build(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates

[dependabot]

Bumps the dev-dependencies group with 9 updates in the / directory:

Package	From	To
@bosonprotocol/common	1.32.2	1.33.0
@eslint/eslintrc	3.3.5	3.3.6
eslint	10.3.0	10.7.0
ethers	6.16.0	6.17.0
globals	17.6.0	17.7.0
hardhat	2.28.6	2.29.0
prettier	3.8.3	3.9.6
simple-statistics	7.8.9	7.9.3
solhint	6.2.1	6.2.3

Updates @bosonprotocol/common from 1.32.2 to 1.33.0

Release notes

Sourced from @​bosonprotocol/common's releases.

@​bosonprotocol/common@​1.33.0

1.33.0 (2026-06-05)

Features

• [protocol upgrade v2.5.1] - add support for ERC3009, ERC2612, and Permit2 token transfers (#1023) (15b59d5)
• upgrade protocol 2.5.1 rc.1 no new features (#1022) (3a59b65)
• upgrade protocol to 2.5.1-rc.2 (ee0aaed) (#1030) (1d74934)

Commits

• 7f00570 chore(release): publish latest [skip ci]
• d1f88fe chore(release): publish alpha [skip ci]
• 1f8bca7 ci: disable setup-node npm cache + add job timeouts (#1035)
• 5207679 fix: short-circuit ensureAllowance when returnTxInfo is set (#1034)
• a0c7a5b chore(release): publish alpha [skip ci]
• f0cee5b test: unskip e2e meta-tx transferAuthorizations tests (#1031)
• 396fa14 chore(release): publish alpha [skip ci]
• 3d1ac4c feat: drop transferAuthorizationQueue wrapper and add DAI permit (#1029)
• c84517c chore(release): publish alpha [skip ci]
• 1d74934 feat: upgrade protocol to 2.5.1-rc.2 (ee0aaed) (#1030)
• Additional commits viewable in compare view

Updates @eslint/eslintrc from 3.3.5 to 3.3.6

Release notes

Sourced from @​eslint/eslintrc's releases.

eslintrc: v3.3.6

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

Changelog

Sourced from @​eslint/eslintrc's changelog.

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

Commits

• b433a22 chore: release 3.3.6 🚀 (#236)
• 0c5de74 fix: update js-yaml to 4.3.0 to address security vulnerability (#235)
• 94837a4 docs: Update README sponsors
• dbae1a1 docs: Update README sponsors
• 19fe72a docs: Update README sponsors
• 92ebd17 docs: Update README sponsors
• 3ba4c8c ci: add Node.js 26 to CI (#231)
• f8d268a docs: Update README sponsors
• 6e20867 docs: Update README sponsors
• 6d722b6 docs: Update README sponsors
• Additional commits viewable in compare view

Updates eslint from 10.3.0 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

... (truncated)

Commits

• fabd99b 10.7.0
• 37c5e75 Build: changelog update for 10.7.0
• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076)
• 81a4774 chore: updates for v9.39.5 release
• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071)
• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032)
• c30d808 docs: Update README
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067)
• Additional commits viewable in compare view

Updates ethers from 6.16.0 to 6.17.0

Release notes

Sourced from ethers's releases.

ethers/v6.17.0 (2026-06-18 00:49)

• Add requestRate throttle to calls (b48bfe3).
• Added provider requestRate throttle support (b74b6d3).
• Disable AlchemyProvider which does not provide the necessary API capacity for tests (1523ca8).
• Map ResolverNotFound error to null for reverse lookup (d07cfb6).
• Use bigint for coinType instead of number values (4f6ec03).
• Updated AlchemyProvider endpoints for BNB (9bec2f9).
• Added basic ENSv2 tests and fixed issues with EVM cointypes (0e9a73d).
• Adding ENSv2 integrations from adraffy (a2d0af4).
• Update Blockscout deffault API key and links (5647ae3).
• Added transactionsRoot to Block (#5077, #5078; 5bd2ce9).
• Preserve 301/302 method and support 307/308 (#3106, #5115; 999af5f).
• Fix maxFeePerGas property for EtherscanProvider transactions (#5080; ca45d23).
• Added rich inspection for Network and Plugins (f2ffb86).
• Tweaking API for Universal Resolver to be completely backward compatible (9a5c4b5).
• Updated ENS Universal Resolver to latest API (0b3b12b).
• Added CCIP to ENS Universal Resolver reverse resolution (982eef2).
• Added reverse lookup for ENS UniversalResolver (9a9a11d).
• Initial forward resolution using ENS UniversalResolver (51df7b9).

Changelog

Sourced from ethers's changelog.

ethers/v6.17.0 (2026-06-17 23:50)

• Add requestRate throttle to calls (b48bfe3).
• Added provider requestRate throttle support (b74b6d3).
• Disable AlchemyProvider which does not provide the necessary API capacity for tests (1523ca8).
• Map ResolverNotFound error to null for reverse lookup (d07cfb6).
• Use bigint for coinType instead of number values (4f6ec03).
• Updated AlchemyProvider endpoints for BNB (9bec2f9).
• Added basic ENSv2 tests and fixed issues with EVM cointypes (0e9a73d).
• Adding ENSv2 integrations from adraffy (a2d0af4).
• Update Blockscout deffault API key and links (5647ae3).
• Added transactionsRoot to Block (#5077, #5078; 5bd2ce9).
• Preserve 301/302 method and support 307/308 (#3106, #5115; 999af5f).
• Fix maxFeePerGas property for EtherscanProvider transactions (#5080; ca45d23).
• Added rich inspection for Network and Plugins (f2ffb86).
• Tweaking API for Universal Resolver to be completely backward compatible (9a5c4b5).
• Updated ENS Universal Resolver to latest API (0b3b12b).
• Added CCIP to ENS Universal Resolver reverse resolution (982eef2).
• Added reverse lookup for ENS UniversalResolver (9a9a11d).
• Initial forward resolution using ENS UniversalResolver (51df7b9).

Commits

• 3ea4c22 admin: updated dist files
• 2d35b6a docs: fix property access order for Flatworm
• b48bfe3 Add requestRate throttle to calls.
• 39f5ce1 tests: add INFURA_APIKEY for docs and workflows
• 96bd29c tests: added provider throttling to test suites
• b74b6d3 Added provider requestRate throttle support.
• 1523ca8 Disable AlchemyProvider which does not provide the necessary API capacity for...
• d07cfb6 Map ResolverNotFound error to null for reverse lookup.
• c32c542 docs: fix typo in config for INFURA API key
• 7c6b840 admin: include INFURA_APIKEY in docs generation to resolve throttling
• Additional commits viewable in compare view

Updates globals from 17.6.0 to 17.7.0

Release notes

Sourced from globals's releases.

v17.7.0

• Update globals (2026-06-22) (#345) 33b75f9

---

sindresorhus/globals@v17.6.0...v17.7.0

Commits

• a19670c 17.7.0
• 9611620 Update actions (#346)
• 33b75f9 Update globals (2026-06-22) (#345)
• 887dd52 Fix build script (#344)
• See full diff in compare view

Updates hardhat from 2.28.6 to 2.29.0

Release notes

Sourced from hardhat's releases.

Hardhat v2.29.0

This is a small Hardhat 2 release that upgrades the version of Mocha to make it compatible with Node 26, and uses a newer version of typescript when initializing projects.

Changes

• a81ad1d: Upgrade Mocha to version ^11.1.0 to make it compatible with Node 26.
• 6ea5832: Update the initialization of new projects to use a newer typescript

Commits

• See full diff in compare view

Updates prettier from 3.8.3 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

3.8.4

• Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (prettier/prettier#17746 by @​byplayer)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Updates simple-statistics from 7.8.9 to 7.9.3

Release notes

Sourced from simple-statistics's releases.

v7.9.3

Patch Changes

• 2a98671: Mark the package as "type": "module" and rename the CommonJS bundle to dist/simple-statistics.cjs. Consumers resolve through the exports map, so both import "simple-statistics" and require("simple-statistics") keep working unchanged — only the internal CJS bundle path moved. (Code that hard-coded the deep path simple-statistics/dist/simple-statistics.js, bypassing the package entry points, should switch to the package name or the .cjs path.)

v7.9.2

Patch Changes

• d571a60: Fix quantile() bug when an array was provided as the second argument

  Thanks Alexander Kireyev for the identification and fix.

v7.9.1

Patch Changes

• 9c1bb2f: fix: gamma() no longer infinitely recurses for 0 < n < 1

v7.9.0

Minor Changes

• b7b2053: Add weighted mean, weighted variance, weighted standard deviation, and weighted quantile.

Changelog

Sourced from simple-statistics's changelog.

7.9.3

Patch Changes

• 2a98671: Mark the package as "type": "module" and rename the CommonJS bundle to dist/simple-statistics.cjs. Consumers resolve through the exports map, so both import "simple-statistics" and require("simple-statistics") keep working unchanged — only the internal CJS bundle path moved. (Code that hard-coded the deep path simple-statistics/dist/simple-statistics.js, bypassing the package entry points, should switch to the package name or the .cjs path.)

7.9.2

Patch Changes

• d571a60: Fix quantile() bug when an array was provided as the second argument

  Thanks Alexander Kireyev for the identification and fix.

7.9.1

Patch Changes

• 9c1bb2f: fix: gamma() no longer infinitely recurses for 0 < n < 1

7.9.0

Minor Changes

• b7b2053: Add weighted mean, weighted variance, weighted standard deviation, and weighted quantile.

Commits

• f9d368f Version Packages (#808)
• 2a98671 Modernize test setup, switch the package to ESM (#807)
• 5715425 Version Packages (#806)
• d571a60 Fix quantile() returning wrong values for some requested quantile sets (#805)
• 17ba2f9 Version Packages (#801)
• 0102f1b Bump biome, sort imports, update deps (#802)
• 9c1bb2f fix: gamma() no longer infinitely recurses for 0 < n < 1 (#800)
• b963ea8 Version Packages (#797)
• 72569e8 build(deps-dev): bump @​rollup/plugin-terser from 0.4.4 to 1.0.0 (#794)
• bdcbf21 build(deps-dev): bump tap from 21.6.2 to 21.7.4 (#793)
• Additional commits viewable in compare view

Updates solhint from 6.2.1 to 6.2.3

Release notes

Sourced from solhint's releases.

v6.2.3

[6.2.3] - 2026-06-19

🛠️ Fix: Dowser poster added.

🧹 Chore: bump js-yaml from 4.1.1 to 4.2.0

v6.2.2

[6.2.2] - 2026-06-14

🧹 Chore: Dowser poster added. Solhint needs funds to keep growing

🧹 Chore: bump fast-uri from 3.0.6 to 3.1.2

🧹 Chore: bump lodash from 4.17.23 to 4.18.1

🛠️ Fix: Removed ajv-errors due to (#750)

🆕 Rule: added no-unchecked-calls Check return value of low-level calls (call, staticcall, delegatecall)

Changelog

Sourced from solhint's changelog.

[6.2.3] - 2026-06-19

🛠️ Fix: Dowser poster added.

🧹 Chore: bump js-yaml from 4.1.1 to 4.2.0

[6.2.2] - 2026-06-14

🧹 Chore: Dowser poster added. Solhint needs funds to keep growing

🧹 Chore: bump fast-uri from 3.0.6 to 3.1.2

🧹 Chore: bump lodash from 4.17.23 to 4.18.1

🛠️ Fix: Removed ajv-errors due to (#750)

🆕 Rule: added no-unchecked-calls Check return value of low-level calls (call, staticcall, delegatecall)

Commits

• 1403d10 Merge pull request #776 from protofire/develop
• ba5359c Merge pull request #775 from protofire/dependabot/npm_and_yarn/js-yaml-4.2.0
• fe87101 Merge branch 'develop' into dependabot/npm_and_yarn/js-yaml-4.2.0
• f102c6b fix: bump js-yaml
• 2d6b244 chore(deps): bump js-yaml from 4.1.1 to 4.2.0
• 8d02adb Merge pull request #774 from protofire/add-dowser-poster1.2
• ab2897e fix: e2e offeset position
• 2d12f70 fix: external poster
• b8633d2 fix: external poster
• f2164f3 Merge pull request #773 from protofire/develop
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
hardhat	[>= 3.a, < 4]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Auto approved automated PR