Chore(deps): Bump the node-minor-patch group across 4 directories with 15 updates

[dependabot]

Bumps the node-minor-patch group with 7 updates in the /backend/compact-connect-ui-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.34.0
@aws-sdk/client-dynamodb	3.1029.0	3.1090.0
@aws-sdk/client-s3	3.1029.0	3.1090.0
@aws-sdk/util-dynamodb	3.996.2	3.996.7
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.7.0
mocha	11.7.5	11.7.6

Bumps the node-minor-patch group with 15 updates in the /backend/compact-connect/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.34.0
@aws-sdk/client-dynamodb	3.1045.0	3.1090.0
@aws-sdk/client-s3	3.1045.0	3.1090.0
@aws-sdk/util-dynamodb	3.996.2	3.996.7
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.7.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1090.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.64.0
@typescript-eslint/parser	8.58.1	8.64.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.1

Bumps the node-minor-patch group with 15 updates in the /backend/cosmetology-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.34.0
@aws-sdk/client-dynamodb	3.1045.0	3.1090.0
@aws-sdk/client-s3	3.1045.0	3.1090.0
@aws-sdk/util-dynamodb	3.996.2	3.996.7
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.7.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1090.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.64.0
@typescript-eslint/parser	8.58.1	8.64.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.1

Bumps the node-minor-patch group with 15 updates in the /backend/social-work-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.34.0
@aws-sdk/client-dynamodb	3.1045.0	3.1090.0
@aws-sdk/client-s3	3.1045.0	3.1090.0
@aws-sdk/util-dynamodb	3.996.2	3.996.7
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.7.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1090.0
nodemailer	9.0.1	9.0.3
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.64.0
@typescript-eslint/parser	8.58.1	8.64.0
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.23.1

Updates @aws-lambda-powertools/logger from 2.32.0 to 2.34.0

Release notes

Sourced from @​aws-lambda-powertools/logger's releases.

v.2.34.0

Summary

This release introduces two new utilities: Signer, for signing HTTP requests to AWS services with SigV4, and Data Masking, for encrypting, decrypting, or irreversibly erasing sensitive fields in your event data.

We've also fixed three bugs affecting Logger and Tracer under [Lambda Managed Instances](https://docs.aws.amazon.com/lambda/latest/dg/managed-instances.html(LMI) concurrency, where multiplexing several invocations into the same execution environment could cause log lines and X-Ray trace data from one invocation to leak into another.

On top of that, Metrics now supports automatic flushing via the using keyword, Parameters gained an opt-in throwOnMissing option to fail fast on missing values, and Idempotency now warns when a shared persistence layer instance receives a reconfiguration it silently ignores. We've also fixed a Metrics bug where a metric name colliding with a dimension or metadata key could silently corrupt the CloudWatch EMF payload, along with a couple of HTTP Router fixes: a crash affecting bundles that don't install Metrics, and unreachable routes caused by trailing slashes.

⭐ Congratulations to @​kimnamu for their first PR merged in the project and thank you to @​vishwakt and @​Zelys-DFKH for their contributions too. 🎉

Signer

The new @aws-lambda-powertools/signer package signs HTTP requests using AWS Signature Version 4 (SigV4), so you can call IAM-authenticated endpoints — API Gateway, Lambda function URLs, AppSync — from within your Lambda functions.

Signing and sending are kept separate: SigV4Signer signs a web-standard Request and performs no network I/O, while createSignedFetcher gives you a drop-in signed fetch for when you just want to sign and send in one step. By default, the signer reads credentials and region from the Lambda runtime environment, so no extra dependencies or configuration are required.

import { SigV4Signer } from '@aws-lambda-powertools/signer/sigv4';
const signer = new SigV4Signer({ service: 'execute-api' });
export const handler = async () => {
const signed = await signer.sign(
'https://example.execute-api.us-east-1.amazonaws.com/items'
);
// signed is a standard Request with the SigV4 headers added
const response = await fetch(signed);
await response.json();
};

Data Masking

The new @aws-lambda-powertools/data-masking package lets you encrypt, decrypt, or irreversibly erase sensitive fields within nested event data, using the AWS Encryption SDK and envelope encryption with AWS KMS for encrypt/decrypt operations.

import { DataMasking } from '@aws-lambda-powertools/data-masking';
const masker = new DataMasking();
export const handler = async (event: { body: Record<string, unknown> }) => {
const data = event.body;
return masker.erase(data, {
fields: ['email', 'address.street', 'company_address'],
});
};

... (truncated)

Changelog

Sourced from @​aws-lambda-powertools/logger's changelog.

2.34.0 (2026-07-10)

Improvements

• commons extract shared isRunningInLambda helper (#5424) (aec888b)
• logger remove unsafe context cast in createChild (#5443) (ac97f52)
• event-handler extract shared IP-extraction util for HTTP middleware (#5346) (3230ca7)

Maintenance

• commons bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)
• commons guard UA string against duplicate PTEnv suffix (#5311) (6b59973)
• logger bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)
• metrics bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)
• tracer bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)
• idempotency bump @​aws/durable-execution-sdk-js to ^1.1.6 (#5298) (dbc07c7)
• batch bump @​aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) (0a05acd)

Bug Fixes

• commons clear LRUCache pointers on eviction of last item (#5295) (acf1ba1)
• logger scope lambda context per invocation under LMI concurrency (#5430) (e5d2e69)
• metrics detect key collisions between dimensions, metrics, and metadata (#5240) (c1e62a6)
• tracer isolate active segment per invocation under LMI concurrency (#5446) (5890d94)
• tracer scope middy middleware segments per invocation (#5444) (14f68b1)
• idempotency recompute key prefix from base on each configure call (#5442) (a739c36)
• event-handler preserve original string for invalid Bedrock Agent number params (#5363) (9cce9f9)
• event-handler avoid runtime import of metrics package in HTTP metrics middleware (#5310) (f4a6752)
• event-handler correct InvalidHttpMethodError name (#5254) (7d410fc)
• event-handler normalize trailing slashes in HTTP Router prefix joining (#5255) (7a500a1)

Features

• metrics add Disposable support for automatic flushing via using (#5349) (e1cc0e1)
• parameters add throwOnMissing option to fail fast on missing values (#5343) (f81d247)
• idempotency warn when persistence layer reconfiguration is ignored (#5422) (6a113b1)
• parser add errorHandler option for inline parse error handling (#5352) (de752b9)
• event-handler add HTTP request/response data to tracer subsegment (#5338) (e1202b0)
• event-handler warn when AppSync Events payload exceeds 240 KB per-event limit (#5339) (2e7850d)
• data-masking add Data Masking utility (#5143) (bae72dd)
• signer add SigV4 request signing utility (#5344) (d5dce6d)

2.33.1 (2026-05-25)

Bug Fixes

• commons prevent deepMerge from mutating source objects (#5202) (9994787)
• commons correctly handle shared references in deepMerge (#5195) (6b1a811)
• logger flush log buffer on critical() when flushOnErrorLog is e… (#5227) (853b44f)

... (truncated)

Commits

• e8cff7f chore(ci): bump version to 2.34.0 (#5448)
• 47bbb3b chore(testing): use stackEventPollingInterval option, drop CDK patch (#5447)
• 5890d94 fix(tracer): isolate active segment per invocation under LMI concurrency (#5446)
• a739c36 fix(idempotency): recompute key prefix from base on each configure call (#5442)
• 14f68b1 fix(tracer): scope middy middleware segments per invocation (#5444)
• de752b9 feat(parser): add errorHandler option for inline parse error handling (#5352)
• ac97f52 refactor(logger): remove unsafe context cast in createChild (#5443)
• 6a113b1 feat(idempotency): warn when persistence layer reconfiguration is ignored (#5...
• 2143417 chore(skills): make create-issue checkbox handling template-driven (#5439)
• e5d2e69 fix(logger): scope lambda context per invocation under LMI concurrency (#5430)
• Additional commits viewable in compare view

Updates @aws-sdk/client-dynamodb from 3.1029.0 to 3.1090.0

Release notes

Sourced from @​aws-sdk/client-dynamodb's releases.

v3.1090.0

3.1090.0(2026-07-17)

