fix(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/config-helpers (source)	0.4.2 → 0.6.0
@fastly/js-compute	3.35.2 → 3.43.1
@semantic-release/npm	13.1.1 → 13.1.5
dotenv	17.2.3 → 17.4.2
fs-extra	11.3.2 → 11.3.6
lint-staged	16.2.6 → 16.4.0
mocha (source)	11.7.5 → 11.7.6
semantic-release	25.0.2 → 25.0.5

---

Release Notes

eslint/rewrite (@​eslint/config-helpers)

v0.6.0

Compare Source

Features

• Add new includeIgnoreFile() to config-helpers (#​430) (9b51352)

v0.5.5

Compare Source

Bug Fixes

• revert re-export ESM types in CommonJS (#​427) (9b16fe1)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

v0.5.4

Compare Source

Bug Fixes

• re-export ESM types in CommonJS (#​416) (ef16f80)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.1.1 to ^1.2.0

v0.5.3

Compare Source

Bug Fixes

• tighten extends typing in config-helpers (#​385) (939bc32)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.1.0 to ^1.1.1

v0.5.2

Compare Source

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.0.1 to ^1.1.0

v0.5.1

Compare Source

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.0.0 to ^1.0.1

v0.5.0

Compare Source

⚠ BREAKING CHANGES

• Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#​297)

Features

• Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#​297) (acc623c)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^0.17.0 to ^1.0.0

fastly/js-compute-runtime (@​fastly/js-compute)

v3.43.1

Compare Source

Fixed

• base64 patch wasn't applying cleanly (#​1494) (9311b97)

v3.43.0

Compare Source

Added

• stale-if-error support (#​1307) (3e06237)

Fixed

• Make boundary parameter of multi-part form data requests safe for use in Content-Type headers (#​1493) (938f15f)
• Remove memory leak of cache write options in error cases (#​1483) (79874b6)

v3.42.1

Compare Source

Fixed

• Null body for non-downstream requests with no stream created for them (#​1479) (511c667)

v3.42.0

Compare Source

Added

• Bail out of reusable sandbox if request fails (#​1453) (b6f41b0)

Fixed

• Allocation failure checks (#​1457) (c882105)
• Avoid dereferencing one-past-the-end iterator in host_api (#​1461) (acf2b25)
• Be more defensive in ip_octets_to_js_string (#​1468) (60bbec1)
• Cache body range check (#​1463) (f38ce55)
• Cache override getters for beforeSend and afterSend (#​1466) (5261936)
• Correct GC guard type in KVStore::put to prevent wasm unreachable crashes and fix some CI issues (#​1475) (15f850d)
• Ensure nul-termination of string for inet_pton (#​1462) (0e3afbe)
• Find invalid characters after nul bytes in KV store keys (#​1464) (5f0f0f2)
• Incorrect catch handler failure check (#​1458) (fb3c01a)
• Memory leak in get_found_response (#​1456) (17559d3)
• Memory leak on failed inspect hostcall (#​1455) (9b77977)
• Protect against GC from validate_bytes (#​1447) (be0867b)
• Shrinking realloc in KVStorePendingLookup (#​1467) (5a72d13)
• Throw error on negative ttl and swr (#​1465) (7d29650)

v3.41.2

Compare Source

Fixed

• HttpBody::read_all for large bodies (#​1444) (99f45b5)
• Check pending exceptions between requests in reusable sandbox mode (#​1425) (64a6b21)
• Memory issues exposed by high GC zeal (#​1442) (f406308)
• Memory leak in normalize_http_method (#​1449) (669b58a)
• mislabeled Response::Slots::URL slot (#​1445) (6d4d268)
• Numeric overflow issue in Core Cache API (#​1448) (360c9bf)
• Potential buffer size issues in shielding (#​1443) (4bf9d72)
• Reset StarlingMonkey engine between requests (#​1426) (238cf70)
• SSL string cipher intersection (#​1446) (13ef2d5)
• Use length rather than NUL-terminator when copying HostStrings (#​1429) (8aa3f4c)

v3.41.1

Compare Source

Fixed

• Deal with bodyless statuses in CandidateResponse situations (#​1414) (cfd6c4b)
• Mark FetchEvent as done when we redirect to ws/grip proxies (9831bd4)
• Support setCacheKey for HTTP cache (#​1411) (a707c3d)

v3.41.0

Compare Source

Added

• Add --gc-frequency option to debug-build.sh (#​1395) (a6e4a1f)
• Allow the use of project-level external config file for js-compute-runtime CLI behavior (#​1405) (9749cab)
• Support installation in projects that use TypeScript 6 (e4273a3)

Fixed

• Allow --aot-cache and --debug-intermediate-files flags to be specified with equals (#​1403) (81a75f8)
• Double free in convertBodyInit (#​1387) (72acfc3)
• GC fixes for edge rate limiter (#​1397) (fd9e322)
• GC issue in handoffs (#​1396) (b57fc8f)
• Shielding GC (#​1401) (6de2f55)

v3.40.1

Compare Source

Fixed

• early-hints: early hints don't need to be sync inside a FetchEve… (#​1323) (22ac0cc)

v3.40.0

Compare Source

Added

• Allow custom weval binary (#​1315) (b143150)
• Reusable sandboxes (#​1314) (70a9d28)

Fixed

• Add security to docs rename script (#​1316) (7028c0b)

v3.39.4

Compare Source

Fixed

• Body truncation error in chained extract_body requests (#​1310) (b929648)

v3.39.3

Compare Source

Fixed

• Don't throw from event.client.geo or event.client.address on hostcall error (#​1306) (471b112)

v3.39.2

Compare Source

Fixed

• NPM publication (f80c089)

v3.39.1

Compare Source

Fixed

• For now, go back to old behavior for default exported types. (#​1298) (e6d96d4)
• TransformStream shortcutting fixes (#​1301) (51369ae)

v3.39.0

Compare Source

Added

• Add isBot support to device detection (#​1287) (fe079b1)
• Implement firstByteTimeout for shielding (#​1286) (ad445b7)
• Map the FastlyStatus values into KVStoreError values the same way the Rust SDK does (#​1280) (726f4e2)

Fixed

• Correct default export (#​1269) (58d872e)
• suppress sourcemap for bundle() step when --enable-stack-traces is not set (#​1277) (ab8c12e)

v3.38.4

Compare Source

Fixed

• Don't shortcut transform too early (#​1281) (291814e)

v3.38.3

Compare Source

Fixed

• clean script to include TypeScript output directory (#​1270) (015e40c)
• pin lol_html to 2.7.0 (#​1276) (363550a)
• Rename shielding docs (#​1272) (e12ab47)
• Try and shortcut transform stream reading before doing a regular read (#​1279) (6b9b939)

v3.38.2

Compare Source

Fixed

• Handle cross-volume renames of intermediate files (#​1264) (94e5671)

v3.38.1

Compare Source

Fixed

• Build CLI in npm publish (#​1262) (2fe6e2d)

v3.38.0

Compare Source

Added

• config: add support for config store buffers longer than 8k (#​1181) (da4c169)
• inspect: add support for NGWAF inspect api (#​1212) (98f45e4)

Fixed

• Correct behaviour of chained body proxy streams in some circumstances (#​1259) (11f9a4b)
• make shielding.d.ts ambient (#​1256) (7a0e987)

v3.37.0

Compare Source

Added

• Add client fingerprint properties (tlsJA4, h2Fingerprint, ohFingerprint) (#​1248) (9390e8c)
• Shielding support (#​1241) (985c55e)

v3.36.0

Compare Source

Added

• Image Optimizer support (#​1224) (c3dd3de)
• Implement 103 Early Hints (#​1217) (fda6ad3)

Fixed

• fanout: commit request headers before fanout handoff (#​1222) (8dfefad)
• Fix broken KVStore test (#​1223) (6055d88)

semantic-release/npm (@​semantic-release/npm)

v13.1.5

Compare Source

Bug Fixes

• deps: update dependency normalize-url to v9 (#​1095) (daec492)

v13.1.4

Compare Source

Bug Fixes

• deps: update dependency @​actions/core to v3 (#​1085) (17abfe1)

v13.1.3

Compare Source

Bug Fixes

• deps: update dependency @​actions/core to v2 (#​1055) (fa4a3ab)

v13.1.2

Compare Source

Bug Fixes

• deps: update dependency read-pkg to v10 (#​1032) (f3f1a00)

motdotla/dotenv (dotenv)

v17.4.2

Compare Source

Changed

• Improved skill files - tightened up details (#​1009)

v17.4.1

Compare Source

Changed

• Change text injecting to injected (#​1005)

v17.4.0

Compare Source

Added

• Add skills/ folder with focused agent skills: skills/dotenv/SKILL.md (core usage) and skills/dotenvx/SKILL.md (encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)

Changed

• Tighten up logs: ◇ injecting env (14) from .env (#​1003)

v17.3.1

Compare Source

Changed

• Fix as2 example command in README and update spanish README

v17.3.0

Compare Source

Added

• Add a new README section on dotenv’s approach to the agentic future.

Changed

• Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

v17.2.4

Compare Source

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#​915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

jprichardson/node-fs-extra (fs-extra)

v11.3.6

Compare Source

• Fix handling of symlinked destination ancestors in copy/move methods (#​1071, #​1073)
• Docs typo fixed (#​1074)

v11.3.5

Compare Source

• Fix ensureLink*/ensureSymlink* identical file detection on Windows (#​1068)
• Fix error handling in timestamp preservation code (#​1065, #​1069)
• Fix potential file descriptor leak on error in synchronous timestamp preservation code (#​1066)

v11.3.4

Compare Source

• Fix bug where calling ensureSymlink/ensureSymlinkSync with a relative srcPath would fail if the symlink already existed (#​1038, #​1064)

v11.3.3

Compare Source

• Fix copying symlink when destination is a symlink to the same target (#​1019, #​1060)

lint-staged/lint-staged (lint-staged)

v16.4.0

Compare Source

Minor Changes

• #​1739 687fc90 Thanks @​hyperz111! - Replace micromatch with picomatch to reduce dependencies.

v16.3.4

Compare Source

Patch Changes

• #​1742 9d6e827 Thanks @​iiroj! - Update dependencies, including tinyexec@1.0.4 to make sure local node_modules/.bin are preferred to global locations (released in tinyexec@1.0.3).

v16.3.3

Compare Source

Patch Changes

• #​1740 0109e8d Thanks @​iiroj! - Make sure Git's warning about CRLF line-endings doesn't interfere with creating initial backup stash.

v16.3.2

Compare Source

Patch Changes

• #​1735 2adaf6c Thanks @​iiroj! - Hide the extra cmd window on Windows by spawning tasks without the detached option.

v16.3.1

Compare Source

Patch Changes

• #​1729 cd5d762 Thanks @​iiroj! - Remove nano-spawn as a dependency from package.json as it was replaced with tinyexec and is no longer used.

v16.3.0

Compare Source

Minor Changes

• #​1698 feda37a Thanks @​iiroj! - Run external processes with tinyexec instead of nano-spawn. nano-spawn replaced execa in lint-staged version 16 to limit the amount of npm dependencies required, but caused some unknown issues related to spawning tasks. Let's hope tinyexec improves the situation.

• #​1699 1346d16 Thanks @​iiroj! - Remove pidtree as a dependency. When a task fails, its sub-processes are killed more efficiently via the process group on Unix systems, and the taskkill command on Windows.

Patch Changes

• #​1726 87467aa Thanks @​iiroj! - Incorrect brace expansions like *.{js} (nothing to expand) are detected exhaustively, instead of just a single pass.

v16.2.7

Compare Source

Patch Changes

• #​1711 ef74c8d Thanks @​iiroj! - Do not display a "failed to spawn" error message when a task fails normally. This message is reserved for when the task didn't run because spawning it failed.

mochajs/mocha (mocha)

v11.7.6

Compare Source

🩹 Fixes

• make describe().timeout() work (aafe6fd)
• test: replace wmic usage with native Windows API (#​5694) (73ebdfa)

🧹 Chores

• format all code (#​5629) (0696784)
• remove Netlify (#​5630) (8d01d33)

semantic-release/semantic-release (semantic-release)

v25.0.5

Compare Source

Bug Fixes

• revert: next (#​4200) (db8ffaa)

v25.0.4

Compare Source

Bug Fixes

• code-quality: add missing comma in context object for consistency (493d6cd)

v25.0.3

Compare Source

Bug Fixes

• deps: remove deprecated semver-diff (#​3980) (f404124)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

This PR will trigger a patch release when merged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!