Repository navigation
deps(npm): bump typescript-eslint from 8.67.0 to 8.70.0 - #1780
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) from 8.67.0 to 8.70.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: typescript-eslint dependency-version: 8.70.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
|
Superseded by the reviewed dependency batch #1786, which includes this update (soak + upstream review recorded there). Closing in favor of that PR. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/typescript-eslint-8.70.0
branch
September 16, 2026 10:46
nadaverell
added a commit
that referenced
this pull request
Sep 16, 2026
…-eslint 8.70, +6) (#1786) ## Summary One evidence-backed dependency PR replacing this week's open Dependabot PRs. Every included version was published at least 72 hours before screening, was reviewed against upstream release notes / commit ranges, and was judged by how Radar actually uses the package. Dependency-only: no application source changes. **Screening time:** 2026-09-16T10:11:50Z · **72-hour cutoff:** 2026-09-13T10:11:50Z ## Included | Dependabot PR | Dependency | Old → New | Published (UTC) | Soak | Risk conclusion | |---|---|---|---|---|---| | #1779 | `react`, `react-dom`, `@types/react`, `@types/react-dom` | 19.2.8 / 19.2.18 / 19.2.3 → **19.3.0** (+ `scheduler` 0.27→0.28) | 2026-09-09 17:17–18:08 | 6.7d | Minor with new opt-in APIs (ViewTransition, Fragment refs, `browser()`) Radar doesn't use. Behavioral changes reviewed: independent transition rendering (Radar uses `useDeferredValue` in ResourcesView / log search — full suites pass), Trusted Types integration (Radar sets no Trusted Types CSP), `resize` batching / form `submitter` / `type=number` defaultValue (no affected call sites). No upstream regressions filed against client-only usage since release. **Dependabot's PR only bumped `react`; react-dom must move in lockstep** (`ensureCorrectIsomorphicReactVersion` hard-fails otherwise — that was its CI failure). | | #1781 | `@vitejs/plugin-react` | 6.1.0 → 6.1.1 | 2026-08-28 | 19d | Only change is React Compiler diagnostics logging (`compiler.logDiagnostics`) + a `builder.sharedPlugins` sourcemap fix. Radar's Vite config uses `react()` with no compiler. | | #1780 | `typescript-eslint` (+ all `@typescript-eslint/*`, nested `ignore` 7.0.6→7.0.9) | 8.67.0 → 8.70.0 | 2026-09-07 | 8.7d | 8.68–8.70: rule fixes + one new rule not in `recommended`. Before/after `npm run lint` in `web/` is identical: 365 warnings, 0 errors (before = `main@77a4a2f` CI). `ignore` changes are gitignore-pattern parsing fixes. | | #1778 | `@fontsource-variable/dm-sans` | 5.2.8 → 5.3.0 | 2026-07-19 | 59d | Tarball diff: font files and `index.css` byte-identical; only adds `index.d.css.ts` + `types` export. Visually inert. | | #1777 | `golang.org/x/net` (+ `x/sync` 0.23.0, `x/text` 0.42.0, `x/crypto` 0.57.0, `x/mod` 0.41.0 via MVS) | 0.58.0 → 0.59.0 | 2026-09-08 (all ≤ 2026-09-08) | ≥7.6d | Radar imports only `x/net/http/httpguts` (no commits in range); `http2` is used transitively by client-go — changes are `Transport`/`Server` deprecation notes, IDNA lookup for non-ASCII hosts, http3/quic fixes. `x/sync`: `semaphore` negative-capacity panic (Radar uses only `singleflight`/`errgroup`). `x/crypto`: ssh/acme fixes (unused by Radar). `x/mod`: sumdb auth-bypass fix. All require `go 1.26.0`, which Radar already is. | | #1775 | `golang.org/x/term` | 0.45.0 → 0.46.0 | 2026-09-08 | 7.7d | Single commit: `Terminal.ReadLine` now surfaces a read error after processing the bytes returned with it. | | #1774 | `golang.org/x/oauth2` | 0.36.0 → 0.37.0 | 2026-08-25 | 21d | Single change in `google/`: GCE metadata path `universe/universe_domain` → `universe/universe-domain`. Radar's OIDC code uses the core package only. | | #1773 | `github.com/prometheus/client_model` | 0.6.2 → 0.6.3 | 2026-08-31 | 16d | Only Go-visible change is a comment edit in `metrics.proto`; rest is repo tooling. | | #1709 | `baseline-browser-mapping` (transitive of browserslist) | 2.10.38 → 2.11.21 | 2026-09-03 | 12.7d | Data-only package; Radar has no browserslist query so it's never consulted. 2.11.0 also fixed CVE-2026-45819. **Pinned explicitly** — `npm update` would float to 2.11.24 (2026-09-15, unsoaked). | ## Excluded / held - **#1776 `github.com/modelcontextprotocol/go-sdk` 1.6.1 → 1.8.0 — excluded, needs a Radar source change.** Its Backend CI fails `TestInvestigationHandlerAnnotatesRealToolCallWithoutChangingPublicContract` ("private mount handshake did not mark the scope connected"). Root cause: v1.7.0 implements protocol `2026-07-28`, which drops the `initialize` handshake in favor of `server/discover`; stateless handlers negotiate it, and `investigationEvidenceReferenceMiddleware` (`internal/mcp/server.go`) only marks the scope connected on `initialize` / `tools/list`. Also worth noting for the follow-up: 1.7 stateless servers ignore `Mcp-Session-Id` entirely and 1.8 changes the stateful rejection body and cancel-notify semantics. Independently, its GitHub Release was only published 2026-09-14 (<72h) even though the tag is older. Left open. ## Graph movement beyond the PR titles - `scheduler` 0.27.0 → 0.28.0 — `react-dom` 19.3.0's pinned dependency, published in the same release (2026-09-09). - `golang.org/x/{sync,text,crypto,mod}` — pulled by `x/net` 0.59.0's `go.mod`; each reviewed above. Identical to the set Dependabot's #1777 produced. - `pkg/go.mod` (separately-versioned shared module) is untouched: no Dependabot PR targeted it and the root `replace` means the root build already uses the root versions. Full resolved-graph diffs (`go list -m all`, lockfile package list) contain exactly the entries above — no other churn. ## Verification - `make tsc` ✓ - `make test` (Go, `-v ./...`) — 40 packages ok, 0 failed - `web/`: vitest 108 files / 1254 tests ✓ · `packages/k8s-ui/`: 189 files / 3763 tests ✓ (1 pre-existing skip) - `node --test scripts/workload-metrics-demo/capture.test.mjs` ✓ · `cd pkg && go test ./...` ✓ - `make build` ✓ (frontend + embed + binary) - `go mod verify` — all modules verified · `git diff --check` clean · worktree clean after build - `web/` lint before/after: 365 warnings / 0 errors both sides - visual-test: **skipped** — React 19.3's runtime changes are covered by the 5,000+ rendering tests across both suites and the production build; no rendered surface in Radar changes by design (fonts byte-identical, no new components). Happy to run one on request before merge. ## Upstream references - React 19.3.0: https://github.com/facebook/react/releases/tag/v19.3.0 - @vitejs/plugin-react 6.1.1: https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-react%406.1.1 - typescript-eslint: https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 · v8.69.0 · v8.70.0 - x/net: golang/net@v0.58.0...v0.59.0 · x/term: golang/term@v0.45.0...v0.46.0 · x/oauth2: golang/oauth2@v0.36.0...v0.37.0 · x/crypto: golang/crypto@v0.55.0...v0.57.0 · x/mod: golang/mod@v0.39.0...v0.41.0 · x/sync: golang/sync@v0.22.0...v0.23.0 · x/text: golang/text@v0.41.0...v0.42.0 - client_model: prometheus/client_model@v0.6.2...v0.6.3 - baseline-browser-mapping 2.11.0: https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0 - go-sdk (excluded): https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0 · https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0 Supersedes #1779, #1781, #1780, #1778, #1777, #1775, #1774, #1773, #1709 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Lockfile and manifest bumps only; excluded packages like MCP go-sdk were not upgraded, limiting exposure to reviewed minor/patch releases. > > **Overview** > This PR is **dependency-only**: it updates lockfiles and `package.json` / `go.mod` manifests with **no application source changes**. > > **Go** bumps include `golang.org/x/net` (0.58→0.59) with related MVS pulls (`x/sync`, `x/text`, `x/crypto`, `x/mod`), plus `x/oauth2`, `x/term`, and `prometheus/client_model`. > > **Frontend** moves **`react` / `react-dom` and matching `@types/*` to 19.3.0** (with `scheduler` 0.28 via `react-dom`) in both `web/` and `packages/k8s-ui`. Dev tooling updates cover **`typescript-eslint` 8.67→8.70**, **`@vitejs/plugin-react` 6.1.1**, and **`@fontsource-variable/dm-sans` 5.3.0**. The root **`package-lock.json`** also refreshes transitive entries such as **`baseline-browser-mapping`**. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1e036fe. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps typescript-eslint from 8.67.0 to 8.70.0.
Release notes
Sourced from typescript-eslint's releases.
... (truncated)
Changelog
Sourced from typescript-eslint's changelog.
Commits
7ee7608chore(release): publish 8.70.04586535fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...9a6e546chore(release): publish 8.69.08f4e00achore(release): publish 8.68.055f6d5dchore: enable source maps (#12677)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Dev-only lint toolchain bump with no runtime or config edits; minor risk of new or changed ESLint rule behavior on upgrade.
Overview
Bumps the
typescript-eslintdev dependency inweb/package.jsonfrom 8.67.0 to 8.70.0, with matching lockfile updates for the@typescript-eslint/*packages and nestedignore(7.0.6 → 7.0.9).There are no application or ESLint config source changes—only dependency resolution. CI/local
npm run lintinwebwill use the newer plugin/parser stack (including upstream fixes such asmember-ordering,no-unnecessary-condition, and clearerparserOptions.projecterrors).Reviewed by Cursor Bugbot for commit 5f77059. Bugbot is set up for automated code reviews on this repo. Configure here.