[dependabot]

Bumps the development group with 3 updates in the / directory: knip, puppeteer and typescript-eslint.

Updates knip from 6.44.2 to 6.45.0

Release notes

Sourced from knip's releases.

Release 6.45.0

• Load formatly only when formatting files (8aae3cd68bd4e680410f09c5a96a265da4fd2f3b)
• Treat undefined plugin config like an absent key (a75133c635312507dcfb3bc63199266c561535ea)
• Replace Zod with handwritten configuration validation (e868a869e92d2c0324c689d5b284076da9899f32)
• Load configuration parsers and Jiti on demand (a4b45b84d63ae6d119155f3f105caae5b8c8f119)
• Handle CLI help and version before loading the analyzer (78c2c4330b7144d23ecd4112f1274cbb743e24b1)
• Make performance measurements reusable and cover analysis phases (52511b59b72220febcbef77c8cc0c23252fd98cb)
• Show startup overhead alongside run time (2f383b6faf75c9d2f2ea5c71b94e4802bc90aaf2)
• Show config location and reason in configuration hints (2305dad9b0d76e5f603cd353a1820c24ae0e720d)
• Preserve double hyphens in CLI links (#2278) (d6d5cae06b8a58a77948602b1273da89f65081b7) - thanks @​deining!
• Read vue.config.cjs in the Vue plugin (#2282) (a2fabc84ab42be7419e7b3a5af61d306e304b2d5) - thanks @​SwastikTripathi!
• Find dangerfile.mts and Dangerfile.* in the Danger plugin (#2283) (9a133c018cc2dd3f658aa027578878b921cd6a70) - thanks @​SwastikTripathi!
• Add AWS CDK plugin (#2302) (4e2f3c7aee1b9d170a306f65e43c84a6dc4a1de1) - thanks @​clean99!
• Find JavaScript root and route files and remix.config.mjs in the Remix plugin (#2304) (af1dd66e6b8606bb9846dbd35847b3dcf13d019f) - thanks @​SwastikTripathi!
• Find payload.config.js in the Payload CMS plugin (#2311) (eb2f3a0a238df0e1c20c148c5cf86499dfc6a0d9) - thanks @​SwastikTripathi!
• Fix grammar errors and typos (#2313) (2fd0461ad9f9fa06da1c7e3d64fe6b68897add79) - thanks @​deining!
• Skip config and resolve arguments without a value (#2315) (71c16dc98da87b9a6f9c6d29a63eaa04f9c99b03) - thanks @​bytedoe!
• Keep production entries that Vite build.lib.entry also names (#2322) (ab7c6de377a9e013cad04c7bd0404dd22210cab6) - thanks @​itisrmk!
• fix: keep locally used destructured bindings (#2306) (1630312caacb050f7f0ca8e6572bc216e55c15bc) - thanks @​gioboa!
• Treat npm flags without values as booleans in npm exec (8162e346de9ae7116bf4f62004a944e1511990b1)
• Require committed fixtures in TESTS.md (746064ee1701a59d0ab63d9eb275de792af2cae5)
• Skip fromArgs arguments without a value (23bb139749089cdb6f46bb95628a59cb570913de)
• Remove redundant bare --config handling from the Rollup plugin (71383dd1af189efdf87525d21c04a3bb8a36d131)
• Resolve Vite entry files without glob expansion (5f8e6a2ae8309bddaa20267bbac3d4f787e3cdec)
• Resolve literal plugin files through the shared entry resolver (5aeb352e849cae5398c1cc964a7c83e496b7bddd)
• Document export analysis for deferred production entries (83f0ead9eb999873158f1688efc7459a4c088f37)
• Test literal entries across plugins (16771714f75324674186c476c6349f0b8d184639)
• Run astro check on the docs in CI (d75cf39c19e4afca6ba18e219bce7c04d43e584d)
• Report unused subpath imports in package.json (resolve #2317) (a5e3830f3af52e2f8d991e44c48781dbdbed7195)
• Report unused subpath exports with includeSubpathExports (53da7f7c454951d9b7206e860ea24764daa7f95d)
• Resolve pnpm workspace: aliases to their workspace (30cd26cb8f98fe93a06fca434404c7dfbcb4e248)
• Bump @​astrojs/markdown-satteri to 0.4.7 to match satteri 0.11 (22bb83ffb4e4bafa605634908d6962969e67bb28)
• Add every msw.workerDirectory entry in MSW plugin (#2326) (c03f0bff4d4a9ca9ad769c0d5b7eaeb82fd5233b) - thanks @​lukaskourilcz!
• Add Evalite plugin (#2316) (8395746ddd4c2f1ed8d09c3240cc351426c78c57) - thanks @​rafactx!
• Read images.loaderFile and cache handler paths in the Next.js plugin (#2319) (089276cd703c55159e5bcb44620f7c31254ee287) - thanks @​yamamoto7!
• Read an existing --app directory as a cloud assembly in the AWS CDK plugin (#2330) (347fc43a9881edf849f191856b19915be09ed677) - thanks @​clean99!
• Follow a namespace import re-exported with export default (#2325) (01daad647f124919b5d44d4a2d702290bc107434) - thanks @​RClaudiuM!
• Compare session issue order with a fresh run only where it is defined (ecf9625fc646da58c28a09aacd420654f461088e)
• Run test files in batches to stay under the Windows command-line limit (93951de1b6573fa36aadb36b07acddfa50238774)
• Resolve bare plugin input paths regardless of dependency reporting (#2305) (85b0e94e17cfb71c54ceee7ecc91d9939808f31c) - thanks @​gioboa!
• Anchor gitignore patterns with a middle slash (#2301) (0a2f0aab6184fe6de71188924831070e580d5895) - thanks @​everton-dgn!
• Detect node tests behind c8 options (#2310) (ed141170ff416b7674cc6d55530b02807731ee7c) - thanks @​everton-dgn!
• Find JavaScript plugins, middleware and app.config in the Nuxt plugin (#2312) (d3181efd7dad2615d32dad3bf91a0494fd5382ed) - thanks @​SwastikTripathi!
• Add Web Test Runner plugin (#2295) (b2dd8be27f8bac8fe15520df6a7a42ca9c5b1df3) - thanks @​clean99!
• Check Node.js builtins independently of the runtime (#2300) (1ccc9ea292dce7ac4242541087007a98aecb901f) - thanks @​everton-dgn!
• Track MDX content mapper provider dependencies (#2320) (318a0eabd0a513039bc1afd0af9b3bfb6d34b83b) - thanks @​2lazzzy!
• Treat require('./mod').A as a named import (#2329) (3b91979222c23fd26034d74a706435be6a42bac7) - thanks @​bytedoe!
• Edit and extend some docs (0eea84622d97a9c917fcb5bd23b1adb3c52fbf13)
• Exclude development deferResolve files in production mode (188a3ba7c3d3b655a236550ef0c50c4deb37c17c)
• Resolve plugin inputs in core and credit the packages they reach (8c5d329f5a139b94623776a4c061de9dc0ac1bcb)

