived deployments, we recommend Node.js or Bun instead of Deno, since the Deno team has announced that it will end its development of the Deno runtime after a year of bug-fix and security releases. [[GHSA-r48c-xx2h-fv4g]]
• Fixed FedifySpanExporter.getRecentTraces()'s activityCount drifting from the number of records getActivitiesByTraceId() actually returns for a trace when a span was re-exported, and a trace becoming permanently undiscoverable through getRecentTraces() if the separate summary entry it depended on was never successfully written. Both problems shared the same cause: counting and discovery depended on a separately maintained counter instead of the records that are actually stored. getRecentTraces() now computes every summary it returns directly from the activity records currently retained for each trace. This costs a scan of every retained record on each call, so its cost grows with the total number of retained records rather than with how much changed since the previous call, and limit does not reduce that cost; a deployment that retains many traces and polls getRecentTraces() should size its polling interval, TTL, and KvStore choice accordingly. [#1257, #1322 by Yujin Jung]

... (truncated)

Commits

• daf84e3 Merge tag '2.3.15' into 2.4-maintenance
• e174063 Merge tag '2.2.20' into 2.3-maintenance
• 0777faa Merge tag '2.1.31' into 2.2-maintenance
• fc72547 Merge tag '2.0.35' into 2.1-maintenance
• d176ea2 Accept decoded colons in HTTP route variables
• a87a1d3 Pin outbound connections to validated addresses on Bun
• 7c65ca7 Cover trace summary recovery and reexports
• 34b42b1 Compute getRecentTraces() straight from retained records
• 4478836 Prefer Node.js in package documentation
• bd2e373 Clarify null signing-key owner results
• Additional commits viewable in compare view

Updates @fedify/vocab from 2.3.8 to 2.4.5

Release notes

Sourced from @​fedify/vocab's releases.

Fedify 2.4.5

Released on October 24, 2026.

@​fedify/fedify

• Fixed DNS rebinding bypassing the SSRF protection on Node.js and Bun. Deno requires a separate deployment mitigation, described below, and remains vulnerable without it. getAuthenticatedDocumentLoader(), outbound activity delivery (sendActivity()), and the NodeInfo client (getNodeInfo()) resolved a hostname once to check that it was public, and then let fetch() resolve it again to connect, so a hostname answering with a public address for the check and a private one for the connection could reach internal services. On Node.js and Bun, connections are now made only to the addresses that passed the check. Bun deployments that set the HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables should use Bun 1.4.3 or later, since earlier versions ignore the option to connect directly and send the requests through the proxy; see Bun behind an HTTP proxy for mitigations. On Bun versions before 1.3.11, requests to HTTPS servers on non-default ports now fail, since those versions cannot verify the certificate of a pinned connection against the original hostname; see HTTPS servers on non-default ports with Bun. [GHSA-r48c-xx2h-fv4g]
• On Deno, fetch() offers no way to choose the addresses it connects to, so Fedify cannot close the gap above. Run Deno 2.8.1 or later with --deny-net listing private IPv4 ranges, [::1], and [::], and listen on a Unix domain socket. IPv6 private ranges cannot be listed in --deny-net and need to be blocked at the network layer. See Restricting outbound connections on Deno for details. For new and long-lived deployments, we recommend Node.js or Bun instead of Deno, since the Deno team has announced that it will end its development of the Deno runtime after a year of bug-fix and security releases. [GHSA-r48c-xx2h-fv4g]
• Fixed FedifySpanExporter.getRecentTraces()'s activityCount drifting from the number of records getActivitiesByTraceId() actually returns for a trace when a span was re-exported, and a trace becoming permanently undiscoverable through getRecentTraces() if the separate summary entry it depended on was never successfully written. Both problems shared the same cause: counting and discovery depended on a separately maintained counter instead of the records that are actually stored. getRecentTraces() now computes every summary it returns directly from the activity records currently retained for each trace. This costs a scan of every retained record on each call, so its cost grows with the total number of retained records rather than with how much changed since the previous call, and limit does not reduce that cost; a deployment that retains many traces and polls getRecentTraces() should size its polling interval, TTL, and KvStore choice accordingly. [#1257, #1322 by Yujin Jung]
• Fixed installation failures with strict peer dependency checks by keeping the OpenTelemetry API dependency within the range supported by the OpenTelemetry SDK. [#1324 by Jiwon Kwon]
• Fixed repeated HTTP signature verification and signing-key owner lookups when a request context was checked concurrently with the same document and context loaders. null key-verification and owner-lookup results are now reused for those loaders within the request; checks that reject can still be retried. An owner result of null caused by an unverified key is not retained, allowing an owner lookup after another loader verifies the key. [#1313, #1315]
• Fixed incoming requests failing to reach dispatchers when Mastodon decoded percent-encoded colons in path identifiers. Generated URIs and HTTP signature verification retain their existing behavior. [#1325]

