[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@typescript-eslint/eslint-plugin (source)	8.71.2 → 8.72.0
@typescript-eslint/parser (source)	8.71.2 → 8.72.0
ovsx (source)	1.2.0 → 1.3.0
typescript-eslint (source)	8.71.2 → 8.72.0

---

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.72.0

Compare Source

🚀 Features

• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#​12992)
• eslint-plugin: lazy load rules (#​13010)

🩹 Fixes

• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#​13054)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#​13055)
• eslint-plugin: [require-array-sort-compare] check tuples (#​13058)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#​13053)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#​12704)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#​13016)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#​12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.72.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

eclipse-openvsx/openvsx (ovsx)

v1.3.0

Compare Source

Changed

• publish checks a package against the size limit that applies to its own namespace, which a size override can raise above the registry default, and refuses an oversized upload before sending it. Against a registry older than 1.3.0, which cannot report that limit, it warns against the default and publishes anyway; if a registry that should be able to report it does not answer, it says the check did not happen rather than passing silently (#​2129)

Fixed

• --version reads the version from package.json at runtime instead of a generated src/version.ts, so it can no longer report a stale version (#​2295)
• publish now deletes the .vsix it packages into the temp directory once publishing finishes or fails, instead of leaving one behind per package and target (#​2286)
• Drop the X-OpenVSX-Token header, which carries the personal access token when --username/--password are set, on a redirect to another origin, as is done for Authorization (#​2309)
• A request with a body that is redirected with 301/302/303 now fails with an error naming the redirect target, instead of being resent as a GET without its body (#​2309)
• Trusted publishing's OIDC ID token request now uses the registry client's request handling: it follows redirects (dropping the runner token on a redirect to another origin) and reports the token service's error message instead of only its status (#​2322)
• An HTML page in a successful response (any <!doctype html> casing, or a text/html Content-Type) now fails with an error naming the status, instead of printing the raw HTML or a JSON SyntaxError (#​2326)
• An error response whose JSON body starts with whitespace now reports the server's message instead of only its status (#​2326)

Dependencies

• Bump commander from 6.2.1 to 14.0.3; a command given more arguments than it takes now fails instead of ignoring the extras (#​2294)
• Bump @​vscode/vsce from 3.7.1 to 4.0.0 (#​2288)
• Bump vitest from 4.1.11 to 5.0.3, adding vite as a direct dev dependency - vitest 5 no longer bundles it, only requires it as a peer (#​2291)
• Remove leven; the command-suggestion distance check now uses a vendored Levenshtein implementation, the same way @vscode/vsce itself replaced its own leven dependency in 4.0.0 (#​2290)
• Remove tmp; temporary file names are now generated with crypto.randomUUID (#​2284)
• Remove follow-redirects; requests use node:http/node:https and the registry client follows redirects itself (#​2309)
• Bump ip-address from 10.4.0 to 10.7.2 (#​2264)
• Bump brace-expansion to 1.1.21, 2.1.7, 5.0.12
• Bump markdown-it from 14.2.0 to 14.3.2 (#​2281)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.72.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "after 9am on friday,before 6pm on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-23 13:50 UTC · Rule: dependency-updates · triggered by merge protections
• 🚫 Left the queue — 2026-10-23 14:03 UTC · at 10d7a245fa9ba00b49e5e2c2fb9ac550a9214c25

This pull request spent 13 minutes 5 seconds in the queue, with no time running CI.

Reason

The pull request #50 has been manually updated

Requeued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-23 14:04 UTC · Rule: dependency-updates · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #50 on main (784e624) #54
• ✅ Merged — 2026-10-23 14:07 UTC · at 590de58daff26e77fec2e856489ea73e7efcd21c · merge

This pull request spent 3 minutes 30 seconds in the queue, including 1 minute 29 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1
  • Update development dependencies #50
• github-review-approved [🛡 GitHub repository ruleset rule main]
  • Update development dependencies #50
• any of [🛡 GitHub repository ruleset rule main]:
  • check-success = @github-actions/Test
  • check-neutral = @github-actions/Test
  • check-skipped = @github-actions/Test