Chore(deps): Bump the node-minor-patch group across 4 directories with 14 updates

[dependabot]

Bumps the node-minor-patch group with 7 updates in the /backend/compact-connect-ui-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1029.0	3.1073.0
@aws-sdk/client-s3	3.1029.0	3.1073.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.5.0
mocha	11.7.5	11.7.6

Bumps the node-minor-patch group with 14 updates in the /backend/compact-connect/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1073.0
@aws-sdk/client-s3	3.1045.0	3.1073.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.5.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1073.0
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.61.1
@typescript-eslint/parser	8.58.1	8.61.1
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.22.4

Bumps the node-minor-patch group with 14 updates in the /backend/cosmetology-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1073.0
@aws-sdk/client-s3	3.1045.0	3.1073.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.5.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1073.0
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.61.1
@typescript-eslint/parser	8.58.1	8.61.1
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.22.4

Bumps the node-minor-patch group with 14 updates in the /backend/social-work-app/lambdas/nodejs directory:

Package	From	To
@aws-lambda-powertools/logger	2.32.0	2.33.1
@aws-sdk/client-dynamodb	3.1045.0	3.1073.0
@aws-sdk/client-s3	3.1045.0	3.1073.0
@aws-sdk/util-dynamodb	3.996.2	3.996.5
esbuild	0.28.0	0.28.1
eslint	10.2.1	10.5.0
mocha	11.7.5	11.7.6
@aws-sdk/client-sesv2	3.1045.0	3.1073.0
@types/aws-lambda	8.10.161	8.10.162
@types/nodemailer	8.0.0	8.0.1
@typescript-eslint/eslint-plugin	8.58.1	8.61.1
@typescript-eslint/parser	8.58.1	8.61.1
ts-jest	29.4.9	29.4.11
tsx	4.21.0	4.22.4

Updates @aws-lambda-powertools/logger from 2.32.0 to 2.33.1

Release notes

Sourced from @​aws-lambda-powertools/logger's releases.

v2.33.1

Summary

This release is mainly composed of bug fixes across the HTTP event handler, Metrics, Logger, and Parser utilities, along with the removal of Node.js 20 support now that the runtime has reached end-of-life on AWS Lambda.

In the HTTP event handler, we have fixed response header corruption where multi-attribute headers like Set-Cookie (with Expires dates) and other comma-containing values were being incorrectly split into multiple headers. The HTTP event handler also now correctly preserves PATCH request bodies on ALB events and returns the proper 204 response for CORS preflight requests that omit the Access-Control-Request-Headers header.

In Metrics, dimension limits are now enforced per-array rather than across the merged set, preventing CloudWatch EMF rejections when default and request-scoped dimensions overlap. Logger now flushes the log buffer when critical() is called with flushOnErrorLog enabled, matching the behaviour of error().

[!IMPORTANT] Node.js 20 is no longer supported. Node.js 20 reached end-of-life on AWS Lambda, so this release drops support for it. If you are still on Node.js 20, we recommend upgrading to Node.js 22 before updating Powertools.

⭐ Congratulations to @​vishwakt and @​nanookclaw for their first PRs merged in the project 🎉

Changes

• chore(deps): fix npm audit vulnerabilities (#5269) by @​svozza
• fix(event-handler): allow cors preflight without request headers (#5267) by @​vishwakt
• fix(event-handler): preserve ALB PATCH bodies (#5259) by @​nanookclaw
• fix(event-handler): restrict v1/alb comma header splitting to an allowlist (#5257) by @​vishwakt
• fix(parser): cognito validationData may be null (#5250) by @​bdellegrazie
• fix(metrics): enforce dimension limits per-array (#5229) by @​vishwakt
• improv(docs): fixed the docs to mention middy support for v7.x (#5238) by @​sdangol
• fix(metrics): account for all dimensions in setDefaultDimensions() li… (#5228) by @​vishwakt
• fix(logger): flush log buffer on critical() when flushOnErrorLog is e… (#5227) by @​vishwakt
• fix(metrics): clear state in publishStoredMetrics even when throwOnEmptyMetrics throws (#5213) by @​svozza
• chore: drop Node.js 20 support (#5218) by @​svozza
• fix(commons): prevent deepMerge from mutating source objects (#5202) by @​svozza
• fix(commons): correctly handle shared references in deepMerge (#5195) by @​svozza
• ci(maintenance): Remove release comment automation (#5193) by @​dreamorosi
• fix(logger): correctly serialize shared object references in JSON replacer (#5186) by @​svozza

