chore(deps): bump the major-deps-updates-main group across 1 directory with 6 updates

[dependabot]

Bumps the major-deps-updates-main group with 6 updates in the / directory:

Package	From	To
@toon-format/toon	2.3.0	4.0.0
puppeteer-core	24.43.1	25.3.0
@release-it/conventional-changelog	10.0.6	11.0.1
eslint	9.39.4	10.7.0
release-it	19.2.4	20.2.1
typescript	5.9.3	7.0.2

Updates @toon-format/toon from 2.3.0 to 4.0.0

Release notes

Sourced from @​toon-format/toon's releases.

v4.0.0

   🚨 Breaking Changes

• Remove key folding and path expansion  -  by @​johannschopplich (46956)

   🚀 Features

• Decode-side comment lines with encoder quoting of #-leading strings  -  by @​johannschopplich (13561)
• Nested field groups in tabular headers  -  by @​johannschopplich (128fc)
• Keyed tabular form for objects of uniform objects  -  by @​johannschopplich (68464)
• decode: Reject indentation depth jumps in strict mode  -  by @​johannschopplich (6db88)

   🐞 Bug Fixes

• decode:
  • Prevent false array header detection for unquoted keys c…  -  by @​rayriffy in toon-format/toon#314 (13360)
  • Trim value tokens by U+0020 only  -  by @​johannschopplich (fea26)
  • Reject over-indented orphan lines and trailing root content in strict mode  -  by @​johannschopplich (4489d)
  • Treat a trailing carriage return as part of the line terminator  -  by @​johannschopplich (9562c)
  • Reject keyless headers outside root and list-item positions  -  by @​johannschopplich (1560d)
  • Reject inline content after fields-bearing headers  -  by @​johannschopplich (06bd0)
• encode:
  • Quote leading-plus numeric-like strings  -  by @​johannschopplich (b769d)

    View changes on GitHub

v2.3.1

   🐞 Bug Fixes

• Harden encode and decode against prototype pollution  -  by @​ckorhonen in toon-format/toon#316 (94a2b)
• decode:
  • Slice key-value rest at key token end offset  -  by @​johannschopplich (70230)
  • Treat quoted spans as opaque in line classification  -  by @​johannschopplich (9024a)

    View changes on GitHub

Commits

• f5f428e chore: release v4.0.0
• a960357 docs(reference): update spec working draft date to v4 release
• 8163b2b chore: consume published @toon-format/spec 4.0.0
• 3deb0b8 ci: drop redundant NPM_TOKEN (publishing via OIDC)
• 06bd025 fix(decode): reject inline content after fields-bearing headers
• 1c411c5 docs: adopt the Ada and Bob example canon and add nested field groups to the ...
• aef2211 test: cover carriage-return stripping on the streaming decode path
• 1560d50 fix(decode): reject keyless headers outside root and list-item positions
• 9562cfc fix(decode): treat a trailing carriage return as part of the line terminator
• 34aef94 chore: link local spec checkout for fixture development
• Additional commits viewable in compare view

Updates puppeteer-core from 24.43.1 to 25.3.0

Release notes

Sourced from puppeteer-core's releases.

puppeteer-core: v25.3.0

25.3.0 (2026-07-01)

🎉 Features

• support installing extensions for browser contexts (#15164) (118d84d)

🛠️ Fixes

• handle swaps without a timer (#15198) (2356a15)
• normalize duplicate set-cookie headers using newline (#15173) (55787d5)
• roll to Firefox 152.0.3 (#15158) (2d64852)
• roll to Firefox 152.0.4 (#15195) (d382a21)

📄 Documentation

• fix the typos on documentation (#15167) (ab74e6a)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.0.5 to 3.0.6

puppeteer-core: v25.2.1

25.2.1 (2026-06-24)

🛠️ Fixes

• regression when using Puppeteer with untrusted sessions (#15150) (801c212)
• roll to Firefox 152.0.2 (#15153) (d2908b2)

puppeteer-core: v25.2.0

25.2.0 (2026-06-22)

🎉 Features

• add page locale emulation (#15075) (c528f65)
• add waitForFunction to webWorkers (#15100) (0bdfa77)
• allow extensions to run over websockets (#15059) (b84d8a1)
• roll to Chrome 150.0.7871.24 (#15126) (b74ed1c)
• roll to Firefox 152.0 (#15125) (87be906)

... (truncated)

Changelog

Sourced from puppeteer-core's changelog.

25.3.0 (2026-07-01)

♻️ Chores

• puppeteer: Synchronize puppeteer versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.0.5 to 3.0.6

🎉 Features

• support installing extensions for browser contexts (#15164) (118d84d)

🛠️ Fixes

• handle swaps without a timer (#15198) (2356a15)
• normalize duplicate set-cookie headers using newline (#15173) (55787d5)
• roll to Firefox 152.0.3 (#15158) (2d64852)
• roll to Firefox 152.0.4 (#15195) (d382a21)

📄 Documentation

• fix the typos on documentation (#15167) (ab74e6a)

25.2.1 (2026-06-24)

♻️ Chores

• puppeteer: Synchronize puppeteer versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • puppeteer-core bumped from 25.2.0 to 25.2.1

🛠️ Fixes

... (truncated)

Commits

• 58d9b02 chore: release main (#15165)
• d382a21 fix: roll to Firefox 152.0.4 (#15195)
• 2356a15 fix: handle swaps without a timer (#15198)
• 537232e chore(webmcp): Clean unnecessary Protocol interfaces (#15199)
• ab74e6a docs: fix the typos on documentation (#15167)
• 9560bcf chore(deps-dev): bump the dev-dependencies group across 1 directory with 20 u...
• 04a9587 refactor: extract zip archives with yauzl instead of CLI tools (#15085)
• 54143a6 chore: fix the typos on the code test and API documentation (#15169)
• 55787d5 fix: normalize duplicate set-cookie headers using newline (#15173)
• 118d84d feat: support installing extensions for browser contexts (#15164)
• Additional commits viewable in compare view

Updates @release-it/conventional-changelog from 10.0.6 to 11.0.1

Release notes

Sourced from @​release-it/conventional-changelog's releases.

Release 11.0.1

• Restore no-preset fallback to prevent whatBump error (636c254fd1df5c4858d9ab48d1e1c13a1f24412a)
• Bump tmp from 0.2.5 to 0.2.6 (#145) (ce9a599e2762247bc8c71143214ab1cc6c162489) - thanks @​dependabot[bot]!
• Update dependencies (063b6af211b095465490e5b1c801955c7d25e72e)
• Derive tag prefix from resolved tag for recommended bump (resolve #80) (8947320a51403c8eaf47eebad8d3cef637cc3279)
• Document transform override and parseCommits resolution (resolve #78, resolve #137) (f3461f1ed7133bb70022ae4e6dbdd011f6d4641d)
• Run tests on Node 26 (74812985412d061d39352071a0c04666e25c61c5)

Release 11.0.0

• Fix repository.url (23d3d9cd50fdb4475b8736273a776541833862c0)
• docs: fix broken links and remove outdated override warning (#138) (344bad3bf2f90618a86d3e38883a5d5eff12aaf1) - thanks @​aarondpn!
• fix: support release-it 20 (#142) (043242693e5c88244a25fbcf0dceafcbf955588f) - thanks @​twk3!
• Update dependencies & bump engines.node (1b746e6b5a26335cf01c314074dcf7e291c260a0)

Commits

• 82f88c9 Release 11.0.1
• 7481298 Run tests on Node 26
• f3461f1 Document transform override and parseCommits resolution (resolve #78, resolve...
• 8947320 Derive tag prefix from resolved tag for recommended bump (resolve #80)
• 063b6af Update dependencies
• ce9a599 Bump tmp from 0.2.5 to 0.2.6 (#145)
• 636c254 Restore no-preset fallback to prevent whatBump error
• 981e7b0 Release 11.0.0
• 1b746e6 Update dependencies & bump engines.node
• 0432426 fix: support release-it 20 (#142)
• Additional commits viewable in compare view

Updates eslint from 9.39.4 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

... (truncated)

Commits

• fabd99b 10.7.0
• 37c5e75 Build: changelog update for 10.7.0
• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076)
• 81a4774 chore: updates for v9.39.5 release
• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071)
• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032)
• c30d808 docs: Update README
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067)
• Additional commits viewable in compare view

Updates release-it from 19.2.4 to 20.2.1

Release notes

Sourced from release-it's releases.

Release 20.2.1

• Document the draft flow for GitHub immutable releases (284e63c6d2022eaf87f9fa66373ca6ad6a942ea0)
• Resolve dependency security alerts (3156203b614039b4e4cf63b1d4addb409606527f)

Release 20.2.0

• Print staged-packages approval URL after stage publish (244d8112498d7283f6bdcfd25d487ecc833aff03)
• Capture the stage id for the approval message (2476065893cfe3421cf54c02d73d280c8192b41d)

Release 20.1.0

• feat: add --quiet flag to hide release previews (#1274) (ecefe4407351bc74a85e88355a2772ea8fb22396) - thanks @​Yeom-JinHo!
• fix: ensure release body is an empty string instead of null (#1303) (5cc5ebd284673cb67b7897c3bd36c3ace6d54880) - thanks @​driiftkiing!
• Add 'Accept-Encoding' header to GitLab API requests (#1301) (14a478e4c1db309a04babe7060f0d95fb2879134) - thanks @​KlausDerKleber!
• Support npm staged publishing (npm.stage) (aa20f56587f0f5720e684d6b1d6b9bc594b3876e)
• Run tests on Node 26 (29f079bf8a515f1fced7bde05902183b1e990b2d)
• Use draft flow for immutable releases with assets (resolve #1295) (c63b4e46710564edf809ea688d12ecc4abc39d33)
• Publish interactively under --only-version so passkey 2FA works (resolve #1234) (4ebb66ebc6cee1b5352aa0fdafc0fa80ad568645)
• Format docs/npm.md (a2a262c524a14b040aa9cc50f3ea45f2e4ac78e3)
• Dogfoodin' (0cb51a9c85cc7e91db57c251e216664197639565)

Release 20.0.1

• fix: allow false as npm config value in types (#1289) (f783e825944cf8114305606116ca61542f0031c6) - thanks @​ahippler!
• Bump actions/checkout from 5 to 6 (#1262) (19921fc2429b314912a139f66ed43ca12475ffd3) - thanks @​dependabot[bot]!
• fix: Replace @​nodeutils/defaults-deep with defu for deep-default merging (#1297) (8616a216ccf2be474732b1aefbe47dce0e6b4eb0) - thanks @​rajnsunny!
• Update dependencies (bee31380a2bbdda7aeaffe7658a3900290a1a181)

Release 20.0.0

• fix: remove leading slashes from owner (#1288) (5585b720e9389fa857ba50f86161245ccb3b9589) - thanks @​driiftkiing!
• Fix write: false guard in npm.bump (resolve #1267) (a2d1b99bfe52fff1b6768f904cae5c4aaa78cfb1)
• Format (f427a85758999073a5ea4f666c6ddb4cd5586d61)

Release 20.0.0-1

• Fix test (56cae4cd441e00a58d3d91fbc15b1503d423a775)
• Update changelog & docs for v20 (509e50b043003f8adf3f347af949819e2954b639)
• Improve guessPreReleaseTag → getRegistryDistTags (a62509e6c7374e3d6898b17ae9ec8c365296fe64)

Release 20.0.0-0

• fix: upgrade undici from 6.23.0 to 7.24.3 to resolve security vulnerabilities (#1285) (cd100eb1368d084f5892a9a2bbad0c14d511125e) - thanks @​nbouvrette!
• Fix Logger.info() on Node.js 25 (#1284) (dcc0b43fc6bb693b3ec176cd8d77bbb40f454164) - thanks @​bidord!
• Update proxy-agent to fix DEP0169 (#1287) (c660ef5f34536988abd203807f53ec3ea5c1c742) - thanks @​risantos!
• Update dependencies (9dc313e29e617af912ace05a5aaa5cc34fdf35a3)
• Fix lint issues (a0522ff8777fc6877bf03f5f441e33561c9dc25b)
• Bump engines.node (5654b9badae6dd08a3d654772d2f280f6b1d84c3)
• Don't roll back if isReleased is set (resolve #1281) (f2a31231f587cb4809415f4eae81a99617177341)
• Fix if not running test using npm (332f40536ec32bbd816f9872bb89bc864ee66136)
• Migrate to @​inquirer/prompts (resolve #1260) (6c21e95c9188e88d41bb30840672cbd5fe99f5b6)
• Pop it (c90c4c97e11da8f90b398f045e5337f8ec5e0439)

Changelog

Sourced from release-it's changelog.

Changelog

This document lists breaking changes for each major release.

See the GitHub Releases page for detailed changelogs: [https://github.com/release-it/release-it/releases][1]

v20 (2026-03-24)

• Upgraded undici from v6 to v7 to resolve security vulnerabilities.
• Upgraded proxy-agent from v6 to v7 to fix DEP0169 (url.parse() deprecation).
• Migrated from deprecated inquirer to @inquirer/prompts.
• Bumped engines.node to minimum Node.js v20.19.0 (was v20.12.0).

v19 (2025-04-18)

• No breaking changes (dependency party)

v18 (2025-01-06)

• Removed support for Node.js v18.

v17 (2023-11-11)

• Removed support for Node.js v16.

v16 (2023-07-05)

• Removed support for Node.js v14.

v15 (2022-04-30)

• Removed support for Node.js v10 and v12.
• Removed support for GitLab v12.4 and lower.
• Removed anonymous metrics (and the option to disable it).
• Programmatic usage and plugins only through ES Module syntax (import)

Use release-it v14 in legacy environments.

v14 (2020-09-03)

• Removed global property from plugins. Use this.config[key] instead.
• Removed deprecated npm.access option. Set this in package.json instead.

v13 (2020-03-07)

• Dropped support for Node v8
• Dropped support for GitLab v11.6 and lower.
• Deprecated scripts are removed (in favor of [hooks][2]).
• Removed deprecated --non-interactive (-n) argument. Use --ci instead.
• Removed old %s and [REV_RANGE] syntax in command substitutions. Use ${version} and ${latestTag} instead.

... (truncated)

Commits

• 23b18df Release 20.2.1
• 3156203 Resolve dependency security alerts
• 284e63c Document the draft flow for GitHub immutable releases
• 3217e49 Release 20.2.0
• 2476065 Capture the stage id for the approval message
• 244d811 Print staged-packages approval URL after stage publish
• 5a105f3 Release 20.1.0
• 0cb51a9 Dogfoodin'
• a2a262c Format docs/npm.md
• 4ebb66e Publish interactively under --only-version so passkey 2FA works (resolve #1234)
• Additional commits viewable in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions