chore(deps): Bump the all group across 1 directory with 8 updates

[dependabot]

Bumps the all group with 8 updates in the /cdk directory:

Package	From	To
@guardian/cdk	63.3.1	64.1.0
@types/node	25.9.1	26.1.1
@typescript-eslint/eslint-plugin	8.60.0	8.64.0
@eslint/js	9.39.4	10.0.1
@guardian/eslint-config	15.0.0	16.0.0
prettier	3.8.3	3.9.5
eslint	9.39.4	10.7.0
typescript	6.0.3	7.0.2

Updates @guardian/cdk from 63.3.1 to 64.1.0

Release notes

Sourced from @​guardian/cdk's releases.

v64.1.0

Minor Changes

• c038df4: Adds deterministic routing rules for EC2 to ECS migrations.

  Allow callers to force a request to a specific target group using an HTTP header rather than relying on the default weighted routing.

  Example usage:

  curl -i -H 'X-Gu-Target-Group: ecs' https://cdk-playground.code.dev-gutools.co.uk
  

v64.0.0

Major Changes

• d880b52: Implement GuParameterStoreReadPolicy as a singleton to support GuLoadBalancedAppExperimental instantiating it once for the EC2 app and once for the ECS app. The result is a single AWS::IAM::Policy resource in the CloudFormation template, which is attached to both the EC2 and ECS roles, keeping the diff small.

  A GitHub search shows GuParameterStoreReadPolicy is never directly instantiated by clients.

• 348cc70: Removes the roleConfiguration property when instantiating a GuEc2App or GuLoadBalancedAppExperimental in favour of declaring additionalPolicies as a top level property. As a consequence, it is no longer possible to opt-out of log shipping with withoutLogShipping; the IAM Policy will always grant PutRecord to the account's logging Kinesis stream.

  To migrate, remove the roleConfiguration property and move any policies declared in roleConfiguration.additionalPolicies to the top level additionalPolicies property:

  // Before
  new GuEc2App(this, {
    // other props
    roleConfiguration: {
      additionalPolicies: [
        new GuAllowPolicy(this, "AllowPolicyCloudwatchLogs", {
          actions: ["cloudwatch:*", "logs:*"],
          resources: ["*"],
        }),
        new GuAllowPolicy(this, "AllowPolicyDescribeDecryptKms", {
          actions: ["kms:Decrypt", "kms:DescribeKey"],
          resources: [`arn:aws:kms:${region}:${account}:FrontendConfigKey`],
        }),
      ],
    },
  });
  // After
  new GuEc2App(this, {
  // other props
  additionalPolicies: [
  new GuAllowPolicy(this, "AllowPolicyCloudwatchLogs", {

... (truncated)

Changelog

Sourced from @​guardian/cdk's changelog.

64.1.0

Minor Changes

• c038df4: Adds deterministic routing rules for EC2 to ECS migrations.

  Allow callers to force a request to a specific target group using an HTTP header rather than relying on the default weighted routing.

  Example usage:

  curl -i -H 'X-Gu-Target-Group: ecs' https://cdk-playground.code.dev-gutools.co.uk
  

64.0.0

Major Changes

• d880b52: Implement GuParameterStoreReadPolicy as a singleton to support GuLoadBalancedAppExperimental instantiating it once for the EC2 app and once for the ECS app. The result is a single AWS::IAM::Policy resource in the CloudFormation template, which is attached to both the EC2 and ECS roles, keeping the diff small.

  A GitHub search shows GuParameterStoreReadPolicy is never directly instantiated by clients.

• 348cc70: Removes the roleConfiguration property when instantiating a GuEc2App or GuLoadBalancedAppExperimental in favour of declaring additionalPolicies as a top level property. As a consequence, it is no longer possible to opt-out of log shipping with withoutLogShipping; the IAM Policy will always grant PutRecord to the account's logging Kinesis stream.

  To migrate, remove the roleConfiguration property and move any policies declared in roleConfiguration.additionalPolicies to the top level additionalPolicies property:

  // Before
  new GuEc2App(this, {
    // other props
    roleConfiguration: {
      additionalPolicies: [
        new GuAllowPolicy(this, "AllowPolicyCloudwatchLogs", {
          actions: ["cloudwatch:*", "logs:*"],
          resources: ["*"],
        }),
        new GuAllowPolicy(this, "AllowPolicyDescribeDecryptKms", {
          actions: ["kms:Decrypt", "kms:DescribeKey"],
          resources: [`arn:aws:kms:${region}:${account}:FrontendConfigKey`],
        }),
      ],
    },
  });
  // After
  new GuEc2App(this, {
  // other props

... (truncated)

Commits

• f66ea01 Merge pull request #2936 from guardian/changeset-release/main
• d6567a7 Bump package version
• ad63bc5 Merge pull request #2933 from guardian/jb/route-deterministically-to-ecs-or-ec2
• c038df4 Add changeset
• aa74b5d Simplify and be opinionated about headers and values ec2/ecs
• 56835df Deterministic routing enabled by default in weighted routing scenario
• b7b1e55 Add ability to deterministically route requests to EC2 or ECS
• 3f6ac8b chore(deps): bump @​types/node from 22.15.30 to 26.1.0 (#2926)
• be22559 Merge pull request #2930 from guardian/changeset-release/main
• 978f09f Bump package version
• Additional commits viewable in compare view

Updates @types/node from 25.9.1 to 26.1.1

Commits

• See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.60.0 to 8.64.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

• support parsing import defer (#12513)
• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
• scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kristjan @​KristjanTammekivi
• Michael Naumov @​mnaoumov
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

8.62.1 (2026-06-29)

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.64.0 (2026-07-13)

🚀 Features

• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kristjan @​KristjanTammekivi
• Michael Naumov @​mnaoumov
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.62.1 (2026-06-29)

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365)

... (truncated)

Commits

• 414d9ab chore(release): publish 8.64.0
• bcfe16f feat(eslint-plugin): [no-loop-func] support using / await using declarati...
• 5b5bfde fix(eslint-plugin): [require-array-sort-compare] handle constrained arrays (#...
• 321856c chore: cleanup cspell config (#12526)
• b418cf5 feat(typescript-estree): throw for invalid definite assignment in class prope...
• 737de2b docs: align unified-signatures correct example parameter (#12506)
• a63c17a docs: fix shadowed parameter name in unified-signatures example (#12502)
• 290cf6c chore(release): publish 8.63.0
• 8d8fda6 feat(eslint-plugin): [no-misused-promises] detect async usage of a sync dispo...
• fec4f4f fix(eslint-plugin): [no-base-to-string] don't flag a shadowed String() call (...
• Additional commits viewable in compare view

Updates @eslint/js from 9.39.4 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

• c87d5bd fix: update eslint (#20531) (renovate[bot])
• d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
• 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
• 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

• 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
• 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
• b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

• e5c281f chore: updates for v9.39.3 release (Jenkins)
• 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
• 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
• 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
• da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
• 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

• f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
• a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
• c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
• fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
• 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
• 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
• ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
• 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
• c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
• 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
• a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
• a89059d feat!: Program range span entire source text (#20133) (Pixel998)
• 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
• f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
• aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
• f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
• 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
• 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
• 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
• 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
• f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

• bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
• 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
• 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

• 84fb885 chore: package.json update for @​eslint/js release
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
• f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
• b4b3127 chore: package.json update for @​eslint/js release
• 0b14059 chore: package.json update for @​eslint/js release
• fa31a60 feat!: add name to configs (#20015)
• 1e2cad5 chore: package.json update for @​eslint/js release
• 454a292 feat!: update eslint:recommended configuration (#20210)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
• See full diff in compare view

Updates @guardian/eslint-config from 15.0.0 to 16.0.0

Release notes

Sourced from @​guardian/eslint-config's releases.

@​guardian/eslint-config@​16.0.0

Major Changes

• 5cf4d48: Update Typescript to v6 (6.0.3):
  • Use https://gist.github.com/privatenumber/3d2e80da28f84ee30b77d53e1693378f as a reference to update your own codebase to TS6.
  • If you use ts-jest to run jest tests, update to v29.4.11 minimum to ensure compatibility with TS6.

Changelog

Sourced from @​guardian/eslint-config's changelog.

16.0.0

Major Changes

• 5cf4d48: Update Typescript to v6 (6.0.3):
  • Use https://gist.github.com/privatenumber/3d2e80da28f84ee30b77d53e1693378f as a reference to update your own codebase to TS6.
  • If you use ts-jest to run jest tests, update to v29.4.11 minimum to ensure compatibility with TS6.

Commits

• 3154079 Bump package versions
• 5cf4d48 chore(deps): upgrade TypeScript to 6.0.3
• See full diff in compare view

Updates prettier from 3.8.3 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

3.9.4

• Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

• Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @​seiyab)
• TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @​evoactivity)

🔗 Changelog

3.9.1

• CLI: Fix ignored file has been cached incorrectly (#19483 by @​kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

• Fix Flow variance annotation print (#19022 by @​marcoww6)

🔗 Changelog

3.8.4

• Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (prettier/prettier#17746 by @​byplayer)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

• b6c7d18 Release 3.9.5
• cd54ccc Avoid corrupting empty Markdown link with title (#19487)
• 2bb67ce Preserving comments' placement property (#19567)
• 91bcac8 Add more tests for comment-only object type (#19587)
• cbee737 Remove space in empty object type (#19583)
• 6394c73 Align empty module declaration with TS (#19568)
• a4e6f7a Prevent the addition of space in type() with + (#19516)
• 3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
• 908503e Handle dangling comments in SwitchStatement (#19581)
• 943a475 Angular: Support expression for exhaustive typechecking (#19571)
• Additional commits viewable in compare view

Updates eslint from 9.39.4 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

v10.6.0

Features

• b1f9106 feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981) (Taejin Kim)

... (truncated)

Commits

• fabd99b 10.7.0
• 37c5e75 Build: changelog update for 10.7.0
• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076)
• 81a4774 chore: updates for v9.39.5 release
• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071)
• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032)
• c30d808 docs: Update README
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
typescript	[>= 5.7.a, < 5.8]
typescript	[>= 5.6.a, < 5.7]

[kelvin-chappell]

@dependabot rebase

[kelvin-chappell]

@copilot fix

[Copilot]

@copilot fix

Fixed in the latest commit. Changes made:

• eslint downgraded from ^10.7.0 to 9.39.5 (pinned exact version) — @guardian/eslint-config@16.0.0 requires eslint ^9.39.1
• @eslint/js downgraded from ^10.0.1 to ^9.39.5 to match
• typescript downgraded from 7.0.2 to 6.0.3 — @typescript-eslint/eslint-plugin@8.64.0 requires typescript <6.1.0
• Added "ignoreDeprecations": "6.0" to tsconfig.json to fix a TS6 error on the moduleResolution: "node" deprecation warning
• Adapted to @guardian/cdk@64.1.0 API change: roleConfiguration.additionalPolicies → top-level additionalPolicies
• Updated snapshot for GuRiffRaffDeploymentIdParameterExperimental rename in @guardian/cdk@64.1.0