Chore(deps): Bump the node-minor-patch group across 4 directories with 15 updates

[dependabot]

Bumps the node-minor-patch group with 7 updates in the /backend/compact-connect-ui-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1029.0	3.1079.0
@aws-sdk/client-s3	3.1029.0	3.1079.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.6.0
mocha	11.7.5	11.7.6

Bumps the node-minor-patch group with 15 updates in the /backend/compact-connect/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1079.0
@aws-sdk/client-s3	3.1045.0	3.1079.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.6.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1079.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.62.1
@typescript-eslint/parser	8.58.1	8.62.1
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.0

Bumps the node-minor-patch group with 15 updates in the /backend/cosmetology-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1079.0
@aws-sdk/client-s3	3.1045.0	3.1079.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.6.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1079.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.62.1
@typescript-eslint/parser	8.58.1	8.62.1
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.0

Bumps the node-minor-patch group with 15 updates in the /backend/social-work-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1079.0
@aws-sdk/client-s3	3.1045.0	3.1079.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.6.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1079.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.62.1
@typescript-eslint/parser	8.58.1	8.62.1
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.0

Updates @aws-lambda-powertools/logger from 2.32.0 to 2.33.1

Release notes

Sourced from @​aws-lambda-powertools/logger's releases.

v2.33.1

Summary

This release is mainly composed of bug fixes across the HTTP event handler, Metrics, Logger, and Parser utilities, along with the removal of Node.js 20 support now that the runtime has reached end-of-life on AWS Lambda.

In the HTTP event handler, we have fixed response header corruption where multi-attribute headers like Set-Cookie (with Expires dates) and other comma-containing values were being incorrectly split into multiple headers. The HTTP event handler also now correctly preserves PATCH request bodies on ALB events and returns the proper 204 response for CORS preflight requests that omit the Access-Control-Request-Headers header.

In Metrics, dimension limits are now enforced per-array rather than across the merged set, preventing CloudWatch EMF rejections when default and request-scoped dimensions overlap. Logger now flushes the log buffer when critical() is called with flushOnErrorLog enabled, matching the behaviour of error().

[!IMPORTANT] Node.js 20 is no longer supported. Node.js 20 reached end-of-life on AWS Lambda, so this release drops support for it. If you are still on Node.js 20, we recommend upgrading to Node.js 22 before updating Powertools.

⭐ Congratulations to @​vishwakt and @​nanookclaw for their first PRs merged in the project 🎉

Changes

• chore(deps): fix npm audit vulnerabilities (#5269) by @​svozza
• fix(event-handler): allow cors preflight without request headers (#5267) by @​vishwakt
• fix(event-handler): preserve ALB PATCH bodies (#5259) by @​nanookclaw
• fix(event-handler): restrict v1/alb comma header splitting to an allowlist (#5257) by @​vishwakt
• fix(parser): cognito validationData may be null (#5250) by @​bdellegrazie
• fix(metrics): enforce dimension limits per-array (#5229) by @​vishwakt
• improv(docs): fixed the docs to mention middy support for v7.x (#5238) by @​sdangol
• fix(metrics): account for all dimensions in setDefaultDimensions() li… (#5228) by @​vishwakt
• fix(logger): flush log buffer on critical() when flushOnErrorLog is e… (#5227) by @​vishwakt
• fix(metrics): clear state in publishStoredMetrics even when throwOnEmptyMetrics throws (#5213) by @​svozza
• chore: drop Node.js 20 support (#5218) by @​svozza
• fix(commons): prevent deepMerge from mutating source objects (#5202) by @​svozza
• fix(commons): correctly handle shared references in deepMerge (#5195) by @​svozza
• ci(maintenance): Remove release comment automation (#5193) by @​dreamorosi
• fix(logger): correctly serialize shared object references in JSON replacer (#5186) by @​svozza

🔧 Maintenance

• chore(deps-dev): bump protobufjs from 8.4.0 to 8.4.2 (#5285) by @dependabot[bot]
• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#5279) by @dependabot[bot]
• chore(deps): bump idna from 3.10 to 3.15 in /docs (#5274) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.3.0 to 8.4.0 (#5270) by @dependabot[bot]
• chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs (#5275) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5277) by @dependabot[bot]
• chore(deps-dev): bump @​valkey/valkey-glide from 2.3.1 to 2.4.0 (#5271) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.0.4 to 17.0.5 (#5272) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.8.0 to 25.9.1 (#5276) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#5264) by @dependabot[bot]
• chore(deps-dev): bump @​aws/durable-execution-sdk-js from 1.1.2 to 1.1.3 (#5265) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.7.0 to 25.8.0 (#5266) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.2.0 to 8.3.0 (#5253) by @dependabot[bot]
• chore(deps): bump gitpython from 3.1.48 to 3.1.50 in /docs (#5234) by @dependabot[bot]
• chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /docs (#5239) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.6.0 to 25.7.0 (#5244) by @dependabot[bot]

... (truncated)

Changelog

Sourced from @​aws-lambda-powertools/logger's changelog.

2.33.1 (2026-05-25)

Bug Fixes

• commons prevent deepMerge from mutating source objects (#5202) (9994787)
• commons correctly handle shared references in deepMerge (#5195) (6b1a811)
• logger flush log buffer on critical() when flushOnErrorLog is e… (#5227) (853b44f)
• logger correctly serialize shared object references in JSON replacer (#5186) (097e440)
• metrics enforce dimension limits per-array (#5229) (8791ee2)
• metrics account for all dimensions in setDefaultDimensions() li… (#5228) (54eb80a)
• metrics clear state in publishStoredMetrics even when throwOnEmptyMetrics throws (#5213) (a37913f)
• parser cognito validationData may be null (#5250) (b3c1293)
• event-handler allow cors preflight without request headers (#5267) (5adc3f4)
• event-handler preserve ALB PATCH bodies (#5259) (9e1a687)
• event-handler restrict v1/alb comma header splitting to an allowlist (#5257) (ca4bb13)

Maintenance

• validation bump ajv from 8.18.0 to 8.20.0 (#5214) (4a9edca)

2.33.0 (2026-04-14)

Bug Fixes

• commons don't overwrite existing value with undefined in deepMerge (#5141) (c7c6c0f)
• commons rename AvailabilityZoneId to AvailabilityZoneID in docs and tests (#5118) (65c054c)
• event-handler http response body validation typings (#5125) (0805db9)

Improvements

• parser export InferOutput from public types entry point (#5175) (16c6de6)

Features

• event-handler add metrics middleware for HTTP routes (#5086) (5af28e8)

Commits

• a3d3147 chore(ci): bump version to 2.33.1 (#5288)
• 56eacb7 chore(deps-dev): bump protobufjs from 8.4.0 to 8.4.2 (#5285)
• ba4d364 chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#5279)
• 30621d6 chore(deps): bump idna from 3.10 to 3.15 in /docs (#5274)
• b756cfc chore(deps-dev): bump protobufjs from 8.3.0 to 8.4.0 (#5270)
• 3fdc9d9 chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs (#5275)
• 3cf427f chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5277)
• 7325ba2 chore(deps-dev): bump @​valkey/valkey-glide from 2.3.1 to 2.4.0 (#5271)
• 519b88d chore(deps-dev): bump lint-staged from 17.0.4 to 17.0.5 (#5272)
• 1a84635 chore(deps): bump @​types/node from 25.8.0 to 25.9.1 (#5276)
• Additional commits viewable in compare view

Updates @aws-sdk/client-dynamodb from 3.1029.0 to 3.1079.0

Release notes

Sourced from @​aws-sdk/client-dynamodb's releases.

v3.1079.0

3.1079.0(2026-07-02)

Chores

• deps: bump @​aws/lambda-invoke-store to ^0.3.0 (#8140) (aeb7e071)

New Features

• clients: update client endpoints as of 2026-07-02 (cc43668e)
• client-config-service: AWS Config now supports tag-on-create for organization-managed Config rules and conformance packs through the PutOrganizationConfigRule and PutOrganizationConformancePack APIs. (2ca9232a)
• client-odb: Updated model definitions for ODB service. (a9d3fd5e)
• client-cognito-identity-provider: Add support for provisioned limit management, enabling customers to view and update their provisioned API rate limits for Amazon Cognito User Pools programmatically through the new GetProvisionedLimit and UpdateProvisionedLimit APIs. (160778dc)
• client-outposts: Tighten Outpost site ContactPhoneNumber regex to perform phone number validation. (4e2b31db)
• client-elementalinference: Adding new BDD representation of endpoint ruleset (dd21a6ec)
• client-mediatailor: Added dual-stack (IPv4 and IPv6) endpoint fields to SSAI and Channel Assembly API responses. (63a258ce)
• client-customer-profiles: Amazon Connect Customer Profiles adds support for diversityConfig to recommenderConfig which can be used for diversifying the recommendations. This release also includes model versioning support which helps customer to rollback trained models. (202ec32a)

Bug Fixes

• core: remove turbo.json (#8141) (91d738d3)

Tests

• client-kinesis: resolve e2e endpoint from client config (#8142) (4cfd7f42)

---

For list of updated packages, view updated-packages.md in assets-3.1079.0.zip

v3.1078.0

3.1078.0(2026-07-01)

Chores

• codegen: sync for thinner command classes, endpoint parameter type fix (#8136) (c39b6765)
• ci: allow AWS maintained packages in yarn age gate (#8139) (3bddc2a6)
• deps-dev: bump yarn to 4.17.0 (#8137) (14dc3ae8)

Documentation Changes

• client-cloud9: Since Amazon Linux 2 (AL2) will reach its end-of-life (EOL) and stop receiving security updates on June 30, 2026, Cloud9 will remove AL2 from AMI options in public API create-environment-ec2. (bbd7a342)
• client-marketplace-metering: The usage reporting window for the BatchMeterUsage API has been extended from 6 hours to 24 hours. Sellers can now submit usage records for up to 24 hours after a metered event occurs. (980d5415)

New Features

• clients: update client endpoints as of 2026-07-01 (0c0bc427)
• client-opensearch: To create a Mustang domain via the AWS CLI, you must pass EngineMode OPTIMIZED (along with UseCase OBSERVABILITY or MIXED) without it, the domain defaults to a regular (GENERAL) domain. Also this release includes Insights Feedback API which user can use to provide feedback for Insight API. (8927c3ad)
• client-ec2: Use declarative policies to enable VPC Encryption Controls across your organization or select accounts. Added AMD SEV-SNP support for EC2 Dedicated Hosts. Managed resource visibility settings control whether AWS-provisioned resources in your account appear in console views and API list operations. (6d82b78d)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-dynamodb's changelog.

3.1079.0 (2026-07-02)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1078.0 (2026-07-01)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1077.0 (2026-06-30)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1076.0 (2026-06-29)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1075.0 (2026-06-23)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1074.0 (2026-06-22)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1073.0 (2026-06-19)

... (truncated)

Commits

• 74dc940 Publish v3.1079.0
• 661087f Publish v3.1078.0
• c39b676 chore(codegen): sync for thinner command classes, endpoint parameter type fix...
• 5c490b6 Publish v3.1077.0
• c4b42a4 chore(codegen): sync for internal checksum impls and IMDSv2 region fallback (...
• dfd62f6 Publish v3.1076.0
• aa94fa0 chore(codegen): sync for checksum impls, hostLabel validation (#8127)
• b6d6a75 chore(codegen): sync for CBOR serde performance and retry fixes (#8125)
• 29ee199 Publish v3.1075.0
• c48dfa0 Publish v3.1074.0
• Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1029.0 to 3.1079.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1079.0

3.1079.0(2026-07-02)

Chores

• deps: bump @​aws/lambda-invoke-store to ^0.3.0 (#8140) (aeb7e071)

New Features

• clients: update client endpoints as of 2026-07-02 (cc43668e)
• client-config-service: AWS Config now supports tag-on-create for organization-managed Config rules and conformance packs through the PutOrganizationConfigRule and PutOrganizationConformancePack APIs. (2ca9232a)
• client-odb: Updated model definitions for ODB service. (a9d3fd5e)
• client-cognito-identity-provider: Add support for provisioned limit management, enabling customers to view and update their provisioned API rate limits for Amazon Cognito User Pools programmatically through the new GetProvisionedLimit and UpdateProvisionedLimit APIs. (160778dc)
• client-outposts: Tighten Outpost site ContactPhoneNumber regex to perform phone number validation. (4e2b31db)
• client-elementalinference: Adding new BDD representation of endpoint ruleset (dd21a6ec)
• client-mediatailor: Added dual-stack (IPv4 and IPv6) endpoint fields to SSAI and Channel Assembly API responses. (63a258ce)
• client-customer-profiles: Amazon Connect Customer Profiles adds support for diversityConfig to recommenderConfig which can be used for diversifying the recommendations. This release also includes model versioning support which helps customer to rollback trained models. (202ec32a)

Bug Fixes

• core: remove turbo.json (#8141) (91d738d3)

Tests

• client-kinesis: resolve e2e endpoint from client config (#8142) (4cfd7f42)

---

For list of updated packages, view updated-packages.md in assets-3.1079.0.zip

v3.1078.0

3.1078.0(2026-07-01)

Chores

• codegen: sync for thinner command classes, endpoint parameter type fix (#8136) (c39b6765)
• ci: allow AWS maintained packages in yarn age gate (#8139) (3bddc2a6)
• deps-dev: bump yarn to 4.17.0 (#8137) (14dc3ae8)

Documentation Changes

• client-cloud9: Since Amazon Linux 2 (AL2) will reach its end-of-life (EOL) and stop receiving security updates on June 30, 2026, Cloud9 will remove AL2 from AMI options in public API create-environment-ec2. (bbd7a342)
• client-marketplace-metering: The usage reporting window for the BatchMeterUsage API has been extended from 6 hours to 24 hours. Sellers can now submit usage records for up to 24 hours after a metered event occurs. (980d5415)

New Features

• clients: update client endpoints as of 2026-07-01 (0c0bc427)
• client-opensearch: To create a Mustang domain via the AWS CLI, you must pass EngineMode OPTIMIZED (along with UseCase OBSERVABILITY or MIXED) without it, the domain defaults to a regular (GENERAL) domain. Also this release includes Insights Feedback API which user can use to provide feedback for Insight API. (8927c3ad)
• client-ec2: Use declarative policies to enable VPC Encryption Controls across your organization or select accounts. Added AMD SEV-SNP support for EC2 Dedicated Hosts. Managed resource visibility settings control whether AWS-provisioned resources in your account appear in console views and API list operations. (6d82b78d)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1079.0 (2026-07-02)

Note: Version bump only for package @​aws-sdk/client-s3

3.1078.0 (2026-07-01)

Note: Version bump only for package @​aws-sdk/client-s3

3.1077.0 (2026-06-30)

Note: Version bump only for package @​aws-sdk/client-s3

3.1076.0 (2026-06-29)

Note: Version bump only for package @​aws-sdk/client-s3

3.1075.0 (2026-06-23)

Note: Version bump only for package @​aws-sdk/client-s3

3.1074.0 (2026-06-22)

Note: Version bump only for package @​aws-sdk/client-s3

3.1073.0 (2026-06-19)

... (truncated)

Commits

• 74dc940 Publish v3.1079.0
• 661087f Publish v3.1078.0
• c39b676 chore(codegen): sync for thinner command classes, endpoint parameter type fix...
• 5c490b6 Publish v3.1077.0
• c4b42a4 chore(codegen): sync for internal checksum impls and IMDSv2 region fallback (...
• ea8faa0 chore(checksums): add crc32c and sha1 checksums (#8126)
• dfd62f6 Publish v3.1076.0
• aa94fa0 chore(codegen): sync for checksum impls, hostLabel validation (#8127)
• b6d6a75 chore(codegen): sync for CBOR serde performance and retry fixes (#8125)
• 29ee199 Publish v3.1075.0
• Additional commits viewable in compare view

Updates @aws-sdk/util-dynamodb from 3.996.2 to 3.996.5

Commits

• See full diff in compare view

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates eslint from 10.2.1 to 10.6.0

Release notes

Sourced from eslint's releases.

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

v10.5.0

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (Description has been truncated