chore(deps): bump the dev-dependencies group with 3 updates

[dependabot]

Bumps the dev-dependencies group with 3 updates: firebase-tools, sharp and typescript-eslint.

Updates firebase-tools from 15.20.0 to 15.22.0

Release notes

Sourced from firebase-tools's releases.

v15.22.0

• Added apphosting:secrets:revokeaccess command. (#10669)
• Updated Pub/Sub emulator to version 0.8.33.
• Updated Data Connect emulator to version 3.4.12.
• Fix Data Connect non-deterministic output order of generated SDK files when compiled from multiple GQL source files.
• Optimize Data Connect singular relation filters on PKs to avoid EXISTS subqueries.

v15.21.0

• Fixed an issue where login:*, target:*, and ext:* subcommands were missing from firebase --help.
• Functions can declare additional API dependencies (#10621)
• Added mock Passkey (WebAuthn) support to the Auth emulator. (#10636)
• Fixes spawn activate.bat ENOENT error on Windows when initializing Python functions. (#10608)
• Fixed an issue where Cloud Run rewrites in the Hosting emulator would always hit the live Cloud Run API instead of routing to the local functions emulator. (#10588)
• Removed temporary warning directing Dart functions users to Cloud Console, as Firebase Console now supports Dart functions. (#10584)
• Updated the Firebase Data Connect local toolkit to v3.4.11, which includes the following changes:
  • [changed] Updated the Golang dependency version to 1.25.11.
• Fixed issue where apptesting:execute command rejects documented --test-username, --test-password, and --test-password-file options.
• Updated Web Frameworks to warn about missing SSRF protection config in Angular 22 deploys (#10523)
• Fixed an issue where Astro 6 SSR deploys returned HTTP 500 by preserving the server/ directory in the generated Cloud Function. (#10537)

Commits

• 6c98ce4 15.22.0
• df9d6c9 feat: add apphosting secrets revokeaccess command (#10669)
• a16b455 Release Data Connect Emulator v3.4.12.
• 6b05417 vscode 2.4.1 (#10682)
• ac90030 chore: upgrade js-yaml to v4 and resolve Docker vulnerabilities (#10677)
• 2da66b6 ci: fix storage emulator integration tests on Node 24 (#10641)
• 17eb99b chore: update Pub/Sub emulator to 0.8.33 (#10676)
• b4027fd [firebase-release] Removed change log and reset repo after 15.21.0 release
• feaa5b6 15.21.0
• f6ae3b4 [VSCODE] Fix hover cursor and styling on Configure emulator link (#10623)
• Additional commits viewable in compare view

Updates sharp from 0.35.1 to 0.35.2

Release notes

Sourced from sharp's releases.

v0.35.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

• Bound dilate and erode width to avoid mask-size overflow. #4548 @​metsw24-max

• Verify convolve kernel values are numbers. #4549 @​metsw24-max

v0.35.2-rc.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits

• c9622a3 Release v0.35.2
• cd4568f Upgrade to sharp-libvips v1.3.1
• 78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
• 61210b4 Verify convolve kernel values are numbers (#4549)
• 1cb27dc Prerelease v0.35.2-rc.2
• c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
• 29d1e9e Prerelease v0.35.2-rc.1
• bbba0a1 Improve code bundler support with stub binaries
• ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
• 0f594dd Prerelease v0.35.2-rc.0
• Additional commits viewable in compare view

Updates typescript-eslint from 8.61.0 to 8.61.1

Release notes

Sourced from typescript-eslint's releases.

v8.61.1

8.61.1 (2026-06-15)

🩹 Fixes

• eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#12396, #10577)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#12281)
• eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#12394, #12393)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#12413)
• eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#12388)

❤️ Thank You

• Anas @​anasm266
• Deftera @​Deftera186
• Kirk Waiblinger @​kirkwaiblinger
• lumir
• Sarath Francis @​sarathfrancis90

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.61.1 (2026-06-15)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• aaad718 chore(release): publish 8.61.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions