Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 15 updates - #919

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-308302c11b
Open

chore(deps): bump the minor-and-patch group across 1 directory with 15 updates#919
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-308302c11b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 14 updates in the / directory:

Package From To
@grammyjs/ratelimiter 1.2.0 1.2.1
axios 1.18.0 1.19.0
canvas 3.0.0 3.2.3
invoices 6.0.5 6.1.0
lightning 12.2.4 12.2.5
nostr-tools 2.10.3 2.24.1
telegraf 4.8.0 4.16.3
winston 3.17.0 3.19.0
@types/node-schedule 2.1.7 2.1.8
@types/qrcode 1.5.5 1.5.6
@typescript-eslint/eslint-plugin 8.11.0 8.67.0
eslint-plugin-import 2.31.0 2.32.0
mocha 11.1.0 11.8.0
prettier 3.6.2 3.9.6

Updates @grammyjs/ratelimiter from 1.2.0 to 1.2.1

Commits
  • c2a6423 Update README.md to include keyPrefix
  • 5966cde Merge pull request #11 from slavafomin/main
  • fedf4c3 Fixed defaultOptions typing
  • 2462125 Removed extraneous undefined guard
  • 0d9a4ec Added keyPrefix option, plus some trivial fixes
  • b089ea9 Merge pull request #9 from grammyjs/2024
  • ad096a1 chore: update license year to 2024
  • 7a29c26 Merge pull request #8 from grammyjs/remove-charset
  • 7f1542e chore: remove charset option from tsconfig
  • See full diff in compare view

Updates axios from 1.18.0 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 311fcc5 chore(release): prepare release 1.19.0 (#11095)
  • cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
  • 004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
  • 122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
  • c44f8d0 ci: use bundled npm for v1 publish (#11083)
  • 878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
  • a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
  • 3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
  • 58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
  • 3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
  • Additional commits viewable in compare view

Updates canvas from 3.0.0 to 3.2.3

Release notes

Sourced from canvas's releases.

v3.2.3

Fixed

  • Fix building with gcc (#2559)

v3.2.2

Fixed

  • Fix dangling env pointer in image MIME data cleanup (#2550)
  • Fix ctx.direction not affected by ctx.save and ctx.restore
  • Preserve rest of PDF pages when changing width and height (#2538)
  • Several security fixes for untrusted inputs to getImageData and putImageData. Thanks to Ethan Kim for the report.

v3.2.1

3.2.1

  • Fix error message HTTP response status code in image src setter
  • roundRect() shape incorrect when radii were large relative to rectangle size (#2400)
  • Reject loadImage when src is null or invalid (#2304)
  • Fix compilation on GCC 15 by including <cstdint> (#2545)

v3.2.0

3.2.0

Added

  • Added ctx.lang to set the ISO language code for text

v3.1.2

3.1.2

Fixed

  • Fix crash when setting width/height on PDF, SVG canvas (#2520)

v3.1.1

3.1.1

This release also introduces arm64 prebuilds for Linux!

Fixed

  • Fix a crash when SVGs without width or height are loaded (#2486)
  • Fix fetching prebuilds during installation on certain newer versions of Node (#2497)
  • Fixed issue with fillText that was breaking subsequent fillText calls (#2171)
  • Fix svg rendering when the image is resized (#2498)
  • Fix measureText with direction rtl textAlign start/end
  • Fix a crash in Node 24, due to external memory API change (#2514)

v3.1.0

3.1.0

  • Replaced simple-get with Node.js builtin fetch (#2309)
  • ctx.font has a new C++ parser and is 2x-400x faster. Please file an issue if you experience different results, as caching has been removed.
  • The restriction of registering fonts before a canvas is created has been removed. You can now register a font as late as right before the fillText call (#1921)

... (truncated)

Changelog

Sourced from canvas's changelog.

3.2.3

Fixed

  • Fix building with gcc (#2559)

3.2.2

Fixed

  • Fix dangling env pointer in image MIME data cleanup (#2550)
  • Fix ctx.direction not affected by ctx.save and ctx.restore
  • Preserve rest of PDF pages when changing width and height (#2538)
  • Several security fixes for untrusted inputs to getImageData and putImageData. Thanks to Ethan Kim for the report.

3.2.1

  • Fix error message HTTP response status code in image src setter
  • roundRect() shape incorrect when radii were large relative to rectangle size (#2400)
  • Reject loadImage when src is null or invalid (#2304)
  • Fix compilation on GCC 15 by including (#2545)

3.2.0

Added

  • Added ctx.lang to set the ISO language code for text

3.1.2

Fixed

  • Fix crash when setting width/height on PDF, SVG canvas (#2520)

3.1.1

Fixed

  • Fix a crash when SVGs without width or height are loaded (#2486)
  • Fix fetching prebuilds during installation on certain newer versions of Node (#2497)
  • Fixed issue with fillText that was breaking subsequent fillText calls (#2171)
  • Fix svg rendering when the image is resized (#2498)
  • Fix measureText with direction rtl textAlign start/end
  • Fix a crash in Node 24, due to external memory API change (#2514)

3.1.0

Changed

  • Replaced simple-get with Node.js builtin fetch (#2309)
  • ctx.font has a new C++ parser and is 2x-400x faster. Please file an issue if you experience different results, as caching has been removed.
  • The restriction of registering fonts before a canvas is created has been removed. You can now register a font as late as right before the fillText call (#1921)

Added

  • Support for accessibility and links in PDFs
  • ctx.direction is implemented: 'rtl' or 'ltr' set the base direction of text

... (truncated)

Commits
  • f91598e v3.2.3
  • 1541544 PAGE_SIZE shouldn't be unsigned
  • ac82fa7 v3.2.2
  • 103a620 add the last flurry of commits to CHANGELOG
  • 7304c7a avoid integer overflow in getImageData
  • f9fcc5f avoid integer overflow in putImageData
  • 802a8ca avoid integer overflow in new ImageData
  • 9d1b478 wrap negative values passed to createImageData
  • 779483c bail early when setting zero-length image source
  • 22ed2b7 make canvas types unsigned
  • Additional commits viewable in compare view

Updates invoices from 6.0.5 to 6.1.0

Changelog

Sourced from invoices's changelog.

6.1.0

  • parsePaymentRequest: Add support for signet payment requests
Commits

Updates lightning from 12.2.4 to 12.2.5

Commits

Updates nostr-tools from 2.10.3 to 2.24.1

Commits
  • fed4a55 fix reconnection relay leakage and double onclose calls.
  • bd02fc3 pass the relay URL to verifyEvent() so trusted-relay policies can be implemen...
  • c66469d declare a missing type.
  • 05c2836 add favorite follow sets kind.
  • fa21fd6 replace ad-hoc regexes with isHex32().
  • 5852585 blossom: optimize hash extraction from url.
  • cbb1b96 subscribeMap's onClose is now called with {url, reason}[] instead of reason[].
  • b1406da blossom: send content-type header when uploading.
  • 514678b automatically closed unused relay connections after a while.
  • 21d11f1 export new modules to jsr.
  • Additional commits viewable in compare view

Updates telegraf from 4.8.0 to 4.16.3

Release notes

Sourced from telegraf's releases.

v4.16.3

  • Fix: bug with link_preview_options.url caused client to try sending it as media
  • Fix: add CommandContextExtn type to Composer::{start|help|settings} (adds ctx.command, payload, args)

v4.16.2

Fixed Context::text: was undefined if entities was undefined. Thanks to @​AnotiaWang.

v4.16.1

Fixed Context::from: now uses callbackQuery.from instead of msg.from

v4.16.0

Phew, what a feature-packed release! 🎉

*tsk tsk* There's a big announcement at the end of this release!

  • Support for API 7.0. Highlights are Reactions, Replies 2.0, Link Previews, Blockquotes, and Chat Boosts.
  • Support for API 7.1.
  • All methods and update types from these API versions are now fully supported.

  • To listen on reaction addition and removal, use Composer.reaction:

    bot.reaction("👍", (ctx) => {
  // user added a 👍 reaction
});
// prefix with - to listen to reaction removal
bot.reaction("-👍", (ctx) => {
// user removed a 👍 reaction
});

    This also just works with custom emoji IDs.

    bot.reaction("5368742036629364794", (ctx) => {
  // user added a reaction with the given custom emoji ID
});
bot.reaction("-5368742036629364794", (ctx) => {
// user removed a reaction with the given custom emoji ID
});

... (truncated)

Commits
  • c591338 chore: lint fix
  • a0f65f4 fix: includesMedia fix was incorrect
  • 0e3b59f ver: 4.16.3
  • 6a1d6cf fix: add CommandContextExtn to start, help, settings
  • b68b961 tempfix: except link_preview_options in includesMedia:
  • e881fa6 ver: 4.16.2
  • 7f2a081 fix: Context::text is undefined when message has only text but no entities ...
  • d180036 ver: 4.16.1
  • 5bb62ee fix: use callbackQuery.from instead of msg.from
  • 096dd01 merge: #1949 from telegraf/feat/api-7.0
  • Additional commits viewable in compare view

Updates winston from 3.17.0 to 3.19.0

Release notes

Sourced from winston's releases.

v3.19.0

  • Run npm audit fix e7ccdc4
  • Don&#39;t include jest.config.js in npm package 5a63c8c
  • fix: append error cause when using logger.child() (#2467) e74a7ae
  • Bump rimraf from 5.0.1 to 5.0.10 (#2517) 8a956fd
  • fix: ensure File transport flushes all data before emitting finish (#2594) 86c890f
  • Bump actions/setup-node from 4 to 6 (#2589) 3b8be02
  • Bump @​babel/core from 7.28.0 to 7.28.5 (#2591) f4c3e2c
  • Bump actions/checkout from 4 to 6 (#2593) dd7906e
  • chore: migrate test runner from mocha to jest (#2567) 2e9eb18

winstonjs/winston@v3.18.3...v3.19.0

v3.18.3

  • Update diagnostics dependency (removes fix-esm transitive dependency) a15a9e9

winstonjs/winston@v3.18.2...v3.18.3

v3.18.2

  • Bump diagnostics package to resolve #2583 (again) f4582c3

winstonjs/winston@v3.18.1...v3.18.2

v3.18.1

  • Bump diagnostics package to resolve #2583 e668c2c

winstonjs/winston@v3.18.0...v3.18.1

v3.18.0

  • Update diagnostics package to latest version to remove vulnerability 376e331
  • add @​initd.sg/winston-cloudwatch (#2532) 71ee92a
  • Update transports.md (#2549) 3547a95
  • docs: update transport.md (#2550) dc88db0
  • feat: adds helper function for highest log level (#2514) c69cdb0

winstonjs/winston@v3.17.0...v3.18.0

Commits

Updates @types/node-schedule from 2.1.7 to 2.1.8

Commits

Updates @types/qrcode from 1.5.5 to 1.5.6

Commits

Updates @typescript-eslint/eslint-plugin from 8.11.0 to 8.67.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

  • typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

  • typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
  • website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.67.0 (2026-08-10)

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.66.0 (2026-08-03)

🩹 Fixes

  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.65.0 (2026-07-20)

🚀 Features

  • eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
  • add warning when TS 7 is detected (#12529)
  • eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)
  • eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
  • eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)

❤️ Thank You

See GitHub Releases for more information.

... (truncated)

Commits
  • 20a261f chore(release): publish 8.67.0
  • 6dfe4d0 chore(eslint-plugin-internal): [plugin-test-formatting] enforce zero-indentat...
  • 3b155bb chore: use typescript 7 for typechecking (#12601)
  • e51b11b chore(release): publish 8.66.0
  • 20cb15e chore(eslint-plugin): split prefer-optional-chain.test.ts in multiple files (...
  • 780a8c5 docs(eslint-plugin): [member-ordering] add lacking commas in default member t...
  • 08dd427 fix(eslint-plugin): [class-literal-property-style] preserve type annotations ...
  • 6be25d3 fix(eslint-plugin): [no-unnecessary-type-parameters] check MappedType key rem...
  • 8826d0e fix(eslint-plugin): [no-useless-default-assignment] don't report defaults use...
  • 7aecc1c fix(eslint-plugin): [prefer-nullish-coalescing] handle shadowed Boolean calls...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​typescript-eslint/eslint-plugin since your current version.


Updates @typescript-eslint/parser from 8.11.0 to 8.67.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

  • typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

8.66.0 (2026-08-03)

🚀 Features

  • typescript-estree: handle import.defer() as ImportExpression (#12609)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
  • website: list onUnsupportedTypeScriptVersion in parser options (#12585)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.67.0 (2026-08-10)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.66.0 (2026-08-03)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.65.0 (2026-07-20)

🚀 Features

  • add warning when TS 7 is detected (#12529)
  • parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

... (truncated)

Commits
  • 20a261f chore(release): publish 8.67.0
  • 3b155bb chore: use typescript 7 for typechecking (#12601)
  • e51b11b chore(release): publish 8.66.0
  • 63ba81b chore(release): publish 8.65.0
  • eaf4576 feat: add warning when TS 7 is detected (#12529)
  • d8f1044 feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupport...
  • 0d06406 chore: add attw validation to repo (#12437)
  • c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
  • 414d9ab chore(release): publish 8.64.0
  • 290cf6c chore(release): publish 8.63.0
  • Additional commits viewable in

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 1…
3bf85f0 
…5 updates

Bumps the minor-and-patch group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@grammyjs/ratelimiter](https://github.com/grammyjs/rateLimiter) | `1.2.0` | `1.2.1` |
| [axios](https://github.com/axios/axios) | `1.18.0` | `1.19.0` |
| [canvas](https://github.com/Automattic/node-canvas) | `3.0.0` | `3.2.3` |
| [invoices](https://github.com/alexbosworth/invoices) | `6.0.5` | `6.1.0` |
| [lightning](https://github.com/alexbosworth/lightning) | `12.2.4` | `12.2.5` |
| [nostr-tools](https://github.com/nbd-wtf/nostr-tools) | `2.10.3` | `2.24.1` |
| [telegraf](https://github.com/telegraf/telegraf) | `4.8.0` | `4.16.3` |
| [winston](https://github.com/winstonjs/winston) | `3.17.0` | `3.19.0` |
| [@types/node-schedule](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node-schedule) | `2.1.7` | `2.1.8` |
| [@types/qrcode](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/qrcode) | `1.5.5` | `1.5.6` |
| [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.11.0` | `8.67.0` |
| [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) | `2.31.0` | `2.32.0` |
| [mocha](https://github.com/mochajs/mocha) | `11.1.0` | `11.8.0` |
| [prettier](https://github.com/prettier/prettier) | `3.6.2` | `3.9.6` |



Updates `@grammyjs/ratelimiter` from 1.2.0 to 1.2.1
- [Commits](grammyjs/ratelimiter@v1.2.0...v1.2.1)

Updates `axios` from 1.18.0 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.0...v1.19.0)

Updates `canvas` from 3.0.0 to 3.2.3
- [Release notes](https://github.com/Automattic/node-canvas/releases)
- [Changelog](https://github.com/Automattic/node-canvas/blob/master/CHANGELOG.md)
- [Commits](Automattic/node-canvas@v3.0.0...v3.2.3)

Updates `invoices` from 6.0.5 to 6.1.0
- [Changelog](https://github.com/alexbosworth/invoices/blob/master/CHANGELOG.md)
- [Commits](https://github.com/alexbosworth/invoices/commits)

Updates `lightning` from 12.2.4 to 12.2.5
- [Changelog](https://github.com/alexbosworth/lightning/blob/master/CHANGELOG.md)
- [Commits](https://github.com/alexbosworth/lightning/commits)

Updates `nostr-tools` from 2.10.3 to 2.24.1
- [Release notes](https://github.com/nbd-wtf/nostr-tools/releases)
- [Commits](nbd-wtf/nostr-tools@v2.10.3...v2.24.1)

Updates `telegraf` from 4.8.0 to 4.16.3
- [Release notes](https://github.com/telegraf/telegraf/releases)
- [Commits](telegraf/telegraf@v4.8.0...v4.16.3)

Updates `winston` from 3.17.0 to 3.19.0
- [Release notes](https://github.com/winstonjs/winston/releases)
- [Changelog](https://github.com/winstonjs/winston/blob/master/CHANGELOG.md)
- [Commits](winstonjs/winston@v3.17.0...v3.19.0)

Updates `@types/node-schedule` from 2.1.7 to 2.1.8
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node-schedule)

Updates `@types/qrcode` from 1.5.5 to 1.5.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/qrcode)

Updates `@typescript-eslint/eslint-plugin` from 8.11.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.11.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/parser)

Updates `eslint-plugin-import` from 2.31.0 to 2.32.0
- [Release notes](https://github.com/import-js/eslint-plugin-import/releases)
- [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md)
- [Commits](import-js/eslint-plugin-import@v2.31.0...v2.32.0)

Updates `mocha` from 11.1.0 to 11.8.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.8.0/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.1.0...v11.8.0)

Updates `prettier` from 3.6.2 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.6.2...3.9.6)

---
updated-dependencies:
- dependency-name: "@grammyjs/ratelimiter"
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: canvas
  dependency-version: 3.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: invoices
  dependency-version: 6.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lightning
  dependency-version: 12.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: nostr-tools
  dependency-version: 2.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: telegraf
  dependency-version: 4.16.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: winston
  dependency-version: 3.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/node-schedule"
  dependency-version: 2.1.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/qrcode"
  dependency-version: 1.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint-plugin-import
  dependency-version: 2.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mocha
  dependency-version: 11.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants