[dependabot]

Bumps the minor-patch group with 12 updates in the / directory:

Package	From	To
@typescript-eslint/eslint-plugin	8.70.0	8.71.0
@typescript-eslint/parser	8.70.0	8.71.0
cspell	10.3.3	10.3.6
eslint	10.10.0	10.11.0
eslint-plugin-n	18.3.0	18.4.0
@modelcontextprotocol/sdk	1.30.0	1.31.0
vscode-jsonrpc	9.0.2	9.0.3
@types/node	26.6.1	26.6.3
@github/copilot-sdk	1.0.14	1.0.15
typedoc-plugin-markdown	4.13.0	4.13.1
ws	8.21.3	8.22.0
@types/ws	8.18.1	8.18.2

Updates @typescript-eslint/eslint-plugin from 8.70.0 to 8.71.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

🩹 Fixes

• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)

❤️ Thank You

• Brad Zacher @​bradzacher
• Diptajoy Mistry @​diptomistry
• Grit @​Grit03
• Hugo @​hugop95
• Michael Naumov @​mnaoumov

... (truncated)

Commits

• 8695664 chore(release): publish 8.71.0
• 99d759a feat(eslint-plugin): [no-unsafe-enum-assignment] add rule (#12732)
• ae3ac15 docs(eslint-plugin): clarify checkTypePredicates assumptions (#12378)
• 33824c1 fix(eslint-plugin): [no-misused-promises] handle a return outside of any func...
• 7e25db3 fix(eslint-plugin): [no-unnecessary-type-assertion] specialize generic assert...
• 8d7ab88 test: order union constituents stably in RuleTester tests
• 7fce912 fix(eslint-plugin): [unbound-method] respect this: void on class properties
• ce70016 fix(eslint-plugin): [switch-exhaustiveness-check] always sort literal cases i...
• 23d38ce chore(release): publish 8.70.1
• 9d82e4b chore: expand eslint-plugin rules test files glob (#12878)
• Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.70.0 to 8.71.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.71.0 (2026-09-28)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 8695664 chore(release): publish 8.71.0
• 23d38ce chore(release): publish 8.70.1
• See full diff in compare view

Updates cspell from 10.3.3 to 10.3.6

Release notes

Sourced from cspell's releases.

v10.3.6

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

cspell lint reports unknown in-document directives again, such as cspell:bad-dir, when --validate-directives or validateDirectives: true in the config asks for them. Since 9.1.0 they were found but never shown or counted.

• --validate-directives and --no-validate-directives override the config setting.
• An unknown directive counts as an issue, so cspell lint exits with an error, as it did before 9.1.0.
• The JSON reporter, @cspell/cspell-json-reporter, includes them in its output again.

• The default reporter and the JSON reporter now ask to receive directive issues. Other reporters still only get them if they ask for them.
• The command-line flag is now applied as a setting, like --report, so it controls what is shown as well as what is checked.

---

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

createRedirectProvider in cspell-io now only serves requests that map to a location under its private root. A request that would resolve outside the private root is refused with VFSErrorUnsupportedRequest, the same error as a request outside the public root.

• Refused: a path that starts with a separator (/, \, %2F, %5C) right after the public root.
• Now served from inside the private root: file names that look like a URL scheme or a drive, such as a:b.txt or C|. They used to resolve to a different URL.

cspell itself does not use createRedirectProvider. This affects projects that use cspell-io directly.

• The part of the URL after the public root is resolved as a relative path under the private root, and the result is checked to be under the private root: same protocol, same host, and the same path prefix.
• Results coming back from the private file system are checked the same way before they are shown under the public root.
• The change is in commit 25359026e1.

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.3.6 (2026-09-29)

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

cspell lint reports unknown in-document directives again, such as cspell:bad-dir, when --validate-directives or validateDirectives: true in the config asks for them. Since 9.1.0 they were found but never shown or counted.

• --validate-directives and --no-validate-directives override the config setting.
• An unknown directive counts as an issue, so cspell lint exits with an error, as it did before 9.1.0.
• The JSON reporter, @cspell/cspell-json-reporter, includes them in its output again.

• The default reporter and the JSON reporter now ask to receive directive issues. Other reporters still only get them if they ask for them.
• The command-line flag is now applied as a setting, like --report, so it controls what is shown as well as what is checked.

---

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

createRedirectProvider in cspell-io now only serves requests that map to a location under its private root. A request that would resolve outside the private root is refused with VFSErrorUnsupportedRequest, the same error as a request outside the public root.

• Refused: a path that starts with a separator (/, \, %2F, %5C) right after the public root.
• Now served from inside the private root: file names that look like a URL scheme or a drive, such as a:b.txt or C|. They used to resolve to a different URL.

cspell itself does not use createRedirectProvider. This affects projects that use cspell-io directly.

• The part of the URL after the public root is resolved as a relative path under the private root, and the result is checked to be under the private root: same protocol, same host, and the same path prefix.
• Results coming back from the private file system are checked the same way before they are shown under the public root.
• The change is in commit 25359026e1.

... (truncated)

Commits

• 8559198 v10.3.6
• 72e1be3 chore: Prepare Release v10.3.6 (auto-deploy) (#9305)
• e230ca0 test: Give time-limited RPC and worker tests room on slow runners (#9330)
• 8eae6b6 fix: Report unknown CSpell directives again (#9319)
• a5f5111 fix: Don't reuse cached results made with different command-line options (#9318)
• 2f897be fix: --show-perf-summary shows where all of the run's time goes (#9307)
• fe37b7b chore: Label per package, and bugs links to its open issues (#9309)
• f37a244 v10.3.5
• b36374c chore: Prepare Release v10.3.5 (auto-deploy) (#9277)
• 93e55c0 fix(cspell-lib): shouldCheckDocument honors the forceCheck option (#9303)
• Additional commits viewable in compare view

Updates eslint from 10.10.0 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

Commits

• 3c0b7c6 10.11.0
• 321f0a7 Build: changelog update for 10.11.0
• 520dd77 perf: Implement fast paths in critical areas (#21210)
• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
• 24310e3 chore: update ecosystem plugins (#21324)
• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
• Additional commits viewable in compare view

Updates eslint-plugin-n from 18.3.0 to 18.4.0

Release notes

Sourced from eslint-plugin-n's releases.

v18.4.0

18.4.0 (2026-09-26)

🌟 Features

• no-extraneous: Support pnpm workspaces in no-extraneous rules (#569) (3aae430)

📚 Documentation

• fix broken documentation links (#567) (569153f)

Changelog

Sourced from eslint-plugin-n's changelog.

18.4.0 (2026-09-26)

🌟 Features

• no-extraneous: Support pnpm workspaces in no-extraneous rules (#569) (3aae430)

📚 Documentation

• fix broken documentation links (#567) (569153f)

Commits

• 3c257fd chore(master): release 18.4.0 (#568)
• 3aae430 feat(no-extraneous): Support pnpm workspaces in no-extraneous rules (#569)
• 569153f docs: fix broken documentation links (#567)
• See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.30.0 to 1.31.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.31.0

Upgrade notes

• Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
• Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

• [v1.x] Bind stored OAuth credentials to the authorization server that issued them by @​maxisbey in modelcontextprotocol/typescript-sdk#2888
• chore: bump version to 1.31.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2890

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

• [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON-RPC batch length by @​maxisbey in modelcontextprotocol/typescript-sdk#2717
• fix(auth): preserve resource URI without trailing slash (#1968) by @​MukundaKatta in modelcontextprotocol/typescript-sdk#1972
• chore: bump version to 1.30.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2848

New Contributors

• @​MukundaKatta made their first contribution in modelcontextprotocol/typescript-sdk#1972

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.0...1.30.1

Commits

• 4b0051f chore: bump version to 1.31.0 (#2890)
• 51ad4f0 [v1.x] Bind stored OAuth credentials to the authorization server that issued ...
• 289ac2c chore: bump version to 1.30.1 (#2848)
• 12b4256 fix(auth): preserve resource URI without trailing slash (#1968) (#1972)
• a9f6eb7 [v1.x] fix(server): read HTTP request bodies with a size limit and bound JSON...
• See full diff in compare view

Updates vscode-jsonrpc from 9.0.2 to 9.0.3

Commits

• d776b6e Prepare new release
• 35409e7 Include error code and message in the 'Sending response' trace log (#1854)
• 020e1b0 Fix unhandled rejection when writing a JSON-RPC request fails (#1855)
• 5010cdf Fix socket transport when TransportKind.socket uses port 0 (#1846)
• 5351a23 Enable publishing to Azure Artifacts (#1847)
• a180df4 Release version 3.18.3 and update lock files (#1844)
• See full diff in compare view

Updates @types/node from 26.6.1 to 26.6.3

Commits

• See full diff in compare view

Updates @github/copilot-sdk from 1.0.14 to 1.0.15

Release notes

Sourced from @​github/copilot-sdk's releases.

v1.0.15

Feature: typed structured outputs for all six SDKs

Provide a JSON Schema, or use an idiomatic typed helper, to have the model return typed, validated output instead of free-form text. (#2590)

const answerSchema = z.object({ value: z.number().int() });
const answer = await session.sendAndWait("What is 19 + 23?", answerSchema);

answer = await session.send_and_wait_typed("What is 19 + 23?", Answer)

Go, Java, C#, and Rust get the same capability via copilot.SendAndWait[Answer], session.sendAndWait(prompt, Answer.class), SendAndWaitAsync<Answer>, and session.send_and_wait_typed(prompt).

Feature: structured JSON-RPC error data in all SDKs

The raw JSON data payload of a JSON-RPC error response can now be inspected in every SDK, so apps can branch on machine-readable error details. (#2664, #2732)

if let Some(data) = error.rpc_data() { println!("{data}"); }

catch (JsonRpcException e) { JsonNode data = e.getData(); }

Feature: experimental connection-global installation confirmation

All six SDKs expose a connection-global handler for the runtime's installations.confirm callback, letting apps present a human review before an MCP or Skill installation proceeds. The handler must return an explicit confirm/decline/cancel decision.

const client = new CopilotClient({
  installationConfirmationHandler: async (request, context) => promptUser(request),
});

Java, Python, Rust, C#, and Go get equivalent options (setInstallationConfirmationHandler, installation_confirmation_handler, with_installation_confirmation_handler, InstallationConfirmationHandler). Java also now exposes typed unions for MCP installation review payloads.

Other changes

• feature: [Java] add native runtime support for darwin-x64 (#2701)
• feature: [Java] add native runtime support for linuxmusl-x64 (Alpine) (#2715)
• feature: [Java] experimental FusionCritic generated diagnostics type
• improvement: [Node/Python/Go/.NET/Java] coalesce intercepted HTTP response chunks for better tool-call streaming throughput (#2734)
• improvement: [Rust] coalesce intercepted HTTP response chunks (#2717)
• improvement: [Rust] avoid rebuilding and copying JSON payloads (#2711)
• improvement: [Rust] cut retained runtime-install memory by ~99% (#2676)
• improvement: [.NET] avoid redundant JSON event materialization and reduce allocations (#2733)

... (truncated)

Changelog

Sourced from @​github/copilot-sdk's changelog.

Changelog

All notable changes to the Copilot SDK are documented in this file.

This changelog is automatically generated by an AI agent when stable releases are published. See GitHub Releases for the full list.

