chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates by dependabot[bot] · Pull Request #391 · openfga/frontend-utils

dependabot · 2026-10-05T02:44:48Z

Bumps the dev-dependencies group with 10 updates in the / directory:

Package	From	To
@openfga/sdk	`0.9.3`	`0.9.7`
@typescript-eslint/eslint-plugin	`8.57.1`	`8.71.1`
@typescript-eslint/parser	`8.57.1`	`8.71.1`
globals	`17.12.0`	`17.13.0`
jest	`30.3.0`	`30.5.2`
jest-util	`30.3.0`	`30.5.1`
monaco-editor	`0.55.1`	`0.57.0`
prettier	`3.8.1`	`3.9.9`
ts-jest	`29.4.6`	`29.4.14`
typescript	`5.9.3`	`7.0.2`

Updates @openfga/sdk from 0.9.3 to 0.9.7

Release notes

Sourced from @openfga/sdk's releases.

v0.9.7

Changed

rework how nock is setup and used to harden tests (#395) (0d20683)

Documentation

update stated node version support (#468) (8ea3346)

What's Changed

chore: pin reusable release please/ pr validator workflows by @SoulPancake in openfga/js-sdk#442

chore(ci): fix npm audit by @SoulPancake in openfga/js-sdk#449

chore(deps): bump the dependencies group across 1 directory with 8 updates by @dependabot[bot] in openfga/js-sdk#444

chore(deps): bump the dependencies group across 1 directory with 4 updates by @dependabot[bot] in openfga/js-sdk#445

chore(ci): group dependabot updates for example projects by @SoulPancake in openfga/js-sdk#450

chore(deps): bump the dependencies group in /example/opentelemetry with 3 updates by @dependabot[bot] in openfga/js-sdk#451

chore(deps): bump the dependencies group with 5 updates by @dependabot[bot] in openfga/js-sdk#453

chore(deps): bump the dependencies group with 5 updates by @dependabot[bot] in openfga/js-sdk#457

chore(deps): bump the dependencies group with 6 updates by @dependabot[bot] in openfga/js-sdk#459

refactor: rework how nock is setup and used to harden tests by @kamilogorek in openfga/js-sdk#395

chore: sync generated code with sdk-generator by @SoulPancake in openfga/js-sdk#454

chore(deps): bump the dependencies group across 1 directory with 3 updates by @dependabot[bot] in openfga/js-sdk#460

chore(deps): bump the dependencies group with 5 updates by @dependabot[bot] in openfga/js-sdk#463

fix(ci): resolve npm audit vulnerabilities by @Siddhant-K-code in openfga/js-sdk#464

chore(deps): bump the dependencies group across 1 directory with 9 updates by @dependabot[bot] in openfga/js-sdk#462

docs: update stated node version support by @ewanharris in openfga/js-sdk#468

chore: replace Jest with Node test runner by @Siddhant-K-code in openfga/js-sdk#466

chore(deps-dev): bump the dependencies group with 4 updates by @dependabot[bot] in openfga/js-sdk#469

release: v0.9.7 by @openfga-releaser-bot[bot] in openfga/js-sdk#470

Full Changelog: openfga/js-sdk@v0.9.7-beta.1...v0.9.7

v0.9.7-beta.1

⚠ BREAKING CHANGES

The $response property type changes from AxiosResponse<T> to FgaResponse<T>. The constructor now accepts an optional HttpClient instead of AxiosInstance. baseOptions.httpAgent/httpsAgent are no longer applicable as fetch handles connection pooling natively.

Changed

replace axios with native fetch (#366) (1af0efd)

What's Changed

chore: update bootstrap sha by @SoulPancake in openfga/js-sdk#419

chore(ci): force tag creation in release config for draft releases by @SoulPancake in openfga/js-sdk#422

chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in openfga/js-sdk#424

... (truncated)

Changelog

Sourced from @openfga/sdk's changelog.

0.9.7 (2026-08-18)

Changed

rework how nock is setup and used to harden tests (#395) (0d20683)

Documentation

update stated node version support (#468) (8ea3346)

0.9.6 (2026-05-11)

Fixed

correctly set default retry params (#394) (6b03882) , Thanks @kamilogorek

prevent token refresh thundering herd (#333) (025346f)

stop mutating token refresh errors into auth errors (#329) (d5cbccb)

0.9.5 (2026-04-10)

Fixed

Correctly set authorization model id when calling batch checks (#372) (bbc8bde)

v0.9.4

v0.9.4 (2026-03-31)

fix(deps): pin axios to 1.14.0 and fix brace-expansion audit vulnerability (#363) - details

Commits

ff0a9f5 release: v0.9.7 (#470)
2978621 chore(deps-dev): bump the dependencies group with 4 updates (#469)
39be98a chore: replace Jest with Node test runner (#466)
8ea3346 docs: update stated node version support (#468)
ad7a03d chore(deps): bump the dependencies group across 1 directory with 9 updates (#...
36497d6 fix(ci): resolve npm audit vulnerabilities (#464)
8d4cfdd chore(deps): bump the dependencies group with 5 updates (#463)
a301a25 chore(deps): bump the dependencies group across 1 directory with 3 updates (#...
acd4913 chore: sync generated code with sdk-generator (#454)
0d20683 refactor: rework how nock is setup and used to harden tests (#395)
Additional commits viewable in compare view

Updates @typescript-eslint/eslint-plugin from 8.57.1 to 8.71.1

Release notes

Sourced from @typescript-eslint/eslint-plugin's releases.

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)

eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)

eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)

eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)

eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)

eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)

eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)

project-service: throttle cleanup when opening files (#12934)

type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

Diptajoy Mistry @diptomistry

Evyatar Daud @StyleShit

Josh Goldberg

Josh Goldberg ✨

Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)

eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)

eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)

eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

Evyatar Daud @StyleShit

Fatih Çakır @wfatih

Josh Goldberg

Josh Goldberg ✨

Zamiell @Zamiell

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from @typescript-eslint/eslint-plugin's changelog.

8.71.1 (2026-10-05)

🩹 Fixes

eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)

eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)

eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)

eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)

eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)

eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)

eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)

❤️ Thank You

Diptajoy Mistry @diptomistry

Evyatar Daud @StyleShit

Josh Goldberg

Josh Goldberg ✨

Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

🚀 Features

eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)

eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)

eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)

❤️ Thank You

Evyatar Daud @StyleShit

Fatih Çakır @wfatih

Josh Goldberg

Josh Goldberg ✨

Zamiell @Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

... (truncated)

Commits

d57b8da chore(release): publish 8.71.1
e8593b2 fix(eslint-plugin): [no-unnecessary-type-parameters] count instantiated mappe...
2211d3f fix(eslint-plugin): [prefer-optional-chain] check the constrained type (#12953)
ba9c0f1 fix(eslint-plugin): [no-confusing-void-expression] don't autofix when declare...
466d739 fix(eslint-plugin): [no-unsafe-enum-assignment] skip identical types and boun...
e8c170f fix(eslint-plugin): [require-array-sort-compare] use array argument type cons...
effa652 fix(eslint-plugin): [no-unused-vars] report usedOnlyAsType for partially expo...
9fbab43 fix(eslint-plugin): [no-misused-promises] skip argument checks for calls with...
3ab28b1 chore(eslint-plugin): re-enable plugin-test-formatting in all tests (#12950)
8695664 chore(release): publish 8.71.0
Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.57.1 to 8.71.1

Release notes

Sourced from @typescript-eslint/parser's releases.

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)

eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)

eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)

eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)

eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)

eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)

eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)

project-service: throttle cleanup when opening files (#12934)

type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

Diptajoy Mistry @diptomistry

Evyatar Daud @StyleShit

Josh Goldberg

Josh Goldberg ✨

Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)

eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)

eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)

eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

Evyatar Daud @StyleShit

Fatih Çakır @wfatih

Josh Goldberg

Josh Goldberg ✨

Zamiell @Zamiell

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from @typescript-eslint/parser's changelog.

8.71.1 (2026-10-05)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.67.0 (2026-08-10)

... (truncated)

Commits

d57b8da chore(release): publish 8.71.1
8695664 chore(release): publish 8.71.0
23d38ce chore(release): publish 8.70.1
7ee7608 chore(release): publish 8.70.0
9a6e546 chore(release): publish 8.69.0
8f4e00a chore(release): publish 8.68.0
55f6d5d chore: enable source maps (#12677)
20a261f chore(release): publish 8.67.0
3b155bb chore: use typescript 7 for typechecking (#12601)
e51b11b chore(release): publish 8.66.0
Additional commits viewable in compare view

Updates globals from 17.12.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

Update globals (2026-10-01) (#354) b007369

sindresorhus/globals@v17.12.0...v17.13.0

Commits

ce512bc 17.13.0
b007369 Update globals (2026-10-01) (#354)
16cb1fe Meta tweaks
See full diff in compare view

Updates jest from 30.3.0 to 30.5.2

Release notes

Sourced from jest's releases.

v30.5.2

Features

[@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

[jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)

[jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)

[@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

New Contributors

@winklemad made their first contribution in jestjs/jest#16345

Full Changelog: jestjs/jest@v30.5.1...v30.5.2

v30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

@HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @timkindberg (#16053):
const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
</tr></table> 

... (truncated)

Changelog

Sourced from jest's changelog.

30.5.2

Features

[@jest/transform] Strip TypeScript types with Node when no transformer claims a .ts, .mts or .cts file (#16421)

Fixes

[jest-core, jest-haste-map, jest-transform] Keep require('../package.json') external when bundling, so jest --version and the transform and haste-map cache keys report the released version instead of the previous one (#16422)

[jest-each] Escape a table row's keys before building the $variable interpolation RegExp, so a column name such as count(*) no longer fails the whole table with Invalid regular expression, and a . or | in a column name is matched literally (#16345)

[@jest/source-map] Resolve absolute Windows paths in a source map's sources and sourceRoot again, instead of appending them to the transformed file's directory (#16439)

30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

30.5.0

Features

[@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#16053)

[@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#16053)

[jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (#16259)

[jest-circus, jest-environment, jest-runtime, jest-types] Add describe-level retries via jest.retryTimes(..., {entireDescribe: true}) (#16322)

[jest-circus, jest-message-util, jest-reporters, jest-types] Add retryMessages to AssertionResult and export formatErrorStack, so the retry log renders nested cause and AggregateError sections with code frames instead of serialized [cause]:/[errors]: markers (#16316)

[jest-circus, jest-types] Add unhandledErrorsDetailed to Circus.RunResult, so an unhandled rejection reports its cause chain and AggregateError entries with code frames instead of a pre-serialized stack (#16316)

[jest-haste-map] Replace NodeWatcher and FSEventsWatcher with @parcel/watcher for the non-watchman watch path (#16188)

[jest-resolve] Bump unrs-resolver to 1.12.1, remove jest-pnp-resolver and unnecessary checks (#15721)

[jest-resolve] Honor Node's --preserve-symlinks / NODE_PRESERVE_SYMLINKS in the default resolver by passing symlinks: false to unrs-resolver (#16260)

[jest-runtime] Apply automocking and manual __mocks__ files to synchronously evaluable ESM graphs on Node 24.9+ - static imports, dynamic import() and require() of an ESM file now generate an automock from the real module's namespace instead of failing with "Attempting to import a mock without a factory". Graphs that need async evaluation (top-level await) or an async-only resolver or transformer still throw (#16391)

[jest-runtime] Route process.getBuiltinModule through the sandbox, so it returns the sandbox process and the hooked node:module instead of the host's (#16391)

[jest-runtime] Throw an actionable error from module.register() and module.registerHooks() inside a test - the hooks attached to the loader running Jest itself, never saw the sandboxed requires they were meant for, and stayed registered for every later test file in the worker (#16391)

[jest-runtime] Surface resolution and import-attribute errors in an ESM graph before executing any of its CJS dependencies on Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the legacy loader on older versions keeps its linking-time execution order (#16391)

[jest-runtime] Throw ERR_SOURCE_PHASE_NOT_DEFINED with an actionable message for import source and import.source(), instead of failing at instantiation with V8's bare "Source phase import object is not defined" (#16391)

[jest-runtime] Emit the JSON-without-import-attribute deprecation warning once per test file instead of once per worker, so it is no longer silently swallowed for every file after the first (#16391)

[jest-runtime] Set import.meta.main to true in the test file and false in every module it loads, matching Node 24+ (#16367)

[jest-runtime] Resolve the module-sync export condition, so a package that exposes its ESM entry point for require() loads the same file Node would (#16336)

[jest-snapshot] Add external snapshot paths to custom reporter failure details (#16374)

Fixes

... (truncated)

Commits

202dd8a v30.5.2
9ab14fe v30.5.1
912baa3 v30.5.0
b91717a chore: refresh coding agent instructions (#16182)
746f2a0 v30.4.2
b3b4a09 v30.4.1
5cbb21e v30.4.0
db7141a fix: allow collectCoverage and coverageProvider in project config (#16132)
See full diff in compare view

Updates jest-util from 30.3.0 to 30.5.1

Release notes

Sourced from jest-util's releases.

v30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

@HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

v30.5.0

On a personal note: King Harald V of Norway passed away this morning. He ascended the throne 35 years ago, two months before I was born. This release is dedicated to his memory. Hvil i fred 🇳🇴

This is a big release. It touches jest-runtime, jest-resolve and jest-haste-map in many places, and with this many changes there might be regressions 😬. If your suite behaves differently after upgrading, please open an issue.

Highlights

whenCalledWith

Mock functions can now configure return values per argument list, contributed by @timkindberg (#16053):
const fn = jest.fn();
fn.whenCalledWith('apple').mockReturnValue('red');
fn.whenCalledWith('banana').mockReturnValue('yellow');
fn.whenCalledWith(expect.any(Number)).mockReturnValue('numeric');
fn('apple'); // 'red'
fn('banana'); // 'yellow'
fn(42); // 'numeric'
fn('grape'); // undefined
The returned object is a real Mock, so mockReturnValueOnce, mockResolvedValue, mockImplementation etc. all chain here too. Argument slots accept literals or any asymmetric matcher, with the same equality semantics as toHaveBeenCalledWith(). Calls that match nothing fall through to the base mock. See the Mock Functions docs for matching and precedence details.

Describe-level retries

jest.retryTimes() can now retry a whole describe block instead of a single test, contributed by @soltonigiri (#16322). Each attempt reruns the block's beforeAll/afterAll hooks, child tests and nested describes, which helps when tests in a block depend on shared state:
</tr></table> 

... (truncated)

Changelog

Sourced from jest-util's changelog.

30.5.1

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)

[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)

[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)

[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)

[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

30.5.0

Features

[@jest/expect-utils, jest-mock] Add mockFn.whenCalledWith(...args) for configuring return values per argument list, with first-class asymmetric-matcher support (#16053)

[@jest/expect-utils] Export AsymmetricMatcher and FunctionParameters types (previously private to expect) (#16053)

[jest-circus, jest-core, jest-jasmine2, jest-test-result, jest-types] --collectTests now expands test.each/describe.each cases and reports per-status counts (skipped/todo via the new wouldRun flag for selected tests) plus a summary line that match a real run, including under --testNamePattern and .only/fdescribe focus on both the circus and jasmine2 runners (#16259)

[jest-circus, jest-environment, jest-runtime, jest-types] Add describe-level retries via jest.retryTimes(..., {entireDescribe: true}) (#16322)

[jest-circus, jest-message-util, jest-reporters, jest-types] Add retryMessages to AssertionResult and export formatErrorStack, so the retry log renders nested cause and AggregateError sections with code frames instead of serialized [cause]:/[errors]: markers (#16316)

[jest-circus, jest-types] Add unhandledErrorsDetailed to Circus.RunResult, so an unhandled rejection reports its cause chain and AggregateError entries with code frames instead of a pre-serialized stack (#16316)

[jest-haste-map] Replace NodeWatcher and FSEventsWatcher with @parcel/watcher for the non-watchman watch path (#16188)

[jest-resolve] Bump unrs-resolver to 1.12.1, remove jest-pnp-resolver and unnecessary checks (#15721)

[jest-resolve] Honor Node's --preserve-symlinks / NODE_PRESERVE_SYMLINKS in the default resolver by passing symlinks: false to unrs-resolver (#16260)

[jest-runtime] Apply automocking and manual __mocks__ files to synchronously evaluable ESM graphs on Node 24.9+ - static imports, dynamic import() and require() of an ESM file now generate an automock from the real module's namespace instead of failing with "Attempting to import a mock without a factory". Graphs that need async evaluation (top-level await) or an async-only resolver or transformer still throw (#16391)

[jest-runtime] Route process.getBuiltinModule through the sandbox, so it returns the sandbox process and the hooked node:module instead of the host's (#16391)

[jest-runtime] Throw an actionable error from module.register() and module.registerHooks() inside a test - the hooks attached to the loader running Jest itself, never saw the sandboxed requires they were meant for, and stayed registered for every later test file in the worker (#16391)

[jest-runtime] Surface resolution and import-attribute errors in an ESM graph before executing any of its CJS dependencies on Node 24.9+, matching Node's run-nothing-on-a-broken-graph behavior; the legacy loader on older versions keeps its linking-time execution order (#16391)

[jest-runtime] Throw ERR_SOURCE_PHASE_NOT_DEFINED with an actionable message for import source and import.source(), instead of failing at instantiation with V8's bare "Source phase import object is not defined" (#16391)

[jest-runtime] Emit the JSON-without-import-attribute deprecation warning once per test file instead of once per worker, so it is no longer silently swallowed for every file after the first (#16391)

[jest-runtime] Set import.meta.main to true in the test file and false in every module it loads, matching Node 24+ (#16367)

[jest-runtime] Resolve the module-sync export condition, so a package that exposes its ESM entry point for require() loads the same file Node would (#16336)

[jest-snapshot] Add external snapshot paths to custom reporter failure details (#16374)

Fixes

[jest-console, jest-reporters] CustomConsole now buffers console output so TestResult.console is populated for reporters when verbose is enabled, while GitHubActionsReporter avoids replaying buffered output in verbose mode (#16155)

[expect, jest-message-util, jest-pattern, jest-regex-util, jest-util] Revert node: protocol imports to restore webpack/browser-bundle compatibility (#16167)

[expect] Widen toMatchObject and objectContaining parameter type from Record<string, unknown> to object so class instances are accepted (#16196)

[jest-circus] Call a generator test body with the shared test context, so this matches what a regular test function receives (#16347)

[jest-circus] Capture the error listeners of the parent process instead of the in-sandbox process, so listeners registered before the test file survive teardown and sandbox listeners no longer leak onto the parent (#16347)

[jest-circus] Clear currentlyRunningTest after skipped and todo tests (#16342)

[jest-circus] Pre...
Description has been truncated

socket-security · 2026-10-05T02:45:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance	License
jest@30.3.0 ⏵ 30.5.2	⁺¹	⁺¹	⁺³
@typescript-eslint/parser@8.57.1 ⏵ 8.71.1		⁺¹
@typescript-eslint/eslint-plugin@8.57.1 ⏵ 8.71.1		⁺¹
globals@17.12.0 ⏵ 17.13.0		⁺¹	^-1
typescript@5.9.3 ⏵ 7.0.2		^-1		⁺¹⁰
monaco-editor@0.55.1 ⏵ 0.57.0		⁺¹
jest-util@30.3.0 ⏵ 30.5.1		⁺¹	⁺³
ts-jest@29.4.6 ⏵ 29.4.14		⁺¹
@openfga/sdk@0.9.3 ⏵ 0.9.7	⁺¹	⁺¹	⁺⁵
prettier@3.8.1 ⏵ 3.9.9		⁺¹	^-1

View full report

socket-security · 2026-10-05T02:45:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	License policy violation: npm `monaco-editor` under CC-BY-4.0 License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/ThirdPartyNotices.txt) From: package-lock.json → `npm/monaco-editor@0.57.0` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/monaco-editor@0.57.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `typescript` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-aix-ppc64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-aix-ppc64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-darwin-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-darwin-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-darwin-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-darwin-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-freebsd-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-freebsd-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-freebsd-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-freebsd-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-linux-arm` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-arm@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-linux-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-linux-loong64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-loong64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-linux-mips64el` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-mips64el@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-linux-ppc64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-ppc64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-linux-riscv64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-riscv64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-linux-s390x` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-s390x@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-linux-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-linux-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-linux-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-netbsd-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-netbsd-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-netbsd-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-netbsd-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-netbsd-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-netbsd-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-openbsd-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-openbsd-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-openbsd-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-openbsd-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-openbsd-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-openbsd-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-sunos-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-sunos-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-sunos-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-win32-arm64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-win32-arm64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-win32-arm64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `@typescript/typescript-win32-x64` under MIT-Khronos-old License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/NOTICE.txt) From: package-lock.json → `npm/typescript@7.0.2` → `npm/@typescript/typescript-win32-x64@7.0.2` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@typescript/typescript-win32-x64@7.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

Siddhant-K-code

it's far bigger of change then it looks, will need to take a look more carefully!

…ith 10 updates Bumps the dev-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@openfga/sdk](https://github.com/openfga/js-sdk) | `0.9.3` | `0.9.7` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.57.1` | `8.71.1` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.57.1` | `8.71.1` | | [globals](https://github.com/sindresorhus/globals) | `17.12.0` | `17.13.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.3.0` | `30.5.2` | | [jest-util](https://github.com/jestjs/jest/tree/HEAD/packages/jest-util) | `30.3.0` | `30.5.1` | | [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.55.1` | `0.57.0` | | [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.9.9` | | [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.6` | `29.4.14` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` | Updates `@openfga/sdk` from 0.9.3 to 0.9.7 - [Release notes](https://github.com/openfga/js-sdk/releases) - [Changelog](https://github.com/openfga/js-sdk/blob/main/CHANGELOG.md) - [Commits](openfga/js-sdk@v0.9.3...v0.9.7) Updates `@typescript-eslint/eslint-plugin` from 8.57.1 to 8.71.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.1/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.57.1 to 8.71.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.1/packages/parser) Updates `globals` from 17.12.0 to 17.13.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.12.0...v17.13.0) Updates `jest` from 30.3.0 to 30.5.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.2/packages/jest) Updates `jest-util` from 30.3.0 to 30.5.1 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.1/packages/jest-util) Updates `monaco-editor` from 0.55.1 to 0.57.0 - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.55.1...v0.57.0) Updates `prettier` from 3.8.1 to 3.9.9 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.1...3.9.9) Updates `ts-jest` from 29.4.6 to 29.4.14 - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](kulshekhar/ts-jest@v29.4.6...v29.4.14) Updates `typescript` from 5.9.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) --- updated-dependencies: - dependency-name: "@openfga/sdk" dependency-version: 0.9.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/parser" dependency-version: 8.71.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: globals dependency-version: 17.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: jest dependency-version: 30.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: jest-util dependency-version: 30.5.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: monaco-editor dependency-version: 0.57.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: ts-jest dependency-version: 29.4.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Siddhant-K-code · 2026-10-12T15:46:03Z

@dependabot rebase

dependabot · 2026-10-12T15:46:09Z

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 5, 2026

dependabot Bot requested review from a team as code owners October 5, 2026 02:44

Siddhant-K-code reviewed Oct 5, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-6e501e95fe branch from 6a9e8b7 to 8c2999c Compare October 12, 2026 14:08

dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-6e501e95fe branch from 8c2999c to 597b027 Compare October 12, 2026 14:13

Navigation Menu

Repository navigation

chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates - #391

chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates#391
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-6e501e95fe

dependabot Bot commented on behalf of github Oct 5, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

Siddhant-K-code left a comment

Uh oh!

Siddhant-K-code commented Oct 12, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.9.7

Changed

Documentation

What's Changed

v0.9.7-beta.1

⚠ BREAKING CHANGES

Changed

What's Changed

0.9.7 (2026-08-18)

Changed

Documentation

0.9.6 (2026-05-11)

Fixed

0.9.5 (2026-04-10)

Fixed

v0.9.4

v0.9.4 (2026-03-31)

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

❤️ Thank You

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

🩹 Fixes

❤️ Thank You

8.71.1 (2026-10-05)

🩹 Fixes

❤️ Thank You

8.71.0 (2026-09-28)

🚀 Features

🩹 Fixes

❤️ Thank You

8.70.1 (2026-09-21)

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

❤️ Thank You

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

🩹 Fixes

❤️ Thank You

8.71.1 (2026-10-05)

8.71.0 (2026-09-28)

8.70.1 (2026-09-21)

8.70.0 (2026-09-07)

8.69.0 (2026-08-31)

8.68.0 (2026-08-24)

8.67.0 (2026-08-10)

v17.13.0

v30.5.2

Features

Fixes

New Contributors

v30.5.1

Fixes

Chore & Maintenance

New Contributors

v30.5.0

Highlights

whenCalledWith

30.5.2

Features

Fixes

30.5.1

Fixes

Chore & Maintenance

30.5.0

Features

Fixes

v30.5.1

Fixes

Chore & Maintenance

New Contributors

v30.5.0

Highlights

dependabot Bot commented on behalf of github Oct 5, 2026 •

edited

Loading

`whenCalledWith`

`whenCalledWith`

socket-security Bot commented Oct 5, 2026 •

edited

Loading

socket-security Bot commented Oct 5, 2026 •

edited

Loading