Bump the dev-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the dev-dependencies group with 8 updates in the / directory:

Package	From	To
@cap-js/audit-logging	1.2.0	1.2.2
@cap-js/cds-typer	0.38.0	0.40.0
@cap-js/cds-types	0.16.0	0.18.0
eslint	10.2.0	10.6.0
mocha	11.7.5	11.7.6
prettier	3.8.1	3.9.4
tsx	4.21.0	4.23.0
typescript-eslint	8.58.0	8.62.1

Updates @cap-js/audit-logging from 1.2.0 to 1.2.2

Release notes

Sourced from @​cap-js/audit-logging's releases.

v1.2.2

Fixed

• Properly encode request body parameters using in audit-log-to-restv2
• Resolved server crash when @PersonalData annotations are applied to composition targets whose DataSubject is only reachable via the parent entity's sibling association

v1.2.1

Fixed

• Updated the audit log service plan detection logic to support the new URL format
• The absence of req.target does not lead to an error

Changelog

Sourced from @​cap-js/audit-logging's changelog.

Version 1.2.2 - 2026-06-18

Fixed

• Properly encode request body parameters using in audit-log-to-restv2
• Resolved server crash when @PersonalData annotations are applied to composition targets whose DataSubject is only reachable via the parent entity's sibling association

Version 1.2.1 - 2026-05-13

Fixed

• Updated the audit log service plan detection logic to support the new URL format
• The absence of req.target does not lead to an error

Commits

• fb41cb8 chore(deps-dev): bump express from 4.22.1 to 5.2.1 (#189)
• 33cd60a chore: bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group ...
• 9a6945c fix: resolve DataSubject via parent's associations for compo targets (#214)
• 572fd77 fix: encode body parameters properly (#216)
• d7f6b25 chore: bump actions/stale from 10.2.0 to 10.3.0 in the github-actions group a...
• 2e5ef31 test: fix test setup by adding cap-js/sqlite for plugin detection (#212)
• 0ce9b6d chore: dependabot cooldown (#209)
• 690b2f3 chore: prep v1.3.0 (#206)
• c83b5fa req.target is not always given (#204)
• 429dca0 [ALS-9774] [ALS v2] Align CAP Plugins with the new Service Binding Structure ...
• Additional commits viewable in compare view

Updates @cap-js/cds-typer from 0.38.0 to 0.40.0

Release notes

Sourced from @​cap-js/cds-typer's releases.

v0.40.0

Added

Changed

• output_d_ts_files now defaults to true and emits proper ambient .d.ts declaration files instead of merely renaming .ts output files. Plain .ts files are treated as source by TypeScript and other build tools, which caused them to be compiled and their .js output to silently overwrite the runtime module exports generated by cds-typer. Projects with strict tsconfig.json settings will benefit from this change, as .d.ts files do not require special handling in cds build or development scripts. Set to false to restore the old behaviour.

Deprecated

Removed

Fixed

• Entities with name conflicts with any of their ancestors now have their aspect name generated properly again
• Fixed sporadic [Object object] appearing in log output

Security

v0.39.1

Added

Changed

Deprecated

Removed

Fixed

• Properly import entities from other services that are used in arrays/ compositions of many/ associations to many

Security

v0.39.0

Added

• Added flag cds.env.typer.branded_primitive_types for branding CDS type definitions aliasing primitive TS types
• Added support for non-ASCII identifiers in .cds files. Non-ASCII characters in identifiers are sanitised to valid TypeScript names. Identifiers consisting entirely of non-ASCII characters (e.g., Kanji) are replaced with random hashes. All affected identifiers are exported under their sanitised/hashed name and also as an alias preserving the original name. To use the original name, import it with import ... as '...' syntax.

Changed

Deprecated

Removed

Fixed

• Association keys pointing to entities with inline enum types are now correctly typed in service projections across namespace boundaries

Security

Changelog

Sourced from @​cap-js/cds-typer's changelog.

[0.40.0] - 2026-06-22

Added

Changed

• output_d_ts_files now defaults to true and emits proper ambient .d.ts declaration files instead of merely renaming .ts output files. Plain .ts files are treated as source by TypeScript and other build tools, which caused them to be compiled and their .js output to silently overwrite the runtime module exports generated by cds-typer. Projects with strict tsconfig.json settings will benefit from this change, as .d.ts files do not require special handling in cds build or development scripts. Set to false to restore the old behaviour.

Deprecated

Removed

Fixed

• Entities with name conflicts with any of their ancestors now have their aspect name generated properly again
• Fixed sporadic [Object object] appearing in log output

Security

[0.39.1] - 2026-05-19

Added

Changed

Deprecated

Removed

Fixed

• Properly import entities from other services that are used in arrays/ compositions of many/ associations to many

Security

[0.39.0] - 2026-05-11

Added

• Added flag cds.env.typer.branded_primitive_types for branding CDS type definitions aliasing primitive TS types
• Added support for non-ASCII identifiers in .cds files. Non-ASCII characters in identifiers are sanitised to valid TypeScript names. Identifiers consisting entirely of non-ASCII characters (e.g., Kanji) are replaced with random hashes. All affected identifiers are exported under their sanitised/hashed name and also as an alias preserving the original name. To use the original name, import it with import ... as '...' syntax.

Changed

Deprecated

Removed

Fixed

• Association keys pointing to entities with inline enum types are now correctly typed in service projections across namespace boundaries

Security

Commits

• 4b63223 chore(version): minor version 0.40.0 (#630)
• 198b2db chore: Bump versions (#628)
• c5ea1c9 feat: Emit declaration specific output (#620)
• 8bad3de fix: Call JSON.stringify on structured variables when logging (#626)
• 7849f48 refactor: Separate traversal logic into its own module (#621)
• dbae011 chore: Remove test runner (#624)
• 64d28a0 fix: Resolve naming conflicts of entities with ancestors of the same name (#616)
• c3437b0 chore: Bump node version (#617)
• 4be7748 chore(deps): Bump qs from 6.13.0 to 6.14.2 (#614)
• 5e1d5c4 chore(version): patch version 0.39.1 (#613)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cap-js/cds-typer since your current version.

Updates @cap-js/cds-types from 0.16.0 to 0.18.0

Release notes

Sourced from @​cap-js/cds-types's releases.

v0.18.0

Added

Changed

• Installing @cap-js/cds-types no longer executes a postinstall script that creates a symlink in node_modules/@types. Instead, use a paths entry in your tsconfig.json. This entry can be created by running cds add typescript in your project.

Deprecated

Removed

Fixed

Security

v0.17.0

Added

• Types for nested .where and .having predicates
• Passing events generated by cds-typer into service.on now offers code completion for the event's properties in the handler
• Allow all events that can be used in service.on to be used in service.once as well

Changed

• ResultHandler now returns unknown instead of void, to accommodate asynchronous functions when having @typescript-eslint/strict-void-return activated
• Documentation for cds.test.axios mentioning that @cap-js/cds-test@1 now returns an axios facade in absence of axios.
• made cds.context.locale optional
• cds.tx(ƒ) now returns the return type of ƒ

Deprecated

• cds.test.chai, cds.test.assert pointing to either cds.test.expect or a custom import of chai.
• cds.test.axios in favor of cds.test.defaults

Removed

Fixed

Security

Changelog

Sourced from @​cap-js/cds-types's changelog.

[0.18.0] - 2026-06-22

Added

Changed

• Installing @cap-js/cds-types no longer executes a postinstall script that creates a symlink in node_modules/@types. Instead, use a paths entry in your tsconfig.json. This entry can be created by running cds add typescript in your project.

Deprecated

Removed

Fixed

Security

[0.17.0] - 2026-05-11

Added

• Types for nested .where and .having predicates
• Passing events generated by cds-typer into service.on now offers code completion for the event's properties in the handler
• Allow all events that can be used in service.on to be used in service.once as well

Changed

• ResultHandler now returns unknown instead of void, to accommodate asynchronous functions when having @typescript-eslint/strict-void-return activated
• Documentation for cds.test.axios mentioning that @cap-js/cds-test@1 now returns an axios facade in absence of axios.
• made cds.context.locale optional
• cds.tx(ƒ) now returns the return type of ƒ

Deprecated

• cds.test.chai, cds.test.assert pointing to either cds.test.expect or a custom import of chai.
• cds.test.axios in favor of cds.test.defaults

Removed

Fixed

Security

Commits

• 1da5e1d chore(version): minor version 0.18.0 (#564)
• 002fbe5 build(deps-dev): bump typescript-eslint (#563)
• 619ea61 build(deps-dev): bump the development-dependencies group across 1 directory w...
• da07731 chore: Remove postinstall script (#560)
• e4d41c4 chore: open dependencies to CDS 10 (#558)
• 5c4e0a0 chore(version): minor version 0.17.0 (#554)
• 0b9140c build(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 (#552)
• f9c9a86 build(deps-dev): bump axios from 1.15.1 to 1.16.0 (#551)
• fe0045f fix: add missing once events (#550)
• 8358aff Revert "Allow on events in once"
• Additional commits viewable in compare view

Updates eslint from 10.2.0 to 10.6.0

Release notes

Sourced from eslint's releases.

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)
• f291007 feat: add checkRelationalComparisons to no-constant-binary-expression (#20948) (sethamus)

Bug Fixes

• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997) (Milos Djermanovic)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013) (den$)
• 8fd8741 fix: don't report shadowed undefined in radix rule (#21011) (Pixel)
• 5784980 fix: don't report shadowed undefined in no-throw-literal (#21010) (Pixel)
• 9cd1e6d fix: suppress invalid class suggestion in no-promise-executor-return (#21008) (Pixel)
• d4eb2dc fix: don't report shadowed undefined in prefer-promise-reject-errors (#21006) (Pixel)
• 2360464 fix: prefer-promise-reject-errors false positives for shadowed Promise (#21003) (den$)
• 63d52d2 fix: restore max-classes-per-file report range (#21002) (Pixel)
• 7feaff0 fix: callback detection logic for IIFEs in max-nested-callbacks (#20979) (fnx)
• 399a2ec fix: don't report inner non-callbacks in max-nested-callbacks (#20995) (Milos Djermanovic)

Documentation

• a83683d docs: Update README (GitHub Actions Bot)
• f5449f9 docs: document userland patterns for global assertionOptions in RuleT… (#20986) (playgirl)
• bea49f7 docs: Update README (GitHub Actions Bot)
• e5f70f9 docs: update code-path diagrams (#20984) (Tanuj Kanti)
• 8890c2d docs: add TypeScript config guidance for MCP server (#20796) (Pierluigi Lenoci)
• 3eb3d9b docs: Update README (GitHub Actions Bot)
• c5bb59c docs: Update README (GitHub Actions Bot)
• eb3c97c docs: fix grammar in prefer-const rule description (#20983) (lumir)

Chores

• 6a42034 ci: run ecosystem tests on main branch (#20891) (sethamus)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014) (dependabot[bot])
• c3abfca chore: correct JSDoc param types in html formatter (#21018) (Minseon Kim)
• a832320 ci: split ecosystem tests into separate jobs (#21001) (xbinaryx)
• 27166e7 chore: update ecosystem plugins (#21005) (ESLint Bot)
• 865d76e ci: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#20989) (dependabot[bot])
• 27a88c9 chore: update dependency markdown-it to v14 in root (#20994) (Milos Djermanovic)
• 970cea6 chore: update dependency markdown-it to v14 (#20993) (Milos Djermanovic)
• b482120 chore: update dependency prettier to v3.8.4 (#20990) (renovate[bot])
• 6993fb3 chore: update ecosystem plugins (#20985) (ESLint Bot)

v10.5.0

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)
• 2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)
• 732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)
• f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)
• bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)
• c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

... (truncated)

Commits

• 5d12a04 10.6.0
• f7ca54b Build: changelog update for 10.6.0
• 6a42034 ci: run ecosystem tests on main branch (#20891)
• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)
• 3dbacdb ci: bump actions/checkout from 6 to 7 (#21014)
• c3abfca chore: correct JSDoc param types in html formatter (#21018)
• a83683d docs: Update README
• a832320 ci: split ecosystem tests into separate jobs (#21001)
• 6b05784 fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)
• bb9eb2a fix: account for shadowed Boolean in no-extra-boolean-cast (#21013)
• Additional commits viewable in compare view

Updates mocha from 11.7.5 to 11.7.6

Release notes

Sourced from mocha's releases.

v11.7.6

11.7.6 (2026-02-14)

🩹 Fixes

• make describe().timeout() work (aafe6fd)
• test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

• format all code (#5629) (0696784)
• remove Netlify (#5630) (8d01d33)

Changelog

Sourced from mocha's changelog.

11.7.6 (2026-02-14)

🩹 Fixes

• make describe().timeout() work (aafe6fd)
• test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

• format all code (#5629) (0696784)
• remove Netlify (#5630) (8d01d33)

Commits

• 3765ba0 chore(v11.x): release 11.7.6 (#5632)
• 73ebdfa fix(test): replace wmic usage with native Windows API (#5694)
• aafe6fd fix: make describe().timeout() work
• 0696784 chore: format all code (#5629)
• 8d01d33 chore: remove Netlify (#5630)
• See full diff in compare view

Updates prettier from 3.8.1 to 3.9.4

Release notes

Sourced from prettier's releases.

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

3.8.4

• Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (prettier/prettier#17746 by @​byplayer)

🔗 Changelog

3.8.3

• SCSS: Prevent trailing comma in if() function (prettier/prettier#18471 by @​kovsu)

🔗 Changelog

3.8.2

• Support Angular v21.2

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.4

diff

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

<!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
@​content(icon) {
<span>Icon!</span>
}
@​content(description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
@​content (icon) {
<span>Icon!</span>
}
@​content (description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>

3.9.3

diff

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @​seiyab)

</tr></table> 

... (truncated)

Commits

• b693cb2 Release 3.9.4
• 2e92ac0 Angular: Format @content(name) -> @content (name) to align with other blo...
• abed2c2 Bump Prettier dependency to 3.9.3
• 6cfbc00 Clean changelog_unreleased
• 3732e1d Release 3.9.3
• a74a7b0 Allow decorators to be used with declare on class fields (#19492)
• bd9e11a Correct text identification in liquid syntax (#19489)
• 269eee3 Bump Prettier dependency to 3.9.1
• ec7ccd1 Clean changelog_unreleased
• c47654c Release 3.9.1
• Additional commits viewable in compare view

Updates tsx from 4.21.0 to 4.23.0

Release notes

Sourced from tsx's releases.

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.4

4.22.4 (2026-05-31)

Bug Fixes

• resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

• decode typed loader source (dce02fc)
• preserve entrypoint with TypeScript preload hooks (68f72f3)

... (truncated)

Commits

• 1dfad37 docs: cite esbuild's extension-resolution model in node notes
• 257bbbb fix: avoid redundant filesystem probes during module resolution
• c178197 feat: add multi-scenario startup benchmark suite
• 51800ac docs: add Node internals knowledge base (notes/node)
• a305f36 fix: isolate hook state per async module.register() registration
• ca501a9 chore: upgrade skills-npm to v1.2.0
• 596cd1f test: cover __dirname, __filename, & require.cache in CJS TS file
• 75d9bf0 test: lock in lenient ESM for ambiguous and CJS-typed packages
• 1472f3e test: cover ESM-syntax dependency with omitted "type" field
• 1ce8463 fix: resolve CommonJS directory requires inside dependencies (#803)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Updates typescript-eslint from 8.58.0 to 8.62.1

Release notes

Sourced from typescript-eslint's releases.

v8.62.1

8.62.1 (2026-06-29)

🩹 Fixes

• eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#12328)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)
• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger
• mdm317
• Patrick Aleite
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

8.62.0 (2026-06-22)

🚀 Features

• remove redundant package.json "files" (#12444)

🩹 Fixes

• add "files" to rule-schema-to-typescript-types (#12441)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.1

8.61.1 (2026-06-15)

🩹 Fixes

• eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#12396, #10577)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#12281)
• eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#12394, #12393)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#12413)
• eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#12388)

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.62.1 (2026-06-29)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.0 (2026-06-22)

🚀 Features

• remove redundant package.json "files" (#12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.1 (2026-06-15)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.0 (2026-06-08)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.60.1 (2026-06-01)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.60.0 (2026-05-25)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

... (truncated)

Commits

• 3ea32f4 chore(release): publish 8.62.1
• 54e2857 chore(release): publish 8.62.0
• 81e4c26 feat: remove redundant package.json "files" (#12444)
• aaad718 chore(release): publish 8.61.1
• 16a5b24 chore(release): publish 8.61.0
• 4f84a69 chore(release): publish 8.60.1
• 1849b53 chore: typecheck using tsgo (#12139)
• f891c29 chore(release): publish 8.60.0
• ca6ca14 chore(release): publish 8.59.4
• 4b927c6 fix(typescript-eslint): export Compatible* types from typescript-eslint to re...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud