Bump the code-management group across 1 directory with 3 updates by dependabot[bot] · Pull Request #1130 · ChainFuse/packages

dependabot · 2026-10-20T19:33:36Z

Bumps the code-management group with 3 updates in the / directory: eslint, prettier and typescript-eslint.

Updates eslint from 10.12.0 to 10.13.0

Release notes

v10.13.0

Features

48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)

a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)

66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

4783a68 docs: Update README (GitHub Actions Bot)

43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])

95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)

317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)

b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)

47b7063 chore: update dependency @eslint/json to ^2.1.1 (#21398) (renovate[bot])

e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

4637f98 10.13.0
96df05c Build: changelog update for 10.13.0
4783a68 docs: Update README
b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
317fcb3 chore: update ecosystem plugins (#21409)
48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
43f0ac9 docs: clarify parameter description in getText (#21287)
a39d9fb feat: add globalThis to no-obj-calls (#21382)
b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
Additional commits viewable in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

1172b82 Release 3.9.10
d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
953b908 Bump Prettier dependency to 3.9.9
ad8a6bf Clean changelog_unreleased
See full diff in compare view

Updates typescript-eslint from 8.71.1 to 8.72.0

Release notes

Sourced from typescript-eslint's releases.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

eslint-plugin: lazy load rules (#13010)

eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)

typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)

eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)

eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)

eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)

eslint-plugin: [require-array-sort-compare] check tuples (#13058)

eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)

type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)

typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

Evyatar Daud @StyleShit

Junichiro Kasuya @jksy

Mitch Fultz @fitchmultz

Shaan GS @ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

8.71.2 (2026-10-12)

🩹 Fixes

eslint-plugin: [no-unused-vars] avoid false-positives when not using our parser (#12989)

eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type templates (#12974)

eslint-plugin: [no-unused-vars] ignore type-only refs for after-used (#12977)

eslint-plugin: [no-unnecessary-type-parameters] parenthesize constraint in optional tuple elements (#12995)

eslint-plugin: [prefer-optional-chain] safe fix when the chain ends with a strict null comparison (#12805)

type-utils: match linked packages and packages with missing version in TypeOrValueSpecifier (#12948)

❤️ Thank You

Abraham Guo

Brad Zacher @bradzacher

Evyatar Daud @StyleShit

Josh Goldberg

Vinccool96

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

a4c2603 chore(release): publish 8.72.0
7488d68 chore(release): publish 8.71.2
See full diff in compare view

claude

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

changeset-bot · 2026-10-20T19:33:44Z

🦋 Changeset detected

Latest commit: 6d19d76

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@chainfuse/ai-tools	Patch
@chainfuse/helpers	Patch
@chainfuse/types	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-10-20T19:33:57Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@typescript-eslint/eslint-plugin

8.72.0

Unknown

npm/@typescript-eslint/parser

8.72.0

Unknown

npm/@typescript-eslint/project-service

8.72.0

Unknown

npm/@typescript-eslint/scope-manager

8.72.0

Unknown

npm/@typescript-eslint/tsconfig-utils

8.72.0

Unknown

npm/@typescript-eslint/type-utils

8.72.0

Unknown

npm/@typescript-eslint/types

8.72.0

Unknown

npm/@typescript-eslint/typescript-estree

8.72.0

Unknown

npm/@typescript-eslint/utils

8.72.0

Unknown

npm/@typescript-eslint/visitor-keys

8.72.0

Unknown

npm/eslint

10.13.0

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 20/23 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

npm/ignore

7.0.13

🟢 4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	⚠️ 2	Found 6/24 approved changesets -- score normalized to 2
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 9	license file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/prettier

3.9.10

🟢 6.1

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 4	Found 9/19 approved changesets -- score normalized to 4
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/typescript-eslint

8.72.0

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 8	Found 17/21 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 3	SAST tool is not run on all commits -- score normalized to 3

Scanned Files

package-lock.json

socket-security · 2026-10-20T19:34:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@8.71.1 ⏵ 8.72.0
	eslint@10.12.0 ⏵ 10.13.0	⁺¹
	prettier@3.9.9 ⏵ 3.9.10

View full report

socket-security · 2026-10-20T19:34:09Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	Potential code anomaly (AI signal): npm `prettier` is 60.0% likely to have a medium risk anomaly Notes: No direct evidence of embedded malware (no eval/new Function, no credential theft, no obvious backdoor/persistence, no explicit network exfiltration) is visible in this fragment. The dominant security concern is supply-chain/execution risk: the code dynamically imports and executes formatter plugins based on user/config-supplied plugin identifiers and resolution rooted at process.cwd(). Additionally, it can read/write local files (including writing formatted output back to caller-specified paths) and uses predictable temp JSON files that may be susceptible to interference in shared environments. Security posture depends heavily on whether plugin inputs and file paths are trusted/validated and whether dependency/plugin resolution is constrained. Confidence: 0.60 Severity: 0.55 From: package-lock.json → `npm/prettier@3.9.10` ℹ Read more on: This package \| This alert \| What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/prettier@3.9.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block

View full report

Bumps the code-management group with 3 updates in the / directory: [eslint](https://github.com/eslint/eslint), [prettier](https://github.com/prettier/prettier) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `eslint` from 10.12.0 to 10.13.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.13.0) Updates `prettier` from 3.9.9 to 3.9.10 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.9...3.9.10) Updates `typescript-eslint` from 8.71.1 to 8.72.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: code-management - dependency-name: prettier dependency-version: 3.9.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: code-management - dependency-name: typescript-eslint dependency-version: 8.72.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: code-management ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 20, 2026

claude Bot reviewed Oct 20, 2026

View reviewed changes

github-actions Bot added the semver-minor label Oct 20, 2026

demosjarco force-pushed the main branch from 997c2cc to 6e14e35 Compare October 20, 2026 19:34

dependabot Bot force-pushed the dependabot/npm_and_yarn/code-management-d6fe7b97e2 branch 2 times, most recently from 8553527 to 840780f Compare October 20, 2026 20:10

dependabot Bot force-pushed the dependabot/npm_and_yarn/code-management-d6fe7b97e2 branch from b880552 to 49bb3f1 Compare October 20, 2026 20:16

Updated changeset

6d19d76

demosjarco merged commit 32396d9 into main Oct 20, 2026
4 of 5 checks passed

demosjarco deleted the dependabot/npm_and_yarn/code-management-d6fe7b97e2 branch October 20, 2026 20:20

github-actions Bot mentioned this pull request Oct 20, 2026

Version Packages #1128

Merged

Navigation Menu

Repository navigation

Bump the code-management group across 1 directory with 3 updates - #1130

Bump the code-management group across 1 directory with 3 updates#1130
demosjarco merged 2 commits into
mainfrom
dependabot/npm_and_yarn/code-management-d6fe7b97e2

dependabot Bot commented on behalf of github Oct 20, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

changeset-bot Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v10.13.0

Features

Bug Fixes

Documentation

Chores

3.9.10

3.9.10

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

🩹 Fixes

❤️ Thank You

v8.71.2

8.71.2 (2026-10-12)

🩹 Fixes

❤️ Thank You

8.72.0 (2026-10-19)

8.71.2 (2026-10-12)

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Claude Code Review

Uh oh!

changeset-bot Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

socket-security Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 20, 2026 •

edited

Loading

Markdown: Update `micromark-extension-gfm-table` to fix the table parse issue on performance (#20266 by `@fisker`)

changeset-bot Bot commented Oct 20, 2026 •

edited

Loading

github-actions Bot commented Oct 20, 2026 •

edited

Loading

socket-security Bot commented Oct 20, 2026 •

edited

Loading

socket-security Bot commented Oct 20, 2026 •

edited

Loading