build(deps): bump the npm group with 5 updates

[dependabot]

Bumps the npm group with 5 updates:

Package	From	To
@anthropic-ai/claude-agent-sdk	0.3.217	0.3.220
imapflow	1.4.8	1.5.0
undici	8.8.0	8.9.0
eslint	10.7.0	10.8.0
typescript	6.0.3	7.0.2

Updates @anthropic-ai/claude-agent-sdk from 0.3.217 to 0.3.220

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.220

What's changed

• Updated to parity with Claude Code v2.1.220

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.220
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.220
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.220
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.220

v0.3.219

What's changed

• Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort
• Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off
• Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session
• Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch
• Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands
• Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.219
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.219
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.219
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.219

v0.3.218

What's changed

• SkillToolOutput now reports background: true when a forked skill was dispatched as a detached background agent
• Fixed the result event's api_error_status reporting null for rate-limit and overloaded errors delivered mid-stream; it now reports 429/529
• Added canonicalModel and provider to each modelUsage entry in result messages so downstream billing can look up the correct rate table for costUSD

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.218
</tr></table> 

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.220

• Updated to parity with Claude Code v2.1.220

0.3.219

• Added opt-in cancel_queued to the interrupt control request (capability interrupt_cancel_queued_v1): cancels queued and pending-dispatch messages alongside the abort
• Added fast_mode_disabled_reason to result and init messages so SDK hosts can explain why fast mode is off
• Added DirectoryAdded lifecycle hook event to the control protocol, fired when a new working directory is registered mid-session
• Fixed the initialize response reporting fast_mode_state from the spawn-time model after a model switch
• Added sandbox.network.strictAllowlist to SDK settings types for deterministically denying non-allowlisted hosts in sandboxed commands
• Added workflowSizeGuideline to SDK settings types for setting the advisory dynamic-workflow size guideline

0.3.218

• SkillToolOutput now reports background: true when a forked skill was dispatched as a detached background agent
• Fixed the result event's api_error_status reporting null for rate-limit and overloaded errors delivered mid-stream; it now reports 429/529
• Added canonicalModel and provider to each modelUsage entry in result messages so downstream billing can look up the correct rate table for costUSD

Commits

• 71c804d chore: Update CHANGELOG.md
• c74106a chore: Update CHANGELOG.md
• dc71e7c chore: Update CHANGELOG.md
• See full diff in compare view

Updates imapflow from 1.4.8 to 1.5.0

Changelog

Sourced from imapflow's changelog.

1.5.0 (2026-07-23)

Features

• add STATUS SIZE/DELETED and rev2 BINARY fetch support, fix protocol bugs found in an RFC 9051 review (04f5bf6)

1.4.9 (2026-07-22)

Bug Fixes

• folder: pass StatusObject value instead of its boolean primitive (043e248)
• list: request subscription state inline and support IMAP4rev2 (93e899d)

Commits

• a2c0470 Merge pull request #370 from postalsys/release-please--branches--master--comp...
• a1dcfb2 docs: drop CodeQL references from CLAUDE.md [skip ci]
• fa1cfdb chore(master): release 1.5.0 [skip-ci]
• 04f5bf6 feat: add STATUS SIZE/DELETED and rev2 BINARY fetch support, fix protocol bug...
• 64ef7e6 ci: run the live IMAP4rev2 suite against Dovecot on linux/amd64 [skip ci]
• 9163206 Merge pull request #369 from postalsys/release-please--branches--master--comp...
• e726a37 docs: document ListTreeResponse.status and pin it with a regression test [ski...
• 4eee536 chore(master): release 1.4.9 [skip-ci]
• 043e248 Merge pull request #367 from CarelessInternet/master
• caa8368 test: fix a vacuous ESEARCH assertion in the rev2 live suite [skip ci]
• Additional commits viewable in compare view

Updates undici from 8.8.0 to 8.9.0

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in nodejs/undici#5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in nodejs/undici#5576
• fix: validate coerced header values for CRLF by @​mcollina in nodejs/undici#5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in nodejs/undici#5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in nodejs/undici#5583

New Contributors

• @​mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

Commits

• 21a8e1e Bumped v8.9.0 (#5589)
• 7d3cf92 fix: validate blob body content type
• c601fff fix(cache): harden cache directive parsing
• 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
• e11a68e fix(retry): reject partial content length mismatch
• 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
• 4fe5bc5 fix: handle empty qualified private cache directive
• 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
• a17e301 Ignore auto-generated .npmrc on Windows (#5583)
• a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
• Additional commits viewable in compare view

Updates eslint from 10.7.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: deps. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

The group that created this PR has been removed from your configuration.