[dependabot]

Bumps the slopesmith group with 12 updates in the /Slopesmith directory:

Package	From	To
@napi-rs/canvas	1.0.11	1.1.0
livekit-client	2.22.4	2.23.0
livekit-server-sdk	2.19.1	2.19.2
three	0.186.1	0.187.0
@types/three	0.186.0	0.187.0
three-mesh-bvh	0.9.16	0.9.18
@types/node	24.19.2	26.6.6
@types/three	0.186.0	0.187.0
eslint	10.12.0	10.14.0
globals	17.13.0	17.14.0
typescript	5.9.3	7.0.2
typescript-eslint	8.71.2	8.72.1
vite	8.3.4	8.3.5

Updates @napi-rs/canvas from 1.0.11 to 1.1.0

Release notes

Sourced from @​napi-rs/canvas's releases.

v1.1.0

Highlights

Portable text rendering by default (#1404)

Text now defaults to the portable renderer, using FreeType on macOS, Linux, and Windows to make rendering and measureText results consistent across operating systems when the same fonts are registered.

Behavior change: default text output, measurements, and system-font resolution can differ from v1.0.12/v1.0.13. To restore the previous Chrome-like, platform-specific behavior, call:

const { setTextRenderer } = require('@napi-rs/canvas')
setTextRenderer('system')

Use getTextRenderer() to inspect the active mode. Installed fonts and fallback for characters missing from registered fonts can still vary by OS and machine.

What's Changed

• chore(deps): group @​oxc-node packages in renovate config by @​Brooooooklyn in Brooooooklyn/canvas#1398
• chore(deps): update dependency electron to v45 by @​renovate[bot] in Brooooooklyn/canvas#1399
• fix(ci): invalidate musl cache on Zig toolchain changes by @​Brooooooklyn in Brooooooklyn/canvas#1400
• docs: remove broken install size badge by @​Brooooooklyn in Brooooooklyn/canvas#1401
• fix(build): bind the addon's own symbols on Linux so Electron's cxx runtime cannot replace them by @​Brooooooklyn in Brooooooklyn/canvas#1406
• feat(text): draw text the same on every OS by default, add setTextRenderer by @​Brooooooklyn in Brooooooklyn/canvas#1404
• fix(path): draw full-sweep arc() and ellipse() for every start angle by @​Brooooooklyn in Brooooooklyn/canvas#1407
• fix(path): draw a degenerate ellipse() as straight lines like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1408
• fix(build): compile Windows Skia with -ffp-contract=off like Chromium by @​Brooooooklyn in Brooooooklyn/canvas#1409
• fix(path): follow-ups to #1408: rotate() path, arc() start == end, rotated ellipse, isPointInStroke state, one-point stroke prune by @​Brooooooklyn in Brooooooklyn/canvas#1411
• fix(build): compile skia-c with -ffp-contract=off like Chromium by @​Brooooooklyn in Brooooooklyn/canvas#1412
• fix(ctx): keep Blink's double CTM as the source of truth by @​Brooooooklyn in Brooooooklyn/canvas#1413
• fix(ctx): decide CTM invertibility from Blink's double CTM by @​Brooooooklyn in Brooooooklyn/canvas#1414
• fix(ctx): skip the stroke of every one-point path like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1415
• chore(deps): update dependency node to v26 by @​renovate[bot] in Brooooooklyn/canvas#1410
• fix(ci): use vendored Yarn in Node test containers by @​Brooooooklyn in Brooooooklyn/canvas#1417

Full Changelog: Brooooooklyn/canvas@v1.0.13...v1.1.0

v1.0.13

What's Changed

• fix(canvas): wrap native methods, not previous wrappers, on re-evaluation by @​Brooooooklyn in Brooooooklyn/canvas#1395

Full Changelog: Brooooooklyn/canvas@v1.0.12...v1.0.13

v1.0.12

What's Changed

• fix(canvas): preserve fractional global alpha through native paints by @​natew in Brooooooklyn/canvas#1355
• fix(canvas): preserve pattern snapshots and honor current image sampling quality by @​natew in Brooooooklyn/canvas#1357
• fix(canvas): enable dithering for gradient fill and stroke paints by @​natew in Brooooooklyn/canvas#1358

... (truncated)

Changelog

Sourced from @​napi-rs/canvas's changelog.

1.1.0 (2026-10-30)

Bug Fixes

• build: bind the addon's own symbols on Linux so Electron's cxx runtime cannot replace them (#1406) (10a395a)
• build: compile skia-c with -ffp-contract=off like Chromium (#1412) (c95bd18)
• build: compile Windows Skia with -ffp-contract=off like Chromium (#1409) (b6d884d)
• ci: invalidate musl cache on Zig toolchain changes (#1400) (d6020bf)
• ci: use vendored Yarn in Node test containers (#1417) (ca7b04a)
• ctx: decide CTM invertibility from Blink's double CTM (#1414) (504e9fe)
• ctx: keep Blink's double CTM as the source of truth (#1413) (2407be5)
• ctx: skip the stroke of every one-point path like Chrome (#1415) (0df1c35)
• path: draw a degenerate ellipse() as straight lines like Chrome (#1408) (767c57c)
• path: draw full-sweep arc() and ellipse() for every start angle (#1407) (18f5c06)
• path: follow-ups to #1408: rotate() path, arc() start == end, rotated ellipse, isPointInStroke state, one-point stroke prune (#1411) (4cbdc28)

Features

• text: draw text the same on every OS by default, add setTextRenderer (#1404) (bf00526)

1.0.13 (2026-10-21)

Bug Fixes

• canvas: wrap native methods, not previous wrappers, on re-evaluation (#1395) (6997e1d)

1.0.12 (2026-10-20)

Bug Fixes

• canvas: compositing, shadows, drawCanvas and filters like Chrome (#1379) (c6f06a6)
• canvas: draw Image sources from Chrome's decode-cache levels (#1367) (7c3d0c2)
• canvas: enable dithering for gradient fill and stroke paints (#1358) (5f95bd4)
• canvas: gradients and SVG conic export work like Chrome (#1377) (4059399)
• canvas: ImageData patterns and SvgCanvas reads like Chrome (#1363) (e2f6a83)
• canvas: match Chrome for alpha:false, clearRect and 'copy' (#1365) (d82b79c)
• canvas: match Chrome for hsl() colors and gradient edge cases (#1362) (17a4b3b)
• canvas: parse fonts, lay out and measure text like Blink (#1381) (a43bb16)
• canvas: paths, clips, roundRect and setTransform work like Chrome (#1375) (1299146)
• canvas: preserve fractional global alpha through native paints (#1355) (2eb68bc)
• canvas: preserve pattern snapshots and honor current image sampling quality (#1357) (65f4e7c)
• canvas: style getters, shadowColor and canvas sizes like Chrome (#1376) (9bf7aef)
• canvas: WebIDL conversion for ImageData, getContext, createPattern (#1361) (583b7e2)
• canvas: WebIDL conversion, arity checks and exceptions like Chrome (#1373) (676047d)
• codecs: Chrome's encoders, AVIF decode, data: URLs and SVG images (#1380) (b5b38a9)
• crash-safe non-finite args, ImageData sizes, DOMMatrixInit (#1372) (004444b)
• deps: pin font-types back to Skia's 0.12.0 (#1388) (57cd52b)
• deps: update rust crate font-types to v0.12.7 (#1386) (61d89eb)

... (truncated)

Commits

• 5246bbf 1.1.0
• ca7b04a fix(ci): use vendored Yarn in Node test containers (#1417)
• 83aa896 chore(deps): update dependency node to v26 (#1410)
• 0df1c35 fix(ctx): skip the stroke of every one-point path like Chrome (#1415)
• 504e9fe fix(ctx): decide CTM invertibility from Blink's double CTM (#1414)
• 2407be5 fix(ctx): keep Blink's double CTM as the source of truth (#1413)
• c95bd18 fix(build): compile skia-c with -ffp-contract=off like Chromium (#1412)
• 4cbdc28 fix(path): follow-ups to #1408: rotate() path, arc() start == end, rotated el...
• b6d884d fix(build): compile Windows Skia with -ffp-contract=off like Chromium (#1409)
• 767c57c fix(path): draw a degenerate ellipse() as straight lines like Chrome (#1408)
• Additional commits viewable in compare view

Updates livekit-client from 2.22.4 to 2.23.0

Release notes

Sourced from livekit-client's releases.

v2.23.0

Minor Changes

• Release the audio contexts and web audio graphs the SDK creates. Previously they accumulated over mute/unmute cycles. They are now collected after room.disconnect(). - #2029 (@​lukasIO)

  • detectSilence tears its context down on the throw path as well as the happy one.
  • The cleanup from createAudioAnalyser disconnects its nodes before it closes the context, and it is now idempotent.
  • The shared empty audio stream track is refcounted. releaseEmptyAudioStreamTrack is a new export, and its context closes once the last clone is handed back.
  • If webAudioMix is an object without an audioContext, a room now closes the context it created for itself.
  • When the underlying track is replaced, audio processors are passed the audio context. This lets them rebuild their filter nodes on unmute. Previously they left the old nodes behind.
  • The iOS dummy audio element and its visibilitychange listener are torn down on disconnect. Previously the listener outlived every room on the page.

  This also fixes a false AudioSilenceDetected. Silence detection read a zero-filled buffer from a context that never reached running. An autoplay-blocked page therefore reported silence on every track it checked.

  Three further behavior changes to be aware of:

  • A track retained across rooms loses its audio processor. room.disconnect({ stopTracks: false }) detaches the track from the audio context, which stops the processor. Call setProcessor again after you republish the track.
  • Under webAudioMix, every attached element is muted, not only the first one. A second attached element no longer plays the track twice. When the audio context goes away, those elements are unmuted again and their volume is restored.
  • Participant.setAudioContext and LocalAudioTrack.setAudioContext now return a promise. Both are marked @internal, but both appear in the published type declarations.

Patch Changes

• Scale the x-google-start-bitrate hint by connection setup time: the 1 Mbps camera cap now applies to connections that set up within 1.5 s and ramps linearly down to 300 kbps at 3.5 s or slower; screen share stays uncapped. - #2146 (@​changt)

• Add jitter to reconnect retries in the default reconnect policy, including the first retry and reconnects requested by the server, so clients that disconnect together don't reconnect at the same time. The first retry waits a random 0 to 500 ms, and later retries scale their existing base delays by a random factor between 0.5 and 1.5. - #2124 (@​RaphaelFakhri)

• Publishing a backup codec now sends correctly sized video layers on that codec's own entry. Before this fix the layers were zero sized, on a field the server ignores. - #2137 (@​lukasIO)

• When an SEI or AUD NALU precedes the slice, encrypt h264 frames from the correct offset. Those NALUs read as h265 slice types, so detection returned h265 and the unencrypted prefix ended inside the leading NALU. The slice header was encrypted and no error was raised. The frame bytes now take precedence over a caller-supplied codec. The sender cryptor is also seeded with the publish codec for h264 and h265. A fallback to VP8 handling now logs the first bytes of the frame. - #2131 (@​lukasIO)

• Do not leave half of a surrogate pair when truncating an RpcError message or data to its byte limit - #2126 (@​RaphaelFakhri)

• Cancel in-flight full reconnects when the engine closes, preventing delayed cleanup, region failover, or join responses from reopening a disconnected session. Honor cancellation before opening a signal transport. - #2095 (@​horvatz)

• Fix E2EE H.264/H.265 decryption failing for encoders that emit 3-byte Annex B start codes (e.g. Intel Quick Sync on Windows). The sender now rewrites them to 4-byte start codes in the unencrypted header, matching what the receiver's depacketizer reconstructs. - #2144 (@​1egoman)

• On Chrome, a disconnected microphone now restarts on the OS default input instead of the first enumerated device. If a restart fails after the user stopped the track, the capture device no longer stays live - #2138 (@​lukasIO)

• fix: lower timeout for validating connection errors and guard against locking - #2148 (@​lukasIO)

• Error in-flight incoming data streams when the room disconnects instead of leaving readers pending - #2125 (@​RaphaelFakhri)

• fix safari specific issue where data channel could change after waiting for headroom - #2130 (@​1egoman)

• Lower the camera x-google-start-bitrate hint further when the browser reports a slow connection (navigator.connection.effectiveType, Chromium only): 300 kbps for 2g and slow-2g, 500 kbps for 3g. The lower of this and the connection setup time cap applies; 4g and browsers without the API keep the setup time cap alone, and screen share stays uncapped. - #2149 (@​changt)

Changelog

Sourced from livekit-client's changelog.

2.23.0

Minor Changes

• Release the audio contexts and web audio graphs the SDK creates. Previously they accumulated over mute/unmute cycles. They are now collected after room.disconnect(). - #2029 (@​lukasIO)

  • detectSilence tears its context down on the throw path as well as the happy one.
  • The cleanup from createAudioAnalyser disconnects its nodes before it closes the context, and it is now idempotent.
  • The shared empty audio stream track is refcounted. releaseEmptyAudioStreamTrack is a new export, and its context closes once the last clone is handed back.
  • If webAudioMix is an object without an audioContext, a room now closes the context it created for itself.
  • When the underlying track is replaced, audio processors are passed the audio context. This lets them rebuild their filter nodes on unmute. Previously they left the old nodes behind.
  • The iOS dummy audio element and its visibilitychange listener are torn down on disconnect. Previously the listener outlived every room on the page.

  This also fixes a false AudioSilenceDetected. Silence detection read a zero-filled buffer from a context that never reached running. An autoplay-blocked page therefore reported silence on every track it checked.

  Three further behavior changes to be aware of:

  • A track retained across rooms loses its audio processor. room.disconnect({ stopTracks: false }) detaches the track from the audio context, which stops the processor. Call setProcessor again after you republish the track.
  • Under webAudioMix, every attached element is muted, not only the first one. A second attached element no longer plays the track twice. When the audio context goes away, those elements are unmuted again and their volume is restored.
  • Participant.setAudioContext and LocalAudioTrack.setAudioContext now return a promise. Both are marked @internal, but both appear in the published type declarations.

Patch Changes

• Scale the x-google-start-bitrate hint by connection setup time: the 1 Mbps camera cap now applies to connections that set up within 1.5 s and ramps linearly down to 300 kbps at 3.5 s or slower; screen share stays uncapped. - #2146 (@​changt)

• Add jitter to reconnect retries in the default reconnect policy, including the first retry and reconnects requested by the server, so clients that disconnect together don't reconnect at the same time. The first retry waits a random 0 to 500 ms, and later retries scale their existing base delays by a random factor between 0.5 and 1.5. - #2124 (@​RaphaelFakhri)

• Publishing a backup codec now sends correctly sized video layers on that codec's own entry. Before this fix the layers were zero sized, on a field the server ignores. - #2137 (@​lukasIO)

• When an SEI or AUD NALU precedes the slice, encrypt h264 frames from the correct offset. Those NALUs read as h265 slice types, so detection returned h265 and the unencrypted prefix ended inside the leading NALU. The slice header was encrypted and no error was raised. The frame bytes now take precedence over a caller-supplied codec. The sender cryptor is also seeded with the publish codec for h264 and h265. A fallback to VP8 handling now logs the first bytes of the frame. - #2131 (@​lukasIO)

• Do not leave half of a surrogate pair when truncating an RpcError message or data to its byte limit - #2126 (@​RaphaelFakhri)

• Cancel in-flight full reconnects when the engine closes, preventing delayed cleanup, region failover, or join responses from reopening a disconnected session. Honor cancellation before opening a signal transport. - #2095 (@​horvatz)

• Fix E2EE H.264/H.265 decryption failing for encoders that emit 3-byte Annex B start codes (e.g. Intel Quick Sync on Windows). The sender now rewrites them to 4-byte start codes in the unencrypted header, matching what the receiver's depacketizer reconstructs. - #2144 (@​1egoman)

• On Chrome, a disconnected microphone now restarts on the OS default input instead of the first enumerated device. If a restart fails after the user stopped the track, the capture device no longer stays live - #2138 (@​lukasIO)

• fix: lower timeout for validating connection errors and guard against locking - #2148 (@​lukasIO)

• Error in-flight incoming data streams when the room disconnects instead of leaving readers pending - #2125 (@​RaphaelFakhri)

• fix safari specific issue where data channel could change after waiting for headroom - #2130 (@​1egoman)

• Lower the camera x-google-start-bitrate hint further when the browser reports a slow connection (navigator.connection.effectiveType, Chromium only): 300 kbps for 2g and slow-2g, 500 kbps for 3g. The lower of this and the connection setup time cap applies; 4g and browsers without the API keep the setup time cap alone, and screen share stays uncapped. - #2149 (@​changt)

Commits

• b6b9210 Version Packages (#2145)
• 5ad048a Additionally use browser effective connection type in determining start bitra...
• 866072d fix: cancel in-flight full reconnects when the engine closes (#2095)
• 23e3afb fix: add proportional jitter to default reconnect delays (#2124)
• 6047746 fix(data-channel): send on the current handle after waiting for headroom (#2130)
• da86e21 fix: consistently clean up audio contexts and graphs (#2029)
• d325ced Seed the E2EE sender cryptor with the publish codec (#2131)
• fb8e5b3 fix: lower timeout for validating connection errors and guard against locking...
• 6c20018 fix: avoid splitting surrogate pairs when truncating RpcError text (#2126)
• 930942c Scale the video start bitrate hint by connection setup time (#2146)
• Additional commits viewable in compare view

Updates livekit-server-sdk from 2.19.1 to 2.19.2

Release notes

Sourced from livekit-server-sdk's releases.

livekit-server-sdk@2.19.2

Patch Changes

• update dependencies - #752 (@​davidzhao)

Changelog

Sourced from livekit-server-sdk's changelog.

