[dependabot]

Bumps the dev-minor-patch group with 4 updates: eslint, got, ky and undici.

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Updates got from 16.0.0 to 16.1.0

Release notes

Sourced from got's releases.

v16.1.0

This release is the result of a large bug hunt. Many of the fixes make Got match its documented behavior, so you may notice some of them:

• Invalid options now throw: an empty method, a negative or fractional maxRedirects or retry.limit, a prefixUrl with a query string or fragment, and a handlers entry that is not a function.
• A stream with a body, json, or form option now rejects writes, as documented.
• The promise response event now only fires for the final response, not for every retry attempt.
• got.extend({body}) (and json, form) no longer sends the payload with every request of the instance. Payloads are never merged with defaults.
• instance.extend() now inherits the parent's mutableDefaults, like got.extend(instance).
• A HEAD request is no longer changed to GET on a 301, 302, or 303 redirect.
• response.body no longer keeps a leading UTF-8 byte order mark, and JSON with a byte order mark now parses.

Improvements

• Accept number values in headers 6fffc9e
• Export the Timings, DnsCacheLookup, and DnsCacheOptions types d012d1d eccaaca
• Retry FormData bodies by re-serializing them instead of failing 90c6ec1
• Support the x-gzip content coding and stacked content codings 5550a79

Fixes

• Fix many HTTP/2 edge cases, including requests that could hang forever when the response or request was destroyed d3c549c 78bf394 6bbc7f4 602b179 687b5c8 4ea02b8 b6522f3 9348ad6 c686386 3bbc37b 91dc486 11621cd
• Fix timeout.request restarting on each redirect, and several timeout phase edge cases 9cd2ee6 df33cdb 4e4c583 795234f 0f1263d
• Fix redirects: keep the URL fragment, evaluate followRedirect once per response, and keep Content-Length correct when a hook replaces the body 1febf3c a2b3d90 1d64f7c 60b48af
• Fix Infinity timeouts firing at once or throwing 724ebc2
• Fix retry delay edge cases, including invalid Retry-After values and calculateDelay for afterResponse retries fe58b8c 0193605
• Fix retries with replaced or non-replayable bodies ae5521f 7c1cda3 8bbc79f 1a56d36 d012d1d
• Fix the default paginate on real-world Link headers, and several pagination option and limit edge cases bd2dee0 1e61807 602b179 f98d0e1 c8419e4 526a988 557e61f 4712e5b a4a50ad b65e533
• Fix afterResponse, beforeRequest, and beforeCache hook edge cases 45c201c c1cf0f8 850e49b a4a50ad 863cf30 494279b
• Fix response body decoding and parsing edge cases c36ad51 c409a84 3c6eaf1 f658d3e dbd83df
• Fix stream edge cases: respect backpressure, stop forwarding after unpipe, and do not copy hop-by-hop headers to a piped ServerResponse 348e114 dc929bd dc56e4b c930cd9 a9a754f
• Fix uploads: DataView byte ranges, upload error classification, progress total for Content-Length: 0, and cancelling Web ReadableStream bodies 2a66686 d1cb051 0238069 b57120c 200bc85
• Fix option normalization, cloning, and immutable defaults 8f44d81 687eb7d 30023f7 5548b00 bec5da6 bcc0b01 9348ad6 a9a754f 7b13369 3bd0486 d272656 0e537c7 60b62a0 129d88d
• Fix error stacks reporting RequestError instead of the real error class, and other error cause edge cases c8419e4 9d61a37 5ccac58 71f4e0e
• Fix custom DNS cache lookups and DNS records without a valid TTL b3dc5c6 4ea02b8 d012d1d
• Fix cookie edge cases with retries, redirects, and async cookie jars 784bbd2 d5cd5e4
• Fix diagnostics channel coverage across retries and terminal errors cfce7b6
• Fix TypeScript types to match the runtime values 7c833b8 c59692b 88eeb13 0c17a8b c788ac9 a4176b6

---

sindresorhus/got@v16.0.0...v16.1.0

Commits

• 05b4476 16.1.0
• 50c4ac6 Simplify
• 03d541e Remove the companies section from the readme
• eac0aa1 Document that a payload does not belong in got.extend()
• 11621cd Settle an HTTP/2 request when the user destroys the response
• 33b3ab4 Sync the option doc comments with the documentation
• 5ccac58 Keep the cause frames intact when its message is not in its stack
• 91dc486 Keep an HTTP/2 response complete once END_STREAM arrived
• 3bbc37b Settle a destroyed in-progress http2 request
• 494279b Name null in the beforeError return validation
• Additional commits viewable in compare view

Updates ky from 2.1.0 to 2.2.0

Release notes

Sourced from ky's releases.

v2.2.0

[!NOTE] In init hooks, options.headers now has lowercase names. Read and delete headers with lowercase names, for example delete options.headers.authorization.

Improvements

• Add maxResponseSize option 0d59458
  • Limits the response body size in bytes, counted after decompression. Exceeding it throws the new ResponseSizeError.
• Let beforeRetry hooks change options for the next attempts (#885) 242c327
  • Return {options: {...}} to change onUploadProgress, onDownloadProgress, timeout, fetch, or throwHttpErrors. For example, retry a failed upload without upload progress.
• Respect Retry-After and rate-limit headers when retry.shouldRetry returns true d1c921f
• Run beforeError hooks for errors thrown while reading the response body 323b98f 50c3810
  • A connection that drops while .json(), .text(), etc. reads the body is now a NetworkError.
• Support onUploadProgress and streamed Request bodies in Bun and Deno 83c711c
• Validate options and report clear errors 3ded2aa
  • Invalid options now throw a TypeError that names the option, instead of being silently ignored or failing later with an internal error. This includes null, non-array hooks, and invalid timeout and retry values.
  • Invalid options and errors thrown by init hooks now reject the returned promise instead of throwing synchronously.
• Improve TypeScript types 51b3177 52b8f93 f4886ca 481f6f7
  • Accept readonly arrays and explicit undefined for all options, allow custom error names, and fix the .clone() and .bytes() return types.

Fixes

• Fix aborts and timeouts in many edge cases e1b088e 2f0a3fb 7c1272b 82fa84c 3f0e330
  • User aborts and timeouts now also cancel requests returned from hooks, interrupt pending hooks and body reads, and are no longer reported as NetworkError and retried in Chromium. totalTimeout is now enforced when the response or body arrives after the deadline.
• Fix searchParams with a Request input dropping its body and options such as credentials b4bdecc 4e0bf0b
• Fix option merging in .extend() and init hooks e06d351 0655b9d c5dc4e6 88e2432
  • Class instances, such as an undici Agent as dispatcher or a Date in json, are no longer turned into plain objects. Header names are now matched case-insensitively. Changes made in .extend() callbacks and init hooks no longer leak into other requests.
• Fix many replaceOption() edge cases cc9b5a3 d6e049a deb5a33
• Fix parseJson being ignored by response.clone().json() and when using onDownloadProgress c6c5dbf 015ef95
• Fix progress events, including wrong totalBytes for compressed responses and missing response properties with onDownloadProgress d89c8c8 e893f16 de278ae
• Fix onUploadProgress breaking uploads without request stream support, and keepalive and no-cors requests 6520f64 06ebf18
• Fix fetch: window.fetch throwing "Illegal invocation" in browsers 92ef60e
• Fix isTimeoutError() and the other type guards matching unrelated errors with the same name d636438
• Fix request on Ky errors being an internal clone instead of the request that was sent 619c427 ec3d17f

---

sindresorhus/ky@v2.1.0...v2.2.0

Commits

• 3541888 2.2.0
• 242c327 Let a beforeRetry hook change per-attempt options
• d9ddb03 Fix CI
• d93adf8 Run the browser tests and static checks once in CI
• a5ed57b Refactor
• 7f0137d Report the sent request for a hook's response, and finish the cross-realm and...
• 13c8da5 Stop surfacing progress callback errors
• 55599c8 Run beforeError for a beforeRetry abort and share the body-wrapping check
• 3ded2aa Tweaks
• 692c435 Restore the retry-only marker condition and cover the remaining cases
• Additional commits viewable in compare view

Updates undici from 8.11.2 to 8.12.2

Release notes

Sourced from undici's releases.

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

... (truncated)

Commits

• bb6cc0a Bumped v8.12.2 (#6021)
• b217373 fix(websocket): bound automatic PONG writes under backpressure
• 789ef26 fix(eventsource): bound retained SSE parser state
• 4f7ef68 fix(sri): accept non-lowercase algorithm tokens
• f851f31 fix(decompress): converge downstream handler throws to per-request errors
• b5084c7 fix(fetch): abort excessive content encoding responses
• 26c2bfb fix(cache): prevent cross-origin redirect cache confusion
• f75eac0 fix: preserve Agent connection options
• e257e9f fix: handle post-connect TLS certificate errors
• a65ec32 Bumped v8.12.1 (#6010)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cursor]

Dependabot conflict resolution (automation)

Scope: Only open Dependabot minor dev-deps PR in this repo (#77).

What changed: Merged main into dependabot/npm_and_yarn/dev-minor-patch-78b4d11800 after #78 landed (follow-redirects 1.16.1). package-lock.json auto-merged cleanly (no manual conflict markers). Pushed merge commit 7791df0.

Verification (local): npm ci, npm run test:unit — all 9 unit tests pass.

Merge status: Branch is up to date with main and mergeable (no dependency-file conflicts). Auto-merge remains enabled; review already APPROVED (minor dev bumps: eslint 10.13, got 16.1, ky 2.2, undici 8.12).

Remaining blocker: Required integration check still fails on ky 2.2.0 (The \fetch` option must resolve with a `Response`). Ky now rejects custom fetch implementations that return ProxyResponseinstead of a nativeResponse. Fixing that needs a small change in lib/` (out of scope for dependency-only unblocking per automation policy).

Next step (human): Either adapt createProxyKy / createProxyFetch for ky 2.2+ compatibility, or temporarily hold ky at 2.1.x in the lockfile until that lands.

  

_{Sent by Cursor Automation: Fix dependency conflicts}