Chore(deps): Bump the node-minor-patch group across 4 directories with 14 updates

[dependabot]

Bumps the node-minor-patch group with 7 updates in the /backend/compact-connect-ui-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1029.0	3.1075.0
@aws-sdk/client-s3	3.1029.0	3.1075.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.6.0
mocha	11.7.5	11.7.6

Bumps the node-minor-patch group with 14 updates in the /backend/compact-connect/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1075.0
@aws-sdk/client-s3	3.1045.0	3.1075.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.6.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1075.0
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.62.0
@typescript-eslint/parser	8.58.1	8.62.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.22.4

Bumps the node-minor-patch group with 14 updates in the /backend/cosmetology-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1075.0
@aws-sdk/client-s3	3.1045.0	3.1075.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.6.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1075.0
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.62.0
@typescript-eslint/parser	8.58.1	8.62.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.22.4

Bumps the node-minor-patch group with 14 updates in the /backend/social-work-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1075.0
@aws-sdk/client-s3	3.1045.0	3.1075.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.6.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1075.0
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.62.0
@typescript-eslint/parser	8.58.1	8.62.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.22.4

Updates @aws-lambda-powertools/logger from 2.32.0 to 2.33.1

Release notes

Sourced from @​aws-lambda-powertools/logger's releases.

v2.33.1

Summary

This release is mainly composed of bug fixes across the HTTP event handler, Metrics, Logger, and Parser utilities, along with the removal of Node.js 20 support now that the runtime has reached end-of-life on AWS Lambda.

In the HTTP event handler, we have fixed response header corruption where multi-attribute headers like Set-Cookie (with Expires dates) and other comma-containing values were being incorrectly split into multiple headers. The HTTP event handler also now correctly preserves PATCH request bodies on ALB events and returns the proper 204 response for CORS preflight requests that omit the Access-Control-Request-Headers header.

In Metrics, dimension limits are now enforced per-array rather than across the merged set, preventing CloudWatch EMF rejections when default and request-scoped dimensions overlap. Logger now flushes the log buffer when critical() is called with flushOnErrorLog enabled, matching the behaviour of error().

[!IMPORTANT] Node.js 20 is no longer supported. Node.js 20 reached end-of-life on AWS Lambda, so this release drops support for it. If you are still on Node.js 20, we recommend upgrading to Node.js 22 before updating Powertools.

⭐ Congratulations to @​vishwakt and @​nanookclaw for their first PRs merged in the project 🎉

Changes

• chore(deps): fix npm audit vulnerabilities (#5269) by @​svozza
• fix(event-handler): allow cors preflight without request headers (#5267) by @​vishwakt
• fix(event-handler): preserve ALB PATCH bodies (#5259) by @​nanookclaw
• fix(event-handler): restrict v1/alb comma header splitting to an allowlist (#5257) by @​vishwakt
• fix(parser): cognito validationData may be null (#5250) by @​bdellegrazie
• fix(metrics): enforce dimension limits per-array (#5229) by @​vishwakt
• improv(docs): fixed the docs to mention middy support for v7.x (#5238) by @​sdangol
• fix(metrics): account for all dimensions in setDefaultDimensions() li… (#5228) by @​vishwakt
• fix(logger): flush log buffer on critical() when flushOnErrorLog is e… (#5227) by @​vishwakt
• fix(metrics): clear state in publishStoredMetrics even when throwOnEmptyMetrics throws (#5213) by @​svozza
• chore: drop Node.js 20 support (#5218) by @​svozza
• fix(commons): prevent deepMerge from mutating source objects (#5202) by @​svozza
• fix(commons): correctly handle shared references in deepMerge (#5195) by @​svozza
• ci(maintenance): Remove release comment automation (#5193) by @​dreamorosi
• fix(logger): correctly serialize shared object references in JSON replacer (#5186) by @​svozza

🔧 Maintenance

• chore(deps-dev): bump protobufjs from 8.4.0 to 8.4.2 (#5285) by @dependabot[bot]
• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#5279) by @dependabot[bot]
• chore(deps): bump idna from 3.10 to 3.15 in /docs (#5274) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.3.0 to 8.4.0 (#5270) by @dependabot[bot]
• chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs (#5275) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5277) by @dependabot[bot]
• chore(deps-dev): bump @​valkey/valkey-glide from 2.3.1 to 2.4.0 (#5271) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.0.4 to 17.0.5 (#5272) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.8.0 to 25.9.1 (#5276) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#5264) by @dependabot[bot]
• chore(deps-dev): bump @​aws/durable-execution-sdk-js from 1.1.2 to 1.1.3 (#5265) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.7.0 to 25.8.0 (#5266) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.2.0 to 8.3.0 (#5253) by @dependabot[bot]
• chore(deps): bump gitpython from 3.1.48 to 3.1.50 in /docs (#5234) by @dependabot[bot]
• chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /docs (#5239) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.6.0 to 25.7.0 (#5244) by @dependabot[bot]

... (truncated)

Changelog

Sourced from @​aws-lambda-powertools/logger's changelog.

2.33.1 (2026-05-25)

Bug Fixes

• commons prevent deepMerge from mutating source objects (#5202) (9994787)
• commons correctly handle shared references in deepMerge (#5195) (6b1a811)
• logger flush log buffer on critical() when flushOnErrorLog is e… (#5227) (853b44f)
• logger correctly serialize shared object references in JSON replacer (#5186) (097e440)
• metrics enforce dimension limits per-array (#5229) (8791ee2)
• metrics account for all dimensions in setDefaultDimensions() li… (#5228) (54eb80a)
• metrics clear state in publishStoredMetrics even when throwOnEmptyMetrics throws (#5213) (a37913f)
• parser cognito validationData may be null (#5250) (b3c1293)
• event-handler allow cors preflight without request headers (#5267) (5adc3f4)
• event-handler preserve ALB PATCH bodies (#5259) (9e1a687)
• event-handler restrict v1/alb comma header splitting to an allowlist (#5257) (ca4bb13)

Maintenance

• validation bump ajv from 8.18.0 to 8.20.0 (#5214) (4a9edca)

2.33.0 (2026-04-14)

Bug Fixes

• commons don't overwrite existing value with undefined in deepMerge (#5141) (c7c6c0f)
• commons rename AvailabilityZoneId to AvailabilityZoneID in docs and tests (#5118) (65c054c)
• event-handler http response body validation typings (#5125) (0805db9)

Improvements

• parser export InferOutput from public types entry point (#5175) (16c6de6)

Features

• event-handler add metrics middleware for HTTP routes (#5086) (5af28e8)

Commits

• a3d3147 chore(ci): bump version to 2.33.1 (#5288)
• 56eacb7 chore(deps-dev): bump protobufjs from 8.4.0 to 8.4.2 (#5285)
• ba4d364 chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#5279)
• 30621d6 chore(deps): bump idna from 3.10 to 3.15 in /docs (#5274)
• b756cfc chore(deps-dev): bump protobufjs from 8.3.0 to 8.4.0 (#5270)
• 3fdc9d9 chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs (#5275)
• 3cf427f chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5277)
• 7325ba2 chore(deps-dev): bump @​valkey/valkey-glide from 2.3.1 to 2.4.0 (#5271)
• 519b88d chore(deps-dev): bump lint-staged from 17.0.4 to 17.0.5 (#5272)
• 1a84635 chore(deps): bump @​types/node from 25.8.0 to 25.9.1 (#5276)
• Additional commits viewable in compare view

Updates @aws-sdk/client-dynamodb from 3.1029.0 to 3.1075.0

Release notes

Sourced from @​aws-sdk/client-dynamodb's releases.

v3.1075.0

3.1075.0(2026-06-23)

New Features

• client-kafka: Amazon MSK Replicator now supports mTLS authentication when connecting to external Apache Kafka clusters, enabling customers to replicate data from clusters that require mutual TLS for client authentication. This capability is supported when replicating to Amazon MSK Express brokers. (005f9529)

---

For list of updated packages, view updated-packages.md in assets-3.1075.0.zip

v3.1074.0

3.1074.0(2026-06-22)

Chores

• xml-builder:
  • move testing devDeps to root, remove unused nodable dep (#8118) (ed82880d)
  • parse XML internally (#7863) (74d0a071)

Documentation Changes

• typo in contributing.md (#8116) (87ff33d3)

New Features

• clients: update client endpoints as of 2026-06-22 (3a55a333)
• client-cloudwatch-logs: CloudWatch Logs Updates - New APIs introduced to support syslog ingestion to a log group. For more information, see CloudWatch Logs API documentation. (01a3b513)
• client-bedrock-agentcore: Adds an optional extractionMode field to CreateEvent. SKIP retains the event in short-term memory but excludes it from long-term memory extraction. (749753ad)
• client-omics: Adds support for scratch ephemeral storage mounted at tmp (331e3023)
• client-application-signals: Application Signals now supports dynamic instrumentation and Service Events telemetry. Add instrumentation at runtime without restarts, and use fine-grained profiling data to quickly pinpoint latency and error root causes. (f93b1c03)
• client-mediaconnect: AWS MediaConnect now supports Content Quality Analysis for Router Inputs, enabling detection of black frames, frozen frames, and silent audio with configurable thresholds. (05054853)
• client-lambda-core: Initial release of the AWS Lambda Core SDK with APIs to create, manage, and tag network connectors that enable Lambda compute resources to access private resources in your Amazon VPC. (e35cdab8)
• client-lambda: Add support for tagging Network Connector resources in AWS Lambda. (fbfc4078)
• client-guardduty: Added AI-powered investigations that automatically analyze security findings, correlate related activity, and produce structured summaries with risk assessment, confidence scoring, MITRE technique classification, and actionable next steps. (83c29839)
• client-lambda-microvms: Lambda MicroVMs GA launch. Lambda MicroVMs enable isolated and highly responsive execution of user-supplied or LLM-generated code. (5519a7e2)
• client-kafka: Amazon MSK Replicator now supports mTLS authentication when connecting to external Apache Kafka clusters, enabling customers to replicate data from clusters that require mutual TLS for client authentication. This capability is supported when replicating to Amazon MSK Express brokers. (ce7d1bf5)
• client-quicksight: Updated the Amazon Quick Spaces API to remove unsupported SPACE and ARTIFACT values from the SpaceQuickSightResourceType enum. (e1b325d4)
• client-ec2: This release adds support for AMI Watermark and Allowed AMIs integration (d1698bed)
• client-direct-connect: Added VIF rate limiting support for AWS Direct Connect, allowing customers to set bandwidth allocations on virtual interfaces to manage traffic on dedicated connections. (228a95dc)

Bug Fixes

• cloudfront-signer: filename asterisk apostrophe encoding fix (#8119) (35acab40)

---

For list of updated packages, view updated-packages.md in assets-3.1074.0.zip

... (truncated)

Changelog

Sourced from @​aws-sdk/client-dynamodb's changelog.

3.1075.0 (2026-06-23)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1074.0 (2026-06-22)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1073.0 (2026-06-19)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1072.0 (2026-06-18)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1071.0 (2026-06-17)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1070.0 (2026-06-16)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1069.0 (2026-06-15)

... (truncated)

Commits

• 29ee199 Publish v3.1075.0
• c48dfa0 Publish v3.1074.0
• ee71adc Publish v3.1073.0
• 501cd33 Publish v3.1072.0
• 3ce820a Publish v3.1071.0
• 4f2cfe1 Publish v3.1070.0
• 7058d13 Publish v3.1069.0
• 67981c5 chore(scripts): tuning the build graph (#8095)
• 0632f6d Publish v3.1068.0
• 0a3246f Publish v3.1067.0
• Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1029.0 to 3.1075.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1075.0

3.1075.0(2026-06-23)

New Features

• client-kafka: Amazon MSK Replicator now supports mTLS authentication when connecting to external Apache Kafka clusters, enabling customers to replicate data from clusters that require mutual TLS for client authentication. This capability is supported when replicating to Amazon MSK Express brokers. (005f9529)

---

For list of updated packages, view updated-packages.md in assets-3.1075.0.zip

v3.1074.0

3.1074.0(2026-06-22)

Chores

• xml-builder:
  • move testing devDeps to root, remove unused nodable dep (#8118) (ed82880d)
  • parse XML internally (#7863) (74d0a071)

Documentation Changes

• typo in contributing.md (#8116) (87ff33d3)

New Features

• clients: update client endpoints as of 2026-06-22 (3a55a333)
• client-cloudwatch-logs: CloudWatch Logs Updates - New APIs introduced to support syslog ingestion to a log group. For more information, see CloudWatch Logs API documentation. (01a3b513)
• client-bedrock-agentcore: Adds an optional extractionMode field to CreateEvent. SKIP retains the event in short-term memory but excludes it from long-term memory extraction. (749753ad)
• client-omics: Adds support for scratch ephemeral storage mounted at tmp (331e3023)
• client-application-signals: Application Signals now supports dynamic instrumentation and Service Events telemetry. Add instrumentation at runtime without restarts, and use fine-grained profiling data to quickly pinpoint latency and error root causes. (f93b1c03)
• client-mediaconnect: AWS MediaConnect now supports Content Quality Analysis for Router Inputs, enabling detection of black frames, frozen frames, and silent audio with configurable thresholds. (05054853)
• client-lambda-core: Initial release of the AWS Lambda Core SDK with APIs to create, manage, and tag network connectors that enable Lambda compute resources to access private resources in your Amazon VPC. (e35cdab8)
• client-lambda: Add support for tagging Network Connector resources in AWS Lambda. (fbfc4078)
• client-guardduty: Added AI-powered investigations that automatically analyze security findings, correlate related activity, and produce structured summaries with risk assessment, confidence scoring, MITRE technique classification, and actionable next steps. (83c29839)
• client-lambda-microvms: Lambda MicroVMs GA launch. Lambda MicroVMs enable isolated and highly responsive execution of user-supplied or LLM-generated code. (5519a7e2)
• client-kafka: Amazon MSK Replicator now supports mTLS authentication when connecting to external Apache Kafka clusters, enabling customers to replicate data from clusters that require mutual TLS for client authentication. This capability is supported when replicating to Amazon MSK Express brokers. (ce7d1bf5)
• client-quicksight: Updated the Amazon Quick Spaces API to remove unsupported SPACE and ARTIFACT values from the SpaceQuickSightResourceType enum. (e1b325d4)
• client-ec2: This release adds support for AMI Watermark and Allowed AMIs integration (d1698bed)
• client-direct-connect: Added VIF rate limiting support for AWS Direct Connect, allowing customers to set bandwidth allocations on virtual interfaces to manage traffic on dedicated connections. (228a95dc)

Bug Fixes

• cloudfront-signer: filename asterisk apostrophe encoding fix (#8119) (35acab40)

---

For list of updated packages, view updated-packages.md in assets-3.1074.0.zip

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1075.0 (2026-06-23)

Note: Version bump only for package @​aws-sdk/client-s3

3.1074.0 (2026-06-22)

Note: Version bump only for package @​aws-sdk/client-s3

3.1073.0 (2026-06-19)

Note: Version bump only for package @​aws-sdk/client-s3

3.1072.0 (2026-06-18)

Note: Version bump only for package @​aws-sdk/client-s3

3.1071.0 (2026-06-17)

Note: Version bump only for package @​aws-sdk/client-s3

3.1070.0 (2026-06-16)

Features

• client-s3: Added support for annotations. You can now attach up to 1000 annotations (up to 1 MB each) directly to objects and create, retrieve, list, and delete them using new annotation APIs. Also added support for configuring an annotation table in S3 Metadata. (c555874)

... (truncated)

Commits

• 29ee199 Publish v3.1075.0
• c48dfa0 Publish v3.1074.0
• 74d0a07 chore(xml-builder): parse XML internally (#7863)
• ee71adc Publish v3.1073.0
• 501cd33 Publish v3.1072.0
• 3ce820a Publish v3.1071.0
• 4f2cfe1 Publish v3.1070.0
• c555874 feat(client-s3): Added support for annotations. You can now attach up to 1000...
• 7058d13 Publish v3.1069.0
• 67981c5 chore(scripts): tuning the build graph (#8095)
• Additional commits viewable in compare view

Updates @aws-sdk/util-dynamodb from 3.996.2 to 3.996.5

Commits

• See full diff in compare view

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates eslint from 10.2.1 to 10.6.0

Release notes

Sourced from eslint's releases.

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

v10.5.0

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)