chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates

[dependabot]

Bumps the dev-dependencies group with 9 updates in the / directory:

Package	From	To
@eslint-react/eslint-plugin	5.9.3	5.10.4
conventional-changelog-conventionalcommits	9.3.1	10.2.0
eslint	10.5.0	10.6.0
prettier	3.8.5	3.9.4
typescript-eslint	8.62.0	8.62.1
webpack	5.108.1	5.108.3
webpack-dev-server	5.2.5	5.2.6
@types/node	26.0.0	26.1.0
testcontainers	12.0.3	12.0.4

Updates @eslint-react/eslint-plugin from 5.9.3 to 5.10.4

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.10.4 (2026-07-04)

What's Changed

🐞 Fixes

• Fixed react-x/no-misused-capture-owner-stack not recognizing process.env.NODE_ENV checks wrapped in TypeScript type expressions such as (process.env as any).NODE_ENV. (#1813)
• Fixed Extract.getFullyQualifiedName to unwrap TSAsExpression, TSTypeAssertion, TSNonNullExpression, and ChainExpression before resolving names. This improves name resolution for rules that identify React APIs or collect component/hook names through type-wrapped expressions.

Full Changelog: Rel1cx/eslint-react@v5.10.3...v5.10.4

Attestation

https://github.com/Rel1cx/eslint-react/attestations/33874614

v5.10.3 (2026-07-04)

What's Changed

🏗️ Internal

• Bumped typescript-eslint packages to ^8.62.1.
• Bumped @effect/language-service to ^0.86.3.
• Bumped undici and undici-types to ^8.6.0.
• Updated the @eslint-react/eslint-plugin package description.

Full Changelog: Rel1cx/eslint-react@v5.10.2...v5.10.3

Attestation

https://github.com/Rel1cx/eslint-react/attestations/33846197

v5.10.2 (2026-07-03)

What's Changed

🐞 Fixes

• Fixed an issue where several rules treated computed identifier keys in spread props (e.g. <div {...{ [key]: value }} />) as static prop names. The actual property name is the runtime value of the variable; computed string literal keys are still recognized. Affected rules:
  • react-x/no-missing-key
  • react-jsx/no-children-prop-with-children
  • react-jsx/no-children-prop
  • react-jsx/no-useless-fragment
  • react-dom/no-dangerously-set-innerhtml-with-children
  • react-dom/no-dangerously-set-innerhtml
  • react-dom/no-missing-button-type
  • react-dom/no-missing-iframe-sandbox
  • react-dom/no-string-style-prop

... (truncated)

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.10.4 (2026-07-04)

🐞 Fixes

• Fixed react-x/no-misused-capture-owner-stack not recognizing process.env.NODE_ENV checks wrapped in TypeScript type expressions such as (process.env as any).NODE_ENV. (#1813)
• Fixed Extract.getFullyQualifiedName to unwrap TSAsExpression, TSTypeAssertion, TSNonNullExpression, and ChainExpression before resolving names. This improves name resolution for rules that identify React APIs or collect component/hook names through type-wrapped expressions.

Full Changelog: Rel1cx/eslint-react@v5.10.3...v5.10.4

v5.10.3 (2026-07-04)

🏗️ Internal

• Bumped typescript-eslint packages to ^8.62.1.
• Bumped @effect/language-service to ^0.86.3.
• Bumped undici and undici-types to ^8.6.0.
• Updated the @eslint-react/eslint-plugin package description.

Full Changelog: Rel1cx/eslint-react@v5.10.2...v5.10.3

v5.10.2 (2026-07-03)

🐞 Fixes

• Fixed an issue where several rules treated computed identifier keys in spread props (e.g. <div {...{ [key]: value }} />) as static prop names. The actual property name is the runtime value of the variable; computed string literal keys are still recognized. Affected rules:
  • react-x/no-missing-key
  • react-jsx/no-children-prop-with-children
  • react-jsx/no-children-prop
  • react-jsx/no-useless-fragment
  • react-dom/no-dangerously-set-innerhtml-with-children
  • react-dom/no-dangerously-set-innerhtml
  • react-dom/no-missing-button-type
  • react-dom/no-missing-iframe-sandbox
  • react-dom/no-string-style-prop
  • react-dom/no-unsafe-iframe-sandbox
  • react-dom/no-unsafe-target-blank
  • react-dom/no-void-elements-with-children
  • react-web-api/no-leaked-event-listener
  • react-web-api/no-leaked-fetch
• Fixed react-x/unsupported-syntax to no longer report IIFEs in JSX. This makes the rule consistent with the upstream react-hooks/unsupported-syntax and removes the iife message.

✨ New

• react-x/unsupported-syntax now detects eval calls via globalThis.eval, globalThis["eval"], and type assertions like (globalThis as any).eval.

🏗️ Internal

• Added an optional resolve parameter to Extract.getPropertyName so callers can control how identifier and private identifier property names are resolved.
• Added unit tests for Extract.getPropertyName.

... (truncated)

Commits

• 499b5e6 release: 5.10.4
• a4130ee release: 5.10.3
• fa53e93 chore(eslint-plugin): update package description
• 3d6f501 release: 5.10.2
• ecb5626 release: 5.10.1
• 9973045 fix: static-components rule is missing from `disable-conflict-eslint-plugin...
• 3a5e3af release: 5.10.0
• 62e9345 release: 5.9.5
• 0f9f809 refactor: unify member expression property name checks with Extract.getProper...
• See full diff in compare view

Updates conventional-changelog-conventionalcommits from 9.3.1 to 10.2.0

Release notes

Sourced from conventional-changelog-conventionalcommits's releases.

conventional-changelog-conventionalcommits: v10.2.0

Features

• support changelog preamble partial (#1491) (e93dbe4)

conventional-changelog-conventionalcommits: v10.1.0

Features

• support changelog preamble (#1489) (7d9794f)

conventional-changelog-conventionalcommits: v10.0.0

⚠ BREAKING CHANGES

• the commit type effect property replaces the hidden commit type property and the bumpStrict preset option for controlling changelog visibility and version bumps.

Fixes #1476.

• Handlebars template strings and partial files were replaced with render functions.
• packages now require Node.js 22 or newer.

Features

• replace handlebars templates with render functions (#1477) (55e6716)
• require node 22 (de5e136)
• support commit type effects (#1484) (78761ae)

Bug Fixes

• encode compare URL tags (#1483) (96bf235)
• render non-closing references separately (#1482) (adb2c69)
• sort notes without compare-func (#1487) (dc78285)

Changelog

Sourced from conventional-changelog-conventionalcommits's changelog.

10.2.0 (2026-06-27)

Features

• support changelog preamble partial (#1491) (e93dbe4)

10.1.0 (2026-06-27)

Features

• support changelog preamble (#1489) (7d9794f)

10.0.0 (2026-06-26)

⚠ BREAKING CHANGES

• the commit type effect property replaces the hidden commit type property and the bumpStrict preset option for controlling changelog visibility and version bumps.

Fixes #1476.

• Handlebars template strings and partial files were replaced with render functions.
• packages now require Node.js 22 or newer.

Features

• replace handlebars templates with render functions (#1477) (55e6716)
• require node 22 (de5e136)
• support commit type effects (#1484) (78761ae)

Bug Fixes

• encode compare URL tags (#1483) (96bf235)
• render non-closing references separately (#1482) (adb2c69)
• sort notes without compare-func (#1487) (dc78285)

Commits

• 69b0d36 chore(release): monorepo release (#1492)
• e93dbe4 feat(conventional-changelog-angular,conventional-changelog-conventionalcommit...
• f72f5e2 chore(release): monorepo release (#1490)
• 7d9794f feat(conventional-changelog-angular,conventional-changelog-conventionalcommit...
• ed9862d chore(release): monorepo release (#1474)
• dc78285 fix(conventional-changelog-angular,conventional-changelog-conventionalcommits...
• f9195d5 fix(conventional-commits-parser,template): keep footers out of breaking notes...
• 78761ae feat(conventional-changelog-conventionalcommits)!: support commit type effect...
• 96bf235 fix(template,conventional-changelog-angular,conventional-changelog-convention...
• adb2c69 fix(conventional-changelog-conventionalcommits): render non-closing reference...
• Additional commits viewable in compare view

Updates eslint from 10.5.0 to 10.6.0

Release notes

Sourced from eslint's releases.

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

Commits

• 5d12a04 10.6.0
• f7ca54b Build: changelog update for 10.6.0
• 6a42034 ci: run ecosystem tests on main branch (#20891)
• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014)
• c3abfca chore: correct JSDoc param types in html formatter (#21018)
• a83683d docs: Update README
• a832320 ci: split ecosystem tests into separate jobs (#21001)
• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013)
• Additional commits viewable in compare view

Updates prettier from 3.8.5 to 3.9.4

Release notes

Sourced from prettier's releases.

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

Changelog

Sourced from prettier's changelog.

3.9.4

diff

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

<!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
@​content(icon) {
<span>Icon!</span>
}
@​content(description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
@​content (icon) {
<span>Icon!</span>
}
@​content (description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>

3.9.3

diff

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @​seiyab)

</tr></table> 

... (truncated)

Commits

• b693cb2 Release 3.9.4
• 2e92ac0 Angular: Format @content(name) -> @content (name) to align with other blo...
• abed2c2 Bump Prettier dependency to 3.9.3
• 6cfbc00 Clean changelog_unreleased
• 3732e1d Release 3.9.3
• a74a7b0 Allow decorators to be used with declare on class fields (#19492)
• bd9e11a Correct text identification in liquid syntax (#19489)
• 269eee3 Bump Prettier dependency to 3.9.1
• ec7ccd1 Clean changelog_unreleased
• c47654c Release 3.9.1
• Additional commits viewable in compare view

Updates typescript-eslint from 8.62.0 to 8.62.1

Release notes

Sourced from typescript-eslint's releases.

v8.62.1

8.62.1 (2026-06-29)

🩹 Fixes

• eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#12328)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)
• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger
• mdm317
• Patrick Aleite
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.62.1 (2026-06-29)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 3ea32f4 chore(release): publish 8.62.1
• See full diff in compare view

Updates webpack from 5.108.1 to 5.108.3

Release notes

Sourced from webpack's releases.

v5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

v5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

Changelog

Sourced from webpack's changelog.

5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

Commits

• 6844305 chore(release): new release (#21304)
• 99286e2 fix: match harmony accept dependencies by module reference (#21303)
• 0abec4d fix: guard HarmonyAcceptDependency against unresolved module ids (#21302)
• 606712d perf(css): struct-of-arrays AST for the streaming CSS parser (#21285)
• cf9c04e docs: update examples (#21293)
• 4dfe770 chore(release): new release (#21287)
• 7534a5e test: add defer import case for #19219 (#21292)
• 9857fc7 fix: lazy barrel for import with side effects (#21291)
• 54fa902 Respect the node: prefix for node.js core modules used as externals (#21286)
• 5e7db5d refactor: extract createHooksRegistry to deduplicate getCompilationHooks patt...
• See full diff in compare view

Updates webpack-dev-server from 5.2.5 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Commits

• 8a37b0e chore(release): new release (#5697)
• f21ed0f fix: handle malformed Host and Origin headers (#5699)
• 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
• 308e853 fix: handle undefined options in Server constructor (#5695)
• 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
• 870ed22 chore: add v5 branch to release workflow triggers
• See full diff in compare view

Updates @types/node from 26.0.0 to 26.1.0

Commits

• See full diff in compare view

Updates testcontainers from 12.0.3 to 12.0.4

Commits

• 4286661 Stop Jest smoke test from flaking on babel/browserslist load (#1395)
• c46ccae Fix container exec output truncation (#1381)
• 8cc4bb5 Reuse insecure HTTP wait agent across retries (#1382)
• aef8483 Bump the dependencies group across 3 directories with 2 updates (#1393)
• 1022d61 Bump the dependencies group with 3 updates (#1394)
• d8c015d Pin Dependabot weekly schedule to Monday (#1392)
• b6e39e2 Document cross-language Testcontainers implementations in AGENTS.md (#1391)
• d6d99a4 NPM audit (#1388)
• e2c6aed Add missing languages and reorder docs navigation (#1385)
• 9130826 Bump the dependencies group across 8 directories with 11 updates (#1386)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[steilerDev]

Security review

VERDICT: INFORMATIONAL (analysis performed on predecessor #1824, same package set minus the excluded @babel/* majors) — no security releases in range; npm audit on the branch lockfile: 0 vulnerabilities (prod and dev); the few new transitives are legitimate registry.npmjs.org packages with no install scripts; no typosquats or registry redirection.

Changelog review

• Breaking: none in this 9-package set. The @babel/* 8.0.1 majors that broke the original group PR (#1824) are excluded — held at v7 until the coordinated Babel 8 migration (#1823); dependabot.yml ignore rule landed in #1840 plus @dependabot ignore commands as bridge.
• Bugfix-relevant: webpack 5.108.x, webpack-dev-server 5.2.6, testcontainers 12.0.4 — patch fixes to build/test infra
• Adoption opportunities: none
• Neutral: eslint 10.6.0, @eslint-react 5.10.4, prettier 3.9.4, typescript-eslint 8.62.1, @types/node 26.1.0 (lint/format are not CI-gated); conventional-changelog-conventionalcommits 10.2.0 is compatible with semantic-release 25 (preset loaded by name, engines satisfied) — watch item: verify release-notes generation on the first beta release after merge, since semantic-release is not exercised by PR CI.

Manual fix included (commit 83e1605)

Dependabot's lockfile generator nested client/node_modules/webpack + webpack-dev-server, crashing the client build with two webpack instances. Fixed by aligning the root overrides webpack-dev-server pin to 5.2.6 (preserves the #1774 security floor), advancing client webpack to 5.108.4 so a single copy hoists for client + Docusaurus, and regenerating the lockfile with full npm install + npm dedupe (zero nested entries, audit clean).

Approved by the /dependabot skill.

[github-actions]

🎉 This PR is included in version 2.13.0-beta.12 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 2.13.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