[lockfile-maintenance]

Update selected lockfiles with a minimum release age of 3 days.

The package managers' native exceptions still apply. Validate updates with the repository's PR CI.

Version changes

Versions are grouped by package name. — means the package was not present.

package-lock.json

Package	Before	After	Change	History
@azure/msal-browser	5.25.1	5.26.0	minor	Release history
@azure/msal-common	16.14.1, 16.14.2	16.14.1, 16.14.3	patch	Release history
@typescript-eslint/eslint-plugin	8.72.0	8.72.1	patch	Release history
@typescript-eslint/parser	8.72.0	8.72.1	patch	Release history
@typescript-eslint/project-service	8.72.0	8.72.1	patch	Release history
@typescript-eslint/scope-manager	8.72.0	8.72.1	patch	Release history
@typescript-eslint/tsconfig-utils	8.72.0	8.72.1	patch	Release history
@typescript-eslint/type-utils	8.72.0	8.72.1	patch	Release history
@typescript-eslint/types	8.72.0	8.72.1	patch	Release history
@typescript-eslint/typescript-estree	8.72.0	8.72.1	patch	Release history
@typescript-eslint/utils	8.72.0	8.72.1	patch	Release history
@typescript-eslint/visitor-keys	8.72.0	8.72.1	patch	Release history
ignore	5.3.2, 7.0.13	5.3.2, 7.0.14	patch	Release history
marked	18.1.1	18.1.2	patch	Release history
serialize-javascript	7.1.2	7.1.4	patch	Release history
typescript-eslint	8.72.0	8.72.1	patch	Release history

Rebase

Rebase requests are not configured for this report. Rebase setup

@azure/msal-browser — 5.25.1 → 5.26.0 (1 release)

Back to version changes · Compare · Releases

msal-browser-v5.26.0

5.26.0

Wed, 21 Oct 2026 18:37:16 GMT

Minor changes

• Add Native Auth V2 authorization inputs and challenge validation fixes #8898 (yongdiwang@​microsoft.com)
• Unify Native Auth V2 authentication method selection #8899 (yongdiwang@​microsoft.com)
• Expose required and invalid Native Auth V2 attribute IDs #8900 (yongdiwang@​microsoft.com)
• Bump @​azure/msal-common to v16.14.3 (beachball)

Patches

• Fall back from EAR to authorization code flow with PKCE in Safari #8903 (shylasummers@​microsoft.com)
• Improve consistency of concurrent silent token requests #8919 (sameera.gajjarapu@​microsoft.com)
• Identify Nested App Auth performance events with the NAA bridge type #8864 (Sameera.Gajjarapu@​microsoft.com)

@azure/msal-common — 16.14.1, 16.14.2 → 16.14.1, 16.14.3 (1 release)

Back to version changes · Compare · Releases

msal-common-v16.14.3

16.14.3

Wed, 21 Oct 2026 18:37:17 GMT

Patches

• Add a bridge type field to performance telemetry #8864 (Sameera.Gajjarapu@​microsoft.com)

@typescript-eslint/eslint-plugin — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/parser — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/project-service — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/scope-manager — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/tsconfig-utils — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/type-utils — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/types — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/typescript-estree — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/utils — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

@typescript-eslint/visitor-keys — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

ignore — 5.3.2, 7.0.13 → 5.3.2, 7.0.14 (0 releases)

Back to version changes · Compare · Releases

No published release notes found. See the links above.

marked — 18.1.1 → 18.1.2 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

• allow a tab or end of input after a type 6 html block tag name (#4128) (e09c40d)
• apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145) (5d8e234)
• cli: await config functions before parsing (#4138) (3a11ad1)
• cli: create no-clobber output files atomically (#4135) (e7c4f64)
• do not continue a block quote paragraph from a whitespace-only line (#4134) (42f34a8)
• expand a tab after the block quote marker to the next tab stop (#4110) (2d3899b)
• honor per-call async options when composing hooks (#4139) (379be9d)
• keep a line starting with # but no space in the list item (#4127) (6b63189)
• keep duplicate link definitions in the tokens (#4132) (2784acc)
• keep lazy lines after a list in a nested blockquote (#4137) (38c7e55)
• keep lazy setext underlines in list items as text (#4126) (398234c)
• render nested image alt formatting as plain text (#4131) (15f59bb)
• stop an unclosed inline raw tag from unescaping later blocks (#4130) (4562b6f)

Performance Improvements

• ~16% faster parsing by skipping em/strong masking for runs without *, _ or ~ (#4142) (f0fd3e0)

serialize-javascript — 7.1.2 → 7.1.4 (2 releases)

Back to version changes · Compare · Releases

v7.1.4

What's Changed

• Fix methods containing nested functions and arrows by @​Shubham-Padkonde in Fix methods containing nested functions and arrows yahoo/serialize-javascript#231
• docs: add SECURITY.md by @​redonkulus in docs: add SECURITY.md yahoo/serialize-javascript#237
• release: v7.1.4 by @​redonkulus in release: v7.1.4 yahoo/serialize-javascript#238

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: yahoo/serialize-javascript@v7.1.3...v7.1.4

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

• fix: escape </script at the end of a serialized function body by @​redonkulus in fix: escape </script at the end of a serialized function body yahoo/serialize-javascript#235
• Fix serialization of Dates with expanded ISO years by @​Shubham-Padkonde in Fix serialization of Dates with expanded ISO years yahoo/serialize-javascript#232
• fix: ignore functions without mutating input objects by @​Shubham-Padkonde in fix: ignore functions without mutating input objects yahoo/serialize-javascript#233
• release: v7.1.3 by @​redonkulus in release: v7.1.3 yahoo/serialize-javascript#236

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

• @​Shubham-Padkonde made their first contribution in Fix serialization of Dates with expanded ISO years yahoo/serialize-javascript#232

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

typescript-eslint — 8.72.0 → 8.72.1 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Rebase setup

For PRs created by the Lockfile Maintenance App, add this to .github/lockfile-maintenance-auth.yml on the default branch:

rebase: true

Keep workflow_dispatch in the maintenance workflow. Existing App installations must approve the Actions and Issues write permissions.

Alternatively, configure an Actions request-rebase job with pull_request_target: types: [edited] for checkboxes or issue_comment: types: [created] for comments. Keep workflow_dispatch for the maintenance run.

Configuration and custom branches

[mergify]

✅ Merged into main as 6654937 at 05:09 UTC

Merged together with #66. 4 min in the queue, less than a minute of it CI.

So far

• ✅ Entered the queue Fri 30 Oct, 05:05 · rule dependency-updates · triggered by merge protections
• ✅ Passed · draft merge queue: merged #67, #66: Lockfile maintenance (+1 more) #68
• ✅ Merged 05:09 · 6654937 · fast-forward

Merge conditions: 3 of 3 met

This pull request

	Condition	Required by
✅	#approved-reviews-by >= 1	—
✅	github-review-approved	GitHub repository ruleset rule main

The batch, tested on draft #68

	Condition	Required by
✅	any of: check-success = @github-actions/Test, check-neutral = @github-actions/Test, check-skipped = @github-actions/Test	GitHub repository ruleset rule main

_{Times in UTC · dashboard · how the merge queue works}