[dependabot]

Bumps the slopesmith group in /Slopesmith with 9 updates:

Package	From	To
@napi-rs/canvas	1.0.11	1.0.13
livekit-client	2.22.4	2.23.0
livekit-server-sdk	2.19.1	2.19.2
three-mesh-bvh	0.9.16	0.9.17
@types/node	24.19.2	26.6.6
eslint	10.12.0	10.13.0
typescript	5.9.3	7.0.2
typescript-eslint	8.71.2	8.72.1
vite	8.3.4	8.3.5

Updates @napi-rs/canvas from 1.0.11 to 1.0.13

Release notes

Sourced from @​napi-rs/canvas's releases.

v1.0.13

What's Changed

• fix(canvas): wrap native methods, not previous wrappers, on re-evaluation by @​Brooooooklyn in Brooooooklyn/canvas#1395

Full Changelog: Brooooooklyn/canvas@v1.0.12...v1.0.13

v1.0.12

What's Changed

• fix(canvas): preserve fractional global alpha through native paints by @​natew in Brooooooklyn/canvas#1355
• fix(canvas): preserve pattern snapshots and honor current image sampling quality by @​natew in Brooooooklyn/canvas#1357
• fix(canvas): enable dithering for gradient fill and stroke paints by @​natew in Brooooooklyn/canvas#1358
• fix: retain display-p3 backing surfaces through context acquisition and resize by @​natew in Brooooooklyn/canvas#1359
• chore(deps): update dependency skia-canvas to v4 by @​renovate[bot] in Brooooooklyn/canvas#1356
• fix(canvas): WebIDL conversion for ImageData, getContext, createPattern by @​Brooooooklyn in Brooooooklyn/canvas#1361
• fix(canvas): match Chrome for hsl() colors and gradient edge cases by @​Brooooooklyn in Brooooooklyn/canvas#1362
• fix(canvas): ImageData patterns and SvgCanvas reads like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1363
• fix: reset style getters on resize, tag AVIF color, exact PDF alpha by @​Brooooooklyn in Brooooooklyn/canvas#1364
• fix(canvas): match Chrome for alpha:false, clearRect and 'copy' by @​Brooooooklyn in Brooooooklyn/canvas#1365
• feat(skia): build Skia with Chrome's CPU raster defines and blitters by @​Brooooooklyn in Brooooooklyn/canvas#1366
• fix(canvas): draw Image sources from Chrome's decode-cache levels by @​Brooooooklyn in Brooooooklyn/canvas#1367
• chore(deps): update rust to v1.99.1 by @​renovate[bot] in Brooooooklyn/canvas#1369
• fix: crash-safe non-finite args, ImageData sizes, DOMMatrixInit by @​Brooooooklyn in Brooooooklyn/canvas#1372
• fix(canvas): WebIDL conversion, arity checks and exceptions like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1373
• fix(imagedata): ImageData and get/put/createImageData work like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1374
• fix(canvas): paths, clips, roundRect and setTransform work like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1375
• fix(canvas): style getters, shadowColor and canvas sizes like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1376
• fix(canvas): gradients and SVG conic export work like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1377
• feat(color): CSS Color 4/5 at every canvas color site, like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1378
• fix(canvas): compositing, shadows, drawCanvas and filters like Chrome by @​Brooooooklyn in Brooooooklyn/canvas#1379
• fix(codecs): Chrome's encoders, AVIF decode, data: URLs and SVG images by @​Brooooooklyn in Brooooooklyn/canvas#1380
• fix(canvas): parse fonts, lay out and measure text like Blink by @​Brooooooklyn in Brooooooklyn/canvas#1381
• feat(canvas): rasterize text like Chrome with CoreText and Fontations by @​Brooooooklyn in Brooooooklyn/canvas#1382
• feat(canvas): float16 canvas storage and float ImageData formats by @​Brooooooklyn in Brooooooklyn/canvas#1383
• feat(svg): draw SVG images like Chrome: CSS, var(), , by @​Brooooooklyn in Brooooooklyn/canvas#1384
• fix(deps): update rust crate font-types to v0.12.7 by @​renovate[bot] in Brooooooklyn/canvas#1386
• fix(deps): pin font-types back to Skia's 0.12.0 by @​Brooooooklyn in Brooooooklyn/canvas#1388
• feat(canvas): write DPI and text metadata in toBuffer, encode and encodeSync by @​Brooooooklyn in Brooooooklyn/canvas#1390
• feat: chrome/m157 by @​Brooooooklyn in Brooooooklyn/canvas#1391
• chore: remove the benchmark by @​Brooooooklyn in Brooooooklyn/canvas#1393

New Contributors

• @​natew made their first contribution in Brooooooklyn/canvas#1355

Full Changelog: Brooooooklyn/canvas@v1.0.11...v1.0.12

Changelog

Sourced from @​napi-rs/canvas's changelog.

1.0.13 (2026-10-21)

Bug Fixes

• canvas: wrap native methods, not previous wrappers, on re-evaluation (#1395) (6997e1d)

1.0.12 (2026-10-20)

Bug Fixes

• canvas: compositing, shadows, drawCanvas and filters like Chrome (#1379) (c6f06a6)
• canvas: draw Image sources from Chrome's decode-cache levels (#1367) (7c3d0c2)
• canvas: enable dithering for gradient fill and stroke paints (#1358) (5f95bd4)
• canvas: gradients and SVG conic export work like Chrome (#1377) (4059399)
• canvas: ImageData patterns and SvgCanvas reads like Chrome (#1363) (e2f6a83)
• canvas: match Chrome for alpha:false, clearRect and 'copy' (#1365) (d82b79c)
• canvas: match Chrome for hsl() colors and gradient edge cases (#1362) (17a4b3b)
• canvas: parse fonts, lay out and measure text like Blink (#1381) (a43bb16)
• canvas: paths, clips, roundRect and setTransform work like Chrome (#1375) (1299146)
• canvas: preserve fractional global alpha through native paints (#1355) (2eb68bc)
• canvas: preserve pattern snapshots and honor current image sampling quality (#1357) (65f4e7c)
• canvas: style getters, shadowColor and canvas sizes like Chrome (#1376) (9bf7aef)
• canvas: WebIDL conversion for ImageData, getContext, createPattern (#1361) (583b7e2)
• canvas: WebIDL conversion, arity checks and exceptions like Chrome (#1373) (676047d)
• codecs: Chrome's encoders, AVIF decode, data: URLs and SVG images (#1380) (b5b38a9)
• crash-safe non-finite args, ImageData sizes, DOMMatrixInit (#1372) (004444b)
• deps: pin font-types back to Skia's 0.12.0 (#1388) (57cd52b)
• deps: update rust crate font-types to v0.12.7 (#1386) (61d89eb)
• imagedata: ImageData and get/put/createImageData work like Chrome (#1374) (82eeacc)
• reset style getters on resize, tag AVIF color, exact PDF alpha (#1364) (09b86b4)
• retain display-p3 backing surfaces through context acquisition and resize (#1359) (0b502f6)

Features

• canvas: float16 canvas storage and float ImageData formats (#1383) (5f841db)
• canvas: rasterize text like Chrome with CoreText and Fontations (#1382) (4c9902a)
• canvas: write DPI and text metadata in toBuffer, encode and encodeSync (#1390) (60f2df2)
• chrome/m157 (#1391) (2c52f61)
• color: CSS Color 4/5 at every canvas color site, like Chrome (#1378) (3be7099)
• skia: build Skia with Chrome's CPU raster defines and blitters (#1366) (9eeb454)
• svg: draw SVG images like Chrome: CSS, var(), , (#1384) (b04d0bc)

Commits

• 00a115d 1.0.13
• 6997e1d fix(canvas): wrap native methods, not previous wrappers, on re-evaluation (#1...
• a89b3c9 1.0.12
• b0e53ea chore: remove the benchmark (#1393)
• 2c52f61 feat: chrome/m157 (#1391)
• 60f2df2 feat(canvas): write DPI and text metadata in toBuffer, encode and encodeSync ...
• 57cd52b fix(deps): pin font-types back to Skia's 0.12.0 (#1388)
• 61d89eb fix(deps): update rust crate font-types to v0.12.7 (#1386)
• b04d0bc feat(svg): draw SVG images like Chrome: CSS, var(), <use>, <image> (#1384)
• 5f841db feat(canvas): float16 canvas storage and float ImageData formats (#1383)
• Additional commits viewable in compare view

Updates livekit-client from 2.22.4 to 2.23.0

Release notes

Sourced from livekit-client's releases.

v2.23.0

Minor Changes

• Release the audio contexts and web audio graphs the SDK creates. Previously they accumulated over mute/unmute cycles. They are now collected after room.disconnect(). - #2029 (@​lukasIO)

  • detectSilence tears its context down on the throw path as well as the happy one.
  • The cleanup from createAudioAnalyser disconnects its nodes before it closes the context, and it is now idempotent.
  • The shared empty audio stream track is refcounted. releaseEmptyAudioStreamTrack is a new export, and its context closes once the last clone is handed back.
  • If webAudioMix is an object without an audioContext, a room now closes the context it created for itself.
  • When the underlying track is replaced, audio processors are passed the audio context. This lets them rebuild their filter nodes on unmute. Previously they left the old nodes behind.
  • The iOS dummy audio element and its visibilitychange listener are torn down on disconnect. Previously the listener outlived every room on the page.

  This also fixes a false AudioSilenceDetected. Silence detection read a zero-filled buffer from a context that never reached running. An autoplay-blocked page therefore reported silence on every track it checked.

  Three further behavior changes to be aware of:

  • A track retained across rooms loses its audio processor. room.disconnect({ stopTracks: false }) detaches the track from the audio context, which stops the processor. Call setProcessor again after you republish the track.
  • Under webAudioMix, every attached element is muted, not only the first one. A second attached element no longer plays the track twice. When the audio context goes away, those elements are unmuted again and their volume is restored.
  • Participant.setAudioContext and LocalAudioTrack.setAudioContext now return a promise. Both are marked @internal, but both appear in the published type declarations.

Patch Changes

• Scale the x-google-start-bitrate hint by connection setup time: the 1 Mbps camera cap now applies to connections that set up within 1.5 s and ramps linearly down to 300 kbps at 3.5 s or slower; screen share stays uncapped. - #2146 (@​changt)

• Add jitter to reconnect retries in the default reconnect policy, including the first retry and reconnects requested by the server, so clients that disconnect together don't reconnect at the same time. The first retry waits a random 0 to 500 ms, and later retries scale their existing base delays by a random factor between 0.5 and 1.5. - #2124 (@​RaphaelFakhri)

• Publishing a backup codec now sends correctly sized video layers on that codec's own entry. Before this fix the layers were zero sized, on a field the server ignores. - #2137 (@​lukasIO)

• When an SEI or AUD NALU precedes the slice, encrypt h264 frames from the correct offset. Those NALUs read as h265 slice types, so detection returned h265 and the unencrypted prefix ended inside the leading NALU. The slice header was encrypted and no error was raised. The frame bytes now take precedence over a caller-supplied codec. The sender cryptor is also seeded with the publish codec for h264 and h265. A fallback to VP8 handling now logs the first bytes of the frame. - #2131 (@​lukasIO)

• Do not leave half of a surrogate pair when truncating an RpcError message or data to its byte limit - #2126 (@​RaphaelFakhri)

• Cancel in-flight full reconnects when the engine closes, preventing delayed cleanup, region failover, or join responses from reopening a disconnected session. Honor cancellation before opening a signal transport. - #2095 (@​horvatz)

• Fix E2EE H.264/H.265 decryption failing for encoders that emit 3-byte Annex B start codes (e.g. Intel Quick Sync on Windows). The sender now rewrites them to 4-byte start codes in the unencrypted header, matching what the receiver's depacketizer reconstructs. - #2144 (@​1egoman)

• On Chrome, a disconnected microphone now restarts on the OS default input instead of the first enumerated device. If a restart fails after the user stopped the track, the capture device no longer stays live - #2138 (@​lukasIO)

• fix: lower timeout for validating connection errors and guard against locking - #2148 (@​lukasIO)

• Error in-flight incoming data streams when the room disconnects instead of leaving readers pending - #2125 (@​RaphaelFakhri)

• fix safari specific issue where data channel could change after waiting for headroom - #2130 (@​1egoman)

• Lower the camera x-google-start-bitrate hint further when the browser reports a slow connection (navigator.connection.effectiveType, Chromium only): 300 kbps for 2g and slow-2g, 500 kbps for 3g. The lower of this and the connection setup time cap applies; 4g and browsers without the API keep the setup time cap alone, and screen share stays uncapped. - #2149 (@​changt)

Changelog

Sourced from livekit-client's changelog.

2.23.0

Minor Changes

• Release the audio contexts and web audio graphs the SDK creates. Previously they accumulated over mute/unmute cycles. They are now collected after room.disconnect(). - #2029 (@​lukasIO)

  • detectSilence tears its context down on the throw path as well as the happy one.
  • The cleanup from createAudioAnalyser disconnects its nodes before it closes the context, and it is now idempotent.
  • The shared empty audio stream track is refcounted. releaseEmptyAudioStreamTrack is a new export, and its context closes once the last clone is handed back.
  • If webAudioMix is an object without an audioContext, a room now closes the context it created for itself.
  • When the underlying track is replaced, audio processors are passed the audio context. This lets them rebuild their filter nodes on unmute. Previously they left the old nodes behind.
  • The iOS dummy audio element and its visibilitychange listener are torn down on disconnect. Previously the listener outlived every room on the page.

  This also fixes a false AudioSilenceDetected. Silence detection read a zero-filled buffer from a context that never reached running. An autoplay-blocked page therefore reported silence on every track it checked.

  Three further behavior changes to be aware of:

  • A track retained across rooms loses its audio processor. room.disconnect({ stopTracks: false }) detaches the track from the audio context, which stops the processor. Call setProcessor again after you republish the track.
  • Under webAudioMix, every attached element is muted, not only the first one. A second attached element no longer plays the track twice. When the audio context goes away, those elements are unmuted again and their volume is restored.
  • Participant.setAudioContext and LocalAudioTrack.setAudioContext now return a promise. Both are marked @internal, but both appear in the published type declarations.

Patch Changes

• Scale the x-google-start-bitrate hint by connection setup time: the 1 Mbps camera cap now applies to connections that set up within 1.5 s and ramps linearly down to 300 kbps at 3.5 s or slower; screen share stays uncapped. - #2146 (@​changt)

• Add jitter to reconnect retries in the default reconnect policy, including the first retry and reconnects requested by the server, so clients that disconnect together don't reconnect at the same time. The first retry waits a random 0 to 500 ms, and later retries scale their existing base delays by a random factor between 0.5 and 1.5. - #2124 (@​RaphaelFakhri)

• Publishing a backup codec now sends correctly sized video layers on that codec's own entry. Before this fix the layers were zero sized, on a field the server ignores. - #2137 (@​lukasIO)

• When an SEI or AUD NALU precedes the slice, encrypt h264 frames from the correct offset. Those NALUs read as h265 slice types, so detection returned h265 and the unencrypted prefix ended inside the leading NALU. The slice header was encrypted and no error was raised. The frame bytes now take precedence over a caller-supplied codec. The sender cryptor is also seeded with the publish codec for h264 and h265. A fallback to VP8 handling now logs the first bytes of the frame. - #2131 (@​lukasIO)

• Do not leave half of a surrogate pair when truncating an RpcError message or data to its byte limit - #2126 (@​RaphaelFakhri)

• Cancel in-flight full reconnects when the engine closes, preventing delayed cleanup, region failover, or join responses from reopening a disconnected session. Honor cancellation before opening a signal transport. - #2095 (@​horvatz)

• Fix E2EE H.264/H.265 decryption failing for encoders that emit 3-byte Annex B start codes (e.g. Intel Quick Sync on Windows). The sender now rewrites them to 4-byte start codes in the unencrypted header, matching what the receiver's depacketizer reconstructs. - #2144 (@​1egoman)

• On Chrome, a disconnected microphone now restarts on the OS default input instead of the first enumerated device. If a restart fails after the user stopped the track, the capture device no longer stays live - #2138 (@​lukasIO)

• fix: lower timeout for validating connection errors and guard against locking - #2148 (@​lukasIO)

• Error in-flight incoming data streams when the room disconnects instead of leaving readers pending - #2125 (@​RaphaelFakhri)

• fix safari specific issue where data channel could change after waiting for headroom - #2130 (@​1egoman)

