chore(deps)(deps-dev): bump the lint group across 1 directory with 4 updates

[dependabot]

Bumps the lint group with 4 updates in the /apps/api directory: eslint, eslint-plugin-sonarjs, eslint-plugin-unicorn and prettier.

Updates eslint from 10.6.0 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

Commits

• fabd99b 10.7.0
• 37c5e75 Build: changelog update for 10.7.0
• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076)
• 81a4774 chore: updates for v9.39.5 release
• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071)
• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032)
• c30d808 docs: Update README
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067)
• Additional commits viewable in compare view

Updates eslint-plugin-sonarjs from 4.1.0 to 4.2.0

Changelog

Sourced from eslint-plugin-sonarjs's changelog.

Release Guide

SonarJS currently has two distinct release targets:

Target	Artifact	Main workflow	Notes
Standard SonarQube analyzer	Maven/JAR release artifacts	.github/workflows/automated-release.yml	This is the normal SonarJS release flow.
SQAA (previously A3S)	Docker image for LanguageAnalyzerService	.github/workflows/docker-sqaa.yml	Manual SQAA-only entry point and fallback.

Terminology

• SQAA is the current name for what older docs and repository names still call A3S.
• Some external identifiers still keep the legacy a3s name for compatibility. The important ones are:
  • the Docker repository path a3s/analysis/javascript
  • packages/grpc/src/proto/language_analyzer.proto with option java_package = "com.sonarsource.a3s.analyzer.grpc";
• Do not rename those compatibility-sensitive identifiers as part of a routine release.

Standard SonarQube Analyzer Release

This is the regular SonarJS analyzer release. It produces the standard SonarQube analyzer artifacts and can also automate the SQAA handoff using the same build number.

Entry points

1. Start .github/workflows/automated-release.yml.
2. That workflow orchestrates the release and then calls .github/workflows/release.yml for the actual artifact publication.
3. After the release succeeds, .github/workflows/bump-versions.yml opens the next development iteration PR.

What .github/workflows/automated-release.yml does

The SonarJS workflow is a thin wrapper around SonarSource/release-github-actions/.github/workflows/automated-release.yml@v1 with SonarJS-specific inputs:

• project name SonarJS
• plugin name javascript
• Jira project JS
• optional SQC and SQS integration PRs
• optional SQAA integration, enabled in the SonarJS wrapper and implemented by a custom local workflow
• SLVS, SLVSCODE, SLE, and SLI integration tickets enabled
• the generic release-github-actions SQAA integration explicitly disabled, because SonarJS uses analysis/js_ts_image_tag instead of gradle/sonar-plugins.versions.toml

The reusable workflow performs the following steps:

1. Freeze the target branch.
2. Run the releasability checks with SonarSource/gh-action_releasability@v3.
3. Resolve the release version with get-release-version.
4. Resolve the Jira version with get-jira-version.
5. Generate Jira-based release notes with get-jira-release-notes unless explicit notes were provided.
6. Create the REL Jira ticket with create-jira-release-ticket.
7. Publish the GitHub release with publish-github-release.
8. Unfreeze the branch.
9. Release the Jira version, create the next Jira version, and move the REL ticket to Technical Release Done.

... (truncated)

Commits

• See full diff in compare view

Updates eslint-plugin-unicorn from 71.1.0 to 72.0.0

Release notes

Sourced from eslint-plugin-unicorn's releases.

v72.0.0

Breaking

• prefer-minimal-ternary: Rename checkVaryingCallee option to checkVaryingBase (#3508) 825b7b9b

New rules

• no-missing-local-resource (#3528) 12a33c61
• no-multiple-promise-resolver-calls (#3523) 81ab092c
• no-shorthand-property-overrides (#3527) 91a4c4d9
• no-transition-all (#3529) 5ef2fcf0
• no-unnecessary-string-trim (#3517) a6516727
• no-useless-re-export (#3540) 96afe553
• prefer-explicit-viewport-units (#3532) 449e6369
• prefer-then-catch (#3526) a17e5a29
• require-frontmatter-fields (#3525) dfd91cdd

Improvements

• Improve performance (#3531) 8233f950
• consistent-boolean-name: Support Vue refs (#3555) 79e79d5f
• no-incorrect-template-string-interpolation: Ignore Unicode code point escapes (#3513) 36fdf1aa
• no-negated-comparison: Ignore relational comparisons with optional chaining (#3512) 7b7e28a7
• no-top-level-side-effects: Ignore <script setup> (#3542) af8fd60b
• no-unnecessary-array-flat-map: Handle TypeScript Vue files (#3545) b6d01a0b
• no-unsafe-property-key: Use type information for narrowed property keys (#3515) 69a6002e
• no-unused-array-method-return: Ignore expect assertions (#3552) 110cc582
• no-useless-promise-resolve-reject: Handle awaited calls (#3504) 9b8a1440
• no-useless-template-literals: Ignore const assertions (#3543) 43672287
• prefer-await: Add async IIFE suggestion (#3550) 305fb4bc
• prefer-dom-node-html-methods: Add options and add to recommended preset (#3541) 581ef479
• prefer-export-from: Preserve JSDoc comments on single-const re-exports (#3544) e273ab63
• prefer-short-arrow-method: Add consistent-as-needed option (#3514) c0687455
• prefer-simple-condition-first: Fix logic (#3530) a339abe8
• prefer-split-limit: Support array destructuring (#3554) b23f959e
• prefer-string-starts-ends-with: Detect slice comparisons (#3518) 98730de6
• prefer-minimal-ternary: Don't report object-varying member access by default (#3508) 825b7b9b

---

sindresorhus/eslint-plugin-unicorn@v71.1.0...v72.0.0

Commits

• 0b9a9af 72.0.0
• 79e79d5 consistent-boolean-name: Support Vue refs (#3555)
• b23f959 prefer-split-limit: Support array destructuring (#3554)
• 110cc58 no-unused-array-method-return: Ignore expect assertions (#3552)
• 305fb4b prefer-await: Add async IIFE suggestion (#3550)
• a1615b6 Update defineConfig config docs (#3524)
• 6ae0e95 prefer-await: Show exact solutions to incorrect code in docs (#3546)
• 4367228 no-useless-template-literals: Ignore const assertions (#3543)
• b6d01a0 no-unnecessary-array-flat-map: Handle TypeScript Vue files (#3545)
• e273ab6 prefer-export-from: Preserve JSDoc comments on single-const re-exports (#3544)
• Additional commits viewable in compare view

Updates prettier from 3.9.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

• b6c7d18 Release 3.9.5
• cd54ccc Avoid corrupting empty Markdown link with title (#19487)
• 2bb67ce Preserving comments' placement property (#19567)
• 91bcac8 Add more tests for comment-only object type (#19587)
• cbee737 Remove space in empty object type (#19583)
• 6394c73 Align empty module declaration with TS (#19568)
• a4e6f7a Prevent the addition of space in type() with + (#19516)
• 3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
• 908503e Handle dangling comments in SwitchStatement (#19581)
• 943a475 Angular: Support expression for exhaustive typechecking (#19571)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[agjs]

Superseded by #335 — batched into a single deps PR to avoid serial lockfile merge conflicts.

[agjs]

Closing in favor of #335.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml