chore(deps): Bump the npm-minor-patch group across 1 directory with 13 updates

[dependabot]

Bumps the npm-minor-patch group with 13 updates in the / directory:

Package	From	To
@icp-sdk/core	6.0.0	6.1.0
@icp-sdk/icp-cli	1.0.2	1.3.0
@noble/hashes	2.2.0	2.3.0
@x402/core	2.18.0	2.21.0
eslint	10.7.0	10.8.1
lint-staged	17.0.8	17.3.0
prettier	3.9.5	3.9.6
tsx	4.23.1	4.23.12
typescript-eslint	8.64.0	8.66.0
viem	2.55.2	2.55.11
@modelcontextprotocol/sdk	1.29.0	1.30.0
@types/node	26.1.1	26.2.0
@noble/curves	2.2.0	2.3.0

Updates @icp-sdk/core from 6.0.0 to 6.1.0

Release notes

Sourced from @​icp-sdk/core's releases.

v6.1.0 (2026-08-03)

Feat

• Revamp Agent.readState (#1375)

Changelog

Sourced from @​icp-sdk/core's changelog.

v6.1.0 (2026-08-03)

Feat

• Revamp Agent.readState (#1375)

Commits

• cb5e25e chore: release v6.1.0 (#1383)
• 78da43e feat: Revamp Agent.readState (#1375)
• See full diff in compare view

Updates @icp-sdk/icp-cli from 1.0.2 to 1.3.0

Release notes

Sourced from @​icp-sdk/icp-cli's releases.

v1.3.0

Release Notes

• feat: a canister environment variable's value can now be read from a file, by writing var: { path: <file> } in place of var: value. The path resolves against the canister's directory — including in an environment override, matching init_args — and surrounding whitespace is trimmed off the file's contents. The file is read when the project is loaded, so a missing file fails before anything is deployed. icp project bundle writes the value into the bundled manifest inline, rejecting a file outside the project as it does for other manifest file references.
• fix: icp network start now explains why a Docker-based network failed to come up. A container that exited before the network was ready was reported as failed to watch docker container <id> for exit with an empty cause, discarding the actual reason (e.g. the gateway port already being taken); the container's output is now attached to the error.
• feat: Docker-based networks now show the launcher's output like non-containerized ones do. In the foreground the container's stdout and stderr are streamed to your terminal as it runs; in background mode icp network start prints the docker logs -f <container-id> command to follow it. Previously container output was never shown at all — which on Windows, where the launcher always runs in a container, meant icp network start was silent.
• fix: a network launcher running in a container (icp settings autocontainerize true, and always on Windows) now receives --verbose when icp -d is used, matching the non-containerized launcher.

Experimental

• feat(bundle): icp project bundle now works on projects that declare dependencies:, which it previously refused outright. The bundle mirrors the workspace instead of flattening it: the root project's icp.yaml sits at the archive root, each dependency instance gets its own icp.yaml at the directory it occupies in the workspace, and the dependencies: declarations are preserved, each pointing at the directory its dependency occupies in the archive (the same path a plainly vendored layout already used). A shared (diamond) dependency is still a single instance, canister names stay as each project wrote them, and canister discovery (PUBLIC_CANISTER_ID:<alias>:<canister>) works in the extracted bundle exactly as it did in the source workspace.
  • Every dependency must resolve to a directory inside the workspace root; one that resolves outside it (including through a symlink) is rejected, because the archive could not contain it. As a result, a vendored member that depends on a sibling cannot be bundled as a standalone project (e.g. via ICP_PROJECT_ROOT) — bundle the workspace root instead.
  • Projects with script sync steps still cannot be bundled, and the restriction now covers every project in the workspace.

Install icp-cli 1.3.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/dfinity/icp-cli/releases/download/v1.3.0/icp-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/dfinity/icp-cli/releases/download/v1.3.0/icp-cli-installer.ps1 | iex"

Download icp-cli 1.3.0

File	Platform	Checksum
icp-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
icp-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
icp-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
icp-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
icp-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

v1.2.0

Release Notes

• feat(sync-plugin): the compute-time limit for plugin sync steps is now configurable via the ICP_CLI_PLUGIN_COMPUTE_LIMIT_SECS environment variable (default 60). Raise it for compute-heavy plugins (e.g. brotli-compressing a large asset bundle) that legitimately exceed the default, especially on slower CI runners. The limit-exceeded error now names the variable and the current limit, and a malformed value is rejected rather than silently ignored.
• feat: icp canister link assigns an existing canister principal to a project canister
• feat: icp canister create --with-icp (not supported in icp deploy) uses the CMC to create canisters. Only needed for deploying to restricted system subnets.
• feat: icp deploy --no-create will error if any canisters do not exist, rather than creating them.
• fix: icp deploy now prints the frontend URL for any canister that exposes an http_request endpoint. Previously a canister whose http_request signature differed from a hard-coded shape (e.g. some certified-asset canisters) was misdetected and shown a Candid UI URL instead of its site URL. Deploy URLs are also now grouped by kind (frontends vs. Candid UI) instead of interleaved.

Install icp-cli 1.2.0

Install prebuilt binaries via shell script

... (truncated)

Changelog

Sourced from @​icp-sdk/icp-cli's changelog.

v1.3.0

• feat: a canister environment variable's value can now be read from a file, by writing var: { path: <file> } in place of var: value. The path resolves against the canister's directory — including in an environment override, matching init_args — and surrounding whitespace is trimmed off the file's contents. The file is read when the project is loaded, so a missing file fails before anything is deployed. icp project bundle writes the value into the bundled manifest inline, rejecting a file outside the project as it does for other manifest file references.
• fix: icp network start now explains why a Docker-based network failed to come up. A container that exited before the network was ready was reported as failed to watch docker container <id> for exit with an empty cause, discarding the actual reason (e.g. the gateway port already being taken); the container's output is now attached to the error.
• feat: Docker-based networks now show the launcher's output like non-containerized ones do. In the foreground the container's stdout and stderr are streamed to your terminal as it runs; in background mode icp network start prints the docker logs -f <container-id> command to follow it. Previously container output was never shown at all — which on Windows, where the launcher always runs in a container, meant icp network start was silent.
• fix: a network launcher running in a container (icp settings autocontainerize true, and always on Windows) now receives --verbose when icp -d is used, matching the non-containerized launcher.

Experimental

• feat(bundle): icp project bundle now works on projects that declare dependencies:, which it previously refused outright. The bundle mirrors the workspace instead of flattening it: the root project's icp.yaml sits at the archive root, each dependency instance gets its own icp.yaml at the directory it occupies in the workspace, and the dependencies: declarations are preserved, each pointing at the directory its dependency occupies in the archive (the same path a plainly vendored layout already used). A shared (diamond) dependency is still a single instance, canister names stay as each project wrote them, and canister discovery (PUBLIC_CANISTER_ID:<alias>:<canister>) works in the extracted bundle exactly as it did in the source workspace.
  • Every dependency must resolve to a directory inside the workspace root; one that resolves outside it (including through a symlink) is rejected, because the archive could not contain it. As a result, a vendored member that depends on a sibling cannot be bundled as a standalone project (e.g. via ICP_PROJECT_ROOT) — bundle the workspace root instead.
  • Projects with script sync steps still cannot be bundled, and the restriction now covers every project in the workspace.

v1.2.0

• feat(sync-plugin): the compute-time limit for plugin sync steps is now configurable via the ICP_CLI_PLUGIN_COMPUTE_LIMIT_SECS environment variable (default 60). Raise it for compute-heavy plugins (e.g. brotli-compressing a large asset bundle) that legitimately exceed the default, especially on slower CI runners. The limit-exceeded error now names the variable and the current limit, and a malformed value is rejected rather than silently ignored.
• feat: icp canister link assigns an existing canister principal to a project canister
• feat: icp canister create --with-icp (not supported in icp deploy) uses the CMC to create canisters. Only needed for deploying to restricted system subnets.
• feat: icp deploy --no-create will error if any canisters do not exist, rather than creating them.
• fix: icp deploy now prints the frontend URL for any canister that exposes an http_request endpoint. Previously a canister whose http_request signature differed from a hard-coded shape (e.g. some certified-asset canisters) was misdetected and shown a Candid UI URL instead of its site URL. Deploy URLs are also now grouped by kind (frontends vs. Candid UI) instead of interleaved.

v1.1.0

• feat: icp token [TOKEN|LEDGER_ID] approve <AMOUNT> <SPENDER> grants an ICRC-2 allowance, letting a spender transfer tokens on your behalf. Supports --from-subaccount (the account debited for the allowance), --spender-subaccount, and an optional --expires-in <DURATION> (e.g. 24h, 30d) to auto-expire the allowance.
• feat: icp token [TOKEN|LEDGER_ID] allowance <SPENDER> displays the ICRC-2 allowance granted to a spender. Supports --subaccount, --spender-subaccount, and --of-principal to inspect any account.
• feat: icp canister delete will now send the canister's remaining cycles to the caller
• feat: Connected networks now take an explicit root-key, which accepts a hex-encoded key or one of two new values:
  • mainnet: use the canonical IC mainnet root key — handy for reaching mainnet through a custom boundary node without repeating the literal.
  • fetch: fetch the key from the network on each use. This is trust-on-first-use and does not verify the key's provenance, so it's meant only for testnets you or someone you trust operate; icp prints a warning whenever it fetches.
  • network status reports where the key came from — a root_key_source field in --json, and a (fetched - unverified, trust-on-first-use) label in text output.
  • root-key is now required for connected networks (previously optional, silently defaulting to the mainnet key). This is technically breaking, but most working projects are unaffected: a non-mainnet connected network already needed an explicit key, so in practice only a mainnet-via-custom-URL network needs to add root-key: mainnet. The built-in ic network is unchanged.

Experimental

• feat: Projects can now depend on other icp projects vendored into them (e.g. as git submodules) via a top-level dependencies: block in icp.yaml.
  • icp deploy deploys the dependency alongside your project and injects its canister IDs.
  • Running icp from inside a vendored sub-project resolves up to the workspace root, so the whole workspace shares one network and one set of canister IDs.
  • Canister names and dependency aliases must now contain only ASCII letters, digits, _, and -, with : reserved as the dependency namespace separator. Names using other characters are now rejected.
  • See the Project Dependencies concept guide for details.

Commits

• See full diff in compare view

Updates @noble/hashes from 2.2.0 to 2.3.0

Release notes

Sourced from @​noble/hashes's releases.

2.3.0

Improve speed:

• +10-45% 32b inputs across all hashes
• +40% SHA-3 / SHAKE, +50% 1mb KT128 / KT256 / TurboSHAKE, +20% kmac
• 2.2x argon
• +20% pbkdf2 and hkdf

Other changes:

• Better error messages and stricter type checks everywhere
• Bugfix: HMAC _cloneInto now preserves canXOF (#134, ChALkeR); Argon2d typo rename (#135).
• blake2.compress renamed to _compress (marked internal).
• Reduce on-disk unpacked size 869kb → 665kb (-204kb) by disabling source maps (they became less relevant).

Full Changelog: paulmillr/noble-hashes@2.2.0...2.3.0

Commits

• 8060cc8 Release 2.3.0.
• 16f8af9 Update workflow and benchmarks
• 734220f Update jsbt to 0.6.5
• fd3d3c3 Minor improvements
• 3654405 test: use new syntax
• e222e2d utils: minor fixes
• ef7ae52 Improve speed. Reduce bundle size. Reduce mem usage.
• 26b194a Rename npm action
• e89d6fa Bump jsbt to v0.6
• de8098a Move benchmarks top-level
• Additional commits viewable in compare view

Updates @x402/core from 2.18.0 to 2.21.0

Commits

• 34cb6bd chore(go): release (#3043)
• a4e23be chore: version python package  (#3042)
• 5e20460 chore: version typescript packages  (#3041)
• 1fd1a6d Update docs/extensions/bazaar.mdx (#3040)
• 6b04d5e fix: reject external / in bazaar discovery schema (SSRF) (#3039)
• dea7937 fix(evm): verify Transfer event in receipt after exact/eip3009 settle (#2385)
• 49a3c7e Update docs/guides/mcp-server-with-x402.md (#3038)
• 08e84ab fix(mcp): plumb spend policies through createx402MCPClient factory (#3034)
• 3c63262 fix(python): verify Transfer event after exact/eip3009 settle (#3032)
• 5192e50 fix: wildcard line terminator bypass (#3036)
• Additional commits viewable in compare view

Updates eslint from 10.7.0 to 10.8.1

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
• d086293 test: add error locations to no-undef (#21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

... (truncated)

Commits

• c049dc3 10.8.1
• a3f7826 Build: changelog update for 10.8.1
• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173)
• 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196)
• 7d0cbf8 docs: Update README
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191)
• 5611035 test: add error locations info to no-void (#21185)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176)
• f131c03 chore: improve ecosystem test failure reporting (#20937)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183)
• Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes

• #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

  /** @type {import('lint-staged').Configuration} */
  export default {
    "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
  };

... (truncated)

Commits

• d153443 Merge pull request #1828 from lint-staged/changeset-release/main
• 5162c14 chore(changeset): release
• a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
• ea96cab style: enable oxlint "suspicious" category
• 2fae007 style: add @e18e/eslint-plugin
• 2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
• 1453ae6 test: relax assertion so that it passes in worktree
• 15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
• dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
• 286e25c feat: allow running parallel tasks by nesting arrays
• Additional commits viewable in compare view

Updates prettier from 3.9.5 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Updates typescript-eslint from 8.64.0 to 8.66.0

Release notes

Sourced from typescript-eslint's releases.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

• typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
• eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
• eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
• eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
• eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
• website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kirk Waiblinger @​kirkwaiblinger
• Steffen Schroeder
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
• typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.66.0 (2026-08-03)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)

❤️ Thank You

• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• e51b11b chore(release): publish 8.66.0
• 63ba81b chore(release): publish 8.65.0
• eaf4576 feat: add warning when TS 7 is detected (#12529)
• 0d06406 chore: add attw validation to repo (#12437)
• c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
• See full diff in compare view

Updates viem from 2.55.2 to 2.55.11

Release notes

Sourced from viem's releases.

viem@2.55.11

Patch Changes

• #4949 f05ae7eff8852cd4b4b117a5c5d77140bd26a8f6 Thanks @​grandpig! - Fixed withRetry hanging when shouldRetry or the retry delay callback throws.

• #4955 87067c2fc2487967872582c1a0739b419612d5ee Thanks @​ShenWang-PiP! - Updated the story (1514) and storyAeneid (1315) chains for the Story → Data rebrand: renamed to "Data Network" / "Data Network Aeneid", set the native currency to $DATA, the RPC URLs to datarpc.io, and the block explorer to datanetscan.io. Chain IDs and the story / storyAeneid exports are unchanged.

• #4958 3fe8f4bef7688d4e76d112cf89846d66d272d17b Thanks <...

  Description has been truncated