[Unreleased]

Commits

• 9b300dc Update SDK snapshot for Copilot CLI 1.0.89
• 0d5cc56 Update SDK snapshot for Copilot CLI 1.0.89-7
• 4b7d31b Update SDK snapshot for Copilot CLI 1.0.89-6
• d106d29 Update SDK snapshot for Copilot CLI 1.0.89-5
• 4001c1d Update SDK snapshot for Copilot CLI 1.0.89-3
• 4cd7a04 Update SDK snapshot for Copilot CLI 1.0.89-2
• 075f027 Update SDK snapshot for Copilot CLI 1.0.89-1
• cb6fc66 Update SDK snapshot for Copilot CLI 1.0.89-0
• 7e47824 Update SDK snapshot for Copilot CLI 1.0.88
• 51a0394 Update SDK snapshot for Copilot CLI 1.0.88-2
• Additional commits viewable in compare view

Updates typedoc-plugin-markdown from 4.13.0 to 4.13.1

Release notes

Sourced from typedoc-plugin-markdown's releases.

typedoc-plugin-markdown@4.13.1

Patch Changes

• Load plugin translations for the merge entry point strategy (#900).
• Translate the @example heading in de, fr and ko (#900).
• Fix truncated option descriptions in the published JSON schema and type declarations.
• Fixed broken links on Windows when using excludeScopesInPaths (#903).

Changelog

Sourced from typedoc-plugin-markdown's changelog.

4.13.1 (2026-09-18)

Patch Changes

• Load plugin translations for the merge entry point strategy (#900).
• Translate the @example heading in de, fr and ko (#900).
• Fix truncated option descriptions in the published JSON schema and type declarations.
• Fixed broken links on Windows when using excludeScopesInPaths (#903).

Commits

• c816716 Version Packages
• bba8325 fix(core): keep url separators platform independent with excludeScopesInPaths
• 1d69896 fix(core): load plugin translations in merge mode (#900)
• bb32a11 fix(core): stop JSDoc truncating the entryModule deprecation notice
• e6f1c38 fix(release): stop prepublishOnly rebuilding during concurrent publish
• 2d45394 chore(all): npm metadata upkeep and version-drift guidance
• 7f51004 docs(quality): correct custom theme examples
• 309ce15 chore(core): broaden npm keywords for discoverability
• 99a9417 chore(release): changelog scripts
• See full diff in compare view

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

• Introduced the protocols option (8b918b01).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

• 297202c [dist] 8.22.0
• 8b918b0 [feature] Introduce the protocols option
• 73e03eb [ci] Update actions/setup-node action to v7
• d9b8954 [fix] Change the ready state after validating the arguments (#2337)
• See full diff in compare view

Updates @types/ws from 8.18.1 to 8.18.2

Commits

• See full diff in compare view

[github-actions]

🟡 Impact Analysis — PR #2151

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	4
Files added	0
Files modified	4
Files deleted	0
Modules touched	3
Critical files	3

🎯 Risk Factors

• 4 files changed (≤5 → LOW)
• 3 modules touched (2-4 → MEDIUM)
• Critical files touched: package.json, packages/squad-cli/package.json, packages/squad-sdk/package.json

📦 Modules Affected

root (2 files)

• package-lock.json
• package.json

squad-cli (1 file)

• packages/squad-cli/package.json

squad-sdk (1 file)

• packages/squad-sdk/package.json

⚠️ Critical Files

• package.json
• packages/squad-cli/package.json
• packages/squad-sdk/package.json

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 8539a1a

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
❌	Branch up to date	dev is 1 commit(s) ahead — rebase recommended
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (4 files, +348 −379)

File	+/−
package-lock.json	+335 −366
package.json	+4 −4
packages/squad-cli/package.json	+3 −3
packages/squad-sdk/package.json	+6 −6

Total: +348 −379

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🔒 Security Review

Authoritative evidence: base-controlled pull_request_target reporter.

🔒 Security review: 3 info.

Severity	Category	Finding	Location
ℹ️ info	new-dependency	4 new/changed dependency version(s) in package.json. Verify these packages are trusted and necessary.	package.json:51
ℹ️ info	new-dependency	3 new/changed dependency version(s) in packages/squad-cli/package.json. Verify these packages are trusted and necessary.	packages/squad-cli/package.json:195
ℹ️ info	new-dependency	6 new/changed dependency version(s) in packages/squad-sdk/package.json. Verify these packages are trusted and necessary.	packages/squad-sdk/package.json:240

---

Automated security review — informational only.