fix(deps): update npm - all minor and patch updates

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@digicatapult/tsoa-oauth-express	^2.0.65 → ^2.0.79
@eslint/eslintrc	^3.3.5 → ^3.3.7
@playwright/test (source)	^1.60.0 → ^1.63.0
@swc-node/register	^1.11.1 → ^1.12.1
@swc/core (source)	^1.15.41 → ^1.16.2
@types/nodemailer (source)	^8.0.1 → ^8.0.2
@types/supertest (source)	^7.2.0 → ^7.2.1
@typescript-eslint/eslint-plugin (source)	^8.61.0 → ^8.70.0
@typescript-eslint/parser (source)	^8.61.0 → ^8.70.0
argon2	^0.44.0 → ^0.45.1
compression	^1.8.1 → ^1.8.2
concurrently	^10.0.3 → ^10.0.5
eslint (source)	^10.5.0 → ^10.10.0
globals	^17.6.0 → ^17.12.0
knex (source)	^3.2.10 → ^3.3.0
mocha (source)	^12.0.0 → ^12.0.1
nodemailer (source)	^9.0.0 → ^9.1.1
pg (source)	^8.21.0 → ^8.23.0
playwright (source)	^1.60.0 → ^1.63.0
prettier (source)	^3.8.4 → ^3.9.6
sinon (source)	^22.0.0 → ^22.1.0
testcontainers	^12.0.2 → ^12.1.0
undici (source)	^8.4.1 → ^8.10.2
ws	^8.21.0 → ^8.21.3
yaml (source)	^2.9.0 → ^2.9.1
zod (source)	^4.4.3 → ^4.6.5

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

digicatapult/tsoa-oauth-express (@​digicatapult/tsoa-oauth-express)

v2.0.79

Compare Source

Changes

Add rootDir to tsconfig

Linked Tickets

ENG-353

High Level Description

Releases have been failing for a little while due to rootDir being missing from tsconfig*.json; tsconfig.json itself requires a root directory of ./ to capture example and src, whereas tsconfig.build.json is satisfied with ./src alone.

eslint/eslintrc (@​eslint/eslintrc)

v3.3.7

Compare Source

Bug Fixes

• Bump js-yaml to 4.3.1 (#​239) (f27e7c9)
• update js-yaml to 4.3.2 to address security vulnerability (#​243) (bb0d97a)

microsoft/playwright (@​playwright/test)

v1.63.0

Compare Source

swc-project/swc (@​swc/core)

v1.16.2

Compare Source

Bug Fixes

• (es/compat) Preserve for-of var binding scope (#​12158) (f6d5bd1)

• (es/decorators) Drop params from getter replacing decorated private method (#​12161) (d56f594)

• (es/flow) Preserve Flow component type semantics (#​12090) (c8d5b49)

• (es/minifier) Mark for update and test as executed multiple time (#​12131) (1260e36)

• (es/minifier) Report for loop var decl as assign (#​12136) (783bbc2)

• (es/minifier) Don't replace value-used console.*.bind() calls with undefined (#​12138) (ed74223)

• (es/minifier) Drop spans of cached globals values (#​12129) (9a306b8)

• (es/minifier) Preserve effects of returned value calls (#​12140) (c37b5a9)

• (es/minifier) Avoid JSX sequence inlining loop (#​12149) (4e79b94)

• (es/minifier) Preserve bindings in copied inline arrows (#​12141) (cf7b5c9)

• (es/minifier) Preserve do-while control-flow targets (#​12160) (f62c437)

• (es/minifier) Preserve pure annotation ownership (#​12180) (ec780f9)

• (es/parser) Retry ambiguous Program parsing (#​12142) (141a320)

• (es/parser) Preserve await grammar boundaries (#​12156) (c732683)

• (es/quote) Restore await parsing (#​12163) (918f517)

• (es/typescript) Treat const variable references as enum constants (#​12101) (c523551)

• (swc) Key optimizer env cache by configured values (#​12166) (c0b6f12)

• (visit) Panic on invalid AST paths (#​12154) (b4d11a9)

Features

• (es/minifier) Evaluate Math.floor, Math.ceil, Math.round and Mat… (#​12117) (e876e80)

• (es/parser) Add opt-in parser-only TSRX lowering (#​12120) (61ff097)

Miscellaneous Tasks

• (deps) Upgrade reqwest to 0.12 (#​12144) (8dd98e4)

• (deps) Ignore unpatched Wasmtime advisory (#​12170) (5dd7422)

Refactor

• (react-compiler) Use official packages (#​12168) (6d34fe7)

Testing

• (es/minifier) Update test fixtures (#​12135) (2f3e88d)

Ci

• Only plan completed issues and merged PRs (#​12133) (4d9aa8e)

• Gate jobs with detected changes (#​12147) (3802924)

• Tag published misc npm packages (#​12173) (a789691)

v1.16.1

Compare Source

Bug Fixes

• (es/minifier) Preserve for init (#​12121) (0a1d4de)

• (es/modules) Preserve destructuring assignment targets in SystemJS (#​12122) (557060b)

• (es/react) Handle apos JSX entities (#​12125) (d09547f)

v1.16.0

Compare Source

Bug Fixes

• (encoding) Fix incorrect fields count (#​11905) (6fb4ca1)

  • BREAKING: Fix incorrect fields count (#​11905)

• (es/ast) Prevent mutable reference escape (#​12088) (592f559)

• (es/ast) Fix panic on JSX surrogate entities (#​11803) (d21de47)

  • BREAKING: fix panic on JSX surrogate entities (#​11803)

• (es/es2015) Preserve this in static field parameters (#​12085) (5b758ed)

• (es/minifier) Remove unused variable initializer cycles (#​12106) (0421534)

• (es/minifier) Bound arguments parameter injection (#​12053) (46d6f41)

• (es/preset-env) Lower unsupported async generators (#​12086) (3a144b1)

• (hstr) Avoid references to uninitialized bytes (#​12087) (68f0983)

• (plugin) Make raw byte reconstruction unsafe (#​12089) (83ab4ed)

• (plugin/runner) Write Wasmer cache atomically (#​12100) (3c4f404)

• (react-compiler) Make fast check conservative (#​12105) (7e14950)

• (react-compiler) Preserve TypeScript function overload signatures (#​12115) (a132384)

Miscellaneous Tasks

• (deps) Update browserslist-rs to 0.20 (#​12098) (b395eab)

• (deps) Update lru to 0.18.2 to fix cargo deny (#​12116) (c9d1da4)

Refactor

• (es/ast) Add body_ctxt to Switch (#​12065) (bf25ae0)

  • BREAKING: Add body_ctxt to Switch (#​12065)

• (es/ast) Split TypeScript this parameters (#​12075) (1687c0f)

  • BREAKING: split TypeScript this parameters (#​12075)

• (es/ast) Use Function for object accessors (#​12077) (9ae902e)

  • BREAKING: use Function for object accessors (#​12077)

• (es/ast) Introduce FunctionBody (#​12096) (394c7c9)

  • BREAKING: introduce FunctionBody (#​12096)

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.70.0

Compare Source

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#​12730)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#​12780)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#​12728)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#​12729)

❤️ Thank You

• Josh Goldberg ✨ @​JoshuaKGoldberg
• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

🚀 Features

• eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#​12603)

🩹 Fixes

• eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#​12727)
• eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#​12741)
• eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#​12731)

❤️ Thank You

• Abdu Alim Arlikhozhaev @​Arlikhozhaev
• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• wonbeanie @​wonbeanie

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.68.0

Compare Source

🚀 Features

• eslint-plugin: [strict-void-return] add fix suggestions (#​12086)

🩹 Fixes

• eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#​12739)
• eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#​12646)
• eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#​12711)
• eslint-plugin: [unified-signatures] report identical signatures (#​12678)
• eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#​12707)
• eslint-plugin: [unified-signatures] deduplicate types in report (#​12656)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Hugo @​hugop95
• Niki @​phaux
• Younsang Na @​nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.67.0

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.70.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.68.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.67.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

ranisalt/node-argon2 (argon2)

v0.45.1

Compare Source

Fixes an issue with v0.45.0 where TypeScript generated types for the hash function as returning Promise<any>

Full Changelog: ranisalt/node-argon2@v0.45.0...v0.45.1

v0.45.0

Compare Source

What's Changed

Drops support for Node 18 and 20 (probably still works, but isn't tested)

• Add comparison with node:crypto and clarify parameter usage in README.md by @​cbodin in #​491
• Fix compilation on solaris by @​matt-fidd in #​538

New Contributors

• @​cbodin made their first contribution in #​491
• @​matt-fidd made their first contribution in #​538

Full Changelog: ranisalt/node-argon2@v0.44.0...v0.45.0

expressjs/compression (compression)

v1.8.2

Compare Source

=====

• Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95)
• deps: add destroy@​1.2.0
• Match Cache-Control: no-transform directive case-insensitively

open-cli-tools/concurrently (concurrently)

v10.0.5

Compare Source

What's Changed

• fix: correctly output non-ASCII text on Windows by @​DanielC000 in #​604
• fix: expand wildcards from package.json5 when package.json is missing by @​DSeaStar in #​608

New Contributors

• @​DanielC000 made their first contribution in #​604
• @​DSeaStar made their first contribution in #​608

Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5

eslint/eslint (eslint)

v10.10.0

Compare Source

v10.9.1

Compare Source

v10.9.0

Compare Source

v10.8.1

Compare Source

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#​21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#​21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#​21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#​20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#​21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#​21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#​21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#​21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#​21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#​21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#​21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#​21151) (JIYEON)
• d086293 test: add error locations to no-undef (#​21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#​21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#​21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#​21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#​21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#​21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#​21138) (dongkyu lee)

sindresorhus/globals (globals)

v17.12.0

Compare Source

• Update globals (2026-09-01) (#​353) 50a2119
• Add __webpack_layer__ global (#​351) 779a11a

---

v17.11.0

Compare Source

v17.10.0

Compare Source

mochajs/mocha (mocha)

v12.0.1

Compare Source

🩹 Fixes

• bump serialize-javascript to ^7.1.1 (#​6278) (02558a3)
• deps: update dependency find-up to v8 (#​5747) (ee11d29)
• deps: update dependency is-path-inside to v4 (#​5748) (5b27e3a)
• deps: update dependency starlight-blog to ^0.29.0 (#​6248) (532b82b)
• keep unknown config values from becoming test specs (#​6244) (15aa7d1)
• only reject positional args that are entirely numeric (#​6222) (1633779)
• reporter: split err.stack at trailing frame block so embedded stacks render once (#​5997) (90f48e4)

📚 Documentation

• blog: fixup v12 blog (#​6258) (6bcbee4)
• fix minor API documentation issue (#​6241) (683fd10)
• publish v12 stable blog (#​6249) (d5ad803)

🧹 Chores

• auto-add GitHub items to project (#​5686) (d24c320)
• convert lib/runner.js to ESM (#​6260) (123b2d5)
• deps: update actions/add-to-project action to v2 (#​6276) (00f873b)
• deps: update actions/github-script action to v9 (#​6277) (49ed525)
• deps: update dependency astro to v7.2.9 (#​6223) (513bd50)
• deps: update dependency eslint to v10.9.1 (#​6251) (e28b90c)
• deps: update dependency eslint-plugin-n to v18.3.0 (#​6240) (3a11840)
• deps: update dependency globals to v17.11.0 (#​6243) (1cf345b)
• deps: update dependency globals to v17.12.0 (#​6288) (97b8df6)
• deps: update dependency js-yaml to v5.4.1 (#​6247) (9593caa)
• deps: update dependency knip to v6.32.3 (#​6224) (6781fa1)
• deps: update dependency knip to v6.34.0 (#​6279) (85ff1b6)
• deps: update dependency rollup to v4.63.1 (#​6274) (e5a779e)
• deps: update dependency serialize-javascript to v7.1.0 (#​6239) (77e4d4a)
• deps: update dependency webpack to v5.110.1 (#​6275) (ec436d5)
• deps: update matteogabriele/agentscan-action action to v2.5.0 (#​6280) (0bb7925)
• remove unused .lintstagedrc.json (#​6270) (d84fdbf)
• update spam filter (#​6271) (b932787)
• use a junction to link the config fixture on Windows (#​6218) (a6b5d98)

brianc/node-postgres (pg)

v8.23.0

Compare Source

• Add support for query pipelineing.

nodejs/undici (undici)

v8.10.2

Compare Source

⚠️ Security fixes

High severity

• GHSA-vp8m-p9jh-q5pm: cache and deduplication interceptors could use caller-controlled request metadata instead of the authoritative dispatcher origin, enabling cross-origin cache poisoning and data disclosure. Undici now derives interceptor identities from the dispatcher origin and bypasses origin-dependent interceptors when no authoritative origin exists. Fixed by caf6194d.
• GHSA-w293-vg96-wgc3: BalancedPool could drop function-valued connection options while cloning its configuration, including custom TLS certificate validation callbacks. Undici now preserves connect and legacy tls options when creating upstreams. Fixed by 8f5868fb.
• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 66e12816.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 4411a238.
• GHSA-rx4f-c7p8-82vq: an unclean WebSocketStream close could create an unobserved rejected promise when its writable stream was locked, potentially terminating the process. Undici now propagates the failure through the retained writable stream controller. Fixed by 662d0ea6.
• GHSA-2jfj-6hjv-fm6j: shared caches could store and replay responses containing Set-Cookie, disclosing one user's cookies to another caller. Undici now excludes these responses from shared caches, including existing entries and revalidation paths. Fixed by cb75bbb3.
• [GHSA-3xpg-4rpp-hhhm](https://redirect.github.com/nod

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.