[dependabot]

Bumps the dev-dependencies group with 2 updates in the / directory: zipnative and typescript-eslint.

Updates zipnative from 1.0.0 to 1.1.0

Release notes

Sourced from zipnative's releases.

v1.1.0 — range access, reproducible-for-any-archive, issues #9–#12, supply-chain parity

zipnative v1.1.0

Released 2026-10-08

The first minor since the freeze, and a statement about what a minor is: zero breaking changes. The public surface grew from 77 to 106 exports with none removed, the 39 error codes are unchanged, every new behaviour is opt-in, and the deterministic: true bytes are unchanged — proven by a byte-level baseline of the 33 pre-existing sample archives and by the previous release's own test suite running against the new sources in CI. Existing inputs produce byte-identical output, with one deliberate exception listed in the Upgrade section: dates outside the DOS range, whose previous output was wrong. The four issues reported by the satellites are closed at the source; the Zip64 streaming opt-in designed in 0.9 ships; five adoption features arrive — random access over remote and huge archives, cancellation and progress, raw transplant, canonicalisation of any archive, legacy name decoding — and the repository reaches hardening parity with pdfnative 1.8.0.

Highlights

• Open a 50 GB archive with the memory of its central directory — openZipRange() reads an archive served by ranges (HTTP Range, Blob.slice(), a file handle, object storage) through a ByteRangeSource you inject; the engine never fetches, every limit and cross-check of openZip() applies, and a counting source shows one tail window, the central directory, then only the entry you read. Guide · playground.
• Make any archive reproducible — analyzeDeterminism() names what would drift (timestamps, order, extra fields…); canonicalizeZip() and saveCompact({ canonical: true }) rewrite a Gradle, Maven, zip or Explorer archive into the canonical form without recompressing a payload, idempotently, under the frozen byte contract (golden SHA-256 hashes over two committed foreign fixtures); addRaw() / addFromReader() assemble artefacts from existing parts in O(bytes copied). Guide.
• Issues #9–#12 closed at the source — UTC DOS timestamps and honest clamping (#9), one error classification for corrupt deflate on every tier (#10), custom codecs streamed by the forward reader through a new createDecompressor() contract (#11), verifyEntry().skipped with a real localHeaderMatch (#12). The satellites' workarounds become unnecessary.
• Zip64 streaming opt-in — addStream(name, source, { zip64: true }) for entries that may exceed 4 GiB: the APPNOTE 4.3.9.2 layout, validated by the ISO/IEC 21320-1 gate and extracted byte-for-byte by the six-tool interop matrix; a real 4 GiB + 1 stream is exercised in the conformance workflow.
• Supply-chain parity with pdfnative 1.8.0 — scripts/gate.ts profiles, harden-runner and --ignore-scripts on every job, OIDC publishing behind the npm-publish environment with SLSA Build L2 provenance and SBOM attestation, dependency review, weekly audit, committed rulesets, a byte baseline of every sample, 25 new verify-docs rules, release-prepare, and a compat-previous job that runs the 1.0.0 suite against 1.1.0.

Security

• fix(security): verifyZip() / verifyEntry() no longer fabricate localHeaderMatch for encrypted entries (it was hard-coded true in one path and false in the other); the local header is cross-checked even when the payload cannot be verified, and an encrypted entry whose local header contradicts the central directory now fails the archive (CWE-1288, issue #12). Verdicts never loosened: unknown methods still fail the archive.
• fix(security): corrupt deflate payloads surface as ZipFormatError ZIP_DEFLATE_CORRUPT / ZIP_DEFLATE_TRUNCATED on every inflate tier — node:zlib, DecompressionStream, pure TS — instead of a runtime-dependent class (CWE-703, issue #10); ZIP_DECOMPRESSION_FAILED is reserved for registered or injected codecs.
• feat(security): encrypted entries are labelled by scheme — feature: 'aes' for WinZip AES (method 99 or the 0x9901 extra), 'zipcrypto', 'strong-encryption' — and still never decrypted in 1.x (CWE-327 context; AES is a 2.0 candidate).
• feat(security): one new named bound, maxEntryCompressedSize (1 GiB + 1 MiB, CWE-770), bounds the byte-range reader's whole-payload fetches; the in-memory reader uses zero-copy views and never consults it, so no 1.0.0 archive is newly refused. A nameDecoder runs before path sanitisation, never around it (CWE-22); a lying byte-range source is ZIP_RECORD_TRUNCATED (CWE-20).
• feat(ci): every workflow starts with step-security/harden-runner and installs with npm ci --ignore-scripts (.npmrc makes that the local default); actions stay SHA-pinned; dependency-review.yml (high severity, licence allow-list) and a weekly audit.yml; publish.yml is three jobs with one artifact between them: verify (no publishing token; fetches the previous tag, runs the full publish gate, packs the tarball once with its SBOM and SHA256SUMS) → publish (the npm-publish environment, id-token: write, a pinned npm ≥ 11.5.1, a sparse checkout of .nvmrc only, the handed-on tarball digest-checked then published through OIDC with provenance) → attest (the same tarball compared byte for byte with what the registry serves, then SLSA Build L2 provenance for it and the CycloneDX SBOM through actions/attest-build-provenance, attached to the GitHub Release); no release job restores a dependency cache; a workflow_dispatch dry run stops at npm publish --dry-run; branch and tag rulesets committed under .github/rulesets/.
• fix(deps): npm audit --audit-level=high is green again — adm-zip 0.6.1, brace-expansion 1.1.21 / 5.0.12 and source-map-js 1.2.2 (dev dependencies only; the engine has none).

