chore(deps): bump the npm-dependencies group across 1 directory with 12 updates

[dependabot]

Bumps the npm-dependencies group with 12 updates in the / directory:

Package	From	To
@astrojs/cloudflare	14.2.0	14.3.1
astro	7.2.0	7.3.2
fast-xml-parser	5.10.1	5.11.1
jose	6.2.8	6.2.12
marked	18.0.9	18.0.12
@types/node	26.2.0	26.5.0
eslint	10.8.1	10.10.0
globals	17.9.0	17.12.0
typescript	6.0.3	7.0.2
typescript-eslint	8.67.0	8.70.0
vitest	4.1.10	5.0.0
wrangler	4.120.1	4.130.0

Updates @astrojs/cloudflare from 14.2.0 to 14.3.1

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.3.1

Patch Changes

• #17914 a400504 Thanks @​astro-factory! - Fixes a build crash when a custom worker entrypoint exports Durable Object classes alongside prerendered pages. The prerender worker no longer inherits durable_objects, migrations, or workflows from the entry worker config.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.0

Minor Changes

• #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

  Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

• #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

  Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

  import { astro, FetchState } from 'astro/fetch';
  import { cf, finalize } from '@astrojs/cloudflare/fetch';
  export default {
  async fetch(request: Request, env: Env, context: ExecutionContext) {
  const state = new FetchState(request);
  const asset = await cf(state, env, context);
  if (asset) return asset;
  return finalize(state, await astro(state));
  
  },
  };

  The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

• #17895 41b88ac Thanks @​astro-factory! - Fixes cold astro dev crashes by adding astro/app/manifest and @astrojs/cloudflare/cache/provider to the optimizeDeps.include list

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.6

Patch Changes

• #17854 07b919f Thanks @​ematipico! - Added @astrojs/prism to the list of dependencies to optimise. The dev server is now faster for sites that use Prism as code highlighter.

• #17850 1301c37 Thanks @​matthewp! - Fixes React SSR failures on the first Cloudflare dev request when JSON logging is enabled

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.3.1

Patch Changes

• #17914 a400504 Thanks @​astro-factory! - Fixes a build crash when a custom worker entrypoint exports Durable Object classes alongside prerendered pages. The prerender worker no longer inherits durable_objects, migrations, or workflows from the entry worker config.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

14.3.0

Minor Changes

• #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

  Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

• #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

  Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

  import { astro, FetchState } from 'astro/fetch';
  import { cf, finalize } from '@astrojs/cloudflare/fetch';
  export default {
  async fetch(request: Request, env: Env, context: ExecutionContext) {
  const state = new FetchState(request);
  const asset = await cf(state, env, context);
  if (asset) return asset;
  return finalize(state, await astro(state));
  
  },
  };

  The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

• #17895 41b88ac Thanks @​astro-factory! - Fixes cold astro dev crashes by adding astro/app/manifest and @astrojs/cloudflare/cache/provider to the optimizeDeps.include list

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

14.2.6

Patch Changes

• #17854 07b919f Thanks @​ematipico! - Added @astrojs/prism to the list of dependencies to optimise. The dev server is now faster for sites that use Prism as code highlighter.

... (truncated)

Commits

• aa4949e [ci] release (#17915)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• 9870f95 [ci] format
• a400504 fix(cloudflare): exclude durable_objects, migrations, and workflows from prer...
• f800de1 [ci] release (#17881)
• 41b88ac fix(cloudflare): prebundle astro/app/manifest and cache provider in optimizeD...
• 35aa62e Add finalize() fetch handler to Cloudflare (#17887)
• 15e2deb Support build concurrency with the incremental build cache (#17795)
• 2fdf731 [ci] release (#17849)
• 76eff3d fix: cache headers (#17878)
• Additional commits viewable in compare view

Updates astro from 7.2.0 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

astro@7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { CacheProvider } from 'astro';
  const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

• aa4949e [ci] release (#17915)
• 42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
• a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
• 92f23cc [ci] release (#17900)
• 0389640 fix: dont use internal paths (#17899)
• f800de1 [ci] release (#17881)
• 1e0b7e6 [ci] format
• 4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
• Additional commits viewable in compare view

Updates fast-xml-parser from 5.10.1 to 5.11.1

Release notes

Sourced from fast-xml-parser's releases.

v5.11.1

What's Changed

• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#858
• Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#856
• Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#854
• docs: fix two 404 documentation links by @​rajanpanth in NaturalIntelligence/fast-xml-parser#862

New Contributors

• @​rajanpanth made their first contribution in NaturalIntelligence/fast-xml-parser#862

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

v5.11.0

What's Changed

• add support for endIndex in node metadata (5.x edition) by @​Wain-PC in NaturalIntelligence/fast-xml-parser#850
• fix: don't crash on a closing tag with no matching opening tag by @​hdimer in NaturalIntelligence/fast-xml-parser#861

New Contributors

• @​Wain-PC made their first contribution in NaturalIntelligence/fast-xml-parser#850
• @​hdimer made their first contribution in NaturalIntelligence/fast-xml-parser#861

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.1 / 2026-08-27

• fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

• feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
• fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
• fix: DOCTYPE to read SYSTEM/PUBLIC
• deps: strnum v2.4.2

5.10.1 / 2026-07-17

• fix: multiple DOCTYPE declarations.
• deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

• upgrade:
  • xml-naming v0.3.0: cache support
  • PEM v1.6.2: sibling bug fix
  • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

• update strnum

*5.9.2 / 2026-06-17

• dummy release to test changes in github action

*5.9.1 / 2026-06-17

• dummy release to test release from github action

*5.9.0 / 2026-06-15

• update strnum to 2.3.0
  • you can set hex, binary, enotation, infinity, unicode
• validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

• integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
  • This will consider xml-version as well. '1.0' is default
• update strnum to 2.3.0
  • You can set octal and binary parsing which is bydeault off
• update fast-xml-builder to 1.2.0
  • can sanitize tag names if found invalid
  • fix format output

5.7.3 / 2006-05-05

• fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

... (truncated)

Commits

• 3617550 5.11.1
• 6021128 update for release
• 6ddcb65 remove regex from validator
• 7d60815 docs: fix two 404 documentation links (#862)
• 4e3857b Bump actions/setup-node from 6.4.0 to 7.0.0 (#854)
• fcc62fb Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 (#856)
• 23a9019 Bump actions/checkout from 7.0.0 to 7.0.1 (#858)
• f3c69ae 5.11.0
• fdbd072 update for release
• c5fcb5b update lock files
• Additional commits viewable in compare view

Updates jose from 6.2.8 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

• clarify and shorten public API guidance (be62530)

Refactor

• simplify JWS and JWE operation cores (92e9640)

Performance

• avoid copying AES-GCM output (6925d43)
• deduplicate pending jwks key imports (bf5138b)
• encode single-signature JWS input once (7bc9a33)
• normalize General JWE shared headers once (78637bd)
• normalize jwks selection metadata once (fd3ae3f)
• use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

• render subpath indexes as tables (94589ee)
• shorten API index descriptions (681482f)

Refactor

• model JWE key management modes (e01dda6)
• types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits

• 505a55b chore(release): 6.2.12
• 7bc9a33 perf: encode single-signature JWS input once
• 78637bd perf: normalize General JWE shared headers once
• bf5138b perf: deduplicate pending jwks key imports
• b23a6f3 perf: use native encoding for larger ASCII strings
• fd3ae3f perf: normalize jwks selection metadata once
• 6925d43 perf: avoid copying AES-GCM output
• be62530 docs: clarify and shorten public API guidance
• 1b41312 build: preserve README when generation fails
• 0b51829 build: check tree-shaking for every public binding
• Additional commits viewable in compare view

Updates marked from 18.0.9 to 18.0.12

Release notes

Sourced from marked's releases.

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#4084) (4417582)
• allow one more level of nested brackets in a link label (#4064) (37b28d8)
• do not add a newline to an empty code block (#4073) (23b1706)
• escape character references in autolink destinations (#4053) (8f432f0)
• reject GFM email autolink when the domain ends in _ or - (#4063) (df57534)
• reject invalid characters in HTML tag names (#4083) (300bb1d)
• remove up to the fence indentation from each content line (#4074) (0244f08)

v18.0.11

18.0.11 (2026-08-24)

Bug Fixes

• do not nest a link inside a link (#4051) (e250e31)
• inlineTokens rebuilds the reflink-mask preamble per call (#4040) (0653c24)
• keep emphasis in the text of a rejected reference link (#4059) (b699db3)

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

• keep the em/strong mask the same length as the source (#4044) (681373c)
• parse EOF backtick fences after paragraphs (#4039) (81bd750)
• place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

Commits

• 24bf47c chore(release): 18.0.12 [skip ci]
• 475ba3d chore(deps-dev): bump eslint from 10.9.1 to 10.10.0 (#4088)
• 4417582 fix: allow a tab before the closing sequence of an ATX heading (#4084)
• 23b1706 fix: do not add a newline to an empty code block (#4073)
• df57534 fix: reject GFM email autolink when the domain ends in _ or - (#4063)
• 37b28d8 fix: allow one more level of nested brackets in a link label (#4064)
• 8f432f0 fix: escape character references in autolink destinations (#4053)
• 44ddc31 docs: add inspect.software health badge (#4062)
• 0244f08 fix: remove up to the fence indentation from each content line (#4074)
• 300bb1d fix: reject invalid characters in HTML tag names (#4083)
• Additional commits viewable in compare view

Updates @types/node from 26.2.0 to 26.5.0

Commits

• See full diff in compare view

Updates eslint from 10.8.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

• 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

• ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

• 3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

v10.9.0

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

... (truncated)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)