[dependabot]

Bumps the npm-development group in /web with 11 updates:

Package	From	To
@eslint/compat	2.0.4	2.1.1
@eslint/eslintrc	3.3.5	3.3.7
@testing-library/dom	10.4.1	10.4.2
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.8
@typescript-eslint/parser	8.58.0	8.72.1
eslint-plugin-react-hooks	7.0.1	7.1.1
eslint-plugin-react-refresh	0.5.2	0.5.7
globals	17.4.0	17.13.0
postcss	8.5.9	8.5.32
prettier	3.8.1	3.9.10

Updates @eslint/compat from 2.0.4 to 2.1.1

Release notes

Sourced from @​eslint/compat's releases.

compat: v2.1.1

2.1.1 (2026-09-01)

Bug Fixes

• preserve markVariableAsUsed return value in compat context (#503) (66d9790)

compat: v2.1.0

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

migrate-config: v2.1.0

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/config-helpers bumped from ^0.5.5 to ^0.6.0

migrate-config: v2.0.7

2.0.7 (2026-05-01)

Bug Fixes

• update espree to the latest (#437) (a8ff72f)

migrate-config: v2.0.6

2.0.6 (2026-04-08)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/compat bumped from ^2.0.4 to ^2.0.5
  • devDependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

... (truncated)

Changelog

Sourced from @​eslint/compat's changelog.

2.1.1 (2026-09-01)

Bug Fixes

• preserve markVariableAsUsed return value in compat context (#503) (66d9790)

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

2.0.5 (2026-04-08)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

Commits

• a4466ca chore: release main (#504)
• 714ffde docs: Update README sponsors
• 66d9790 fix: preserve markVariableAsUsed return value in compat context (#503)
• caffae7 docs: Update README sponsors
• ae1ba25 docs: Update README sponsors
• 50051c6 docs: Update README sponsors
• ea83524 docs: Update README sponsors
• 29956ae docs: Update README sponsors
• f6d5bdf docs: Update README sponsors
• 8b71ed3 chore: restore eslint-plugin-jsdoc rules (#316)
• Additional commits viewable in compare view

Updates @eslint/eslintrc from 3.3.5 to 3.3.7

Release notes

Sourced from @​eslint/eslintrc's releases.

eslintrc: v3.3.7

3.3.7 (2026-09-01)

Bug Fixes

• Bump js-yaml to 4.3.1 (#239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a)

eslintrc: v3.3.6

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

Changelog

Sourced from @​eslint/eslintrc's changelog.

3.3.7 (2026-09-01)

Bug Fixes

• Bump js-yaml to 4.3.1 (#239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#243) (bb0d97a)

3.3.6 (2026-07-10)

Bug Fixes

• update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

Commits

• 7943fa6 chore: release 3.3.7 🚀 (#240)
• bb0d97a fix: update js-yaml to 4.3.2 to address security vulnerability (#243)
• 5b4abc9 docs: Update README sponsors
• f27e7c9 fix: Bump js-yaml to 4.3.1 (#239)
• b75e1d2 docs: Update README sponsors
• 302c133 docs: Update README sponsors
• e62e766 docs: Update README sponsors
• cf27f9f docs: Update README sponsors
• c7f4cdf docs: Update README sponsors
• 3319822 docs: Update README sponsors
• Additional commits viewable in compare view

Updates @testing-library/dom from 10.4.1 to 10.4.2

Release notes

Sourced from @​testing-library/dom's releases.

v10.4.2

10.4.2 (2026-09-13)

Bug Fixes

• deps: pin @​types/node to a TypeScript 4-compatible version (#1386) (6049cc0)

Commits

• 6049cc0 fix(deps): pin @​types/node to a TypeScript 4-compatible version (#1386)
• e395d5b Switch to trusted publishing (#1368)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/dom since your current version.

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @testing-library/user-event from 14.6.1 to 14.6.8

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

• treat programmatic null input values as empty string (#1329) (1951eb7)

v14.6.7

14.6.7 (2026-09-02)

Bug Fixes

• normalize DataTransfer format aliases (#1326) (1e0020b)
• feature: Add iframe support for user.keyboard typing (#1275) (1e0020b)

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

• default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

• tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

• keyboard event repeat property (#1312) (d7e80e3)

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

• release: manually release a patch version (#1321) (1d18b1f), closes #1317

v14.6.2

... (truncated)

Commits

• 1951eb7 fix: treat programmatic null input values as empty string (#1329)
• 1e0020b fix: normalize DataTransfer format aliases (#1326)
• d4b0593 feature: Add iframe support for user.keyboard typing (#1275)
• 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
• 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
• d7e80e3 fix: keyboard event repeat property (#1312)
• 43d8e6c ci: remove broken npm backfill step (#1322)
• 1d18b1f fix(release): manually release a patch version (#1321)
• 232f3e6 docs: add migration note and clean up README badges (#1320)
• 83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.

Updates @typescript-eslint/parser from 8.58.0 to 8.72.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: lazy load rules (#13010)
• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

• ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz
• Shaan GS @​ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.72.1 (2026-10-26)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.1 (2026-10-05)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

... (truncated)

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• a4c2603 chore(release): publish 8.72.0
• 7488d68 chore(release): publish 8.71.2
• d57b8da chore(release): publish 8.71.1
• 8695664 chore(release): publish 8.71.0
• 23d38ce chore(release): publish 8.70.1
• 7ee7608 chore(release): publish 8.70.0
• 9a6e546 chore(release): publish 8.69.0
• 8f4e00a chore(release): publish 8.68.0
• Additional commits viewable in compare view

Updates eslint-plugin-react-hooks from 7.0.1 to 7.1.1

Release notes

Sourced from eslint-plugin-react-hooks's releases.

eslint-plugin-react-hooks@7.1.1 (April 17, 2026)

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

• Add deprecated no-op component-hook-factories rule for backwards compatibility. (@​mofeiZ in #36307)

eslint-plugin-react-hooks@7.1.0 (April 16, 2026)

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

• Add ESLint v10 support. (@​azat-io in #35720)
• Skip compilation for non-React files to improve performance. (@​josephsavona in #35589)
• Fix exhaustive deps bug with Flow type casting. (@​jorge-cab in #35691)
• Fix useEffectEvent checks in component syntax. (@​jbrown215 in #35041)
• Improved set-state-in-effect validation with fewer false negatives. (@​jorge-cab in #35134, @​josephsavona in #35147, @​jackpope in #35214, @​chesnokov-tony in #35419, @​jsleitor in #36107)
• Improved ref validation for non-mutating functions and event handler props. (@​josephsavona in #35893, @​kolvian in #35062)
• Compiler now reports all errors instead of stopping at the first. (@​josephsavona in #35873–#35884)
• Improved source locations and error display in compiler diagnostics. (@​nathanmarks in #35348, @​josephsavona in #34963)

Changelog

Sourced from eslint-plugin-react-hooks's changelog.

7.1.1

Note: 7.1.0 accidentally removed the component-hook-factories rule, causing errors for users who referenced it in their ESLint config. This is now fixed.

• Add deprecated no-op component-hook-factories rule for backwards compatibility. (@​mofeiZ in #36307)

7.1.0

This release adds ESLint v10 support, improves performance by skipping compilation for non-React files, and includes compiler lint improvements including better set-state-in-effect detection, improved ref validation, and more helpful error reporting.

• Add ESLint v10 support. (@​azat-io in #35720)
• Skip compilation for non-React files to improve performance. (@​josephsavona in #35589)
• Fix exhaustive deps bug with Flow type casting. (@​jorge-cab in #35691)
• Fix useEffectEvent checks in component syntax. (@​jbrown215 in #35041)
• Improved set-state-in-effect validation with fewer false negatives. (@​jorge-cab in #35134, @​josephsavona in #35147, @​jackpope in #35214, @​chesnokov-tony in #35419, @​jsleitor in #36107)
• Improved ref validation for non-mutating functions and event handler props. (@​josephsavona in #35893, @​kolvian in #35062)
• Compiler now reports all errors instead of stopping at the first. (@​josephsavona in #35873–#35884)
• Improved source locations and error display in compiler diagnostics. (@​nathanmarks in #35348, @​josephsavona in #34963)

Commits

• See full diff in compare view

Updates eslint-plugin-react-refresh from 0.5.2 to 0.5.7

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

v0.5.6

• Support re-exporting namespace components (fixes #116)

v0.5.5

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #114 (fixes #113)
• Add contentType and size to allowExportNames in Next config #115

v0.5.4

• Add instant to allowExportNames in Next config #112

v0.5.3

• Fix check for non component class exported via export { } #110 (fixes #109)

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

0.5.6

• Support re-exporting namespace components (fixes #116)

0.5.5

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #114 (fixes #113)
• Add contentType and size to allowExportNames in Next config #115

0.5.4

• Add instant to allowExportNames in Next config #112

0.5.3

• Fix check for non component class exported via export { } #110 (fixes #109)

Commits

• fd40d83 Add allowCompoundComponents option [publish] (#117)
• 620568a Support re-exporting namespace components (fixes #116) [publish]
• 65c3172 [publish] v0.5.5
• 8411020 Bump deps
• c28fa15 Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly ...
• 554c764 [publish] add contentType and size to allowExportNames in Next config (#115)
• e316617 [publish] Add instant to allowExportNames in Next config (#112)
• 00818e9 v0.5.3 [publish]
• 202fc4a Fix PascalCase class exported via export { Name } incorrectly treated as Re...
• See full diff in compare view

Updates globals from 17.4.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

• Update globals (2026-10-01) (#354) b007369

---

sindresorhus/globals@v17.12.0...v17.13.0

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

v17.11.0

• Add react-native globals (#337) 61eafbf

---

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

• Add GM_cookie to Greasemonkey globals (#349) f468407

---

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

• Update globals (2026-08-01) (#348) 5a958ed

---

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

v17.7.0

• Update globals (2026-06-22) (#345) 33b75f9

---

sindresorhus/globals@v17.6.0...v17.7.0

... (truncated)

Commits

• ce512bc 17.13.0
• b007369 Update globals (2026-10-01) (#354)
• 16cb1fe Meta tweaks
• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• 8c59927 17.11.0
• 61eafbf Add react-native globals (#337)
• 7bed4af 17.10.0
• f468407 Add GM_cookie to Greasemonkey globals (#349)
• Additional commits viewable in compare view

Updates postcss from 8.5.9 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

... (truncated)

Commits

• 2455ac8 Release 8.5.32 version
• e367106 Update dependencies
• f70f586 Fix Input#origin() without from or with relative sourceRoot (#2179)
• eb28619 Fix final-word lookup without source offsets (#2178)
• 095654b Preserve explicit start in Warning#toString() (#2177)
• 9b3d8b8 Preserve Promise semantics in result finally() (#2176)
• d190857 Release 8.5.31 version
• 4ef6d8c Update dependencies
• 6abd674 Call the builder with every node when the output is escaped (#2175)
• f1aca7e Release 8.5.30 version
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates prettier from 3.8.1 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

Description has been truncated