New Features

• clients: update client endpoints as of 2026-07-17 (857153f3)
• client-kinesis-analytics-v2: Support for Flink 2.3 in Managed Service for Apache Flink (1ad0421f)
• client-gameliftstreams: Amazon GameLift Streams now supports assigning an IAM role to a stream session, enabling your application to securely access resources in your AWS account, such as Amazon S3 buckets and DynamoDB tables. (cf945cdb)
• client-rds: Adds the AssociatedRoles parameter to CreateDBCluster, RestoreDBClusterFromSnapshot, RestoreDBClusterToPointInTime, and RestoreDBClusterFromS3, letting customers associate IAM roles with an Aurora DB cluster at create or restore time instead of calling AddRoleToDBCluster afterward. (48b74a43)
• client-odb: Adds support for sourcing Autonomous Database admin and wallet passwords from customer-managed AWS Secrets Manager secrets, including password source configuration and summaries, and enabling or disabling the OCI IAM service role for Secrets Manager integration via InitializeService. (d5619c8b)
• client-cognito-identity-provider: Amazon Cognito user pools now support sending SMS via AWS End User Messaging. A new EumsSms object in SmsConfigurationType lets you deliver MFA and verification texts through AWS End User Messaging, alongside the existing Amazon SNS option. (600cf8d5)

---

For list of updated packages, view updated-packages.md in assets-3.1090.0.zip

v3.1089.0

3.1089.0(2026-07-16)

Chores

• enable pkg json sorting (#8200) (926898ee)
• remove redundant type assertions (#8193) (b41fbb0e)

Documentation Changes

• client-s3: Documentation update for removing the 30 day minimum restriction for transition to Standard-IA or OneZone-IA storage classes (91723d24)
• client-redshift: Amazon Redshift - Added support for rg.large and rg.12xlarge node types in CreateCluster, ModifyCluster, and ResizeCluster API operations. (50989cf0)

New Features

• clients: update client endpoints as of 2026-07-16 (c9150fe6)
• client-chime-sdk-voice: Marked CreateProxySession, DeleteProxySession, GetProxySession, ListProxySessions, UpdateProxySession, PutVoiceConnectorProxy, DeleteVoiceConnectorProxy, and GetVoiceConnectorProxy as deprecated. (d706c456)
• client-emr: Amazon EMR updates the Session object returned by GetSession API (863234ad)
• client-omics: Adds support for returning the task UUID (universally unique identifier) in GetRunTask and ListRunTasks responses (bafd66dd)
• client-sagemaker: Release support for g7 instance type for SageMaker inference endpoints. (668f46cb)
• client-sustainability: Adds support for retrieving estimated water allocation data. (432031b6)

Bug Fixes

• package.json: run make lint format without file args (#8201) (33ac9c0b)

Tests

• extend TypeScript compatibility check to 3.4-4.4 (#8197) (59f7fc67)

---

... (truncated)

Changelog

Sourced from @​aws-sdk/client-dynamodb's changelog.

3.1090.0 (2026-07-17)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1089.0 (2026-07-16)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1088.0 (2026-07-15)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1087.0 (2026-07-14)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1086.0 (2026-07-13)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1085.0 (2026-07-10)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1084.0 (2026-07-09)

... (truncated)

Commits

• eb268ed Publish v3.1090.0
• 60e8b54 Publish v3.1089.0
• 73de389 Publish v3.1088.0
• d43e5bf chore(codegen): sync to use typesVersions entries for submodules (#8195)
• ec24bb4 Publish v3.1087.0
• a20c28d chore(codegen): sync for codegen and include OAuthIAM operation for signin li...
• 64c3e50 Publish v3.1086.0
• 8d0b498 Publish v3.1085.0
• c34ce8a Publish v3.1084.0
• ceb9aee Publish v3.1083.0
• Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1029.0 to 3.1090.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1090.0

3.1090.0(2026-07-17)

New Features

• clients: update client endpoints as of 2026-07-17 (857153f3)
• client-kinesis-analytics-v2: Support for Flink 2.3 in Managed Service for Apache Flink (1ad0421f)
• client-gameliftstreams: Amazon GameLift Streams now supports assigning an IAM role to a stream session, enabling your application to securely access resources in your AWS account, such as Amazon S3 buckets and DynamoDB tables. (cf945cdb)
• client-rds: Adds the AssociatedRoles parameter to CreateDBCluster, RestoreDBClusterFromSnapshot, RestoreDBClusterToPointInTime, and RestoreDBClusterFromS3, letting customers associate IAM roles with an Aurora DB cluster at create or restore time instead of calling AddRoleToDBCluster afterward. (48b74a43)
• client-odb: Adds support for sourcing Autonomous Database admin and wallet passwords from customer-managed AWS Secrets Manager secrets, including password source configuration and summaries, and enabling or disabling the OCI IAM service role for Secrets Manager integration via InitializeService. (d5619c8b)
• client-cognito-identity-provider: Amazon Cognito user pools now support sending SMS via AWS End User Messaging. A new EumsSms object in SmsConfigurationType lets you deliver MFA and verification texts through AWS End User Messaging, alongside the existing Amazon SNS option. (600cf8d5)

---

For list of updated packages, view updated-packages.md in assets-3.1090.0.zip

v3.1089.0

3.1089.0(2026-07-16)

Chores

• enable pkg json sorting (#8200) (926898ee)
• remove redundant type assertions (#8193) (b41fbb0e)

Documentation Changes

• client-s3: Documentation update for removing the 30 day minimum restriction for transition to Standard-IA or OneZone-IA storage classes (91723d24)
• client-redshift: Amazon Redshift - Added support for rg.large and rg.12xlarge node types in CreateCluster, ModifyCluster, and ResizeCluster API operations. (50989cf0)

New Features

• clients: update client endpoints as of 2026-07-16 (c9150fe6)
• client-chime-sdk-voice: Marked CreateProxySession, DeleteProxySession, GetProxySession, ListProxySessions, UpdateProxySession, PutVoiceConnectorProxy, DeleteVoiceConnectorProxy, and GetVoiceConnectorProxy as deprecated. (d706c456)
• client-emr: Amazon EMR updates the Session object returned by GetSession API (863234ad)
• client-omics: Adds support for returning the task UUID (universally unique identifier) in GetRunTask and ListRunTasks responses (bafd66dd)
• client-sagemaker: Release support for g7 instance type for SageMaker inference endpoints. (668f46cb)
• client-sustainability: Adds support for retrieving estimated water allocation data. (432031b6)

Bug Fixes

• package.json: run make lint format without file args (#8201) (33ac9c0b)

Tests

• extend TypeScript compatibility check to 3.4-4.4 (#8197) (59f7fc67)

---

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1090.0 (2026-07-17)

Note: Version bump only for package @​aws-sdk/client-s3

3.1089.0 (2026-07-16)

Note: Version bump only for package @​aws-sdk/client-s3

3.1088.0 (2026-07-15)

Note: Version bump only for package @​aws-sdk/client-s3

3.1087.0 (2026-07-14)

Note: Version bump only for package @​aws-sdk/client-s3

3.1086.0 (2026-07-13)

Note: Version bump only for package @​aws-sdk/client-s3

3.1085.0 (2026-07-10)

Note: Version bump only for package @​aws-sdk/client-s3

3.1084.0 (2026-07-09)

... (truncated)

Commits

• eb268ed Publish v3.1090.0
• 60e8b54 Publish v3.1089.0
• 91723d2 docs(client-s3): Documentation update for removing the 30 day minimum restric...
• 73de389 Publish v3.1088.0
• d43e5bf chore(codegen): sync to use typesVersions entries for submodules (#8195)
• 7d14409 chore: migrate eslint/prettier to oxlint/oxfmt (#8192)
• ec24bb4 Publish v3.1087.0
• a20c28d chore(codegen): sync for codegen and include OAuthIAM operation for signin li...
• 64c3e50 Publish v3.1086.0
• 8d0b498 Publish v3.1085.0
• Additional commits viewable in compare view

Updates @aws-sdk/util-dynamodb from 3.996.2 to 3.996.7

Commits

• See full diff in compare view

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates eslint from 10.2.1 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

... (truncated)

Commits