🔧 Maintenance

• chore(deps-dev): bump protobufjs from 8.4.0 to 8.4.2 (#5285) by @dependabot[bot]
• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#5279) by @dependabot[bot]
• chore(deps): bump idna from 3.10 to 3.15 in /docs (#5274) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.3.0 to 8.4.0 (#5270) by @dependabot[bot]
• chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs (#5275) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5277) by @dependabot[bot]
• chore(deps-dev): bump @​valkey/valkey-glide from 2.3.1 to 2.4.0 (#5271) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.0.4 to 17.0.5 (#5272) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.8.0 to 25.9.1 (#5276) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#5264) by @dependabot[bot]
• chore(deps-dev): bump @​aws/durable-execution-sdk-js from 1.1.2 to 1.1.3 (#5265) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.7.0 to 25.8.0 (#5266) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.2.0 to 8.3.0 (#5253) by @dependabot[bot]
• chore(deps): bump gitpython from 3.1.48 to 3.1.50 in /docs (#5234) by @dependabot[bot]
• chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /docs (#5239) by @dependabot[bot]
• chore(deps): bump @​types/node from 25.6.0 to 25.7.0 (#5244) by @dependabot[bot]

... (truncated)

Changelog

Sourced from @​aws-lambda-powertools/logger's changelog.

2.33.1 (2026-05-25)

Bug Fixes

• commons prevent deepMerge from mutating source objects (#5202) (9994787)
• commons correctly handle shared references in deepMerge (#5195) (6b1a811)
• logger flush log buffer on critical() when flushOnErrorLog is e… (#5227) (853b44f)
• logger correctly serialize shared object references in JSON replacer (#5186) (097e440)
• metrics enforce dimension limits per-array (#5229) (8791ee2)
• metrics account for all dimensions in setDefaultDimensions() li… (#5228) (54eb80a)
• metrics clear state in publishStoredMetrics even when throwOnEmptyMetrics throws (#5213) (a37913f)
• parser cognito validationData may be null (#5250) (b3c1293)
• event-handler allow cors preflight without request headers (#5267) (5adc3f4)
• event-handler preserve ALB PATCH bodies (#5259) (9e1a687)
• event-handler restrict v1/alb comma header splitting to an allowlist (#5257) (ca4bb13)

Maintenance

• validation bump ajv from 8.18.0 to 8.20.0 (#5214) (4a9edca)

2.33.0 (2026-04-14)

Bug Fixes

• commons don't overwrite existing value with undefined in deepMerge (#5141) (c7c6c0f)
• commons rename AvailabilityZoneId to AvailabilityZoneID in docs and tests (#5118) (65c054c)
• event-handler http response body validation typings (#5125) (0805db9)

Improvements

• parser export InferOutput from public types entry point (#5175) (16c6de6)

Features

• event-handler add metrics middleware for HTTP routes (#5086) (5af28e8)

Commits

• a3d3147 chore(ci): bump version to 2.33.1 (#5288)
• 56eacb7 chore(deps-dev): bump protobufjs from 8.4.0 to 8.4.2 (#5285)
• ba4d364 chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#5279)
• 30621d6 chore(deps): bump idna from 3.10 to 3.15 in /docs (#5274)
• b756cfc chore(deps-dev): bump protobufjs from 8.3.0 to 8.4.0 (#5270)
• 3fdc9d9 chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs (#5275)
• 3cf427f chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5277)
• 7325ba2 chore(deps-dev): bump @​valkey/valkey-glide from 2.3.1 to 2.4.0 (#5271)
• 519b88d chore(deps-dev): bump lint-staged from 17.0.4 to 17.0.5 (#5272)
• 1a84635 chore(deps): bump @​types/node from 25.8.0 to 25.9.1 (#5276)
• Additional commits viewable in compare view