• Lower the camera x-google-start-bitrate hint further when the browser reports a slow connection (navigator.connection.effectiveType, Chromium only): 300 kbps for 2g and slow-2g, 500 kbps for 3g. The lower of this and the connection setup time cap applies; 4g and browsers without the API keep the setup time cap alone, and screen share stays uncapped. - #2149 (@​changt)

Commits

• b6b9210 Version Packages (#2145)
• 5ad048a Additionally use browser effective connection type in determining start bitra...
• 866072d fix: cancel in-flight full reconnects when the engine closes (#2095)
• 23e3afb fix: add proportional jitter to default reconnect delays (#2124)
• 6047746 fix(data-channel): send on the current handle after waiting for headroom (#2130)
• da86e21 fix: consistently clean up audio contexts and graphs (#2029)
• d325ced Seed the E2EE sender cryptor with the publish codec (#2131)
• fb8e5b3 fix: lower timeout for validating connection errors and guard against locking...
• 6c20018 fix: avoid splitting surrogate pairs when truncating RpcError text (#2126)
• 930942c Scale the video start bitrate hint by connection setup time (#2146)
• Additional commits viewable in compare view

Updates livekit-server-sdk from 2.19.1 to 2.19.2

Release notes

Sourced from livekit-server-sdk's releases.

livekit-server-sdk@2.19.2

Patch Changes

• update dependencies - #752 (@​davidzhao)

Changelog

Sourced from livekit-server-sdk's changelog.

2.19.2

Patch Changes

• update dependencies - #752 (@​davidzhao)

Commits

• 73cc2c1 Version Packages (#753)
• 95fc537 update dependencies (#752)
• See full diff in compare view

Updates three-mesh-bvh from 0.9.16 to 0.9.17

Release notes

Sourced from three-mesh-bvh's releases.

v0.9.17

Added

• BVHComputeData: "updateAsync" so a "getBVH" override can build BVHs asynchronously.

Changed

• SAH builds are faster: 8 bins per axis and an exact sweep for small nodes.
• BVH builds write nodes directly into the packed buffer instead of an intermediate node tree, using a fraction of the memory.

Fixed

• MeshBVH: Raycasts no longer test triangles when the ray misses a root that is a leaf.
• OrientedBox: Fixed "distanceToBox" using the wrong axis for one set of box edges.
• ExtendedTriangle: Fixed "closestPointToSegment" returning a positive distance for segments that pass through the triangle.

Changelog

Sourced from three-mesh-bvh's changelog.

[0.9.17] - 2026-10-28

Added

• BVHComputeData: "updateAsync" so a "getBVH" override can build BVHs asynchronously.

Changed

• SAH builds are faster: 8 bins per axis and an exact sweep for small nodes.
• BVH builds write nodes directly into the packed buffer instead of an intermediate node tree, using a fraction of the memory.

Fixed

• MeshBVH: Raycasts no longer test triangles when the ray misses a root that is a leaf.
• OrientedBox: Fixed "distanceToBox" using the wrong axis for one set of box edges.
• ExtendedTriangle: Fixed "closestPointToSegment" returning a positive distance for segments that pass through the triangle.

Commits

• 26fc97c 0.9.17
• d181e17 Update CHANGELOG
• bf1dea8 Update CHANGELOG
• 3306faa Merge pull request #934 from zzoraemon043/fix/closest-point-to-crossing-segment
• 220cbdd Merge pull request #945 from gkjohnson/webgpu/node-layout
• 6dbceea Regenerate API md
• 596865d Add a method of async bvh generation
• 5694a66 Improve closest point to point perf
• 591a2fe Pack child bounds into the parent node, increasing performance
• 453153a Merge pull request #943 from gkjohnson/sah-flat
• Additional commits viewable in compare view

Updates @types/node from 24.19.2 to 26.6.6

Commits

• See full diff in compare view

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

• 4637f98 10.13.0
• 96df05c Build: changelog update for 10.13.0
• 4783a68 docs: Update README
• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
• 317fcb3 chore: update ecosystem plugins (#21409)
• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
• 43f0ac9 docs: clarify parameter description in getText (#21287)
• a39d9fb feat: add globalThis to no-obj-calls (#21382)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
• Additional commits viewable in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates typescript-eslint from 8.71.2 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: lazy load rules (#13010)
• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

• ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz
• Shaan GS @​ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• a4c2603 chore(release): publish 8.72.0
• See full diff in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.