chore(deps-dev): bump the development group across 1 directory with 6 updates

[dependabot]

Bumps the development group with 6 updates in the / directory:

Package	From	To
@iconify-json/fluent	1.2.54	1.2.57
@types/node	26.1.2	26.4.0
@types/react-dom	19.2.4	19.2.5
cspell	10.0.1	10.1.1
lint-staged	17.2.0	17.4.1
postcss-nested	8.0.0	8.0.1

Updates @iconify-json/fluent from 1.2.54 to 1.2.57

Commits

• See full diff in compare view

Updates @types/node from 26.1.2 to 26.4.0

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

• See full diff in compare view

Updates cspell from 10.0.1 to 10.1.1

Release notes

Sourced from cspell's releases.

v10.1.1

Fixes

fix: Do not load .pnp.js files when untrusted (#9064)

---

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#9055)

Update Dictionaries (main)

Summary

 packages/cspell-bundled-dicts/package.json | 2 +-
 pnpm-lock.yaml                             | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

---

v10.1.0

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.1.1 (2026-08-25)

Fixes

fix: Do not load .pnp.js files when untrusted (#9064)

---

Dictionary Updates

fix: Workflow Bot -- Update Dictionaries (main) (#9055)

Update Dictionaries (main)

Summary

 packages/cspell-bundled-dicts/package.json | 2 +-
 pnpm-lock.yaml                             | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

---

v10.1.0 (2026-08-22)

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:

</tr></table> 

... (truncated)

Commits

• bc3bc22 v10.1.1
• 77992dd chore: Prepare Release v10.1.1 (auto-deploy) (#9043)
• 8ca97eb fix: add publishConfig with provenance to cspell package (#9041)
• 401518c v10.1.0
• acf8449 chore: Prepare Release v10.1.0 (auto-deploy) (#8883)
• 3078371 fix: Workflow Bot -- Update Dictionaries (main) (#9024)
• f557824 ci: Workflow Bot -- Update ALL Dependencies (main) (#9014)
• 1c11da6 ci: Workflow Bot -- Update ALL Dependencies (main) (#8970)
• 67448c8 chore: bump the development-dependencies group across 1 directory with 16 upd...
• ce30dc7 chore: bump chalk from 5.6.2 to 6.0.0 (#8973)
• Additional commits viewable in compare view

Updates lint-staged from 17.2.0 to 17.4.1

Release notes

Sourced from lint-staged's releases.

v17.4.1

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

• #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

• #1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.4.1

Patch Changes

• #1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes

• #1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:

  // lint-staged.config.ts
  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': ['prettier --check', 'eslint'],
  })

• #1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

  By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.

Patch Changes

• #1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

• #1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    '*': [

... (truncated)

Commits

• d0c1517 Merge pull request #1841 from lint-staged/changeset-release/main
• f061335 chore(changeset): release
• d2721af Merge pull request #1840 from lint-staged/updates
• efe5b63 ci: update Changesets action because it failed to publish
• cd76ce3 build: update dependencies
• ea195e1 Merge pull request #1837 from lint-staged/changeset-release/main
• a6a0d61 chore(changeset): release
• 0a09098 Merge pull request #1832 from lint-staged/add-all-flag
• 7fd685b fix: further fix parsing options logic
• 510a27c feat: add --all flag for including all files tracked by Git instead of just...
• Additional commits viewable in compare view

Updates postcss-nested from 8.0.0 to 8.0.1

Release notes

Sourced from postcss-nested's releases.

8.0.1

• Fixed DEP0151 warning in Node.js.

Changelog

Sourced from postcss-nested's changelog.

8.0.1

• Fixed DEP0151 warning in Node.js.

Commits

• 4c48e81 Release 8.0.1 version
• 1586e7b Add exports to package.json
• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​react-dom@​19.2.4 ⏵ 19.2.5	+1		+1
	@​iconify-json/​fluent@​1.2.54 ⏵ 1.2.57	+5			+1
	@​types/​node@​26.1.2 ⏵ 26.4.0	+1		+1
	postcss-nested@​8.0.0 ⏵ 8.0.1				+1
	cspell@​10.0.1 ⏵ 10.1.1				+3
	lint-staged@​17.2.0 ⏵ 17.4.1

View full report

[netlify]

✅ Deploy Preview for expressjscom-preview ready!

Name	Link
🔨 Latest commit	fae144e
🔍 Latest deploy log	https://app.netlify.com/projects/expressjscom-preview/deploys/6a983857635e5400087744ab
😎 Deploy Preview	https://deploy-preview-2500--expressjscom-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 95 (🔴 down 2 from production) Accessibility: 100 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: 80 (no change from production) View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.