Updates @aws-sdk/client-dynamodb from 3.1029.0 to 3.1073.0

Release notes

Sourced from @​aws-sdk/client-dynamodb's releases.

v3.1073.0

3.1073.0(2026-06-19)

New Features

• client-glue: Adds the SearchAssets operation for discovering assets in the AWS Glue Data Catalog using full-text search and filters. Minor naming refinements across the Glossary Terms and Attachment APIs for consistency. (ef204650)
• client-connect: This is the release for point based scoring system and the evaluation form validation project (b19c162a)
• client-bedrock-agent: Add support for metadata-only retrieval on GetFlow, GetFlowVersion, and GetPrompt APIs. (c9d5fb33)
• client-appstream: Amazon WorkSpaces Agent Access now supports domain-joined fleets for enterprise identity integration, real-time agent observation with instant stop controls, and MCP tool forwarding for lower-latency, cost-effective desktop tool access. (d9c25f0b)
• client-opensearch: This release introduces data source attachment APIs, enabling users to attach and detach Amazon OpenSearch Service domains and Amazon OpenSearch Serverless collections to an OpenSearch application. (6cce3d69)

---

For list of updated packages, view updated-packages.md in assets-3.1073.0.zip

v3.1072.0

3.1072.0(2026-06-18)

Documentation Changes

• client-ec2: Documentation updates clarifying CancelCapacityReservation cancellable states (e3723ba7)

New Features

• client-compute-optimizer: This release surfaces two new metrics Volume IOPS Exceeded and Volume Throughput Exceeded into EBS volume rightsizing recommendations. (ded6618d)
• client-application-auto-scaling: Adds support for ECS high-resolution predefined scaling metrics (ECSServiceAverageCPUUtilizationHighResolution, ECSServiceAverageMemoryUtilizationHighResolution) enabling 20-second metric periods for faster scaling (95b3513a)
• client-cognito-identity-provider: In order to support the new TLS Self-Service feature, this change adds SecurityPolicyType to CustomDomainConfigType. During CreateUserPoolDomain and UpdateUserPoolDomain this is used to select a custom domain's TLS enforcement, and for DescribeUserPoolDomain it informs users about the current TLS. (e8937787)
• client-sagemaker: Adds support for automatic AMI patching on HyperPod clusters. Customers can configure patching strategies to automatically apply security patch with zero job termination. Customers can also specify an AMI version at instance group level and update cluster software to a certain AMI version. (fd33a5e4)
• client-ecs: Amazon ECS services now support high resolution (20 second) CloudWatch metrics for CPUUtilization and MemoryUtilization. Use these metrics for faster service auto scaling. (93055ac9)
• client-healthlake: Adding New Configurations to the FHIR Create Datastore. The new configurations include NLP Configuration, AnalyticsConfiguration, ProfileConfiguration (494fa59f)
• client-gamelift: Amazon GameLift Servers has launched support for customizing Linux capabilities in container fleets. You can now specify additional Linux capabilities for containers in a container group definition, giving you finer control over the default Docker capabilities available to your containers. (93cefd90)
• client-eks: Adds support for configurable control plane egress routing in Amazon EKS, allowing you to route control plane egress traffic through your VPC and control how the control plane reaches resources in your network such as webhook servers and OIDC providers. (693db629)
• client-lambda: Converging and fixing existing documentation gaps in Lambda SDK (6555a565)
• client-synthetics: CloudWatch Synthetics adds support for multi-location canaries. Customers can now monitor their endpoints from multiple locations with centralized management from a primary location. The SDK includes new parameters for configuring multiple locations and tracking their state. (f2c8b480)
• client-cloudwatch-logs: Added optional startFromHead parameter to FilterLogEvents enabling descending timestamp order (newest first) when set to false. Default true preserves existing ascending order. Reverse sorting requires a startTime on or after Jan 1, 2024. (1be63ed9)
• client-batch: Adds Support for ordered allocation strategies- BEST-FIT-PROGRESSIVE-ORDERED or SPOT-CAPACITY-OPTIMIZED-PRIORITIZED (0e57e53b)

---

For list of updated packages, view updated-packages.md in assets-3.1072.0.zip

v3.1071.0

3.1071.0(2026-06-17)

New Features

• client-partnercentral-selling: Cosell Resonate AND Prospecing API Launch with ARN correction (7e8c98ab)
• client-compute-optimizer-automation: This launch adds IfExists comparison operators to Compute Optimizer Automation rule criteria, so a rule can include recommended actions whose specified attribute isn't present. (ab2c616d)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-dynamodb's changelog.

3.1073.0 (2026-06-19)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1072.0 (2026-06-18)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1071.0 (2026-06-17)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1070.0 (2026-06-16)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1069.0 (2026-06-15)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1068.0 (2026-06-12)

Note: Version bump only for package @​aws-sdk/client-dynamodb

3.1067.0 (2026-06-11)

... (truncated)

Commits

• ee71adc Publish v3.1073.0
• 501cd33 Publish v3.1072.0
• 3ce820a Publish v3.1071.0
• 4f2cfe1 Publish v3.1070.0
• 7058d13 Publish v3.1069.0
• 67981c5 chore(scripts): tuning the build graph (#8095)
• 0632f6d Publish v3.1068.0
• 0a3246f Publish v3.1067.0
• 4b11912 Publish v3.1066.0
• e4ef6c5 test: use crypto.randomUUID for resource names in e2e tests (#8091)
• Additional commits viewable in compare view

Updates @aws-sdk/client-s3 from 3.1029.0 to 3.1073.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1073.0

3.1073.0(2026-06-19)

New Features

• client-glue: Adds the SearchAssets operation for discovering assets in the AWS Glue Data Catalog using full-text search and filters. Minor naming refinements across the Glossary Terms and Attachment APIs for consistency. (ef204650)
• client-connect: This is the release for point based scoring system and the evaluation form validation project (b19c162a)
• client-bedrock-agent: Add support for metadata-only retrieval on GetFlow, GetFlowVersion, and GetPrompt APIs. (c9d5fb33)
• client-appstream: Amazon WorkSpaces Agent Access now supports domain-joined fleets for enterprise identity integration, real-time agent observation with instant stop controls, and MCP tool forwarding for lower-latency, cost-effective desktop tool access. (d9c25f0b)
• client-opensearch: This release introduces data source attachment APIs, enabling users to attach and detach Amazon OpenSearch Service domains and Amazon OpenSearch Serverless collections to an OpenSearch application. (6cce3d69)

---

For list of updated packages, view updated-packages.md in assets-3.1073.0.zip

v3.1072.0

3.1072.0(2026-06-18)

Documentation Changes

• client-ec2: Documentation updates clarifying CancelCapacityReservation cancellable states (e3723ba7)

New Features

• client-compute-optimizer: This release surfaces two new metrics Volume IOPS Exceeded and Volume Throughput Exceeded into EBS volume rightsizing recommendations. (ded6618d)
• client-application-auto-scaling: Adds support for ECS high-resolution predefined scaling metrics (ECSServiceAverageCPUUtilizationHighResolution, ECSServiceAverageMemoryUtilizationHighResolution) enabling 20-second metric periods for faster scaling (95b3513a)
• client-cognito-identity-provider: In order to support the new TLS Self-Service feature, this change adds SecurityPolicyType to CustomDomainConfigType. During CreateUserPoolDomain and UpdateUserPoolDomain this is used to select a custom domain's TLS enforcement, and for DescribeUserPoolDomain it informs users about the current TLS. (e8937787)
• client-sagemaker: Adds support for automatic AMI patching on HyperPod clusters. Customers can configure patching strategies to automatically apply security patch with zero job termination. Customers can also specify an AMI version at instance group level and update cluster software to a certain AMI version. (fd33a5e4)
• client-ecs: Amazon ECS services now support high resolution (20 second) CloudWatch metrics for CPUUtilization and MemoryUtilization. Use these metrics for faster service auto scaling. (93055ac9)
• client-healthlake: Adding New Configurations to the FHIR Create Datastore. The new configurations include NLP Configuration, AnalyticsConfiguration, ProfileConfiguration (494fa59f)
• client-gamelift: Amazon GameLift Servers has launched support for customizing Linux capabilities in container fleets. You can now specify additional Linux capabilities for containers in a container group definition, giving you finer control over the default Docker capabilities available to your containers. (93cefd90)
• client-eks: Adds support for configurable control plane egress routing in Amazon EKS, allowing you to route control plane egress traffic through your VPC and control how the control plane reaches resources in your network such as webhook servers and OIDC providers. (693db629)
• client-lambda: Converging and fixing existing documentation gaps in Lambda SDK (6555a565)
• client-synthetics: CloudWatch Synthetics adds support for multi-location canaries. Customers can now monitor their endpoints from multiple locations with centralized management from a primary location. The SDK includes new parameters for configuring multiple locations and tracking their state. (f2c8b480)
• client-cloudwatch-logs: Added optional startFromHead parameter to FilterLogEvents enabling descending timestamp order (newest first) when set to false. Default true preserves existing ascending order. Reverse sorting requires a startTime on or after Jan 1, 2024. (1be63ed9)
• client-batch: Adds Support for ordered allocation strategies- BEST-FIT-PROGRESSIVE-ORDERED or SPOT-CAPACITY-OPTIMIZED-PRIORITIZED (0e57e53b)

---

For list of updated packages, view updated-packages.md in assets-3.1072.0.zip

v3.1071.0

3.1071.0(2026-06-17)

New Features

• client-partnercentral-selling: Cosell Resonate AND Prospecing API Launch with ARN correction (7e8c98ab)
• client-compute-optimizer-automation: This launch adds IfExists comparison operators to Compute Optimizer Automation rule criteria, so a rule can include recommended actions whose specified attribute isn't present. (ab2c616d)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1073.0 (2026-06-19)

Note: Version bump only for package @​aws-sdk/client-s3

3.1072.0 (2026-06-18)

Note: Version bump only for package @​aws-sdk/client-s3

3.1071.0 (2026-06-17)

Note: Version bump only for package @​aws-sdk/client-s3

3.1070.0 (2026-06-16)

Features

• client-s3: Added support for annotations. You can now attach up to 1000 annotations (up to 1 MB each) directly to objects and create, retrieve, list, and delete them using new annotation APIs. Also added support for configuring an annotation table in S3 Metadata. (c555874)

3.1069.0 (2026-06-15)

Note: Version bump only for package @​aws-sdk/client-s3

3.1068.0 (2026-06-12)

Note: Version bump only for package @​aws-sdk/client-s3

... (truncated)

Commits

• ee71adc Publish v3.1073.0
• 501cd33 Publish v3.1072.0
• 3ce820a Publish v3.1071.0
• 4f2cfe1 Publish v3.1070.0
• c555874 feat(client-s3): Added support for annotations. You can now attach up to 1000...
• 7058d13 Publish v3.1069.0
• 67981c5 chore(scripts): tuning the build graph (#8095)
• 0632f6d Publish v3.1068.0
• 0a3246f Publish v3.1067.0
• 4b11912 Publish v3.1066.0
• Additional commits viewable in compare view

Updates @aws-sdk/util-dynamodb from 3.996.2 to 3.996.5

Commits

• See full diff in compare view

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates eslint from 10.2.1 to 10.5.0

Release notes

Sourced from eslint's releases.

v10.5.0

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)
• 2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)
• 732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)
• f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)
• bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)
• c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

• 8ae1b5b docs: Update README (GitHub Actions Bot)
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)
• f99b47a docs: Update README (GitHub Actions Bot)
• acf03d4 docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)

Chores

• b18bf58 chore: update ecosystem plugins (#20959) (ESLint Bot)
• c2d1444 refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)
• 243b8c5 chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)
• 217b2a9 test: add unit tests for ParserService (#20949) (Taejin Kim)
• 72003e7 test: add location information to error messages in max-statements (#20945) (lumir)
• 7797c26 refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)
• 67c46fa chore: update ecosystem plugins (#20938) (ESLint Bot)
• 95d8c7a chore: update dependency @​eslint/json to v2 (#20934) (renovate[bot])
• cf9e496 chore: update @​arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)
• fb6d396 test: run type tests with TypeScript 7 (#20868) (sethamus)

v10.4.1

Bug Fixes

• e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930) (Francesco Trotta)
• d4ce898 fix: propagate failures from delegated commands (#20917) (Minh Vu)