... (truncated)

Commits

• a58d5d8 Release knip@6.45.0
• 9d1308b Pin oxc-parser to 0.156 and fix the emnapi runtime peer for astro check
• 75cfacb Update dependencies
• de958a7 fix: don't crash on floating rejections (#2308)
• 1308a86 Add strict-mode test with workspaces fixture
• f70079b Emit packages loaded at runtime as production dependencies
• 80e751a Exclude files of development scripts in production mode
• 31a4df2 Stop crediting development inputs in production mode
• 8b786fb Emit package-only values as dependencies in 8 plugins
• 89bdb35 Emit tsconfig plugins and tslib as dependencies
• Additional commits viewable in compare view

Updates puppeteer from 25.16.0 to 25.17.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.17.0

25.17.0 (2026-11-10)

🎉 Features

• add console events to Browser and BrowserContext (#15710) (e9894e3)
• add HTTPResponse.stream() (#15717) (8fab4dc)
• add page and worker methods on HTTPRequest (#15514) (9b2fe5e)
• add request events to Browser and BrowserContext (#15539) (b99132a)
• add scriptId to ConsoleMessageLocation (#15537) (f3511d8)
• cdp: expose DomContentLoaded and NavigationStart in page.metrics() (#15676) (5862b81)
• expose HTTPResponse.encodedDataLength() (#15678) (9abca26)
• introduce other network event on browser and browserContext (#15726) (9319ada)
• locators: support passing arguments to Locator.filter and Locator.map (#15684) (a0b2b8d)
• report dedicated worker console messages on Browser and BrowserContext (#15711) (092e6e6)
• roll to Chrome 157.0.8103.38 (#15716) (591d736)
• roll to Firefox 159.0 (#15685) (de2e9f9)

🛠️ Fixes

• bidi: apply downloadBehavior from launch and connect options (#15687) (d8cc590)
• bidi: deliver console messages replayed while connecting (#15712) (5115e5c)
• bidi: enforce exhaustive switch in getBidiKeyValue and support Abort/NumpadEnter (#15654) (7cb1c0b)
• bidi: keep the plain GMT timezone ID in page.emulateTimezone() (#15728) (026b426)
• bidi: let contentType replace a content-type header in respond() (#15653) (7cb283c)
• bidi: make page.setCacheEnabled() enable the cache by default (#15698) (4b211de)
• bidi: respect waitForFonts in page.pdf() (#15714) (0814ac1)
• bidi: return domain cookies for the domain itself in page.cookies() (#15689) (884a8c3)
• bidi: send the default accuracy in page.setGeolocation() (#15704) (8dfe2ff)
• bidi: send the Enter code for the Enter key (#15743) (27e017c)
• bidi: tolerate respond() and abort() failures for gone requests (#15697) (1c4e4ad)
• bidi: update Request.isBlocked on network lifecycle events (#15677) (a0d910a)
• cdp: allow calling exposed functions after deleting from globalThis (#15683) (5c11065)
• cdp: handle internal redirects not paused by Fetch.requestPaused (#15644) (176afa2)
• cdp: include null and undefined in ConsoleMessage.text() (#15693) (e54f1db)
• deflake BiDi navigation and flaky tests from main CI (#15638) (d8ef67a)
• do not mutate options.args in defaultArgs (#15664) (1581677)
• do not throw in evaluate when the caller stack frame is missing (#15666) (28782a2)
• extensions: support Target.attachToTarget in ExtensionTransport (#15647) (c615311)
• fail pending worker requests on worker termination (#15538) (7231774)
• network: emit requestfailed when loadingFailed precedes requestPaused (#15576) (5b0c34a)
• roll to Chrome 156.0.8078.73 (#15686) (33f2ad6)
• roll to Chrome 156.0.8078.80 (#15696) (715534b)
• roll to Chrome 157.0.8103.50 (#15747) (5a0d6de)
• roll to Firefox 159.0.1 (#15715) (62d357a)
• type wildcard event emitter handlers correctly (#15643) (08e7b1a)
• validate CRLF in input HTTPRequest headers (#15601) (d830850)
• webdriver: dispose requests that complete with a 3xx status but are not redirected (#15631) (fac3a5b)

... (truncated)

Commits

• f255d23 chore: release main (#15637)
• b40ada9 chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 u...
• 026b426 fix(bidi): keep the plain GMT timezone ID in page.emulateTimezone() (#15728)
• 9abca26 feat: expose HTTPResponse.encodedDataLength() (#15678)
• 5a0d6de fix: roll to Chrome 157.0.8103.50 (#15747)
• 27e017c fix(bidi): send the Enter code for the Enter key (#15743)
• 8fab4dc feat: add HTTPResponse.stream() (#15717)
• 40a88f1 chore(deps): bump ws from 8.22.0 to 8.22.1 in the dependencies group (#15736)
• dc67a65 chore(deps): bump the all group in /website with 3 updates (#15738)
• 7cb283c fix(bidi): let contentType replace a content-type header in respond() (#15653)
• Additional commits viewable in compare view

Updates typescript-eslint from 8.72.1 to 8.72.2

Release notes

Sourced from typescript-eslint's releases.

v8.72.2

8.72.2 (2026-11-09)

🩹 Fixes

• eslint-plugin: [prefer-string-starts-ends-with] parse RegExps with the v flag in unicode sets mode (#13102)
• eslint-plugin: [no-deprecated] stop on circular alias chains (#13117)
• eslint-plugin: [no-unnecessary-type-assertion] don't report number to enum assertions (#13104)
• eslint-plugin: [prefer-nullish-coalescing] treat unconstrained type parameters as possibly nullish (#12994)

❤️ Thank You

• Ankur Dubey
• Evyatar Daud @​StyleShit
• Harsh Bhanushali @​harshbhx
• Jacob Ley @​JacobLey
• yash

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.2 (2026-11-09)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 12e452f chore(release): publish 8.72.2
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript-eslint@​8.72.1 ⏵ 8.72.2
	puppeteer@​25.16.0 ⏵ 25.17.0				+2
	knip@​6.44.2 ⏵ 6.45.0	+1

View full report