[dependabot]

Bumps the minor-and-patch group with 54 updates in the / directory:

Package	From	To
@babel/eslint-parser	7.29.7	7.29.9
@testing-library/dom	10.4.1	10.4.2
@typescript-eslint/eslint-plugin	8.61.0	8.71.0
@typescript-eslint/parser	8.61.0	8.71.0
@vercel/ncc	0.44.0	0.45.0
eslint	10.6.0	10.11.0
globals	17.7.0	17.12.0
lint-staged	17.0.8	17.6.0
prettier	3.8.4	3.9.9
react-i18next	17.0.8	17.0.15
ts-loader	9.6.0	9.6.2
webpack	5.107.2	5.111.1
webpack-cli	7.2.1	7.2.3
@blockaid/client	1.4.0	1.8.0
@docusaurus/core	3.10.1	3.10.2
@docusaurus/preset-classic	3.10.1	3.10.2
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
react-is	19.2.7	19.3.0
styled-components	6.4.2	6.5.3
@amplitude/analytics-browser	2.44.4	2.47.1
@amplitude/experiment-js-client	1.21.2	1.23.1
@ledgerhq/hw-app-str	7.7.4	7.8.0
@ledgerhq/hw-transport-webhid	6.35.4	6.36.0
@radix-ui/react-dialog	1.1.16	1.1.23
@radix-ui/react-popover	1.1.16	1.1.23
@tailwindcss/postcss	4.3.1	4.3.3
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
@types/chrome	0.1.43	0.3.0
@types/lodash	4.17.24	4.17.25
@types/node	26.1.0	26.6.3
@types/webextension-polyfill	0.12.5	0.12.6
concurrently	10.0.3	10.0.5
css-loader	7.1.4	7.1.5
html-webpack-plugin	5.6.7	5.6.8
i18next	26.3.4	26.4.2
i18next-resources-to-backend	1.2.1	1.2.3
jest-canvas-mock	2.5.2	2.5.8
js-yaml	5.2.1	5.4.2
react-router-dom	7.17.0	7.18.4
sass	1.101.0	1.105.0
sass-loader	17.0.0	17.0.1
semver	7.8.4	7.8.5
@types/semver	7.7.1	7.8.0
ses	2.2.0	2.3.0
sonner	2.0.7	2.0.8
tailwindcss	4.3.1	4.3.3
@playwright/test	1.61.0	1.63.0
@sentry/webpack-plugin	5.3.0	5.4.0
@types/semver	7.7.1	7.8.0
postcss	8.5.15	8.5.28
shadcn	4.13.0	4.21.0

Updates @babel/eslint-parser from 7.29.7 to 7.29.9

Release notes

Sourced from @​babel/eslint-parser's releases.

v7.29.9 (2026-09-18)

🐛 Bug Fix

• babel-plugin-transform-typescript
  • #18247 [ts] Allow merging enum into a namespace (@​nicolo-ribaudo)
• babel-parser
  • #18241 Fix parsing of arrow function params inside ternaries with Flow (@​robhogan)

🏠 Internal

• babel-parser
  • #18245 test: test with ts-eslint 8.70.0 (@​JLHwung)

Committers: 4

• Huáng Jùnliàng (@​JLHwung)
• Joelle Mahfoud (@​joelle-a-dev)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• Rob Hogan (@​robhogan)

v7.29.8 (2026-07-31)

👓 Spec Compliance

• babel-generator, babel-parser, babel-plugin-transform-spread, babel-traverse, babel-types
  • #17871 Disallow super call after new (@​JLHwung)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-node, babel-plugin-transform-modules-systemjs
  • #18044 fix(systemjs): support __proto__ as an export name (@​JLHwung)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

Commits

• 54405f2 v7.29.9
• 092e6e5 test: test with ts-eslint 8.70.0 (#18245)
• See full diff in compare view

Updates @testing-library/dom from 10.4.1 to 10.4.2

Release notes

Sourced from @​testing-library/dom's releases.

v10.4.2

10.4.2 (2026-09-13)

Bug Fixes

• deps: pin @​types/node to a TypeScript 4-compatible version (#1386) (6049cc0)

Commits

• 6049cc0 fix(deps): pin @​types/node to a TypeScript 4-compatible version (#1386)
• e395d5b Switch to trusted publishing (#1368)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/dom since your current version.

Updates @typescript-eslint/eslint-plugin from 8.61.0 to 8.71.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

🩹 Fixes

• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)

❤️ Thank You

• Brad Zacher @​bradzacher
• Diptajoy Mistry @​diptomistry
• Grit @​Grit03
• Hugo @​hugop95
• Michael Naumov @​mnaoumov

... (truncated)

Commits

• 8695664 chore(release): publish 8.71.0
• 99d759a feat(eslint-plugin): [no-unsafe-enum-assignment] add rule (#12732)
• ae3ac15 docs(eslint-plugin): clarify checkTypePredicates assumptions (#12378)
• 33824c1 fix(eslint-plugin): [no-misused-promises] handle a return outside of any func...
• 7e25db3 fix(eslint-plugin): [no-unnecessary-type-assertion] specialize generic assert...
• 8d7ab88 test: order union constituents stably in RuleTester tests
• 7fce912 fix(eslint-plugin): [unbound-method] respect this: void on class properties
• ce70016 fix(eslint-plugin): [switch-exhaustiveness-check] always sort literal cases i...
• 23d38ce chore(release): publish 8.70.1
• 9d82e4b chore: expand eslint-plugin rules test files glob (#12878)
• Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.61.0 to 8.71.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.71.0 (2026-09-28)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.67.0 (2026-08-10)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.66.0 (2026-08-03)

... (truncated)

Commits

• 8695664 chore(release): publish 8.71.0
• 23d38ce chore(release): publish 8.70.1
• 7ee7608 chore(release): publish 8.70.0
• 9a6e546 chore(release): publish 8.69.0
• 8f4e00a chore(release): publish 8.68.0
• 55f6d5d chore: enable source maps (#12677)
• 20a261f chore(release): publish 8.67.0
• 3b155bb chore: use typescript 7 for typechecking (#12601)
• e51b11b chore(release): publish 8.66.0
• 63ba81b chore(release): publish 8.65.0
• Additional commits viewable in compare view

Updates @vercel/ncc from 0.44.0 to 0.45.0

Release notes

Sourced from @​vercel/ncc's releases.

0.45.0

0.45.0 (2026-08-13)

Features

• update @​vercel/webpack-asset-relocator-loader to 1.10.3 (#1342) (cb1f1f0)

0.44.1

0.44.1 (2026-06-29)

Bug Fixes

• preserve runtime createRequire in ESM builds (#1334) (8f0aefd), closes #1312

Commits

• cb1f1f0 feat: update @​vercel/webpack-asset-relocator-loader to 1.10.3 (#1342)
• cfec24e chore(deps): Bump actions/setup-python from 6 to 7 (#1338)
• b037995 chore(deps): Bump actions/setup-node from 6 to 7 (#1339)
• 063c592 chore(deps): Bump actions/checkout from 6 to 7 (#1335)
• 8f0aefd fix: preserve runtime createRequire in ESM builds (#1334)
• b9c6310 chore: Update vm2 to latest version (3.11.5) (#1333)
• See full diff in compare view

Updates eslint from 10.6.0 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits

• 3c0b7c6 10.11.0
• 321f0a7 Build: changelog update for 10.11.0
• 520dd77 perf: Implement fast paths in critical areas (#21210)
• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
• 24310e3 chore: update ecosystem plugins (#21324)
• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
• Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

v17.11.0

• Add react-native globals (#337) 61eafbf

---

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

• Add GM_cookie to Greasemonkey globals (#349) f468407

---

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

• Update globals (2026-08-01) (#348) 5a958ed

---

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

Commits

• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• 8c59927 17.11.0
• 61eafbf Add react-native globals (#337)
• 7bed4af 17.10.0
• f468407 Add GM_cookie to Greasemonkey globals (#349)
• 8e7b935 17.9.0
• 5a958ed Update globals (2026-08-01) (#348)
• 36c7659 17.8.0
• Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.6.0

Release notes

Sourced from lint-staged's releases.

v17.6.0

Minor Changes

• #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*': {
  title: 'Fail if PDF files are committed',
  task: async (filepaths, { log }) => {
  const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
  if (pdfFiles.length > 0) {
  log('PDF files should not be committed: %s', pdfFiles)
  throw new Error('Failed')
  }
  },
  },
  })

• #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

  If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

• #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

• #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
  })

• #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

• #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

v17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.6.0

Minor Changes

• #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*': {
  title: 'Fail if PDF files are committed',
  task: async (filepaths, { log }) => {
  const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
  if (pdfFiles.length > 0) {
  log('PDF files should not be committed: %s', pdfFiles)
  throw new Error('Failed')
  }
  },
  },
  })

• #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

  If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

• #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

• #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
  })

• #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

• #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

... (truncated)

Commits

• 48f9f4e Merge pull request #1857 from lint-staged/changeset-release/main

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-router-dom@​7.17.0 ⏵ 7.18.4
	npm/​@​docusaurus/​preset-classic@​3.10.1 ⏵ 3.10.2			+1	+3
	npm/​@​radix-ui/​react-popover@​1.1.16 ⏵ 1.1.23				-6
	npm/​@​radix-ui/​react-dialog@​1.1.16 ⏵ 1.1.23	+1
	npm/​@​typescript-eslint/​parser@​8.61.0 ⏵ 8.71.0			+1
	npm/​@​amplitude/​experiment-js-client@​1.21.2 ⏵ 1.23.1				+4
	npm/​@​types/​semver@​7.7.1 ⏵ 7.8.0			+1	+3
	npm/​@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	npm/​@​docusaurus/​core@​3.10.1 ⏵ 3.10.2	+1		+1	+5
	npm/​@​babel/​eslint-parser@​7.29.7 ⏵ 7.29.9				+7
	npm/​@​types/​react@​19.3.0
	npm/​@​types/​webextension-polyfill@​0.12.5 ⏵ 0.12.6	+1			+7
	npm/​@​types/​chrome@​0.1.43 ⏵ 0.3.0	+21			+2
	npm/​@​blockaid/​client@​1.4.0 ⏵ 1.8.0	-5		+1	+2
	npm/​@​types/​lodash@​4.17.24 ⏵ 4.17.25			+1
	npm/​@​typescript-eslint/​eslint-plugin@​8.61.0 ⏵ 8.71.0	+1		+1
	npm/​@​types/​node@​26.1.0 ⏵ 26.6.3	+1		+1	+1
	npm/​postcss@​8.5.28
	npm/​sonner@​2.0.7 ⏵ 2.0.8			+1
	npm/​tailwindcss@​4.3.1 ⏵ 4.3.3	+1		+1	-1
	npm/​react@​19.2.7 ⏵ 19.3.0	+1		+1
	npm/​globals@​17.7.0 ⏵ 17.12.0	+1		+1
	npm/​js-yaml@​5.2.1 ⏵ 5.4.2		+18	-13
	npm/​css-loader@​7.1.4 ⏵ 7.1.5	+1
	npm/​html-webpack-plugin@​5.6.8
	npm/​concurrently@​10.0.3 ⏵ 10.0.5	+1		+1
	npm/​sass-loader@​17.0.0 ⏵ 17.0.1				-2
	npm/​@​vercel/​ncc@​0.44.0 ⏵ 0.45.0			+1	-3
	npm/​@​sentry/​webpack-plugin@​5.3.0 ⏵ 5.4.0			-2	-2
	npm/​i18next-resources-to-backend@​1.2.1 ⏵ 1.2.3	+1			+9
	npm/​@​testing-library/​react@​16.3.2 ⏵ 16.3.3	+1
	npm/​@​testing-library/​dom@​10.4.1 ⏵ 10.4.2	+1
See 21 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm playwright-core under MIT WITH Google-Patent-WebM License: MIT WITH Google-Patent-WebM - The applicable license policy does not permit this license (5) (package/lib/webp_codec.LICENSE) From: extension/package.json → npm/@playwright/test@1.63.0 → npm/playwright-core@1.63.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/playwright-core@1.63.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report