Bump the dev-tools group across 1 directory with 5 updates

[dependabot]

Bumps the dev-tools group with 5 updates in the / directory:

Package	From	To
eslint-plugin-solid	0.17.0	0.18.0
happy-dom	20.14.0	20.14.5
typescript	6.0.3	7.0.2
typescript-eslint	8.69.0	8.70.0
vitest	5.0.0	5.0.1

Updates eslint-plugin-solid from 0.17.0 to 0.18.0

Release notes

Sourced from eslint-plugin-solid's releases.

v0.18.0

Four new correctness rules (from #219, thanks @​brenelz), a revived community rule (#145, thanks @​SarguelUnda), extensions to existing rules, and a batch of reactivity false-positive fixes. Verified against the official Solid 2.0 templates (zero findings).

New rules (enabled in v2/v2-strict)

• solid/no-write-in-pure-computation (error) — setter calls in createMemo callbacks, the compute half of createEffect(compute, effect), and component bodies, all pure owned scopes that throw on writes in Solid 2.0 dev. Honors ownedWrite: true; onSettled/createTrackedEffect/handlers/effect halves exempt by function boundary. Closes #79.
• solid/no-store-mutation-outside-setter (error) — mutating a store's read proxy is silently ignored by core (no error, no update); lint is the only guardrail today.
• solid/no-unused-signal (warn) — never-written or never-read createSignal/createStore/createOptimistic tuples, which unused-variable rules can't see.
• solid/no-boolean-enumerated-attribute (error) — booleans on enumerated attributes (draggable, spellcheck, contenteditable, translate, tristate aria-*) produce a different state than the string tokens; literals autofix. Closes #144/#145.

Reactivity false-positive fixes

• untrack(async () => ...) no longer reports an async tracked scope (#188)
• this.state = state is a reference escape, not a snapshot (#184)
• makePersisted(createSignal(...))-style wrappers analyze as pass-through (#190)

New setting

• settings.solid.moduleSources registers custom renderers/re-export wrappers as Solid primitive sources (#183)

Full details in the changelog.

v0.17.1

Bug fixes only. Thanks to @​jynxio and @​brenelz for the reports and PRs.

Fixes

• solid/reactivity regression from 0.16.1 (#223). The staleCapture check flagged captures read inside synchronous array-method callbacks (items.filter((item) => item.includes(q))) within createMemo/createEffect bodies. A function passed as a call argument doesn't escape through a return below it — only the call's result does — so these callbacks run during the computation, where the capture is fresh. IIFEs are exempt for the same reason.
• solid/imports type mappings for Solid 2.0 (#220, #221, #222). The JSX namespace only exists in @solidjs/web in 2.0; the rule was autofixing correct imports into a module that doesn't export it. ValidComponent/ComponentProps are now accepted from both solid-js (DOM-independent) and @solidjs/web (DOM-aware) since the two packages export genuinely different types. The fixer also no longer produces a duplicate type modifier (import type { type JSX }) when moving inline type specifiers.
• renderToStringAsync is a removed API, not a misplaced one. It no longer exists in Solid 2.0 (renderToString awaits async content). Dropped from the v2 imports map — which was autofixing imports into a dead end — and added to solid/removed-api with migration guidance. solid/removed-api now also scans @solidjs/web imports, so a mechanically source-rewritten import of a removed API is still reported.

Also verified fixed and closed: #193 (signals passed as create* arguments stopped warning with the 0.16.1 accessor-passing work).

Commits

• 84ddb05 v0.18.0
• 061eee0 Merge 0.18.0: four correctness rules (#219 by @​brenelz), no-boolean-enumerate...
• 3100db5 chore: release 0.18.0
• 8b4b59d feat: 0.18.0 rule batch — component-body writes, enumerated attributes, store...
• fbd900f no-write-in-pure-computation: resolve ownedWrite through const indirection
• b9f13d5 review amendments: drop no-async-effect-half, honor ownedWrite, correct store...
• e3f7b1c Merge pull request #224 from solidjs-community/patch-0.17.1
• 893c5f7 v0.17.1
• abc08ea fix: 0.17.1 patch bucket — staleCapture regression, imports type maps, render...
• d3cc0d9 Merge pull request #220 from jynxio/main
• Additional commits viewable in compare view

Updates happy-dom from 20.14.0 to 20.14.5

Release notes

Sourced from happy-dom's releases.

v20.14.5

👷‍♂️ Patch fixes

• Preserve character references in comment data - By @​hampustagerud in task #2409

v20.14.4

👷‍♂️ Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #2407

v20.14.3

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #2363

v20.14.2

👷‍♂️ Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #2344

v20.14.1

👷‍♂️ Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #2366

Commits

• 0d4cdbe fix: #2409 Preserve character references in comment data (#2410)
• 9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...
• 5fb1df3 fix: #2363 Avoids cloning all properties in CSSPropertyManager.toString() (...
• de0a1e9 fix: #2344 Resolve every var() in a value, not only the first one (#2395)
• 64b8b94 fix: #2366 Invalidate the computed style cache for the whole subtree (#2367)
• See full diff in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates typescript-eslint from 8.69.0 to 8.70.0

Release notes

Sourced from typescript-eslint's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.70.0 (2026-09-07)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• See full diff in compare view

Updates vitest from 5.0.0 to 5.0.1

Release notes

Sourced from vitest's releases.

v5.0.1

   🚀 Features

• ui:
  • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11189 (5dc4b)
  • Add focused trace view layout mode  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11190 (376dc)

   🐞 Bug Fixes

• Exit 1 when vitest list fails collection  -  by @​hamed-bavar in vitest-dev/vitest#11145 and vitest-dev/vitest#11146 (6108b)
• Keep parse error details in static collection  -  by @​hamed-bavar in vitest-dev/vitest#11150 and vitest-dev/vitest#11151 (7c818)
• Avoid recursive prototype in automocking  -  by @​sheremet-va in vitest-dev/vitest#11195 (99fc5)
• Prevent false Vitest import resolution  -  by @​sheremet-va in vitest-dev/vitest#11196 (b426c)
• Keep metadata file when clearing the cache  -  by @​sheremet-va in vitest-dev/vitest#11199 (73614)
• Correct typos in error message and comments  -  by @​shinji00222 and Shinji in vitest-dev/vitest#11187 (115c3)
• Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by @​LukeAbby in vitest-dev/vitest#11175 (498fb)
• Share the server on self-referencing extends  -  by @​sheremet-va in vitest-dev/vitest#11034 (23dda)
• Warn when deprecated deps.optimizer.web is used  -  by @​im10furry in vitest-dev/vitest#11214 (2ce29)
• browser:
  • Avoid double quotes in config.define  -  by @​sheremet-va in vitest-dev/vitest#11198 (972e2)
• doctor:
  • Measure vm pools for custom environments  -  by @​sheremet-va in vitest-dev/vitest#11212 (91ab1)
• expect:
  • Correct return value in toMatchAriaSnapshot  -  by @​sheremet-va in vitest-dev/vitest#11208 (c119b)
• fakeTimers:
  • Force queueMicrotask and nextTick in toNotFake  -  by @​kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @​hi-ogawa in vitest-dev/vitest#11261 (a47d7)
• snapshot:
  • Report obsolete keys next to skipped tests  -  by @​hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#11157 and vitest-dev/vitest#11158 (17e2b)
• types:
  • Make public declarations self-contained  -  by @​ZoeySigel in vitest-dev/vitest#11141 (45546)
• ui:
  • Fix collapse/expand suite with file name search  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11260 (0a712)
  • Fix explorer file summary count  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in vitest-dev/vitest#11125 (05982)
• utils:
  • Fix deepMerge to handle prototype  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in vitest-dev/vitest#11215 (4944c)

    View changes on GitHub

Commits

• 03630a5 chore: release v5.0.1 (#11275)
• a47d790 fix(fakeTimers): force queueMicrotask and nextTick in toNotFake (#11261)
• 2ce29d5 fix: warn when deprecated deps.optimizer.web is used (#11214)
• ccd6d05 docs: fix typecheck exclude default in documentation (#11223)
• 91ab158 fix(doctor): measure vm pools for custom environments (#11212)
• 23dda73 fix: share the server on self-referencing extends (#11034)
• 498fbe9 fix: resolve ResolvedConfig exactOptionalPropertyTypes errors (#11175)
• 115c3f6 fix: correct typos in error message and comments (#11187)
• 7361465 fix: keep metadata file when clearing the cache (#11199)
• 972e24b fix(browser): avoid double quotes in config.define (#11198)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	happy-dom@​20.14.0 ⏵ 20.14.5			+1	-1
	typescript-eslint@​8.69.0 ⏵ 8.70.0	+1		+1
	vitest@​5.0.0 ⏵ 5.0.1	+1		+1	-1
	eslint-plugin-solid@​0.17.0 ⏵ 0.18.0			+1	+1

View full report