Bump the all-npm group across 1 directory with 78 updates

[dependabot]

Bumps the all-npm group with 28 updates in the / directory:

Package	From	To
@actions/core	1.11.1	3.0.1
@actions/github	6.0.1	9.1.1
@actions/io	1.1.3	3.0.2
@actions/tool-cache	2.0.2	4.0.0
@octokit/plugin-retry	8.0.3	8.1.0
esbuild	0.24.2	0.28.1
eslint	8.57.1	10.5.0
eslint-plugin-promise	6.6.0	7.3.0
nock	13.5.6	14.0.15
@napi-rs/wasm-runtime	1.1.5	1.1.6
brace-expansion	1.1.12	1.1.15
call-bind	1.0.8	1.0.9
es-abstract	1.24.1	1.24.2
es-object-atoms	1.1.1	1.1.2
es-to-primitive	1.3.0	1.3.1
eslint-import-resolver-node	0.3.9	0.3.10
eslint-module-utils	2.12.1	2.13.0
function.prototype.name	1.1.8	1.2.0
get-tsconfig	4.13.0	4.14.0
minimatch	3.1.2	3.1.5
resolve	1.22.11	1.22.12
safe-array-concat	1.1.3	1.1.4
side-channel	1.1.0	1.1.1
string.prototype.trim	1.2.10	1.2.11
string.prototype.trimend	1.0.9	1.0.10
typed-array-length	1.0.7	1.0.8
vite	8.0.16	8.1.0
which-typed-array	1.1.19	1.1.22

Updates @actions/core from 1.11.1 to 3.0.1

Changelog

Sourced from @​actions/core's changelog.

3.0.1

• Bump undici from 6.23.0 to 6.24.1 #2348

3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

2.0.3

• Bump @actions/http-client to 3.0.2

2.0.1

• Bump @​actions/exec from 1.1.1 to 2.0.0 #2199

2.0.0

• Add support for Node 24 #2110
• Bump @​actions/http-client from 2.0.1 to 3.0.0

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​actions/core since your current version.

Updates @actions/github from 6.0.1 to 9.1.1

Changelog

Sourced from @​actions/github's changelog.

9.1.1

• Bump undici from 6.23.0 to 6.24.0 #2346

9.1.0

• Append actions_orchestration_id to user-agent when the ACTIONS_ORCHESTRATION_ID environment variable is set #2364

9.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()
  • Example: const { getOctokit, context } = await import('@actions/github')
• Fix TypeScript compilation by migrating to ESM, enabling proper imports from @octokit/core/types

8.0.1

• Update undici to 6.23.0
• Update @actions/http-client to 3.0.2

8.0.0

• Update @​octokit dependencies
  • @octokit/core ^7.0.6
  • @octokit/plugin-paginate-rest ^14.0.0
  • @octokit/plugin-rest-endpoint-methods ^17.0.0
  • @octokit/request ^10.0.7
  • @octokit/request-error ^7.1.0
• Breaking change: Minimum Node.js version is now 20 (previously 18)

7.0.0

• Update to v3.0.1 of @actions/http-client

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​actions/github since your current version.

Updates @actions/io from 1.1.3 to 3.0.2

Changelog

Sourced from @​actions/io's changelog.

3.0.2

• Fix: update lock file version

3.0.1

• Fix: export @actions/io/lib/io-util

3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

2.0.0

• Add support for Node 24 #2110
• Ensures consistent behavior for paths on Node 24 with Windows

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​actions/io since your current version.

Updates @actions/tool-cache from 2.0.2 to 4.0.0

Changelog

Sourced from @​actions/tool-cache's changelog.

4.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

3.0.1

• Bump @actions/http-client to 3.0.2

3.0.0

• Update to v2.0.1 of @actions/core
• Update to v2.0.0 of @actions/exec
• Update to v3.0.1 of @actions/http-client
• Update to v2.0.0 of @actions/io

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​actions/tool-cache since your current version.

Updates @octokit/plugin-retry from 8.0.3 to 8.1.0

Release notes

Sourced from @​octokit/plugin-retry's releases.

v8.1.0

8.1.0 (2026-02-18)

Features

• add types (#661) (e8bdeb7)

Commits

• e8bdeb7 feat: add types (#661)
• 96f572f chore(deps): replace glob with tinyglobby (#657)
• 2b9b2ea build(deps): bump glob (#656)
• 31bd239 build(deps): lock file maintenance (#643)
• 58b66d1 chore(deps): update dependency node to v24 (#649)
• 927b598 chore(deps): update dependency prettier to v3.6.2 (#636)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/plugin-retry since your current version.

Updates esbuild from 0.24.2 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Updates eslint from 8.57.1 to 10.5.0

Release notes

Sourced from eslint's releases.

v10.5.0

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)
• 2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)
• 732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)
• f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)
• bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)
• c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

• 8ae1b5b docs: Update README (GitHub Actions Bot)
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)
• f99b47a docs: Update README (GitHub Actions Bot)
• acf03d4 docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)

Chores

• b18bf58 chore: update ecosystem plugins (#20959) (ESLint Bot)
• c2d1444 refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)
• 243b8c5 chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)
• 217b2a9 test: add unit tests for ParserService (#20949) (Taejin Kim)
• 72003e7 test: add location information to error messages in max-statements (#20945) (lumir)
• 7797c26 refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)
• 67c46fa chore: update ecosystem plugins (#20938) (ESLint Bot)
• 95d8c7a chore: update dependency @​eslint/json to v2 (#20934) (renovate[bot])
• cf9e496 chore: update @​arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)
• fb6d396 test: run type tests with TypeScript 7 (#20868) (sethamus)

v10.4.1

Bug Fixes

• e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930) (Francesco Trotta)
• d4ce898 fix: propagate failures from delegated commands (#20917) (Minh Vu)
• f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#20916) (kuldeep kumar)
• c5bc78b fix: false positive for reference in finally block (#20655) (Tanuj Kanti)
• 27538c0 fix: add missing CodePath and CodePathSegment types (#20853) (Pixel998)

Documentation

• 61b0add docs: remove deprecated rule from related rules of max-params (#20921) (Tanuj Kanti)
• 305d5b9 docs: remove deprecated rules from related rules section (#20911) (Tanuj Kanti)
• 49b0202 docs: fix display: none of ad (#20901) (Tanuj Kanti)
• 9067f94 docs: switch build to Node.js 24 (#20893) (Milos Djermanovic)
• c91b041 docs: Update README (GitHub Actions Bot)
• e349265 docs: clarify semver strings in rule deprecation objects (#20885) (Milos Djermanovic)

Chores

• b0e466b test: add data property to invalid tests cases for rules (#20924) (Tanuj Kanti)
• f78838b test: add CodePath type coverage (#20904) (Pixel998)
• 1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#20922) (Francesco Trotta)
• 002942c ci: declare contents:read on update-readme workflow (#20919) (Arpit Jain)
• 64bca24 chore: update ecosystem plugins (#20912) (ESLint Bot)

... (truncated)

Commits

• de3b672 10.5.0
• 362a518 Build: changelog update for 10.5.0
• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973)
• b565783 feat: report no-with violations at the with keyword (#20971)
• 2ce032f feat: report max-lines-per-function violations at function head (#20966)
• 732cb3e feat: report max-nested-callbacks violations at function head (#20967)
• f9c138a feat: report max-depth violations on keywords (#20943)
• 8ae1b5b docs: Update README
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962)
• b18bf58 chore: update ecosystem plugins (#20959)
• Additional commits viewable in compare view

Updates eslint-plugin-promise from 6.6.0 to 7.3.0

Release notes

Sourced from eslint-plugin-promise's releases.

v7.3.0

7.3.0 (2026-04-27)

🌟 Features

• no-promise-in-callback: add exemptDeclarations option (#513) (550524f)
• add support for ESLint v10 (#617) (6096821)

🩹 Fixes

• no-native: fix to report Promise usage in eslint v9 or later (#619) (1230ced)

🧹 Chores

• add missing 'use strict' directive (#593) (4cd7ea1)
• deps-dev: update eslint-plugin-eslint-plugin to v6.4.0 (#583) (45385a3)
• deps-dev: update eslint-plugin-jest to v28.11.0 (#585) (a33ffb6)
• deps-dev: update eslint-plugin-n to v17.14.0 (#575) (fad9049)
• deps-dev: update eslint-plugin-prettier to v5.2.3 (#586) (b2095cb)
• deps-dev: update eslint-plugin-prettier to v5.2.4 (#600) (fad5029)
• deps-dev: update lint-staged to v15.4.3 (#582) (d1e23e5)
• deps-dev: update prettier to v3.4.1 (#578) (3fae241)
• deps-dev: update prettier to v3.4.2 (#580) (7219528)
• deps-dev: update prettier to v3.5.0 (#588) (5da83c4)
• deps: update globals to v15.13.0 (#579) (75defcf)
• deps: update globals to v15.14.0 (#584) (846ad48)
• deps: update typescript to v5.7.3 (#589) (79b0eff)
• package: explicitly declare js module type (#592) (b19e133)
• update typescript to ~5.7.0 (#577) (04d0b2b)

v7.2.1

7.2.1 (2024-11-26)

🩹 Fixes

• no-callback-in-promise: false triggering of callback (#574) (8324564)

🧹 Chores

• deps-dev: update husky to v9.1.7 (#573) (24fd90a)
• deps: bump cross-spawn from 7.0.3 to 7.0.6 (#568) (f33f82e)

v7.2.0

7.2.0 (2024-11-25)

... (truncated)

Changelog

Sourced from eslint-plugin-promise's changelog.

7.3.0 (2026-04-27)

🌟 Features

• no-promise-in-callback: add exemptDeclarations option (#513) (550524f)
• add support for ESLint v10 (#617) (6096821)

🩹 Fixes

• no-native: fix to report Promise usage in eslint v9 or later (#619) (1230ced)

🧹 Chores

• add missing 'use strict' directive (#593) (4cd7ea1)
• deps-dev: update eslint-plugin-eslint-plugin to v6.4.0 (#583) (45385a3)
• deps-dev: update eslint-plugin-jest to v28.11.0 (#585) (a33ffb6)
• deps-dev: update eslint-plugin-n to v17.14.0 (#575) (fad9049)
• deps-dev: update eslint-plugin-prettier to v5.2.3 (#586) (b2095cb)
• deps-dev: update eslint-plugin-prettier to v5.2.4 (#600) (fad5029)
• deps-dev: update lint-staged to v15.4.3 (#582) (d1e23e5)
• deps-dev: update prettier to v3.4.1 (#578) (3fae241)
• deps-dev: update prettier to v3.4.2 (#580) (7219528)
• deps-dev: update prettier to v3.5.0 (#588) (5da83c4)
• deps: update globals to v15.13.0 (#579) (75defcf)
• deps: update globals to v15.14.0 (#584) (846ad48)
• deps: update typescript to v5.7.3 (#589) (79b0eff)
• package: explicitly declare js module type (#592) (b19e133)
• update typescript to ~5.7.0 (#577) (04d0b2b)

7.2.1 (2024-11-26)

🩹 Fixes

• no-callback-in-promise: false triggering of callback (#574) (8324564)

🧹 Chores

• deps-dev: update husky to v9.1.7 (#573) (24fd90a)
• deps: bump cross-spawn from 7.0.3 to 7.0.6 (#568) (f33f82e)

7.2.0 (2024-11-25)

🌟 Features

... (truncated)

Commits

• f1dd605 chore(main): release 7.3.0 (#576)
• 6096821 feat: add support for ESLint v10 (#617)
• 1230ced fix(no-native): fix to report Promise usage in eslint v9 or later (#619)
• 6cf7adb ci: trusted publishing (#610)
• fad5029 chore(deps-dev): update eslint-plugin-prettier to v5.2.4 (#600)
• 4cd7ea1 chore: add missing 'use strict' directive (#593)
• b19e133 chore(package): explicitly declare js module type (#592)
• 5da83c4 chore(deps-dev): update prettier to v3.5.0 (#588)
• d1e23e5 chore(deps-dev): update lint-staged to v15.4.3 (#582)
• b2095cb chore(deps-dev): update eslint-plugin-prettier to v5.2.3 (#586)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for eslint-plugin-promise since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates nock from 13.5.6 to 14.0.15

Release notes

Sourced from nock's releases.

v14.0.15

14.0.15 (2026-05-07)

Bug Fixes

• Revert "fix(backport): apply body delay before the response end" (#2973) (de5450c), closes #2969

v14.0.14

14.0.14 (2026-04-30)

Bug Fixes

• backport: apply body delay before the response end (#2969) (215cd2a)

v14.0.13

14.0.13 (2026-04-20)

Bug Fixes

• types: align Definition with runtime; add rawHeaders, drop headers (#2955) (07fbfab)

v14.0.12

14.0.12 (2026-04-05)

Bug Fixes

• prevent crash when query params have conflicting dot-notation keys (#2958) (7ea9933)

v14.0.11

14.0.11 (2026-02-09)

Bug Fixes

• migrate to npm OIDC (#2940) (113dcac)
• restore github actions write permissions (#2941) (a4cb6b8)
• update @mswjs/interceptors to fix a memory leak (#2938) (025db76)
• upgrade semantic-release (#2943) (db0b280)

v14.0.10

14.0.10 (2025-08-12)

Bug Fixes

• Use Error objects instead of plain objects with replyWithError() (#2900) (f2a3389)

... (truncated)

Commits

• de5450c fix: Revert "fix(backport): apply body delay before the response end" (#2973)
• 215cd2a fix(backport): apply body delay before the response end (#2969)
• 07fbfab fix(types): align Definition with runtime; add rawHeaders, drop headers (#2955)
• fe2c3ea chore(deps-dev): bump lodash-es from 4.17.23 to 4.18.1 (#2961)
• ee49b4f chore(deps-dev): bump flatted from 3.2.5 to 3.4.2
• 11bf183 chore(deps-dev): bump undici from 6.23.0 to 6.24.1 (#2954)
• 6b80154 chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#2960)
• 4cbf6cc chore(deps): bump tar and npm (#2952)
• 7ea9933 fix: prevent crash when query params have conflicting dot-notation keys (#2958)
• d00d371 chore(deps): bump picomatch
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nock since your current version.

Updates @actions/exec from 1.1.1 to 3.0.0

Changelog

Sourced from @​actions/exec's changelog.

3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

2.0.0

• Add support for Node 24 #2110
• Bump @​actions/io dependency from ^1.0.1 to ^2.0.0

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​actions/exec since your current version.

Updates @octokit/auth-token from 4.0.0 to 6.0.0

Release notes

Sourced from @​octokit/auth-token's releases.

v6.0.0

6.0.0 (2025-05-20)

Continuous Integration

• stop testing against NodeJS v18 (#448) (86e1a2f)

BREAKING CHANGES

• Drop support for NodeJS v18

• build: set minimal node version in build script to v20

• ci: stop testing against NodeJS v18

v5.1.2

5.1.2 (2025-01-27)

Bug Fixes

• create isJWT helper, avoid regex in favour of String#startsWith() (#420) (59207f6)

v5.1.1

5.1.1 (2024-04-15)

Bug Fixes

• pkg: add default fallback and types export (#404) (2b19c22)

v5.1.0

5.1.0 (2024-04-03)

Features

• security: Add provenance (#402) (f97b06b)

v5.0.1

5.0.1 (2024-02-29)

Bug Fixes

• pkg: add main entry point (#395) (3216862), closes octokit/core.js#662

v5.0.0

... (truncated)

Commits

• 86e1a2f ci: stop testing against NodeJS v18 (#448)
• a4be067 build(deps): bump vite from 6.2.6 to 6.3.4 (#447)
• db17cfb build(deps): bump vite from 6.2.5 to 6.2.6 (#446)
• ab9723f ci(prettier): use Node LTS instead of pinning to a specific version (#442)
• d269e35 chore(deps): update dependency @​octokit/types to v14 (#445)
• 9c8d051 build(deps): bump vite from 6.1.0 to 6.2.5 (#444)
• 080bcfc chore(deps): update dependency prettier to v3.5.3 (#438)
• 356b1f5 chore(deps): update dependency prettier to v3.5.2 (#437)
• dcf9157 chore(deps): update dependency prettier to v3.5.1 (#436)
• 3f5cf51 chore(deps): update dependency esbuild to ^0.25.0 (#435)
• Additional commits viewable in compare view

Updates @octokit/core from 5.2.2 to 7.0.6

Release notes

Sourced from @​octokit/core's releases.

v7.0.6

7.0.6 (2025-10-31)

Bug Fixes

• deps: update dependency @​octokit/types to v16 (#759) (951bd35)

v7.0.5

7.0.5 (2025-09-29)

Bug Fixes

• deps: update octokit dependencies, and @​sinonjs/fake-timers (#749) (14d23a1)

v7.0.4

7.0.4 (2025-09-16)

Bug Fixes

• deps: update dependency @​octokit/types to v15 (#748) (03b6c28)

v7.0.3

7.0.3 (2025-07-10)

Bug Fixes

• add createLogger to ensure that pino does not break (#744) (0896c50)

v7.0.2

7.0.2 (2025-05-20)

Bug Fixes

• deps: update octokit monorepo (major) (#742) (629fa4e)

v7.0.1

7.0.1 (2025-05-20)

Bug Fixes

• deps: update dependency before-after-hook to v4 (#739) (2abf89e)

v7.0.0

7.0.0 (2025-05-20)

... (truncated)

Commits

• 951bd35 fix(deps): update dependency @​octokit/types to v16 (#759)
• 48961f8 ci(action): update peter-evans/create-or-update-comm...

  Description has been truncated