@​fedify/cli

• Fixed fedify nodeinfo fetching remote page and favicon URLs that lead to private network addresses. The command now skips the favicon when the page, icon, or a redirect points to a private address, while still showing the NodeInfo document. Upgrade @fedify/cli to protect the machine running the command. Reported by Zachariah Mithani. [GHSA-cj5r-cw77-6gwp]

@​fedify/postgres

• PostgresKvStore no longer scans the entire table for expired entries after every write. Cleanup now deletes up to 1,000 rows per batch, including across partitioned or inherited tables, with a delay between attempts that shortens after a full batch. Store instances sharing a table do not sweep it concurrently. With a pooled client, writes no longer wait for cleanup, and a cleanup failure no longer fails the write. Caller-owned transactions and reserved connections still await cleanup and propagate its errors to avoid hiding a rollback. Reads continue to exclude expired entries before physical deletion. [#1308, #1314]
• Fixed PostgresKvStore.set() retaining an old creation time when replacing an existing key. TTLs are now measured from the SQL statement clock on both insert and update, and expiration checks use that same clock inside caller-owned transactions. Replacing an expired value works before its row is physically deleted, and a replacement written with a zero TTL still reads as absent. [#1308, #1314]

@​fedify/testing

• Fixed createFederation() ignoring allowPrivateAddress: true. Received activities and federation-created contexts now use document loaders that allow local servers, so calls such as follow.getActor() can resolve localhost actors in inbox listeners. [#1302, #1306]
• Fixed missing runtime dependencies in the npm package. @fedify/vocab and @js-temporal/polyfill are now installed automatically so importing @fedify/testing works even when dependency hoisting is disabled on Node.js and Bun. [#1305, #1307]

@​fedify/uri-template

• Added the allowUnencodedColon option to Router.route() for matching HTTP request paths containing decoded colons in variable values. Exact matches take precedence, and matching remains strict by default. [#1325]
• Reduced excessive routing work on paths containing many colons, including paths with invalid percent encoding. Candidate traversal avoids repeated states, and matching rejects output that the template cannot produce while preserving route priority and colon compatibility. [#1325]

@​fedify/vocab-runtime

• Fixed DNS rebinding bypassing the SSRF protection of getDocumentLoader() on Node.js and Bun. Deno requires a separate deployment mitigation, described in the @fedify/fedify section above, and remains vulnerable without it. The document loader resolved a hostname once to check that it was public, and then let fetch() resolve it again to connect. On Node.js and Bun, connections are now made only to the addresses that passed the check. The behavior of allowPrivateAddress is unchanged. [GHSA-r48c-xx2h-fv4g]
• Added undici ^7.30.1 as a dependency, which is used on Node.js to connect only to validated addresses. [GHSA-r48c-xx2h-fv4g]
• Documented that validatePublicUrl() only checks the addresses a hostname currently resolves to and does not pin the connection, so it alone does not prevent DNS rebinding. [GHSA-r48c-xx2h-fv4g]

@​fedify/webfinger

• Fixed DNS rebinding bypassing the SSRF protection of lookupWebFinger() on Node.js and Bun. Deno requires a separate deployment mitigation, described in the @fedify/fedify section above, and remains vulnerable without it. [GHSA-r48c-xx2h-fv4g]

Fedify 2.4.4

Released on October 12, 2026.

@​fedify/fedify

• Fixed getAuthenticatedDocumentLoader() accepting URLs with a username or password. Such URLs now throw UrlError before fetching on all runtimes, including redirect and alternate document targets, regardless of allowPrivateAddress. [#1294, #1295]
• Fixed key ownership checks accepting another actor's document when resolving an actor ID. When an actor ID redirected to, or directly served, the document of a different actor, keys listed by that other actor were attributed to the requested one, so an attacker whose actor document was reached through a victim's actor ID could sign activities that passed authentication as the victim's. This affected HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs. Fetched actor documents are now accepted only when their id is exactly the requested actor ID. [GHSA-8863-8468-7hq7]
• As a consequence of the above fix, an actor whose ID redirects to a document with a different id, even on the same origin and for the same account, can no longer have its keys confirmed through that redirect. Servers that normalize actor URLs should use the canonical actor ID, which responds without redirecting, as the owner or controller of their keys and as the actor of their activities. [GHSA-8863-8468-7hq7]
• The built-in KvStore-backed key cache now uses a new generation, so keys cached under the weaker check are fetched and verified again after upgrading. Applications with a custom KeyCache implementation should clear it once when upgrading. [GHSA-8863-8468-7hq7]

... (truncated)

Changelog

Sourced from @​fedify/vocab's changelog.

Version 2.4.5

Released on October 24, 2026.

@​fedify/fedify

• Fixed DNS rebinding bypassing the SSRF protection on Node.js and Bun. Deno requires a separate deployment mitigation, described below, and remains vulnerable without it. getAuthenticatedDocumentLoader(), outbound activity delivery (sendActivity()), and the NodeInfo client (getNodeInfo()) resolved a hostname once to check that it was public, and then let fetch() resolve it again to connect, so a hostname answering with a public address for the check and a private one for the connection could reach internal services. On Node.js and Bun, connections are now made only to the addresses that passed the check. Bun deployments that set the HTTP_PROXY, HTTPS_PROXY, or ALL_PROXY environment variables should use Bun 1.4.3 or later, since earlier versions ignore the option to connect directly and send the requests through the proxy; see [Bun behind an HTTP proxy] for mitigations. On Bun versions before 1.3.11, requests to HTTPS servers on non-default ports now fail, since those versions cannot verify the certificate of a pinned connection against the original hostname; see [HTTPS servers on non-default ports with Bun]. [[GHSA-r48c-xx2h-fv4g]]
• On Deno, fetch() offers no way to choose the addresses it connects to, so Fedify cannot close the gap above. Run Deno 2.8.1 or later with --deny-net listing private IPv4 ranges, [::1], and [::], and listen on a Unix domain socket. IPv6 private ranges cannot be listed in --deny-net and need to be blocked at the network layer. See [Restricting outbound connections on Deno] for details. For new and long-lived deployments, we recommend Node.js or Bun instead of Deno, since the Deno team has announced that it will end its development of the Deno runtime after a year of bug-fix and security releases. [[GHSA-r48c-xx2h-fv4g]]
• Fixed FedifySpanExporter.getRecentTraces()'s activityCount drifting from the number of records getActivitiesByTraceId() actually returns for a trace when a span was re-exported, and a trace becoming permanently undiscoverable through getRecentTraces() if the separate summary entry it depended on was never successfully written. Both problems shared the same cause: counting and discovery depended on a separately maintained counter instead of the records that are actually stored. getRecentTraces() now computes every summary it returns directly from the activity records currently retained for each trace. This costs a scan of every retained record on each call, so its cost grows with the total number of retained records rather than with how much changed since the previous call, and limit does not reduce that cost; a deployment that retains many traces and polls getRecentTraces() should size its polling interval, TTL, and KvStore choice accordingly. [#1257, #1322 by Yujin Jung]

... (truncated)

Commits

• daf84e3 Merge tag '2.3.15' into 2.4-maintenance
• e174063 Merge tag '2.2.20' into 2.3-maintenance
• 0777faa Merge tag '2.1.31' into 2.2-maintenance
• fc72547 Merge tag '2.0.35' into 2.1-maintenance
• a87a1d3 Pin outbound connections to validated addresses on Bun
• 0c5c366 Version bump
• 369819c Version bump
• 1506be4 Version bump
• 8191f41 Version bump
• b27d9a5 Version bump
• Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.5

Commits

• See full diff in compare view

Updates eslint from 10.11.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])

... (truncated)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Updates typescript-eslint from 8.70.1 to 8.72.0

Release notes

Sourced from typescript-eslint's releases.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: lazy load rules (#13010)
• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

• ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz
• Shaan GS @​ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

8.71.2 (2026-10-12)

🩹 Fixes

• eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#12989)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#12974)
• eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)
• eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)
• eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)
• type-utils: match linked packages and packages with missing version in TypeOrValueSpecifier (#12948)

❤️ Thank You

• Abraham Guo
• Brad Zacher @​bradzacher
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Vinccool96

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.1 (2026-10-05)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• a4c2603 chore(release): publish 8.72.0
• 7488d68 chore(release): publish 8.71.2
• d57b8da chore(release): publish 8.71.1
• 8695664 chore(release): publish 8.71.0
• See full diff in compare view

Updates wrangler from 4.119.0 to 4.152.0

Release notes

Sourced from wrangler's releases.

[email protected]

Patch Changes

• #15611 4508172 Thanks @​taylorlee! - Allow wrangler dev to start module Workers without a default export

  Previously, wrangler dev failed to start module Workers that exported only named entrypoints, such as RPC services, unless an unused default export was added. These Workers now start normally in local development without that workaround.

• #16370 61fc739 Thanks @​WalshyDev! - Fetch the remote config diff from the configured compliance region

  When a Worker was last deployed from the dashboard, wrangler deploy and wrangler versions upload download its remote configuration to compare with the local one. These requests ignored the compliance_region field in the Wrangler configuration file and only honoured the CLOUDFLARE_COMPLIANCE_REGION environment variable. A FedRAMP High Worker configured through the config file would send them to api.cloudflare.com instead of api.fed.cloudflare.com, and the deploy would fail with authentication errors. They now use t...

  Description has been truncated

[davidwkeith]

Review against CONTRIBUTING.md:

Conforms

• Title chore(deps-dev): bump the dev-dependencies group with 9 updates is valid Conventional Commits. It will be the squash-merge entry.
• Every changed package.json entry is a devDependency (root, cf-shims, conformance-target, deno-host, server). Versions are pinned exactly. No published package's runtime surface changes, so no changeset is needed.
• The workspace:* and ESM conventions are untouched.

To check before merging

1. CI is still running (build-test, integration, release-gate, image). Merge only when lint → format:check → typecheck → build → test are all green.
2. @cloudflare/vitest-pool-workers 0.20.2 → 0.23.0 is three minor versions on a 0.x line, where minors can break. It drives every workerd project, so a failure would most likely show up there. It also moves Miniflare/workerd, which should be compatible with the wrangler 4.151.3 bump.
3. @fedify/fedify and @fedify/vocab 2.3.8 → 2.4.4. activitypub and mastodon-api consume them. Confirm the ActivityPub tests pass, since those are the real signal for a minor bump here.
4. packages/server bundling. CONTRIBUTING.md says the CI gate does not exercise pnpm --filter @dwk/server bundle. The wrangler, @types/node and workers-types bumps touch that package, so run it once (or confirm the image job passes).
5. Lockfile. pnpm-lock.yaml has about 1k changed lines, which is expected. Skim it for new duplicate versions of miniflare or workerd.

PR body. The PR body is Dependabot's rather than .github/PULL_REQUEST_TEMPLATE.md. I'd treat that as acceptable for bot PRs, but it has no Summary, Packages affected or Checklist sections.

I found nothing to fix in the diff itself. Approval depends on CI going green.

---

Generated by Claude Code

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.