Added

• feat(parser): openZipRange(source, options?), ByteRangeSource, ZipRangeReader, rangeSourceFromBytes() — random access over an injected byte-range source; shared per-entry defences with openZip() (src/parser/zip-entry-checks.ts); 256 KiB ranged streaming through createDecompressor(); the cached tail window serves the central directory and small archives without a round trip, and local headers are prefetched with 1 KiB of slack.
• feat(core,parser): signal?: AbortSignal and onProgress?: ZipProgressHandler on every asynchronous call — on the options of extractZipStream, iterateZipEntries, openZip / openZipRange (every read of the reader), createZip / createParallelZip (every stream() and toBytes()), and per call on readEntryStream(entry, options) and stream(options); abort rejects with signal.reason after resources are released (stream locks released without cancel, worker pools closed); ZipProgress is monotonic, a skipped entry counts as done, the parallel toBytes() reports per settled entry.
• feat(core): ZipWriter.addRaw(name, payload, meta) and addFromReader(reader, entry, options?) — transplant without recompression; addFromReader verifies the source entry first unless verify: false; RawEntryMeta, RawEntryReader, AddFromReaderOptions; the modifier's raw-copy plan moved to core/zip-segments.ts so both writers share one implementation.
• feat(parser): canonicalizeZip(bytes, options?), CanonicalizeOptions; ZipModifier.saveCompact({ canonical }) with CanonicalOptions / CompactOptions; analyzeDeterminism(bytes) with DeterminismReport, DeterminismOffender, DeterminismConcern — the verdict the satellites re-derived.
• feat(core,parser): nameDecoder option on every read path (applied when flag bit 11 is clear, and as the fallback when a UTF-8-flagged name is not valid UTF-8; entry.nameEncoding becomes 'custom'); getExtendedTimestamps(entry) (UT 0x5455, NTFS 0x000a, DOS fallback — ExtendedTimestamps) and getUnixIds(entry) (ux 0x7875 — UnixIds); externalAttributesFromUnixMode(mode, options?), the write-side mirror of getUnixMode.
• feat(core): dosTimeMode: 'local' | 'utc' (DosTimeMode) on every option bag that writes or reads lastModified; full DOS-date clamping with the new ZIP_TIMESTAMP_CLAMPED diagnostic (the twelfth; issue #9).
• feat(codecs): ZipCodec.createDecompressor?(maxOutput) → ZipDecompressor { push, end } — the incremental contract the forward reader streams in O(chunk); the built-in store and deflate codecs implement it (issue #11).
• feat(core): AddEntryOptions.zip64 — the per-entry Zip64 streaming opt-in for addStream(): version 45 in both records, sentinel sizes and a (0, 0) Zip64 extra in the local header (lfhZip64Fields moved to core/zip-extra-fields.ts), 24-byte data descriptor, both sizes in the central record; assertStreamSizesInRange names the option in its refusal.
• feat(parser): EntryVerification.skipped?: EntrySkipReason ('encrypted' | 'stream-only-codec' | 'unsupported-method'); verifyZip() delegates every entry to verifyEntry() (issue #12).
• feat(samples): five samples — zip64/zip64-streamed, incremental/merged-from-two, names-encoding/shift-jis-legacy (an expected ISO non-conformant: non-ASCII names without bit 11), attributes/unix-ids, attributes/ntfs-timestamps — 38 in the corpus, 33/5 in the ISO canary; two interop write cases (zip64-streamed, transplanted) — 19 validation cases (6 producer reads + 13 write cases, each run against every extractor present).
• feat(tooling): scripts/gate.ts (--fast / --ci / --publish, --require-all, --only, --from, --json, dist probes), scripts/verify-samples.ts + tests/regression/samples.test.ts + tests/regression/baselines/samples.sha256.json (SHA-256 of every sample with a since chain), scripts/release-prepare.ts (the bump in one pass), scripts/run-compat.ts (compat:previous), scripts/build-claude-rules.ts (agents:rules), scripts/install-git-hooks.mjs (opt-in pre-commit / pre-push), scripts/lib/prose-language.ts, scripts/lib/agent-config.ts; tests/tools/ (workflows, gate, guard, agent-config, verify-issue, release-prepare, prose-language, api-compat).
• feat(docs): 25 verify-docs rules (52 total, catalogued by --rules): no-control-bytes, playground-syntax, export-named, limits-table, since-tags, derived-counts, count-tokens, version-token, errors-verified-on, sample-regression, prose-language, claude-md-budget, governance-sources, node-pin-parity, ruleset-parity, agent-config-parity, claude-rules-sync, claude-rules-budget, pr-template-parity, eol-lf, skills-shape, sitemap-lastmod-vs-git, bench-parity, rules-list, and a since check in surfaces-shape; docs/assets/ecosystem.json carries derived.* figures recomputed from the tree and declared.tests / coverage held to the last gate run.
• feat(docs): two guides — Large and remote archives, Reproducible builds; the remote range access playground (a dropped file read by Blob.slice() or a URL served with HTTP Range, with a live read counter and Abort); four recipes (remote-range, determinism-report, zip64-stream, utc-dates); nine 1.1.0 capabilities in docs/data/surfaces.json and the choose guide; the inspector shows the determinism verdict and extended timestamps, the modifier offers canonical compaction, the streaming page demonstrates progress and cancellation, the toolkit pins dates with dosTimeMode.
• feat(governance): CLAUDE.md, .claude/settings.json (deny list, HITL command denies), .claude/hooks/guard.mjs, .claude/rules/ rendered from .github/instructions/, the release-audit skill; .github/AGENT_RULES.md and ai-governance.json on the pdfnative schema; .github/ISSUE_TEMPLATE/maintenance.md, .github/prompts/compliance-audit.prompt.md, release-notes/PR_TEMPLATE.md; CODEOWNERS; .nvmrc / .node-version / .npmrc.

Changed

• fix(codecs): corrupt or truncated deflate payloads raise ZIP_DEFLATE_CORRUPT / ZIP_DEFLATE_TRUNCATED (ZipFormatError) on the node:zlib and DecompressionStream tiers too, through normalizeInflateError — see the ledger (C2). getCodec(8).compressSync with an invalid level is ZIP_INVALID_OPTION on every tier.
• fix(core): dates below 1980-01-01 clamp to the DOS epoch, dates above 2107-12-31 23:59:58 to that maximum, and an invalid Date to the epoch, each with ZIP_TIMESTAMP_CLAMPED — previously 1975-07-15 became 1980-07-15 and NaN produced a silent zero field (C1).
• fix(parser): verifyZip() computes localHeaderMatch for every entry, encrypted ones included (C3); unknown methods are reported skipped: 'unsupported-method' while still failing the archive, as before (C4).
• chore(parser): ZipUnsupportedFeature gains 'aes', ZipEntry.nameEncoding gains 'custom', ZipDiagnosticCode gains ZIP_TIMESTAMP_CLAMPED (C5); the messages of ZIP_UNSUPPORTED_ZIP64_STREAMING and ZIP_UNSUPPORTED_CODEC_MODE name the new remedies (C8).
• chore(tooling): scripts/validate-zip.ts keys the data-descriptor width on the local header's Zip64 extra (APPNOTE 4.3.9.2) rather than on the central record (WF/DESCRIPTOR-WIDTH); conformance.yml runs test:generate, verify:samples, validate:zip and test:interop through the gate on Linux and Windows and the 4 GiB streaming test behind ZIPNATIVE_BIG_TESTS; ci.yml gains the os (Windows, macOS) and compat-previous jobs and drops its path filter; sample-regression.yml, dependency-review.yml, audit.yml; vitest.config.ts pins TZ=UTC and pool: 'forks'.
• docs: recipes/custom-codec.ts demonstrates method 97 (99 is WinZip AES — C9); docs/data/errors.json re-audited for nine codes; ROADMAP's post-1.0 items resolved (Zip64 opt-in shipped, AES moved to the 2.0 candidates); SECURITY.md gains the supply-chain section, the 1.1.x support row and three threat rows; AGENTS.md fits the 120-line budget; the homepage, README, llms.txt and the agent brief describe 1.1.

... (truncated)

Changelog

Sourced from zipnative's changelog.

[1.1.0] - 2026-10-08

Nothing yet.

[1.1.0] - 2026-10-08

Zero breaking changes. The public surface grew from 77 to 106 exports with none removed, the 39 error codes are unchanged, every new behaviour is opt-in, and the deterministic: true bytes are unchanged — proven by the byte baseline of the 33 pre-existing samples (npm run verify:samples), by tests/tools/api-compat.test.ts (every 1.0.0 export, code and signature still present) and by the compat-previous CI job (the 1.0.0 test suite run against these sources). The one deliberate output change — dates outside the DOS range, previously wrong — is entry C1 of the compatibility ledger in https://github.com/Nizoka/zipnative/blob/main/release-notes/v1.1.0.md.

Security

• verifyZip() / verifyEntry() stop fabricating localHeaderMatch for encrypted entries (hard-coded true in one path, false in the other); the local header is cross-checked even when the payload cannot be verified, and an encrypted entry whose local header contradicts the central directory now fails the archive — CWE-1288, #12. Verdicts were never loosened.
• One error classification for corrupt deflate on every tier — node:zlib, DecompressionStream and the pure-TS inflater all raise ZipFormatError ZIP_DEFLATE_CORRUPT / ZIP_DEFLATE_TRUNCATED; ZIP_DECOMPRESSION_FAILED is reserved for registered or injected codecs — CWE-703, #10.
• Encrypted entries labelled by scheme — feature: 'aes' for WinZip AES (method 99 or the 0x9901 extra), 'zipcrypto', 'strong-encryption'; still never decrypted in 1.x.
• One new named bound, maxEntryCompressedSize (1 GiB + 1 MiB, CWE-770), consulted only by the byte-range reader's whole-payload fetches; the in-memory reader never refuses a 1.0.0 archive on it. A nameDecoder runs before path sanitisation (CWE-22); a lying byte-range source is ZIP_RECORD_TRUNCATED (CWE-20).
• Supply chain — harden-runner and npm ci --ignore-scripts on every job (.npmrc makes it the local default), dependency-review.yml, weekly audit.yml, publish.yml in three jobs — verify (the full publish gate, one tarball packed with its SBOM) → publish (the npm-publish environment, a pinned npm, the handed-on tarball digest-checked and published through OIDC with provenance) → attest (the published tarball compared with the registry's, SLSA Build L2 provenance for it and the CycloneDX SBOM) — with a workflow_dispatch dry run; npm audit --audit-level=high green again (adm-zip 0.6.1, brace-expansion, source-map-js — dev dependencies only), committed branch and tag rulesets, CODEOWNERS.

Added

• openZipRange(source, options?) — random access over an injected ByteRangeSource { size, read(offset, length) } (HTTP Range, Blob.slice(), a file handle, object storage); ZipRangeReader, rangeSourceFromBytes(); the same defences as openZip() through the shared src/parser/zip-entry-checks.ts; 256 KiB ranged streaming through createDecompressor(); the cached tail window serves the central directory and small archives without a round trip, local headers are prefetched with 1 KiB of slack. Guide: large and remote archives; playground: remote range access.
• signal and onProgress on every asynchronous call — on the options of extractZipStream, iterateZipEntries, openZip / openZipRange (every read), createZip / createParallelZip (every stream() and toBytes()), and per call on readEntryStream(entry, options) and stream(options); an abort rejects with signal.reason after resources are released (stream locks released without cancel, worker pools closed); ZipProgress, ZipProgressHandler; a skipped entry counts as done; the parallel toBytes() reports per settled entry.
• addRaw() and addFromReader() on ZipWriter — transplant entries without recompression; addFromReader verifies the source entry first unless verify: false; RawEntryMeta, RawEntryReader, AddFromReaderOptions; the modifier's raw-copy plan now lives in core/zip-segments.ts.
• canonicalizeZip(), saveCompact({ canonical }), analyzeDeterminism() — measure, canonicalise and prove reproducibility for any archive without recompression; CanonicalOptions, CompactOptions, CanonicalizeOptions, DeterminismReport, DeterminismOffender, DeterminismConcern; the canonical bytes join the frozen determinism contract (golden SHA-256 hashes over two committed foreign fixtures in tests/parser/zip-canonical.test.ts); analyzeDeterminism(bytes, { date, dosTimeMode }) judges an archive canonicalised with a pinned date. Guide: reproducible builds.
• nameDecoder on every read path (applied when flag bit 11 is clear; nameEncoding: 'custom'), getExtendedTimestamps() (UT, NTFS, DOS fallback — ExtendedTimestamps), getUnixIds() (UnixIds), externalAttributesFromUnixMode().
• dosTimeMode: 'local' | 'utc' on every option bag that writes or reads lastModified, with full DOS-date clamping and the new ZIP_TIMESTAMP_CLAMPED diagnostic — #9.
• ZipCodec.createDecompressor?(maxOutput) → ZipDecompressor — the incremental codec contract; the forward reader streams any codec exposing it and refuses the others before the first byte with ZIP_UNSUPPORTED_CODEC_MODE; built-in store and deflate implement it — #11.
• AddEntryOptions.zip64 — the per-entry Zip64 streaming opt-in for addStream() (APPNOTE 4.3.9.2: version 45, sentinel sizes and a (0, 0) Zip64 extra in the local header, 24-byte descriptor, both sizes in the central record); buffered entries refuse the option with ZIP_INVALID_OPTION.
• EntryVerification.skipped (EntrySkipReason: 'encrypted' | 'stream-only-codec' | 'unsupported-method'); verifyZip() delegates every entry to verifyEntry() — #12.
• Samples and interop — zip64/zip64-streamed, incremental/merged-from-two, names-encoding/shift-jis-legacy (an expected ISO non-conformant), attributes/unix-ids, attributes/ntfs-timestamps (38 samples, 33/5 in the ISO canary); write cases zip64-streamed and transplanted (19 validation cases: 6 producer reads + 13 write cases); validate-zip keys the descriptor width on the local header's Zip64 extra (WF/DESCRIPTOR-WIDTH).
• Tooling — scripts/gate.ts (gate, gate:fast; profiles --fast / --ci / --publish, --require-all, --only, --from, --json, dist probes), verify:samples + tests/regression/ (SHA-256 baseline with a since chain), release:prepare, compat:previous (scripts/run-compat.ts + tests/compat/), agents:rules, hooks:install / hooks:uninstall (opt-in pre-commit / pre-push), scripts/lib/prose-language.ts, scripts/lib/agent-config.ts; tests/tools/ (workflows, gate, guard, agent-config, verify-issue, release-prepare, prose-language, api-compat); vitest.config.ts pins TZ=UTC and pool: 'forks', and writes test-output/.gate/vitest.json under GATE=1.
• verify-docs — 25 rules (52 in all, --rules lists them): no-control-bytes, playground-syntax, export-named, limits-table, since-tags, derived-counts, count-tokens, version-token, errors-verified-on, sample-regression, prose-language, claude-md-budget, governance-sources, node-pin-parity, ruleset-parity, agent-config-parity, claude-rules-sync, claude-rules-budget, pr-template-parity, eol-lf, skills-shape, sitemap-lastmod-vs-git, bench-parity, rules-list, and a since check in surfaces-shape; docs/assets/ecosystem.json gains derived.* figures recomputed from the tree and declared.tests / coverage held to the last gate run; the duplicated switcher-parity block is gone.
• Governance — CLAUDE.md, .claude/settings.json, .claude/hooks/guard.mjs, .claude/rules/ rendered from .github/instructions/, the release-audit skill; AGENT_RULES.md and ai-governance.json on the pdfnative schema; ISSUE_TEMPLATE/maintenance.md, prompts/compliance-audit.prompt.md, release-notes/PR_TEMPLATE.md; .nvmrc, .node-version, .npmrc.
• Docs and site — two guides, the remote playground, four recipes (remote-range, determinism-report, zip64-stream, utc-dates), nine 1.1.0 capabilities in docs/data/surfaces.json and the choose guide; the inspector shows the determinism verdict and extended timestamps, the modifier offers canonical compaction, the streaming page demonstrates progress and cancellation, the toolkit pins dates with dosTimeMode; docs/data/errors.json re-audited for nine codes.

Changed

• Out-of-range dates clamp correctly (1975-07-15 → 1980-01-01, not 1980-07-15; 2200 → 2107-12-31 23:59:58; an invalid Date → the epoch) with ZIP_TIMESTAMP_CLAMPED — bytes change only for inputs whose previous output was wrong (ledger C1).
• ZipUnsupportedFeature + 'aes', ZipEntry.nameEncoding + 'custom', ZipDiagnosticCode + ZIP_TIMESTAMP_CLAMPED (additive; an exhaustive consumer switch adds a case — ledger C5); ZipWriter, ZipModifier.saveCompact(options?), ZipCodec, ZipCommonOptions, AddEntryOptions, StreamOptions and ReadEntryOptions extended with optional members; ZipLimits gains the required member maxEntryCompressedSize — a hand-written complete ZipLimits literal must add it, { ...DEFAULT_ZIP_LIMITS } spreads keep working (C6).
• The messages of ZIP_UNSUPPORTED_ZIP64_STREAMING and ZIP_UNSUPPORTED_CODEC_MODE name the new remedies (outside the contract — C8); recipes/custom-codec.ts uses method 97 (C9).
• ci.yml gains the os (Windows, macOS) and compat-previous jobs, runs the gate with --require-all and drops its path filter; conformance.yml runs samples, baseline, ISO validation and interop through the gate on Linux and Windows and the 4 GiB streaming test behind ZIPNATIVE_BIG_TESTS; sample-regression.yml; rulesets require ci (22), ci (24), os (windows-latest), os (macos-latest), interop-linux, interop-windows, sample-regression, compat-previous.
• ROADMAP: the post-1.0 items resolved (Zip64 opt-in shipped; AES moved to the 2.0 candidates; 1.2 candidates listed); SECURITY.md gains the supply-chain section, the 1.1.x support row and three threat rows; AGENTS.md fits a 120-line budget; README, llms.txt, the agent brief, the homepage and the guides describe 1.1; verifiedOn 2026-10-08.

Fixed

• Final audit, second pass: canonicalizeZip() / analyzeDeterminism() forward nameDecoder, signal and onProgress (a legacy name without bit 11 was frozen as mojibake); a pre-aborted signal no longer leaks a deflate worker pool; the parallel writer reports one monotonic ZipProgress series per call; every synchronous entry point taking ZipCommonOptions (openZip and readEntry, createZipModifier and its saves, canonicalizeZip, analyzeDeterminism) checks signal once on entry.
• #9 DOS timestamps depended on the process time zone and clamped only the year.
• #10 node:zlib and DecompressionStream errors leaked or carried a runtime-dependent class.
• #11 iterateZipEntries() ignored registered codecs.
• #12 verifyEntry() reported encrypted and stream-only entries as failed without a reason and with a fabricated localHeaderMatch.

Documentation (the ecosystem alignment, previously unreleased)

... (truncated)

Commits

• 1e2ab42 Merge pull request #21 from Nizoka/release/v1.1.0
• c0404cc test(tools): read the PR template by its committed name — Linux runners are c...
• 67a6272 docs(tooling): jsonld-version checks every ItemList against the hub cards
• 6f58660 docs(site): list the remote playground in the playgrounds hub JSON-LD ItemLis...
• 7ce6c1b docs(release): phase D — six sentences aligned on the shipped behaviour
• fea9de4 docs(release): limits table, every export named, five verify-docs rules, fina...
• 3b31f14 fix(ci): publish one verified tarball in three jobs, green audit, measured co...
• de0484b fix(parser,worker): forward nameDecoder through canonicalizeZip, one progress...
• fedb645 docs(release): record the audit verdict and the final publish gate in the PR ...
• 72faadc fix(release): close the 1.1.0 pre-release audit ledger
• Additional commits viewable in compare view

Updates typescript-eslint from 8.69.0 to 8.71.1

Release notes

Sourced from typescript-eslint's releases.

v8.71.1

8.71.1 (2026-10-05)

🩹 Fixes

• eslint-plugin: [no-misused-promises] skip argument checks for calls without arguments (#12923)
• eslint-plugin: [no-unused-vars] report usedOnlyAsType for partially exported merged declarations (#12892)
• eslint-plugin: [require-array-sort-compare] use array argument type constraint (#12919)
• eslint-plugin: [no-unsafe-enum-assignment] skip identical types and bound deep type walks (#12957)
• eslint-plugin: [no-confusing-void-expression] don't autofix when declared return type is unknown (#12930)
• eslint-plugin: [prefer-optional-chain] check the constrained type (#12953)
• eslint-plugin: [no-unnecessary-type-parameters] count instantiated mapped type constraints (#12941)
• project-service: throttle cleanup when opening files (#12934)
• type-utils: match re-exports and global declarations in TypeOrValueSpecifier (#12943)

❤️ Thank You

• Diptajoy Mistry @​diptomistry
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Medhansh Poojari

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.0

8.71.0 (2026-09-28)

🚀 Features

• eslint-plugin: [no-unsafe-enum-assignment] add rule (#12732)

🩹 Fixes

• eslint-plugin: [switch-exhaustiveness-check] always sort literal cases in stable order (#12885)
• eslint-plugin: [unbound-method] respect this: void on class properties (7fce9127d)
• eslint-plugin: [no-unnecessary-type-assertion] specialize generic assertion report message (#12832)
• eslint-plugin: [no-misused-promises] handle a return outside of any function (#12912)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Fatih Çakır @​wfatih
• Josh Goldberg
• Josh Goldberg ✨
• Zamiell @​Zamiell

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.71.1 (2026-10-05)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• d57b8da chore(release): publish 8.71.1
• 8695664 chore(release): publish 8.71.0
• 23d38ce chore(release): publish 8.70.1
• eb42d9b chore: cleanup and fix Nx dependencies and missing tasks (#12897)
• 8c80531 chore: fix typos in comments and docs (#12846)
• b6b86a1 chore: migrate to nx 23.2.0 (#12843)
• 7ee7608 chore(release): publish 8.70.0
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.