[dependabot]

Bumps the npm-minor-and-patch group with 19 updates:

Package	From	To
@semantic-release/github	12.0.9	12.0.10
@types/node	24.13.5	24.13.6
@typescript-eslint/parser	8.70.0	8.70.1
eslint	10.10.0	10.11.0
prettier	3.9.6	3.9.8
promptfoo	0.123.0	0.123.1
typescript-eslint	8.70.0	8.70.1
tsx	4.23.13	4.23.15
@fastify/swagger	9.8.1	9.9.0
fastify	5.12.4	5.12.5
lru-cache	11.5.2	11.5.3
lucide	1.46.0	1.47.0
@anthropic-ai/sandbox-runtime	0.0.76	0.0.77
systeminformation	5.33.10	5.33.13
undici	8.10.2	8.11.0
cronstrue	3.26.0	3.27.0
lucide-react	1.46.0	1.47.0
next-intl	4.14.5	4.14.6
posthog-js	1.433.4	1.434.7

Updates @semantic-release/github from 12.0.9 to 12.0.10

Release notes

Sourced from @​semantic-release/github's releases.

v12.0.10

12.0.10 (2026-09-21)

Bug Fixes

• deps: update dependency @​octokit/plugin-paginate-rest to v15 (#1284) (a63f458)

Commits

• a63f458 fix(deps): update dependency @​octokit/plugin-paginate-rest to v15 (#1284)
• f5f6d0e build(deps): bump brace-expansion (#1300)
• eaffbba build(deps): bump undici from 6.27.0 to 6.28.1 (#1301)
• 07686dc chore(deps): update dependency undici to v7.29.0 [security] (#1283)
• 9f010ee build(deps-dev): bump baseline-browser-mapping from 2.10.42 to 2.11.25 (#1295)
• 81eeeca build(deps-dev): bump js-yaml from 3.15.0 to 3.15.2 (#1294)
• 43c2210 build(deps-dev): bump fast-uri from 3.1.4 to 3.1.8 (#1290)
• e703272 build(deps-dev): bump browserslist from 4.28.4 to 4.29.0 (#1291)
• e7f4b4b chore(deps): update dependency prettier to v3.9.8 (#1298)
• 2e9e42b chore(deps): update dependency prettier to v3.9.7 (#1296)
• Additional commits viewable in compare view

Updates @types/node from 24.13.5 to 24.13.6

Commits

• See full diff in compare view

Updates @typescript-eslint/parser from 8.70.0 to 8.70.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)
• typescript-estree: require string literal import attribute values (#12894)
• website: prevent playground from breaking down after opening link with the .js file type (#12777)

❤️ Thank You

• Amin @​amiin-dev
• Brad Zacher @​bradzacher
• Cameron
• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Grit @​Grit03
• Hugo @​hugop95
• Josh Goldberg ✨
• Michael Naumov @​mnaoumov
• Mikhail Baev @​baevm
• Om Rawat
• overlookmotel
• Sanath @​sansynx
• Shinji
• stoicism @​stoicism02
• Vinccool96
• Younsang Na @​nayounsang
• 김채영 @​cchaeyoung
• 송재욱

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 23d38ce chore(release): publish 8.70.1
• See full diff in compare view

Updates eslint from 10.10.0 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

Commits

• 3c0b7c6 10.11.0
• 321f0a7 Build: changelog update for 10.11.0
• 520dd77 perf: Implement fast paths in critical areas (#21210)
• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
• 24310e3 chore: update ecosystem plugins (#21324)
• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
• Additional commits viewable in compare view

Updates prettier from 3.9.6 to 3.9.8

Release notes

Sourced from prettier's releases.

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
  second paragraph at six spaces that wraps
  onto another line here.

<!-- Prettier 3.9.6 -->

 
short first line.
second paragraph at six spaces that wraps
    onto another line here.



<!-- Prettier 3.9.7 -->

 
short first line.
second paragraph at six spaces that wraps
onto another line here.

JavaScript: Fix embedded template literal idempotency (#19725 by @​fisker)

... (truncated)

Commits

• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• 0df8eb8 Bump Prettier dependency to 3.9.7
• 3cf6c8c Clean changelog_unreleased
• 0449af3 Release 3.9.7
• 43cd5b0 Allow verify markdown test with mdx parser
• ab8c911 Fix test on Node.js v26 (#19927)
• 4a5adf9 Fix tests
• Additional commits viewable in compare view

Updates promptfoo from 0.123.0 to 0.123.1

Release notes

Sourced from promptfoo's releases.

0.123.1

0.123.1 (2026-09-18)

Features

• bedrock: refresh auth across HTTP adapters (#10123) (9d3f063)
• providers: add Gemini 3.8 and Vertex Live (#10956) (1417f22)
• providers: add GPT-Live voice sessions (#10891) (316a334)
• providers: add OpenAI Agents API (#10892) (ad3bee3)
• providers: add portable HTTP config schemas (#10968) (fcd0604)
• providers: add portable MCP config schemas (#10965) (f5ccb3c)
• providers: support Ollama 0.34 features and refresh model docs (#10964) (ac01a4f)
• providers: surface Ollama thinking output and finish reason (#10954) (27d4c22)
• providers: update Gemini tools and media support (#10172) (627bdd0)

Bug Fixes

• assertions: bound embedded tool call parsing (#10877) (78202a3)
• assertions: bound tool-call parser state (#10887) (15290b4)
• assertions: default RAG assertion thresholds to 0.5 (#10202) (4831b60), closes #9910 #9848
• assertions: invert score along with pass for search-rubric (#10103) (26e8f2f)
• assertions: never invert grader failures on not-classifier and not-search-rubric (#10904) (e049702)
• assertions: reject malformed webhook results (#10955) (fc57736)
• assertions: reject non-string search rubrics (#10934) (7bbb79e)
• auth: harden custom header requests (#10524) (5325084)
• cli: handle large values during result export (#10884) (be798f4)
• cli: preserve in-memory results for extensions (#10885) (60483d9)
• code-scan: extractValidLineRanges off-by-one on trailing newline (#10107) (2cbabdb)
• config: preserve discovery in paths containing quotes (#10549) (d9b3927)
• db: preserve shared blobs after persistence errors (#10897) (3b353fb)
• deps: update dependency @​anthropic-ai/sdk to v0.123.0 (#10901) (14f7c06)
• deps: update dependency @​anthropic-ai/sdk to v0.124.0 (#10940) (29a15d1)
• deps: update engine.io to v6.6.10 (#10915) (e54a968)
• deps: update opentelemetry (#10886) (280bc5e)
• deps: update type definitions (#10924) (01c6397)
• drain database writes and preserve provider options (#10911) (32bfa9e)
• eval: keep concurrent derived metrics consistent (#10873) (2a3a3bd)
• eval: preserve audio grading results and order (#10822) (395d21e)
• eval: preserve cloud UUID config semantics (#7732) (8544fed)
• fetch: decode URL credentials and match Authorization case-insensitively (#10909) (b8aa6ff)
• fetch: treat credit_balance_exhausted as a hard quota error (#10881) (7f21bb2)
• honor SDK options and load AVIF/TIFF images (#10902) (15bba21)
• integrations: honor --env-file and config env for Helicone key and Langfuse base URL (#10942) (8bd9f37)
• integrations: read Langfuse env at fetch time (#10937) (033080c)
• integrations: share Langfuse prompt fetches and surface real SDK load errors (#10943) (379ecd0)
• matchers: tag context-faithfulness grader failures (#9907) (77bc3ba)
• matchers: tag RAG grader failures so inverse assertions cannot pass (#10494) (b3d21d2)
• mcp: accept fine-tuned model identifiers (#10847) (9442129)

... (truncated)

Changelog

Sourced from promptfoo's changelog.

0.123.1 (2026-09-18)

Features

• bedrock: refresh auth across HTTP adapters (#10123) (9d3f063)
• providers: add Gemini 3.8 and Vertex Live (#10956) (1417f22)
• providers: add GPT-Live voice sessions (#10891) (316a334)
• providers: add OpenAI Agents API (#10892) (ad3bee3)
• providers: add portable HTTP config schemas (#10968) (fcd0604)
• providers: add portable MCP config schemas (#10965) (f5ccb3c)
• providers: support Ollama 0.34 features and refresh model docs (#10964) (ac01a4f)
• providers: surface Ollama thinking output and finish reason (#10954) (27d4c22)
• providers: update Gemini tools and media support (#10172) (627bdd0)

Bug Fixes

• assertions: bound embedded tool call parsing (#10877) (78202a3)
• assertions: bound tool-call parser state (#10887) (15290b4)
• assertions: default RAG assertion thresholds to 0.5 (#10202) (4831b60), closes #9910 #9848
• assertions: invert score along with pass for search-rubric (#10103) (26e8f2f)
• assertions: never invert grader failures on not-classifier and not-search-rubric (#10904) (e049702)
• assertions: reject malformed webhook results (#10955) (fc57736)
• assertions: reject non-string search rubrics (#10934) (7bbb79e)
• auth: harden custom header requests (#10524) (5325084)
• cli: handle large values during result export (#10884) (be798f4)
• cli: preserve in-memory results for extensions (#10885) (60483d9)
• code-scan: extractValidLineRanges off-by-one on trailing newline (#10107) (2cbabdb)
• config: preserve discovery in paths containing quotes (#10549) (d9b3927)
• db: preserve shared blobs after persistence errors (#10897) (3b353fb)
• deps: update dependency @​anthropic-ai/sdk to v0.123.0 (#10901) (14f7c06)
• deps: update dependency @​anthropic-ai/sdk to v0.124.0 (#10940) (29a15d1)
• deps: update engine.io to v6.6.10 (#10915) (e54a968)
• deps: update opentelemetry (#10886) (280bc5e)
• deps: update type definitions (#10924) (01c6397)
• drain database writes and preserve provider options (#10911) (32bfa9e)
• eval: keep concurrent derived metrics consistent (#10873) (2a3a3bd)
• eval: preserve audio grading results and order (#10822) (395d21e)
• eval: preserve cloud UUID config semantics (#7732) (8544fed)
• fetch: decode URL credentials and match Authorization case-insensitively (#10909) (b8aa6ff)
• fetch: treat credit_balance_exhausted as a hard quota error (#10881) (7f21bb2)
• honor SDK options and load AVIF/TIFF images (#10902) (15bba21)
• integrations: honor --env-file and config env for Helicone key and Langfuse base URL (#10942) (8bd9f37)
• integrations: read Langfuse env at fetch time (#10937) (033080c)
• integrations: share Langfuse prompt fetches and surface real SDK load errors (#10943) (379ecd0)
• matchers: tag context-faithfulness grader failures (#9907) (77bc3ba)
• matchers: tag RAG grader failures so inverse assertions cannot pass (#10494) (b3d21d2)
• mcp: accept fine-tuned model identifiers (#10847) (9442129)
• opencode: capture skill calls from full session history (#10011) (290973d)
• prompts: CSV rows collapse to duplicate labels/IDs when basePrompt.label is set (#10102) (25963c3)
• providers: align ElevenLabs requests and audio inputs (#10736) (de12341)

... (truncated)

Commits

• 34f74d3 chore(main): release 0.123.1 (#10879)
• 9d3f063 feat(bedrock): refresh auth across HTTP adapters (#10123)
• 5325084 fix(auth): harden custom header requests (#10524)
• f385d96 fix(providers): isolate Agents endpoint credentials (#10951)
• ba0eeb4 fix(providers): preserve patterned OpenCode skill history (#10971)
• 288e26c chore(deps): update dependency oxc-parser to ^0.149.0 (#10975)
• fc57736 fix(assertions): reject malformed webhook results (#10955)
• 52ce503 chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates (#...
• 1417f22 feat(providers): add Gemini 3.8 and Vertex Live (#10956)
• 08e91da fix(redteam): preserve strategy grading context (#10969)
• Additional commits viewable in compare view

Updates typescript-eslint from 8.70.0 to 8.70.1

Release notes

Sourced from typescript-eslint's releases.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

• ast-spec: narrow import attribute keys to identifiers and strings (#12879)
• eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
• eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
• eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
• eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
• eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
• eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
• eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
• eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
• eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
• eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
• eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
• eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
• rule-tester: test the final autofix output instead of the first pass (#12867)
• scope-manager: merge implicit global definitions (#12809)
• type-utils: match package specifiers on whole path components (#12838)
• typescript-estree: resolve symlinked paths when matching files to projects (#12725)
• typescript-estree: add missing < token opening type arguments (#12821)
• typescript-estree: require string literal import attribute values (#12894)
• website: prevent playground from breaking down after opening link with the .js file type (#12777)

❤️ Thank You

• Amin @​amiin-dev
• Brad Zacher @​bradzacher
• Cameron
• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Grit @​Grit03
• Hugo @​hugop95
• Josh Goldberg ✨
• Michael Naumov @​mnaoumov
• Mikhail Baev @​baevm
• Om Rawat
• overlookmotel
• Sanath @​sansynx
• Shinji
• stoicism @​stoicism02
• Vinccool96
• Younsang Na @​nayounsang
• 김채영 @​cchaeyoung
• 송재욱

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.70.1 (2026-09-21)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 23d38ce chore(release): publish 8.70.1
• eb42d9b chore: cleanup and fix Nx dependencies and missing tasks (#12897)
• 8c80531 chore: fix typos in comments and docs (#12846)
• b6b86a1 chore: migrate to nx 23.2.0 (#12843)
• See full diff in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• See full diff in compare view

Updates @fastify/swagger from 9.8.1 to 9.9.0

Release notes

Sourced from @​fastify/swagger's releases.

v9.9.0

What's Changed

• feat: OpenAPI 3.2.0 compatibility by @​Tony133 in fastify/fastify-swagger#949

Full Changelog: