[dependabot]

Bumps the all group with 4 updates in the / directory: eslint, neostandard, node-gyp and pre-commit.

Updates eslint from 9.39.5 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])

... (truncated)

Commits

• 12cbff4 10.14.0
• 6b696e7 Build: changelog update for 10.14.0
• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
• 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
• dab466e docs: Update README
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419)
• Additional commits viewable in compare view

Updates neostandard from 0.12.2 to 0.14.1

Release notes

Sourced from neostandard's releases.

v0.14.1

0.14.1 (2026-10-09)

📚 Documentation

• clarify global ignore behavior (#409) (939f7b9)

v0.14.0

0.14.0 (2026-10-08)

🩹 Fixes

• complete release workflow lifecycle (#401) (7c5379b)
• select committed Release Please configs (#402) (9bf2092)

🧹 Chores

• request stable 0.14.0 (#407) (3a2295a)

v0.14.0-next.1

0.14.0-next.1 (2026-08-10)

🌟 Features

• deps: update dependency eslint-plugin-n to ^18.2.2 (#381) (3172802)
• deps: update dependency globals to ^17.9.0 (#366) (4b8bb40)

🩹 Fixes

• deps: update dependency peowly to v2 (#391) (f98d93d)
• style: ignore TSTypeParameterInstantiation indent (#394) (74afb95)

v0.14.0-next

0.14.0-next (2026-08-06)

⚠ BREAKING CHANGES

• package is ESM-only; Node.js floor raised to ^22.13.0 || >=24; peer eslint range is ^9.22.0 || ^10.0.0; @stylistic pinned at 5.10.0; eslint-plugin-n v18; eslint-plugin-react and all React logic rules removed (JSX style rules remain); cli.mjs renamed to cli.js; default export property access deprecated in favor of named exports. All configs are now scoped to files and ignores is applied to those scopes rather than being global.

🌟 Features

• convert to ESM, support ESLint 10, adopt @​stylistic v5 (#340) (409c468)

... (truncated)

Changelog

Sourced from neostandard's changelog.

0.14.1 (2026-10-09)

📚 Documentation

• clarify global ignore behavior (#409) (939f7b9)

0.14.0 (2026-10-08)

🩹 Fixes

• complete release workflow lifecycle (#401) (7c5379b)
• select committed Release Please configs (#402) (9bf2092)

🧹 Chores

• request stable 0.14.0 (#407) (3a2295a)

0.14.0-next.1 (2026-08-10)

🌟 Features

• deps: update dependency eslint-plugin-n to ^18.2.2 (#381) (3172802)
• deps: update dependency globals to ^17.9.0 (#366) (4b8bb40)

🩹 Fixes

• deps: update dependency peowly to v2 (#391) (f98d93d)
• style: ignore TSTypeParameterInstantiation indent (#394) (74afb95)

0.14.0-next (2026-08-06)

⚠ BREAKING CHANGES

• package is ESM-only; Node.js floor raised to ^22.13.0 || >=24; peer eslint range is ^9.22.0 || ^10.0.0; @stylistic pinned at 5.10.0; eslint-plugin-n v18; eslint-plugin-react and all React logic rules removed (JSX style rules remain); cli.mjs renamed to cli.js; default export property access deprecated in favor of named exports. All configs are now scoped to files and ignores is applied to those scopes rather than being global.

🌟 Features

• convert to ESM, support ESLint 10, adopt @​stylistic v5 (#340) (409c468)

📚 Documentation

• correct version number in README.md import docs (#365) (99205a3)

... (truncated)

Commits

• 2d12a3e chore(main): release 0.14.1 (#411)
• 041c6dd ci: quarantine failing canary dependents (#410)
• 939f7b9 docs: clarify global ignore behavior (#409)
• 91b55eb chore(main): release 0.14.0 (#403)
• 3a2295a chore: request stable 0.14.0 (#407)
• 0662df8 Release-As: 0.14.0
• 0acd5d3 ci: restore static release workflow (#405)
• 62e71bc ci: support explicit stable release version (#404)
• 9bf2092 fix: select committed Release Please configs (#402)
• 7c5379b fix: complete release workflow lifecycle (#401)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for neostandard since your current version.

Updates node-gyp from 12.4.0 to 13.1.0

Release notes

Sourced from node-gyp's releases.

v13.1.0

13.1.0 (2026-10-02)

Features

• update gyp-next to v0.22.3 (#3361) (729bfb8)

Bug Fixes

• accept --msvs_version as the README documents it (#3364) (8cca9c9)
• add Python 3.15 and update OS versions in tests.yml (#3369) (03c7b3b)
• let --loglevel on the command line override npm_config_loglevel (#3384) (2275aa9)

Core

• deps-dev: bump eslint to 10 and neostandard to 0.14.0-next.1 (#3374) (d389298)

Tests

• fix missing cb in fs.unlink (#3368) (e91cd76)
• fix non-ASCII addon cache path (#3370) (e6f699f)

Doc

• use Visual Studio 2026 in Windows setup instructions (#3367) (20bd442)

Miscellaneous

• deps: upgrade tar to 7.5.7 to address CVE-2026-24842 (#3375) (79048c9)
• use Visual Studio 2026 on windows-11-arm (#3380) (6feed93)

v13.0.2

13.0.2 (2026-08-25)

Bug Fixes

• ci: add zizmor security linter for github actions (#3358) (8466166)
• ci: do not ruff format gyp example code in markdown (#3357) (4a74fbe)
• fall back gracefully when build symlink creation fails (#3339) (eae161f)

Core

... (truncated)

Changelog

Sourced from node-gyp's changelog.

13.1.0 (2026-10-02)

Features

• update gyp-next to v0.22.3 (#3361) (729bfb8)

Bug Fixes

• accept --msvs_version as the README documents it (#3364) (8cca9c9)
• add Python 3.15 and update OS versions in tests.yml (#3369) (03c7b3b)
• let --loglevel on the command line override npm_config_loglevel (#3384) (2275aa9)

Core

• deps-dev: bump eslint to 10 and neostandard to 0.14.0-next.1 (#3374) (d389298)

Tests

• fix missing cb in fs.unlink (#3368) (e91cd76)
• fix non-ASCII addon cache path (#3370) (e6f699f)

Doc

• use Visual Studio 2026 in Windows setup instructions (#3367) (20bd442)

Miscellaneous

• deps: upgrade tar to 7.5.7 to address CVE-2026-24842 (#3375) (79048c9)
• use Visual Studio 2026 on windows-11-arm (#3380) (6feed93)

13.0.2 (2026-08-25)

Bug Fixes

• ci: add zizmor security linter for github actions (#3358) (8466166)
• ci: do not ruff format gyp example code in markdown (#3357) (4a74fbe)
• fall back gracefully when build symlink creation fails (#3339) (eae161f)

Core

• deps: bump actions/checkout from 6 to 7 (#3335) (353050b)
• deps: bump actions/setup-node from 6 to 7 (#3348) (005a7c5)

... (truncated)

Commits

• 399f6fa chore(main): release 13.1.0 (#3366)
• 2275aa9 fix: let --loglevel on the command line override npm_config_loglevel (#3384)
• 6feed93 ci: use Visual Studio 2026 on windows-11-arm (#3380)
• 729bfb8 feat: update gyp-next to v0.22.3 (#3361)
• 79048c9 chore(deps): upgrade tar to 7.5.7 to address CVE-2026-24842 (#3375)
• d389298 build(deps-dev): bump eslint to 10 and neostandard to 0.14.0-next.1 (#3374)
• 03c7b3b fix: add Python 3.15 and update OS versions in tests.yml (#3369)
• e6f699f test: fix non-ASCII addon cache path (#3370)
• e91cd76 test: fix missing cb in fs.unlink (#3368)
• 20bd442 docs: use Visual Studio 2026 in Windows setup instructions (#3367)
• Additional commits viewable in compare view

Updates pre-commit from 1.2.2 to 2.0.0

Changelog

Sourced from pre-commit's changelog.

2.0.0

• Breaking: requires Node.js 16.13 or newer. engines.node is now declared as ">=16.13.0" to match the minimum required by which@4.
• Breaking: cross-spawn upgraded ^5 → ^7.0.5, fixing the ReDoS vulnerability (GHSA-3xgq-45jj-v275). cross-spawn's spawnSync now returns status/signal/error instead of code; index.js was updated to match.
• Breaking: which upgraded 1.2.x → ^4. The spawn-sync runtime dependency is dropped in favor of cross-spawn's built-in spawnSync.
• Breaking: the generated .git/hooks/pre-commit wrapper is rewritten. It is now a small bash script that execs the package's hook file via an absolute path (single-line invocation instead of multi-line inline bash). Anyone parsing the wrapper file will need to adjust.
• Breaking: hook file mode tightened from 0777 to 0755 (CIS 6.1.10).
• Breaking: submodule installs now write to <super>/.git/modules/<sub>/hooks/pre-commit. The previous behavior silently walked up to the super-project's .git directory and installed there because the gitdir-parsing branch was unreachable. Linked worktrees (whose .git is also a file) are handled correctly too.
• The hook now unsets GIT_LITERAL_PATHSPECS, so commits triggered from emacs/magit behave the same as on the command line (magit FAQ).
• The hook now cds to the git root before resolving pre-commit via require.resolve, so Yarn Plug'n'Play and GUI git clients that invoke hooks with an unexpected cwd resolve dependencies correctly.
• The hook is resilient to a missing pre-commit package: switching to a branch without node_modules (or removing the package) no longer blocks commits — it exits 0 with a warning instead of throwing a Node module-not-found stack trace.
• Fixed handling of null close codes and signal-terminated scripts; the hook no longer treats a signal kill as success.
• Hardened install.js gitdir parsing against missing matches and bad input; gitdir: paths are resolved relative to the directory containing the .git file (was incorrectly resolved against the package root).
• install.js: typo fix ("backuped" → "backed up").
• Dev tooling refresh: mocha 3 → 10, assume 1 → 2, dropped istanbul for nyc.

1.0.2

• Check /usr/local/bin/node if we cannot find the binaries in the PATH.

1.0.1

• Corrected the hook file so it doesn't attempt to run your index.js but ours instead.

1.0

• Create symlinks instead of a copying the hook file so we can depend on modules.
• More readable output messages.

... (truncated)

Commits

• See full diff in compare view

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.68%. Comparing base (25c6b21) to head (325d2d2).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1757   +/-   ##
=======================================
  Coverage   63.68%   63.68%           
=======================================
  Files           3        3           
  Lines        2065     2065           
  Branches      731      731           
=======================================
  Hits         1315     1315           
  Misses        162      162           
  Partials      588      588           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.