chore(deps): bump the npm-production-minor-patch group with 21 updates

[dependabot]

Bumps the npm-production-minor-patch group with 21 updates:

Package	From	To
mongodb-connection-string-url	7.0.1	7.0.2
socks	2.8.3	2.8.9
mongodb	7.5.0	7.6.0
resolve-mongodb-srv	1.1.3	1.1.7
mongodb-client-encryption	7.0.0	7.2.1
lru-cache	11.3.5	11.5.2
@aws-sdk/client-s3	3.1098.0	3.1117.0
ajv	8.18.0	8.20.0
semver	7.7.4	7.8.5
ipaddr.js	2.2.0	2.5.0
acorn	8.16.0	8.18.0
bson	7.3.1	7.3.2
tar	7.5.11	7.5.22
heap-js	2.3.0	2.7.1
yargs	18.0.0	18.1.0
@mongosh/shell-api	5.1.6	5.5.0
node-addon-api	8.3.1	8.9.2
@types/ssh2	1.11.19	1.15.5
eslint-plugin-filename-rules	1.2.0	1.3.1
eslint-plugin-react	7.30.1	7.37.5
chai-dom	1.11.0	1.12.1

Updates mongodb-connection-string-url from 7.0.1 to 7.0.2

Release notes

Sourced from mongodb-connection-string-url's releases.

v7.0.2

7.0.2 (2026-07-15)

The MongoDB Node.js team is pleased to announce version 7.0.2 of the mongodb-connection-string-url package!

Release Notes

Loosened type restriction on generic arugments

• .typedSearchParams<...>()
• CommaAndColonSeparatedRecord<...>

The generics passed into these APIs were inadvertently made stricter than desirable. They've been updated to use the extends {} condition which permits string keyed types as a type argument. Notably improving the compatibility with the driver's AuthMechanismProperties type, a possible output of connection string parsing.

Fixed parsing issue

Unescaped @ in credentials now throws instead of silently misparsing.

Error messages no longer reveal invalid connection strings

Invalid connection strings are no longer revealed in error messages, reducing sensitive information disclosure. Historically we've had URI's embedded in error messages from validation failures.

Bug Fixes

• NODE-7449: loosen type requirement for generics on typedSearchParams and CommaAndColonSeparatedRecord (#116) (69bd1af)
• NODE-7597: handle unescaped @ in the password (#125) (9b39443)
• NODE-7663: uri disclosure on error (#131) (7a1f4ce)

Documentation

• Changelog

We invite you to try the mongodb-connection-string-url library immediately, and report any issues to the NODE project.

Changelog

Sourced from mongodb-connection-string-url's changelog.

7.0.2 (2026-07-09)

Bug Fixes

• NODE-7449: loosen type requirement for generics on typedSearchParams and CommaAndColonSeparatedRecord (#116) (69bd1af)
• NODE-7597: handle unescaped @ in the password COMPASS-10688 (#125) (9b39443)
• NODE-7663: uri disclosure on error (#131) (7a1f4ce)

Commits

• a084dac chore(main): release 7.0.2 (#117)
• 1480167 chore: fix release_notes action (#132)
• 7a1f4ce fix(NODE-7663): uri disclosure on error (#131)
• 9b39443 fix(NODE-7597): handle unescaped @ in the password COMPASS-10688 (#125)
• 09fd0f7 chore(deps): bump googleapis/release-please-action from 4 to 5 (#122)
• 342fd88 chore(deps): bump glob from 10.4.5 to 10.5.0 (#110)
• 911fc72 chore(deps): bump actions/checkout from 5 to 6 (#111)
• 1855495 chore(deps-dev): bump minimatch from 3.1.2 to 3.1.5 (#118)
• 6032b5c chore(deps): bump picomatch from 2.3.1 to 2.3.2 (#121)
• 7c64b4b chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#120)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb-connection-string-url since your current version.

Updates socks from 2.8.3 to 2.8.9

Commits

• c191a5c 2.8.9
• 1eb8ea7 2.8.8
• c8f3d34 upgrade ip-address (#116)
• 83435e0 2.8.7
• 4ffb89d Bump ip-address from 9.0.5 to 10.0.1 (#113)
• 80cbeb9 2.8.6
• a753596 fix: prevent RangeError by validating domain length in socks5 client (#111)
• 93818fc 2.8.5
• f047ee4 2.8.4
• 8146521 Corrected the UDP Relay section in the README. (#109)
• Additional commits viewable in compare view

Updates mongodb from 7.5.0 to 7.6.0

Release notes

Sourced from mongodb's releases.

v7.6.0

7.6.0 (2026-08-21)

The MongoDB Node.js team is pleased to announce version 7.6.0 of the mongodb package!

Release Notes

Support for MongoDB 4.2 is removed

[!WARNING] When the driver connects to a MongoDB server of version 4.2 or less, it will now throw an error.

HTTP proxy support for KMS requests in CSFLE and Queryable Encryption

In-use encryption can now route KMS requests through an HTTP proxy. Set kmsConnectCallback on your ClientEncryption or auto-encryption options to control how the driver connects to a KMS host. The callback receives the target host and port and returns a connected socket (for example, a tunnel opened with HTTP CONNECT); the driver then performs the KMS TLS handshake over that socket using the provider's configured TLS options. This unblocks CSFLE and Queryable Encryption in environments that require an HTTP forward proxy for outbound KMS traffic, which the existing SOCKS5 proxyOptions does not cover.

const clientEncryption = new ClientEncryption(keyVaultClient, {
  keyVaultNamespace,
  kmsProviders,
  // Establish the KMS connection through your HTTP proxy; the driver adds TLS.
  kmsConnectCallback: ({ host, port }) => connectThroughHttpProxy(host, port)
});

Improved Intelligent Workload Management

Improved performance for MongoDB 9.0's Intelligent Workload Management (IWM) by only retrying overload errors when doing so is expected to not worsen server conditions

Bundling the driver into ESM no longer throws ReferenceError: require is not defined

v7.2.0 introduced the experimental runtimeAdapters option and, as part of it, replaced the driver’s static import of Node’s os module with a runtime require('os'). That works in a CommonJS build, but when the driver is bundled into ESM output (e.g. a Vite/esbuild/rollup server build with "type": "module"), there is no require in module scope, so constructing a client threw ReferenceError: require is not defined. The driver now loads the default os adapter through a dynamic import() that survives bundling, so new MongoClient() works in ESM bundles. CommonJS usage is unchanged, and supplying your own runtimeAdapters.os continues to work.

Bulk writes serialize each document only once

insertMany and bulkWrite previously processed each document twice - once to measure its size for batch splitting (a full recursive walk via calculateObjectSize) and again to serialize it into the command sent to the server. Documents are now serialized a single time and the resulting bytes are reused for both, decreasing the BSON-encoding CPU spent on bulk writes and reducing event-loop blocking during large batches. The improvement is most noticeable with high document counts and documents that have many fields.

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

... (truncated)

Changelog

Sourced from mongodb's changelog.

7.6.0 (2026-08-21)

Features

• NODE-7546: add HTTP Proxy support for QE & CSFLE (#5007) (3366c21)
• NODE-7547: bump minimum support server/wire versions to '4.4' & '9' respectively (#4994) (3d97028)
• NODE-7624: support baseBackoffMS and update client backpressure backoff (#5020) (560837b)

Bug Fixes

• NODE-7603: emit dynamic import('os') via tsconfig (#4992) (52f5e61)

Performance Improvements

• NODE-7660: serialize bulk write documents a single time (#4999) (1217aa1)

Commits

• 0fb2c13 chore(main): release 7.6.0 (#5001)
• bb35ded docs: Add preliminary checks to release instructions (#5028)
• 560837b feat(NODE-7624): support baseBackoffMS and update client backpressure backoff...
• ce33c59 chore(NODE-7767): bson compat tests snappy fix (#5025)
• 0f2ed29 chore(NODE-7770): add server 9.0 to the test matrix (#5024)
• bc92c29 chore(NODE-7767): snappy 7.4 is incompatible in CI (#5021)
• dce7939 chore(NODE-7759): pin bson-compat server (#5018)
• 7f8edf3 chore: run bson compat tests against latest server (#5017)
• 30c31e5 ci(deps): bump drivers-evergreen-tools from 3741fa9 to e86753e (#5016)
• 3366c21 feat(NODE-7546): add HTTP Proxy support for QE & CSFLE (#5007)
• Additional commits viewable in compare view

Updates resolve-mongodb-srv from 1.1.3 to 1.1.7

Commits

• fdede64 1.1.7
• a94b236 1.1.6
• 5982169 fix: normalize domains to ensure FQDN equality (#6)
• 2c37c13 1.1.5
• d9738c8 1.1.4
• 48e8349 Merge pull request #5 from mongodb-js/add-code-ql
• 320ac3b Add or update CodeQL workflow
• b2a507b Add or update CodeQL workflow
• 59753d3 Add or update CodeQL workflow
• 3b8f408 Add or update CodeQL workflow
• Additional commits viewable in compare view

Updates mongodb-client-encryption from 7.0.0 to 7.2.1

Release notes

Sourced from mongodb-client-encryption's releases.

v7.2.1

7.2.1 (2026-07-29)

The MongoDB Node.js team is pleased to announce version 7.2.1 of the mongodb-client-encryption package!

Release Notes

macOS x64 prebuild

Fixes ERR_DLOPEN_FAILED when loading the addon in an x64 Node.js process on macOS. The x86_64 half of the universal binary in 7.1.0 and 7.2.0 was missing libmongocrypt's symbols. arm64 processes and 7.0.0 are not affected.

Bug Fixes

• NODE-7704: build libmongocrypt for both macOS architectures (#137) (9335322)

[!IMPORTANT] This library provides encryption functionality for the MongoDB Node.js driver but is not intended to be consumed in isolation. The public API that uses the functionality in this library is available in the mongodb package.

v7.2.0

7.2.0 (2026-07-06)

Features

• NODE-7653: bump libmongocrypt to 1.20.0 (#135) (e9d1a1c)

v7.1.0

7.1.0 (2026-06-25)

Features

• NODE-7569: upgrade libmongocrypt to 1.19.2 (#133) (952c6cb)

Changelog

Sourced from mongodb-client-encryption's changelog.

7.2.1 (2026-07-29)

Bug Fixes

• NODE-7704: build libmongocrypt for both macOS architectures (#137) (9335322)

7.2.0 (2026-07-06)

Features

• NODE-7653: bump libmongocrypt to 1.20.0 (#135) (e9d1a1c)

7.1.0 (2026-06-24)

Features

• NODE-7569: upgrade to libmongocrypt 1.19.2 from GitHub Releases (#133) (952c6cb)

Commits

• d068409 chore(main): release 7.2.1 (#138)
• 9335322 fix(NODE-7704): build libmongocrypt for both macOS architectures (#137)
• ab0a1a3 chore(main): release 7.2.0 (#136)
• e9d1a1c feat(NODE-7653): bump libmongocrypt to 1.20.0 (#135)
• e34e350 chore(NODE-7523): update prod/dev dependencies (#131)
• 5e42621 chore(main): release 7.1.0 (#134)
• 952c6cb feat(NODE-7569): upgrade to libmongocrypt 1.19.2 from GitHub Releases (#133)
• 3a2f2fb chore(NODE-7599): update release integrity docs (#130)
• 2c6fa35 chore: fix release job, remove unused id-token permission (#129)
• bb1633c chore(NODE-7565): migrate release workflow to npm Trusted Publishing (#128)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongodb-client-encryption since your current version.

Updates lru-cache from 11.3.5 to 11.5.2

Changelog

Sourced from lru-cache's changelog.

cringe lorg

11.5

• Add backgroundFetchSize option, defaulting to 1, to set an effective size for provisional background fetch objects while in flight, if they do not shadow an existing stale entry.

11.4

• Add cache property to status objects, in order to differentiate which cache is emitting the metric or trace.
• Several small bugs regarding fetch behavior edge cases.
  • onInsert does not fire for background fetch internal promises.
  • dispose() and disposeAfter() now fire for the stale value left behind when an in-process background fetch is pre-empted by eviction.
  • fetchMethod that returns a non-Promise value is handled correctly.
  • No Error is created, or abort() signaled, when a background fetch promise is resolved. (Presumably the implementation is done by that point.)

11.3

• Add observability features, expand the coverage of LRUCache.Status objects.

11.2

• Add the perf option to specify performance, Date, or any other object with a now() method that returns a number.

11.1

• Add the onInsert method

11.0

• Drop support for node less than v20

10.4

• Accidental minor update, should've been patch.

10.3

• add forceFetch() method
• set disposeReason to 'expire' when it's the result of a TTL

... (truncated)

Commits

• 16b3a91 11.5.2
• 0b0a77e fire autopurge again if the first time isn't stale
• cd98065 11.5.1
• 281f49d work with exactOptionalPropertyTypes
• 0adc7a5 11.5.0
• 4708153 add backgroundFetchSize option
• 9bed6db formatting changelog
• cd8f37b test: loosen test on onInsert
• c440996 11.4.0
• fdab191 changelog 11.4
• Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1098.0 to 3.1117.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1117.0

3.1117.0(2026-08-24)

Documentation Changes

• client-batch: Doc Update, Add note that UpdatePolicy applies only to EC2 managed compute environments (26c213cf)

New Features

• client-securityagent: Adding private and self-signed certificate configuration support for penetration tests (42f6ecb8)
• client-bedrock: Adds support for specifying an inference profile ID or ARN, or an application inference profile ARN as the target model in CreateAdvancedPromptOptimizationJob. (9110f46b)
• client-connect-contact-lens: This release adds the ExtractedInformation segment to the ListRealtimeContactAnalysisSegments API, enabling customers to retrieve information extracted from real-time contact analysis. (9c5bda85)
• client-dsql: Corrected the validation pattern on the ServiceName response field in the GetVpcEndpointServiceName API to match the values Amazon Aurora DSQL actually returns. (1b689a9f)
• client-connect: This release adds the ExtractedInformation segment to the ListRealtimeContactAnalysisSegmentsV2 API, enabling customers to retrieve information extracted from real-time contact analysis. (775d1ad4)
• client-launch-wizard: Added accountConstraints and patternType to GetWorkload, ListWorkloads, GetWorkloadDeploymentPattern and ListWorkloadDeploymentPatterns for Launch Wizard (721b9f47)
• client-elementalinference: Added support for the GetFixture API, enabling customers to retrieve the details of a fixture from its fixture ID, and added the access role ARN to the CreateFeed, GetFeed, and UpdateFeed responses. (d4b71834)
• client-kafka: Amazon MSK Replicator now supports OAuth authentication when connecting to external Apache Kafka clusters, enabling customers to replicate data from clusters that require OAuth for client authentication. This new capability is supported in all AWS Regions where MSK Express brokers are available. (a461b5a0)
• client-timestream-influxdb: Service-managed parameter groups now only apply optimized defaults to DB Clusters automatically. New field effectiveDbParameterGroupIdentifier surfaces the parameter group actually applied. (8c7f04cd)

---

For list of updated packages, view updated-packages.md in assets-3.1117.0.zip

v3.1116.0

3.1116.0(2026-08-21)

Chores

• codegen:
  • bump smithyVersion to 1.73.0 (#8273) (64f21cd0)
  • update to sync with the latest smithy-ts (#8272) (8369ada7)

Documentation Changes

• client-backup: Updating CLI Docs for Backup Audit Manager List Job Summaries APIs. (98f47ffe)
• client-wafv2: DataProtectionConfig field Key Documentation Update (a8f1fb90)

New Features

• client-cloudwatch: Allows customers to specify an initial warm up period to wait for metrics to arrive when creating metric or log alarms (e354f162)
• client-device-farm: Added support to CreateRemoveAccessSession for selecting a server version on the mobile WebDriver endpoint. (d91e09c8)
• client-bedrock-agentcore: Increase spans count from 1k to 20k (e83264aa)
• client-kinesis: Generate account endpoint for Kinesis Data Streams requests when the account ID is available (ed9966e2)
• client-bedrock-agentcore-control: Update Dataset schema to THIRDPARTYEVALUATIONV1 (f0fe8db3)

---

For list of updated packages, view updated-packages.md in assets-3.1116.0.zip

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1117.0 (2026-08-24)

Note: Version bump only for package @​aws-sdk/client-s3

3.1116.0 (2026-08-21)

Note: Version bump only for package @​aws-sdk/client-s3

3.1115.0 (2026-08-20)

Note: Version bump only for package @​aws-sdk/client-s3

3.1114.0 (2026-08-19)

Note: Version bump only for package @​aws-sdk/client-s3

3.1113.0 (2026-08-18)

Note: Version bump only for package @​aws-sdk/client-s3

3.1112.0 (2026-08-17)

Note: Version bump only for package @​aws-sdk/client-s3

3.1111.0 (2026-08-14)

... (truncated)

Commits

• 78b069a Publish v3.1117.0
• d760a00 Publish v3.1116.0
• 8369ada chore(codegen): update to sync with the latest smithy-ts (#8272)
• efc86fc Publish v3.1115.0
• 5318b44 Publish v3.1114.0
• 73a06d2 Publish v3.1113.0
• cb4ae76 Publish v3.1112.0
• c41e9a9 Publish v3.1111.0
• ca81fbb chore: upgrade to typescript 7 (#8264)
• 4efe5bc Publish v3.1110.0
• Additional commits viewable in compare view

Updates ajv from 8.18.0 to 8.20.0

Release notes

Sourced from ajv's releases.

v8.20.0

What's Changed

• fix: add support for node 22/24, drop node 16/21 by @​jasoniangreen in ajv-validator/ajv#2580
• fix: add ES2022.RegExp for RegExpIndicesArray by @​SignpostMarv in ajv-validator/ajv#2604

Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0

v8.19.0

What's Changed

• fix prototype pollution via format keyword using $data ref by @​epoberezkin in ajv-validator/ajv#2607

Full Changelog: ajv-validator/ajv@v8.18.0...v8.19.0

Commits

• 0fba0b8 8.20.0
• 9caf8d6 fix: add ES2022.RegExp for RegExpIndicesArray; fixes ajv-validator/ajv#2603 (...
• 2065350 fix: add support for node 22/24, drop node 16/21 (#2580)
• 154b58d 8.19.0
• e8d2bdc test/fix prototype pollution via $data ref with format keyword (#2607)
• See full diff in compare view

Updates semver from 7.7.4 to 7.8.5

Release notes

Sourced from semver's releases.

v7.8.5

7.8.5 (2026-06-19)

Bug Fixes

• 9c8692a #878 include prereleases in tilde range lower bound with includePrerelease (#878) (@​chatman-media)

v7.8.4

7.8.4 (2026-06-09)

Bug Fixes

• e583226 #874 reject numeric segments after x-ranges (@​pupuking723)

v7.8.3

7.8.3 (2026-06-08)

Bug Fixes

• 046da7f #872 align caret includePrerelease lower bounds (#872) (@​wayyoungboy)

Chores

• 3485dda #866 bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) (@​dependabot[bot])

v7.8.2

7.8.2 (2026-06-04)

Bug Fixes

• bea6028 #870 increment dotted prerelease identifiers (#870) (@​liuzemei, @​SheldonNeo)

v7.8.1

7.8.1 (2026-05-21)

Bug Fixes

• 17aa702 #869 strip build metadata before comparator trimming (#869) (@​owlstronaut)
• 5f3ca13 #867 handle prerelease bounds in subset (#867) (@​puneetdixit200, Puneet Dixit)

v7.8.0

7.8.0 (2026-05-08)

Features

• 0d0a0a2 #855 Add truncate function (#855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #853 fix typos in documentation (#853) (@​ankitkumar572005)
• 37776c3 #846 fix BNF grammar to distinguish prerelease from build identifiers (#846) (@​abhu85, @​claude)

Chores

• 9542e09 #860 template-oss-apply (@​owlstronaut)
• 937bc2c #860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#852) (@​dependabot[bot], @​npm-cli-bot)

Changelog

Sourced from semver's changelog.

7.8.5 (2026-06-19)

Bug Fixes

• 9c8692a #878 include prereleases in tilde range lower bound with includePrerelease (#878) (@​chatman-media)

7.8.4 (2026-06-09)

Bug Fixes

• e583226 #874 reject numeric segments after x-ranges (@​pupuking723)

7.8.3 (2026-06-08)

Bug Fixes

• 046da7f #872 align caret includePrerelease lower bounds (#872) (@​wayyoungboy)

Chores

• 3485dda #866 bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) (@​dependabot[bot])

7.8.2 (2026-06-04)

Bug Fixes

• bea6028 #870 increment dotted prerelease identifiers (#870) (@​liuzemei, @​SheldonNeo)

7.8.1 (2026-05-21)

Bug Fixes

• 17aa702 #869 strip build metadata before comparator trimming (#869) (@​owlstronaut)
• 5f3ca13 #867 handle prerelease bounds in subset (#867) (@​puneetdixit200, Puneet Dixit)

7.8.0 (2026-05-08)

Features

• 0d0a0a2 #855 Add truncate function (#855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #853 fix typos in documentation (#853) (@​ankitkumar572005)
• 37776c3 #846 fix BNF grammar to distinguish prerelease from build identifiers (#846) (@​abhu85, @​claude)

Chores

• 9542e09 #860 template-oss-apply (@​owlstronaut)
• 937bc2c #860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#852) (@​dependabot[bot], @​npm-cli-bot)

Commits

• 6e05b76 chore: release 7.8.5 (#879)
• 9c8692a fix: include prereleases in tilde range lower bound with includePrerelease (#...
• 8640bd6 chore: release 7.8.4 (#875)
• e583226 fix: reject numeric segments after x-ranges
• 6b77aa8 chore: release 7.8.3 (#873)
• 3485dda chore: bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#866)
• 046da7f fix: align caret includePrerelease lower bounds (#872)
• efafcf8 chore: release 7.8.2 (#871)
• bea6028 fix: increment dotted prerelease identifiers (#870)
• 7641608 chore: release 7.8.1 (#868)
• Additional commits viewable in compare view

Updates ipaddr.js from 2.2.0 to 2.5.0

Changelog

Sourced from ipaddr.js's changelog.

2.5.0 - 2026-08-04

• remove ipaddr.min.js, end users must provide own minification/bundling
• fix: compress the leftmost zero run in toString (RFC 5952, 4.2.3)
• fix: strict IPv6 validation — reject :: with zero compression and hextets >4 hex digits
• fix: reject non-numeric prefix length in subnetMaskFromPrefixLength
• fix: compress trailing zero run in toString when a zoneIndex is present
• fix: throw a descriptive error for malformed input in IPv6.parse

2.4.0 - 2026-05-03

• remove Bower support
• add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges

2.3.0 - 2025-11-27

• add isValidCIDRFourPartDecimal helper for IPv4 CIDR in four-part decimal form
• upgrade eslint dev dependency to v9
• remove duplicated LICENSE entry from published files list

Commits

• See full diff in compare view

Updates acorn from 8.16.0 to 8.18.0

Commits

• d788421 Mark version 8.18.0
• b61cb9a Add startLocation option
• c8d515c Don't compute curLine when locations are off
• a7bd3cd Reject an unparenthesized arrow function as the left operand of **
• b7c31b6 Fix mistake in previous patch
• 5c4af50 Avoid scanning from start of document in loose parser's resetTo
• 5b9d16c Mark version 8.17.0