2.19.2

Patch Changes

• update dependencies - #752 (@​davidzhao)

Commits

• 73cc2c1 Version Packages (#753)
• 95fc537 update dependencies (#752)
• See full diff in compare view

Updates three from 0.186.1 to 0.187.0

Commits

• See full diff in compare view

Updates @types/three from 0.186.0 to 0.187.0

Commits

• See full diff in compare view

Updates three-mesh-bvh from 0.9.16 to 0.9.18

Release notes

Sourced from three-mesh-bvh's releases.

v0.9.18

Added

• BVHComputeData: "raycastAnyHit" function that ends traversal at the first hit, for shadow and occlusion rays.
• BVHComputeData: "getShapecastFn" range callbacks can return "STOP_TRAVERSAL" to end the traversal early.

Fixed

• BVHComputeData: "raycastFirstHit" no longer misses bounds for axis-parallel rays that lie on a bounds face.
• BVHHelper: No longer generates infinite positions for a BVH with empty bounds, such as one built from an empty geometry.

v0.9.17

Added

• BVHComputeData: "updateAsync" so a "getBVH" override can build BVHs asynchronously.

Changed

• SAH builds are faster: 8 bins per axis and an exact sweep for small nodes.
• BVH builds write nodes directly into the packed buffer instead of an intermediate node tree, using a fraction of the memory.

Fixed

• MeshBVH: Raycasts no longer test triangles when the ray misses a root that is a leaf.
• OrientedBox: Fixed "distanceToBox" using the wrong axis for one set of box edges.
• ExtendedTriangle: Fixed "closestPointToSegment" returning a positive distance for segments that pass through the triangle.

Changelog

Sourced from three-mesh-bvh's changelog.

[0.9.18] - 2026-11-03

Added

• BVHComputeData: "raycastAnyHit" function that ends traversal at the first hit, for shadow and occlusion rays.
• BVHComputeData: "getShapecastFn" range callbacks can return "STOP_TRAVERSAL" to end the traversal early.

Fixed

• BVHComputeData: "raycastFirstHit" no longer misses bounds for axis-parallel rays that lie on a bounds face.
• BVHHelper: No longer generates infinite positions for a BVH with empty bounds, such as one built from an empty geometry.

[0.9.17] - 2026-10-28

Added

• BVHComputeData: "updateAsync" so a "getBVH" override can build BVHs asynchronously.

Changed

• SAH builds are faster: 8 bins per axis and an exact sweep for small nodes.
• BVH builds write nodes directly into the packed buffer instead of an intermediate node tree, using a fraction of the memory.

Fixed

• MeshBVH: Raycasts no longer test triangles when the ray misses a root that is a leaf.
• OrientedBox: Fixed "distanceToBox" using the wrong axis for one set of box edges.
• ExtendedTriangle: Fixed "closestPointToSegment" returning a positive distance for segments that pass through the triangle.

Commits

• 1d92383 0.9.18
• 4bba9ca Update CHANGELOG for 0.9.18
• d163819 Use numeric constants
• 3b4d8c7 Merge pull request #955 from bhouston/webgpu-nearest-first-traversal
• 0a46e3d WebGPU: Use fixed names for the ray scalar variables, update CHANGELOG
• 0eb5f88 WebGPU: Define the ray transform functions in place instead of sharing them t...
• e6ac6f7 Make a any hit function that doesn't require a result struct
• 260bad9 Merge remote-tracking branch 'origin/master' into webgpu-nearest-first-traversal
• 03ba01a WebGPU: Let range callbacks control shapecast termination
• 951d8d7 BVHHelper: Match empty bounds checks, update CHANGELOG
• Additional commits viewable in compare view

Updates @types/node from 24.19.2 to 26.6.6

Commits

• See full diff in compare view

Updates @types/three from 0.186.0 to 0.187.0

Commits

• See full diff in compare view

Updates eslint from 10.12.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])

... (truncated)

Commits

• 12cbff4 10.14.0
• 6b696e7 Build: changelog update for 10.14.0
• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
• 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
• dab466e docs: Update README
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419)
• Additional commits viewable in compare view

Updates globals from 17.13.0 to 17.14.0

Release notes

Sourced from globals's releases.

v17.14.0

• Update globals (2026-11-01) (#355) 7abfb5d

---

sindresorhus/globals@v17.13.0...v17.14.0

Commits

• 3080111 17.14.0
• c61cc23 Tweaks
• 7abfb5d Update globals (2026-11-01) (#355)
• See full diff in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates typescript-eslint from 8.71.2 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (