Bump the npm group with 3 updates

[dependabot]

Bumps the npm group with 3 updates: eslint, html-minifier-next and puppeteer.

Updates eslint from 10.8.1 to 10.9.0

Release notes

Sourced from eslint's releases.

v10.9.0

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

• 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
• 87f66f4 docs: Update README (GitHub Actions Bot)
• 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
• f3993b0 docs: Update README (GitHub Actions Bot)
• ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
• 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
• 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
• 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

• 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
• 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
• dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
• f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
• 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])

Commits

• c27bc92 10.9.0
• fa831d9 Build: changelog update for 10.9.0
• 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243)
• 08de88e feat: handle underflow in no-loss-of-precision (#21218)
• 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216)
• 9aa3873 chore: update ecosystem plugins (#21235)
• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213)
• dc1e7a8 chore: update ecosystem plugins (#21208)
• 87f66f4 docs: Update README
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204)
• Additional commits viewable in compare view

Updates html-minifier-next from 7.5.3 to 8.1.0

Changelog

Sourced from html-minifier-next's changelog.

[8.1.0] - 2026-08-19

Fixed

• Fixed the ignoreCustomFragments risk analysis missing two unbounded repeats that overlap without being spelled alike—[a]*a* and \w*\d* split a run of input the same way a*a* does, and are now flagged the same way
• Fixed the ignoreCustomFragments risk analysis reading patterns without their flags, so that /.*\n*/s and /[a]*A*/i passed as the flagless sources they are spelled as
• Fixed the ignoreCustomFragments risk analysis reading \b inside a character class as a word boundary rather than the backspace it stands for
• Fixed regex sources being read as though a character class could not nest, so that a v pattern like /[[a][b]]*b*/v was analyzed—and, under i, rewritten—from the wrong class boundary
• Fixed the demo building regex options with new RegExp rather than the /…/flags parsing the library itself uses, so that a pattern entered as /ng-class/—the form the demo’s customAttrCollapse example shows—matched literal slashes, and no pattern could carry flags

Changed

• Updated customAttrAssign and customAttrSurround patterns carrying u, v, or m to refuse with an error, where the flag changes what the source matches (a flag the source does not depend on, as in /x=/u, is left alone)
• Updated ignoreCustomFragments patterns whose unbounded repeats reach each other across atoms that can match empty—a*b*a*, \s*\w*\s*—to be flagged as backtracking risks, which strictCustomFragments rejects outright
• Updated the same analysis to read a group by what its body can match
• Updated the same analysis to compare repeats across a group boundary, flagging (a*)a* like a*a*
• Split the demo’s option building out into demo/get-options.js, which puts the regex options it assembles under test without a page to run in

[8.0.0] - 2026-08-19

Fixed

• Fixed ignoreCustomFragments patterns losing their flags (/…/i matched case-sensitively and /…/s left . stopping at line terminators)
• Fixed the ignoreCustomFragments ReDoS warning firing for every * or +, which flagged linear patterns—among them HMN’s defaults, whenever they were passed explicitly
• Fixed custom fragment matching costing O(n²) on documents that open fragments they never close—ignoreCustomFragments patterns that wrap an any-character or negated-class body in literal delimiters are matched by scanning for those delimiters in linear time
• Fixed a whitespace run longer than 200 characters next to a custom fragment being split at that bound, which discarded the excess—or, under collapseWhitespace, left two spaces where one belonged
• Fixed customAttrAssign and customAttrSurround patterns losing their flags, so that a /…/i pattern matched case-sensitively
• Fixed an entity-encoded iframe srcdoc not being minified
• Fixed a malformed iframe srcdoc document aborting the whole run despite continueOnMinifyError
• Fixed removeUnusedCSS minifying iframe srcdoc style sheets against the parent document’s symbols—the nested document now gets its own set
• Fixed CLI error messages reading undefined when the thrown value was not an Error

Added

• Added strictCustomFragments to reject ignoreCustomFragments patterns that risk catastrophic backtracking, rather than warning about them—those are the patterns that reach the backtracking path, so an error is the safer answer where the patterns or the input are not fully under your control
  • The risk analysis is capped: Patterns longer than 10,000 characters or nested deeper than 50 groups are judged risky rather than analyzed further

Changed

• BREAKING: Removed customFragmentQuantifierLimit in favor of linear matching, strictCustomFragments, and maxInputLength
  • Migration: Drop the option
• Sped up sortAttributes and sortClassNames on documents with many distinct attribute names or classes
• Sped up URL minification in style sheets with many url() references (by consuming replacement results by index instead of quadratic array shifting)
• Moved the web demo onto the same ReDoS pattern check as the minifier, which had drifted from its own copy
• Extended ESLint to the backtest scripts and resolved reports
• Extended type checking beyond src/ to cli.js, scripts/, and build configuration

[7.6.0] - 2026-08-18

Added

... (truncated)

Commits

• See full diff in compare view

Updates puppeteer from 25.7.0 to 25.8.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.8.0

25.8.0 (2026-08-17)

🎉 Features

• support followSymlinks option (#15335) (af6a23d)

🛠️ Fixes

• computeSystemExecutablePath support validatePath (#15340) (73da9a4)
• launch browsers in detached mode on Windows to fix flakiness (#15339) (8e1022b)
• remove redundant overwrite and file access from ScreenRecorder (#15352) (61a1675)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.2.0 to 3.2.1

puppeteer: v25.8.0

25.8.0 (2026-08-17)

🎉 Features

• support followSymlinks option (#15335) (af6a23d)

🛠️ Fixes

• tell the user how to recover a partial browser folder (#15319) (bbc51bd)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.2.0 to 3.2.1
    • puppeteer-core bumped from 25.7.0 to 25.8.0

Changelog

Sourced from puppeteer's changelog.

25.8.0 (2026-08-17)

🎉 Features

• support followSymlinks option (#15335) (af6a23d)

🛠️ Fixes

• computeSystemExecutablePath support validatePath (#15340) (73da9a4)
• launch browsers in detached mode on Windows to fix flakiness (#15339) (8e1022b)
• remove redundant overwrite and file access from ScreenRecorder (#15352) (61a1675)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.2.0 to 3.2.1

Commits

• 8a95741 chore: release main (#15341)
• bbc51bd fix: tell the user how to recover a partial browser folder (#15319)
• 61a1675 fix: remove redundant overwrite and file access from ScreenRecorder (#15352)
• 8e1022b fix: launch browsers in detached mode on Windows to fix flakiness (#15339)
• af6a23d feat: support followSymlinks option (#15335)
• 73da9a4 fix: computeSystemExecutablePath support validatePath (#15340)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions