⬆️ Bump the minor-updates group across 1 directory with 16 updates

[dependabot]

Bumps the minor-updates group with 16 updates in the / directory:

Package	From	To
electron	43.0.0	43.1.0
eslint-config-xo-react	0.30.1	0.31.0
globals	17.6.0	17.7.0
i18next	26.3.1	26.3.5
i18next-cli	1.63.1	1.65.0
immer	11.1.8	11.1.11
material-symbols	0.45.1	0.45.6
node-addon-api	8.8.0	8.9.0
prettier	3.8.4	3.9.4
react-icons	5.6.0	5.7.0
react-tooltip	6.0.7	6.0.8
semver	7.8.4	7.8.5
simple-icons-font	16.23.0	16.25.0
ts-loader	9.6.0	9.6.2
tsx	4.22.4	4.23.0
typescript-eslint	8.61.0	8.63.0

Updates electron from 43.0.0 to 43.1.0

Release notes

Sourced from electron's releases.

electron v43.1.0

Release Notes for v43.1.0

Fixes

• Fixed crash triggered by replacing an open application menu. #52276 (Also in 41, 42, 44)

Other Changes

• Updated Chromium to 150.0.7871.47. #52235
• Updated Node.js to v24.18.0. #52106

Commits

• b5c102b fix: restore SelfKeepAlive in Menu (#52276)
• 295cdff build: replace chalk with node:util styleText (#52258)
• c4baa54 chore: bump chromium to 150.0.7871.47 (43-x-y) (#52235)
• e4a5c5a chore: bump node to v24.18.0 (43-x-y) (#52106)
• 74daf45 build: update PGO profiles (#52201)
• bf4d07f build: report lint / Lint as skipped for pgo-only PRs (#52211)
• 0249c95 docs: add future deprecation warning for macOS 12 on v44 (#52206)
• 5f5c56e refactor: parentPort managed by cppgc (#52195)
• de94bcc docs: update breaking changes to clarify v43 is last 32-bit (#52196)
• See full diff in compare view

Updates eslint-config-xo-react from 0.30.1 to 0.31.0

Release notes

Sourced from eslint-config-xo-react's releases.

v0.31.0

• Don't apply React rules to non-JavaScript files 14da006

---

xojs/eslint-config-xo-react@v0.30.1...v0.31.0

Commits

• 396efc6 0.31.0
• 14da006 Don't apply React rules to non-JavaScript files
• d311f34 Meta tweaks
• See full diff in compare view

Updates globals from 17.6.0 to 17.7.0

Release notes

Sourced from globals's releases.

v17.7.0

• Update globals (2026-06-22) (#345) 33b75f9

---

sindresorhus/globals@v17.6.0...v17.7.0

Commits

• a19670c 17.7.0
• 9611620 Update actions (#346)
• 33b75f9 Update globals (2026-06-22) (#345)
• 887dd52 Fix build script (#344)
• See full diff in compare view

Updates i18next from 26.3.1 to 26.3.5

Release notes

Sourced from i18next's releases.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

Changelog

Sourced from i18next's changelog.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

Commits

• 573ae73 26.3.5
• cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
• 3180d67 fix: skip interpolation of placeholders inside escaped values (#2442)
• d16f5a2 fix: stop mutating the passed replace object when returning details (#2441)
• bed56c1 fix: parse $t() nesting options block that spans multiple lines (#2440)
• c19e458 docs(changelog): link GHSA advisory for deepExtend fix
• 7bb87d0 docs(changelog): reference security advisory for deepExtend fix
• df9b799 docs(changelog): update security disclosure credit
• 817ede5 26.3.4
• 46d0dd8 build
• Additional commits viewable in compare view

Updates i18next-cli from 1.63.1 to 1.65.0

Changelog

Sourced from i18next-cli's changelog.

1.65.0

• fix(extract): respect fallbackNS — keys already translated in a fallback namespace are no longer duplicated into the requesting namespace's file (#272).
  • Such keys are now attributed to the fallback namespace instead, so removeUnusedKeys no longer prunes them from the fallback file (previously a key like cancel living only in the fallback namespace was deleted there and re-created in every namespace that used it).
  • A key that already has a non-empty value in the requesting namespace's own file is treated as an intentional per-namespace override and keeps being extracted there, mirroring the i18next runtime lookup order (requested namespace first, then the fallback chain). Empty-string placeholders left behind by previous extract runs are cleaned up.
  • Keys not found in any fallback namespace are still added to the requesting namespace, like the i18next saveMissing behavior.
• feat(extract): fallbackNS now also accepts an array of namespaces (looked up in order, like the i18next runtime option) — supported by extract, status, and the TypeScript types generator.

1.64.2

• fix(status): scope the pass/fail result to the requested locale (#271).
  • status <locale> now exits based on that locale only, instead of always evaluating every secondary language. Previously, running e.g. status en-AU on a fully-translated primary could print "🎉 All keys present" and still exit 1 because an unrelated secondary (e.g. an empty de-DE) was incomplete — a summary that contradicted the exit code.
  • When the requested locale is the primary, the check still fails only on absent keys (empty placeholders are tolerated); for a secondary it fails on any untranslated/absent key. The global view (status with no locale) is unchanged.
  • The failure message now names the locale when scoped (Error: Incomplete translations detected for "de-DE".) so the reason is no longer hidden.

1.64.1

• fix(status): align plural reporting with the i18next runtime (#270).
  • Plural categories that Intl.PluralRules only selects for out-of-range values (e.g. French _many, which fires only for counts ≥ 1,000,000) are now treated as optional: a missing or empty variant is shown as a soft "optional plural form" note instead of a hard "missing key" error, so it no longer fails the check. Categories reachable by typical counts (including decimals, e.g. Polish/Russian other) remain required.
  • With disablePlurals: true, a key used with count is now considered satisfied when either its plural variants (_one/_other) or the bare key exist — mirroring the runtime's key + suffix → key resolution chain —

... (truncated)

Commits

• 9497126 1.65.0
• cebfb66 fix(extract): respect fallbackNS and stop duplicating keys into namespace fil...
• 4af3b5b 1.64.2
• 59e5c15 fix(status): scope pass/fail to the requested locale #271
• 58e96ac 1.64.1
• 90fb64d fix(status): align plural reporting with the i18next runtime #270
• 4f32c05 1.64.0
• 9ab66af feat(extract): support trailing wildcards in functions (e.g. 'tProps.*')
• See full diff in compare view

Updates immer from 11.1.8 to 11.1.11

Release notes

Sourced from immer's releases.

v11.1.11

11.1.11 (2026-07-03)

Bug Fixes

• improve DraftMap.{entries,values}() compatibility#1228 (#1228) (858d036)

v11.1.10

11.1.10 (2026-07-03)

Bug Fixes

• undefined assigned to a prototype-inherited key gets dropped (#1262) (16e225b)

v11.1.9

11.1.9 (2026-07-01)

Bug Fixes

• prevent prototype pollution via constructor.prototype access (CVE-2026-XXXX) (#1259) (48fc378)

Commits

• 60ca295 chore(deps): bump @​sigstore/core from 3.2.0 to 3.2.1 (#1258)
• 858d036 fix: improve DraftMap.{entries,values}() compatibility#1228 (#1228)
• 89acf94 chore(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 in /website (#1257)
• f2b409e chore(deps-dev): bump vite from 6.4.2 to 6.4.3 (#1256)
• e6eb6e3 chore(deps): bump @​babel/plugin-transform-modules-systemjs in /website (#1238)
• 5868ec5 chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /website (#1237)
• c6ce0e9 chore(deps): bump tar from 7.5.13 to 7.5.16 (#1253)
• 9ec6559 chore(deps): bump joi from 17.7.0 to 17.13.4 in /website (#1250)
• 86c3776 chore(deps): bump shell-quote from 1.7.4 to 1.8.4 in /website (#1248)
• e606b33 chore(deps): bump shell-quote from 1.8.0 to 1.8.4 (#1247)
• Additional commits viewable in compare view

Updates material-symbols from 0.45.1 to 0.45.6

Commits

• ddf73b9 0.45.6
• ab687ab Auto Update
• 8472b34 0.45.5
• 39c03c3 Auto Update
• 299966d 0.45.4
• 158732a Auto Update
• 8b517d2 0.45.3
• 8cf6a21 Auto Update
• 44ac997 0.45.2
• 220e9dc Auto Update
• See full diff in compare view

Updates node-addon-api from 8.8.0 to 8.9.0

Changelog

Sourced from node-addon-api's changelog.

8.9.0 (2026-05-24)

Features

• add support for SharedArrayBuffer in TypedArray and TypedArrayOf<T> (#1731) (00b95ef)

Commits

• 13c28f6 chore: release v8.9.0 (#1733)
• e56a8dd chore: add node v26 test (#1732)
• 00b95ef feat: add support for SharedArrayBuffer in TypedArray and TypedArrayOf<T> (#1...
• See full diff in compare view

Updates prettier from 3.8.4 to 3.9.4

Release notes

Sourced from prettier's releases.

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.4

diff

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

<!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
@​content(icon) {
<span>Icon!</span>
}
@​content(description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
@​content (icon) {
<span>Icon!</span>
}
@​content (description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>

3.9.3

diff

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @​seiyab)

</tr></table> 

... (truncated)

Commits

• b693cb2 Release 3.9.4
• 2e92ac0 Angular: Format @content(name) -> @content (name) to align with other blo...
• abed2c2 Bump Prettier dependency to 3.9.3
• 6cfbc00 Clean changelog_unreleased
• 3732e1d Release 3.9.3
• a74a7b0 Allow decorators to be used with declare on class fields (#19492)
• bd9e11a Correct text identification in liquid syntax (#19489)
• 269eee3 Bump Prettier dependency to 3.9.1
• ec7ccd1 Clean changelog_unreleased
• c47654c Release 3.9.1
• Additional commits viewable in compare view

Updates react-icons from 5.6.0 to 5.7.0

Release notes

Sourced from react-icons's releases.

v5.7.0

What's Changed

• update packages by @​kamijin-fanta in react-icons/react-icons#1153

Full Changelog: react-icons/react-icons@v5.6.0...v5.7.0

Icon Library	License	Version	Count
Circum Icons	MPL-2.0 license	1.0.0	288
Font Awesome 5	CC BY 4.0 License	5.15.4-3-gafecf2a	1612
Font Awesome 6	CC BY 4.0 License	6.7.2-1-g840c215	2060
Ionicons 4	MIT	4.6.3	696
Ionicons 5	MIT	5.5.4	1332
Material Design icons	Apache License Version 2.0	4.0.0-161-gf3fb4442b2	4341
Typicons	CC BY-SA 3.0	2.1.2	336
Github Octicons icons	MIT	18.3.0	264
Feather	MIT	4.29.2	287
Lucide	ISC	0.462.0	1541
Game Icons	CC BY 3.0	12920d6565588f0512542a3cb0cdfd36a497f910	4040
Weather Icons	SIL OFL 1.1	2.0.12	219
Devicons	MIT	1.8.0	192
Ant Design Icons	MIT	4.4.2	831
Bootstrap Icons	MIT	1.13.1	2754
Remix Icon	Apache License Version 2.0	4.9.1	3229
Flat Color Icons	MIT	1.0.2	329
Grommet-Icons	Apache License Version 2.0	4.14.0	637
Heroicons	MIT	1.0.6	460
Heroicons 2	MIT	2.2.0	972
Simple Icons	CC0 1.0 Universal	16.24.0	3446
Simple Line Icons	MIT	2.5.5	189
IcoMoon Free	CC BY 4.0 License	d006795ede82361e1bac1ee76f215cf1dc51e4ca	491
BoxIcons	MIT	2.1.4	1634
css.gg	MIT	2.1.4	704
VS Code Icons	CC BY 4.0	0.0.0	612
Tabler Icons	MIT	3.44.0	6146
Themify Icons	MIT	v0.1.2-2-g9600186	352
Radix Icons	MIT	@​radix-ui/react-icons@​1.3.2-35-g112af91	332
Phosphor Icons	MIT	2.1.1	9072
Icons8 Line Awesome	MIT	1.3.1	1544

Commits

• 87470d5 v5.7.0
• e1cb061 fix ci publish
• bffaab7 Revert "v5.7.0"
• 2cde989 v5.7.0
• dac95cc update npm in ci workflow
• 21fcd04 Revert "v5.7.0"
• 3a05518 v5.7.0
• c8b5050 fix github pages deploy
• 2f78ae4 Update CI actions, Pages deploy, and staged npm publishing
• 11f5a06 update packages (#1153)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-icons since your current version.

Updates react-tooltip from 6.0.7 to 6.0.8

Release notes

Sourced from react-tooltip's releases.

v6.0.8

If you like ReactTooltip, please give the project a star on GitHub 🌟

What's Changed

• fix: global events broke on ios by @​danielbarion in ReactTooltip/react-tooltip#1282

Full Changelog: ReactTooltip/react-tooltip@v6.0.7...v6.0.8

Commits

• 32e9179 chore: bump version v6.0.8
• 5bc1fe6 Merge pull request #1282 from ReactTooltip/fix/issue-1281-global-events
• e74d5a5 fix: global events broke on ios
• See full diff in compare view

Updates semver from 7.8.4 to 7.8.5

Release notes

Sourced from semver's releases.

v7.8.5

7.8.5 (2026-06-19)

Bug Fixes

• 9c8692a #878 include prereleases in tilde range lower bound with includePrerelease (#878) (@​chatman-media)

Changelog

Sourced from semver's changelog.

7.8.5 (2026-06-19)

Bug Fixes

• 9c8692a #878 include prereleases in tilde range lower bound with includePrerelease (#878) (@​chatman-media)

Commits

• 6e05b76 chore: release 7.8.5 (#879)
• 9c8692a fix: include prereleases in tilde range lower bound with includePrerelease (#...
• See full diff in compare view

Updates simple-icons-font from 16.23.0 to 16.25.0

Release notes

Sourced from simple-icons-font's releases.

Release 16.25.0

See https://github.com/simple-icons/simple-icons/releases/tag/16.25.0

Release 16.24.1

See https://github.com/simple-icons/simple-icons/releases/tag/16.24.1

Release 16.24.0

See https://github.com/simple-icons/simple-icons/releases/tag/16.24.0

Commits

• 2526811 Add font
• 61c0d90 Release 16.25.0
• e04620b Bump version
• 11b02e4 Release 16.24.1
• 20b2e9b Bump version
• 586a4be Release 16.24.0
• fd4955d Bump version
• See full diff in compare view

Updates ts-loader from 9.6.0 to 9.6.2

Release notes

Sourced from ts-loader's releases.

v9.6.2

• chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micromatch → picomatch - thanks @​johnnyreilly

Officially ts-loader has supported 3.6.3+ versions of TypeScript. This change means that certain scenarios with older versions of TS will now certainly fail. If anyone is actually using these versions it would be surprising.

v9.6.1

• fix: rspack support - thanks @​johnnyreilly and @​bhollis

Changelog

Sourced from ts-loader's changelog.

9.6.2

• chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micromatch → picomatch - thanks @​johnnyreilly

Officially ts-loader has supported 3.6.3+ versions of TypeScript. This change means that certain scenarios with older versions of TS will now certainly fail. If anyone is actually using these versions it would be surprising.

9.6.1

• fix: rspack support - thanks @​johnnyreilly and @​bhollis

Commits

• b347bb7 chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micro...
• 32d82e6 fix: rspack support (#1699)
• 6bd992e chore: Update GitHub Actions workflow for release
• See full diff in compare view

Updates tsx from 4.22.4 to 4.23.0

Release notes

Sourced from tsx's releases.

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 1dfad37 docs: cite esbuild's extension-resolution model in node notes
• 257bbbb fix: avoid redundant filesystem probes during module resolution
• c178197 feat: add multi-scenario startup benchmark suite
• 51800ac docs: add Node internals knowledge base (notes/node)
• a305f36 fix: isolate hook state per async module.register() registration
• ca501a9 chore: upgrade skills-npm to v1.2.0
• 596cd1f test: cover __dirname, __filename, & require.cache in CJS TS file
• 75d9bf0 test: lock in lenient ESM for ambiguous and CJS-typed packages
• 1472f3e test: cover ESM-syntax dependency with omitted "type" field
• See full diff in compare view

Updates typescript-eslint from 8.61.0 to 8.63.0

Release notes

Sourced from typescript-eslint's releases.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
• eslint-plugin:Description has been truncated