Bump the dev-dependencies group across 1 directory with 10 updates

[dependabot]

Bumps the dev-dependencies group with 10 updates in the / directory:

Package	From	To
@cap-js/audit-logging	1.2.0	1.2.2
@cap-js/cds-typer	0.38.0	0.39.1
@cap-js/cds-types	0.16.0	0.17.0
@cap-js/sqlite	2.2.0	2.4.0
@sap/cds-dk	9.8.3	9.9.2
eslint	10.2.0	10.5.0
mocha	11.7.5	11.7.6
prettier	3.8.1	3.8.4
tsx	4.21.0	4.22.4
typescript-eslint	8.58.0	8.61.1

Updates @cap-js/audit-logging from 1.2.0 to 1.2.2

Release notes

Sourced from @​cap-js/audit-logging's releases.

v1.2.2

Fixed

• Properly encode request body parameters using in audit-log-to-restv2
• Resolved server crash when @PersonalData annotations are applied to composition targets whose DataSubject is only reachable via the parent entity's sibling association

v1.2.1

Fixed

• Updated the audit log service plan detection logic to support the new URL format
• The absence of req.target does not lead to an error

Changelog

Sourced from @​cap-js/audit-logging's changelog.

Version 1.2.2 - 2026-06-18

Fixed

• Properly encode request body parameters using in audit-log-to-restv2
• Resolved server crash when @PersonalData annotations are applied to composition targets whose DataSubject is only reachable via the parent entity's sibling association

Version 1.2.1 - 2026-05-13

Fixed

• Updated the audit log service plan detection logic to support the new URL format
• The absence of req.target does not lead to an error

Commits

• fb41cb8 chore(deps-dev): bump express from 4.22.1 to 5.2.1 (#189)
• 33cd60a chore: bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group ...
• 9a6945c fix: resolve DataSubject via parent's associations for compo targets (#214)
• 572fd77 fix: encode body parameters properly (#216)
• d7f6b25 chore: bump actions/stale from 10.2.0 to 10.3.0 in the github-actions group a...
• 2e5ef31 test: fix test setup by adding cap-js/sqlite for plugin detection (#212)
• 0ce9b6d chore: dependabot cooldown (#209)
• 690b2f3 chore: prep v1.3.0 (#206)
• c83b5fa req.target is not always given (#204)
• 429dca0 [ALS-9774] [ALS v2] Align CAP Plugins with the new Service Binding Structure ...
• Additional commits viewable in compare view

Updates @cap-js/cds-typer from 0.38.0 to 0.39.1

Release notes

Sourced from @​cap-js/cds-typer's releases.

v0.39.1

Added

Changed

Deprecated

Removed

Fixed

• Properly import entities from other services that are used in arrays/ compositions of many/ associations to many

Security

v0.39.0

Added

• Added flag cds.env.typer.branded_primitive_types for branding CDS type definitions aliasing primitive TS types
• Added support for non-ASCII identifiers in .cds files. Non-ASCII characters in identifiers are sanitised to valid TypeScript names. Identifiers consisting entirely of non-ASCII characters (e.g., Kanji) are replaced with random hashes. All affected identifiers are exported under their sanitised/hashed name and also as an alias preserving the original name. To use the original name, import it with import ... as '...' syntax.

Changed

Deprecated

Removed

Fixed

• Association keys pointing to entities with inline enum types are now correctly typed in service projections across namespace boundaries

Security

Changelog

Sourced from @​cap-js/cds-typer's changelog.

[0.39.1] - 2026-05-19

Added

Changed

Deprecated

Removed

Fixed

• Properly import entities from other services that are used in arrays/ compositions of many/ associations to many

Security

[0.39.0] - 2026-05-11

Added

• Added flag cds.env.typer.branded_primitive_types for branding CDS type definitions aliasing primitive TS types
• Added support for non-ASCII identifiers in .cds files. Non-ASCII characters in identifiers are sanitised to valid TypeScript names. Identifiers consisting entirely of non-ASCII characters (e.g., Kanji) are replaced with random hashes. All affected identifiers are exported under their sanitised/hashed name and also as an alias preserving the original name. To use the original name, import it with import ... as '...' syntax.

Changed

Deprecated

Removed

Fixed

• Association keys pointing to entities with inline enum types are now correctly typed in service projections across namespace boundaries

Security

Commits

• 5e1d5c4 chore(version): patch version 0.39.1 (#613)
• 46a6105 fix: Properly resolve remote entities in arrays (#612)
• 162b15d chore(version): minor version 0.39.0 (#609)
• c5cbf13 fix: export inline enums so they are accessible cross-namespace in service pr...
• cec179a feat: Non-alpha identifiers (#581)
• cc18bc6 chore(deps): Bump path-to-regexp from 0.1.12 to 0.1.13 (#604)
• b484218 chore(deps): Bump yaml from 2.5.0 to 2.8.3 (#603)
• 748e6f6 chore(deps-dev): Bump flatted from 3.3.1 to 3.4.2 (#598)
• 5738837 chore(deps-dev): Bump brace-expansion from 1.1.12 to 1.1.14 (#605)
• 43fff45 chore(deps-dev): Bump picomatch from 4.0.3 to 4.0.4 (#602)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​cap-js/cds-typer since your current version.

Updates @cap-js/cds-types from 0.16.0 to 0.17.0

Release notes

Sourced from @​cap-js/cds-types's releases.

v0.17.0

Added

• Types for nested .where and .having predicates
• Passing events generated by cds-typer into service.on now offers code completion for the event's properties in the handler
• Allow all events that can be used in service.on to be used in service.once as well

Changed

• ResultHandler now returns unknown instead of void, to accommodate asynchronous functions when having @typescript-eslint/strict-void-return activated
• Documentation for cds.test.axios mentioning that @cap-js/cds-test@1 now returns an axios facade in absence of axios.
• made cds.context.locale optional
• cds.tx(ƒ) now returns the return type of ƒ

Deprecated

• cds.test.chai, cds.test.assert pointing to either cds.test.expect or a custom import of chai.
• cds.test.axios in favor of cds.test.defaults

Removed

Fixed

Security

Changelog

Sourced from @​cap-js/cds-types's changelog.

[0.17.0] - 2026-05-11

Added

• Types for nested .where and .having predicates
• Passing events generated by cds-typer into service.on now offers code completion for the event's properties in the handler
• Allow all events that can be used in service.on to be used in service.once as well

Changed

• ResultHandler now returns unknown instead of void, to accommodate asynchronous functions when having @typescript-eslint/strict-void-return activated
• Documentation for cds.test.axios mentioning that @cap-js/cds-test@1 now returns an axios facade in absence of axios.
• made cds.context.locale optional
• cds.tx(ƒ) now returns the return type of ƒ

Deprecated

• cds.test.chai, cds.test.assert pointing to either cds.test.expect or a custom import of chai.
• cds.test.axios in favor of cds.test.defaults

Removed

Fixed

Security

Commits

• 5c4e0a0 chore(version): minor version 0.17.0 (#554)
• 0b9140c build(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 (#552)
• f9c9a86 build(deps-dev): bump axios from 1.15.1 to 1.16.0 (#551)
• fe0045f fix: add missing once events (#550)
• 8358aff Revert "Allow on events in once"
• 4d70141 Allow on events in once
• 2d54f7a feat: Add code completion for custom events in handlers (#547)
• 662aeb7 fix(test): add cds.test.defaults, deprecate .axios (#545)
• adcf9ba feat: Strong type where condition predicates (#503)
• 0111641 fix: signature of cds.tx (#544)
• Additional commits viewable in compare view

Updates @cap-js/sqlite from 2.2.0 to 2.4.0

Release notes

Sourced from @​cap-js/sqlite's releases.

db-service: v2.4.0

2.4.0 (2025-08-27)

Added

• tuple expansion: allow structs with exactly one element/fk in comparison (#1291) (75ea826)
• cds.db.foreach uses real object mode streaming (#1318) (cd28b53)

Fixed

• assoc2join: target side access detection (#1282) (6f9befa)
• cqn4sql: only consider own property [@cds](https://github.com/cds).persistence.skip (#1324) (bd1f52f)
• exists: do not loose custom where (#1322) (644918c)
• arithmetic operators can only be used with scalar operands (#1307) (d58d335)
• detect path expression inside nested xpr after exists (#1292) (852d915), closes #1225
• reject comparison of two empty structures (#1306) (d97304d)

hana: v2.4.0

2.4.0 (2025-11-26)

Added

• error standard function (#1421) (b1b0fca)
• show default pool configuration in env (#1422) (89b397a)

Fixed

• deps: update dependency hdb to v2 (#1266) (742a784)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​cap-js/db-service bumped from ^2.6.0 to ^2.7.0

sqlite: v2.4.0

2.4.0 (2026-04-29)

Added

• supersede potentially compromised release (#1590) (3be4044)

Dependencies

... (truncated)

Commits

• f9d6ece chore: release main (#1403)
• 6e924c9 fix: reject nested projection if duplicated (#1411)
• 31766cd fix: LimitedRank with compositions (#1391)
• 89b397a feat: show default pool configuration in env (#1422)
• f6ef6e0 chore(deps): update actions/checkout action to v6 (#1425)
• 565633e chore(deps): lock file maintenance (#1427)
• b1b0fca feat: error standard function (#1421)
• 6c4a4f0 chore: $main (#1397)
• 2a10d2c chore(deps): lock file maintenance (#1419)
• be54935 chore: enable provenance, remove obsolete NPM token (#1416)
• Additional commits viewable in compare view

Updates @sap/cds-dk from 9.8.3 to 9.9.2

Updates eslint from 10.2.0 to 10.5.0

Release notes

Sourced from eslint's releases.

v10.5.0

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)
• 2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)
• 732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)
• f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)
• bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)
• c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

• 8ae1b5b docs: Update README (GitHub Actions Bot)
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)
• f99b47a docs: Update README (GitHub Actions Bot)
• acf03d4 docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)

Chores

• b18bf58 chore: update ecosystem plugins (#20959) (ESLint Bot)
• c2d1444 refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)
• 243b8c5 chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)
• 217b2a9 test: add unit tests for ParserService (#20949) (Taejin Kim)
• 72003e7 test: add location information to error messages in max-statements (#20945) (lumir)
• 7797c26 refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)
• 67c46fa chore: update ecosystem plugins (#20938) (ESLint Bot)
• 95d8c7a chore: update dependency @​eslint/json to v2 (#20934) (renovate[bot])
• cf9e496 chore: update @​arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)
• fb6d396 test: run type tests with TypeScript 7 (#20868) (sethamus)

v10.4.1

Bug Fixes

• e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930) (Francesco Trotta)
• d4ce898 fix: propagate failures from delegated commands (#20917) (Minh Vu)
• f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#20916) (kuldeep kumar)
• c5bc78b fix: false positive for reference in finally block (#20655) (Tanuj Kanti)
• 27538c0 fix: add missing CodePath and CodePathSegment types (#20853) (Pixel998)

Documentation

• 61b0add docs: remove deprecated rule from related rules of max-params (#20921) (Tanuj Kanti)
• 305d5b9 docs: remove deprecated rules from related rules section (#20911) (Tanuj Kanti)
• 49b0202 docs: fix display: none of ad (#20901) (Tanuj Kanti)
• 9067f94 docs: switch build to Node.js 24 (#20893) (Milos Djermanovic)
• c91b041 docs: Update README (GitHub Actions Bot)
• e349265 docs: clarify semver strings in rule deprecation objects (#20885) (Milos Djermanovic)

Chores

• b0e466b test: add data property to invalid tests cases for rules (#20924) (Tanuj Kanti)
• f78838b test: add CodePath type coverage (#20904) (Pixel998)
• 1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#20922) (Francesco Trotta)
• 002942c ci: declare contents:read on update-readme workflow (#20919) (Arpit Jain)
• 64bca24 chore: update ecosystem plugins (#20912) (ESLint Bot)

... (truncated)

Commits

• de3b672 10.5.0
• 362a518 Build: changelog update for 10.5.0
• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973)
• b565783 feat: report no-with violations at the with keyword (#20971)
• 2ce032f feat: report max-lines-per-function violations at function head (#20966)
• 732cb3e feat: report max-nested-callbacks violations at function head (#20967)
• f9c138a feat: report max-depth violations on keywords (#20943)
• 8ae1b5b docs: Update README
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962)
• b18bf58 chore: update ecosystem plugins (#20959)
• Additional commits viewable in compare view

Updates mocha from 11.7.5 to 11.7.6

Release notes

Sourced from mocha's releases.

v11.7.6

11.7.6 (2026-02-14)

🩹 Fixes

• make describe().timeout() work (aafe6fd)
• test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

• format all code (#5629) (0696784)
• remove Netlify (#5630) (8d01d33)

Changelog

Sourced from mocha's changelog.

11.7.6 (2026-02-14)

🩹 Fixes

• make describe().timeout() work (aafe6fd)
• test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

• format all code (#5629) (0696784)
• remove Netlify (#5630) (8d01d33)

Commits

• 3765ba0 chore(v11.x): release 11.7.6 (#5632)
• 73ebdfa fix(test): replace wmic usage with native Windows API (#5694)
• aafe6fd fix: make describe().timeout() work
• 0696784 chore: format all code (#5629)
• 8d01d33 chore: remove Netlify (#5630)
• See full diff in compare view

Updates prettier from 3.8.1 to 3.8.4

Release notes

Sourced from prettier's releases.

3.8.4

• Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (prettier/prettier#17746 by @​byplayer)

🔗 Changelog

3.8.3

• SCSS: Prevent trailing comma in if() function (prettier/prettier#18471 by @​kovsu)

🔗 Changelog

3.8.2

• Support Angular v21.2

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.8.4

diff

Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @​byplayer)

Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.

<!-- Input -->
- a


b


c

d



<!-- Prettier 3.8.3 -->

a

b


c

d



<!-- Prettier 3.8.4 -->


a

b



c

d

3.8.3

diff

SCSS: Prevent trailing comma in if() function (#18471 by @​kovsu)

// Input
$value: if(sass(false): 1; else: -1);
// Prettier 3.8.2
$value: if(
sass(false): 1; else: -1,
</tr></table>

... (truncated)

Commits

• 1c6ba55 Release 3.8.4
• 4a673dc Fix blank lines between list items and nested sub-lists being removed in Mark...
• 074aaed Replace main branch in changelog link with tags (#19054)
• c22a003 Bump Prettier dependency to 3.8.3
• 07bad1f Clean changelog_unreleased
• d7108a7 Release 3.8.3
• 177f908 Prevent trailing comma in SCSS if() function (#18471)
• 1cd4066 Release @​prettier/plugin-oxc@​0.1.4
• a8700e2 Update oxc-parser to v0.125.0
• 752157c Fix tests
• Additional commits viewable in compare view

Updates tsx from 4.21.0 to 4.22.4

Release notes

Sourced from tsx's releases.

v4.22.4

4.22.4 (2026-05-31)

Bug Fixes

• resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

• decode typed loader source (dce02fc)
• preserve entrypoint with TypeScript preload hooks (68f72f3)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

• preserve CJS JSON require in ESM hooks (35b700b)
• preserve named exports from CommonJS TypeScript (11de737)
• support module.exports require(esm) interop (cf8f199)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.1

4.22.1 (2026-05-17)

Bug Fixes

• resolve tsconfig path aliases containing a colon (#780) (6979f28)

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• 1ce8463 fix: resolve CommonJS directory requires inside dependencies (#803)
• dce02fc fix: decode typed loader source
• 68f72f3 fix: preserve entrypoint with TypeScript preload hooks
• 69455cf test: cover package exports for ambiguous ESM reexports
• 35b700b fix: preserve CJS JSON require in ESM hooks
• ef807db chore: update testing dependencies
• 3917090 test: document compatibility test taxonomy
• de8113f refactor: centralize Node capability facts
• c1f62db test: consolidate tsconfig path edge coverage
• 4e08174 test: consolidate loader hook coverage
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Updates typescript-eslint from 8.58.0 to 8.61.1

Release notes

Sourced from typescript-eslint's releases.

v8.61.1

8.61.1 (2026-06-15)

🩹 Fixes

• eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#12396, #10577)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#12281)
• eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#12394, #12393)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#12413)
• eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#12388)

❤️ Thank You

• Anas @​anasm266
• Deftera @​Deftera186
• Kirk Waiblinger @​kirkwaiblinger
• lumir
• Sarath Francis @​sarathfrancis90

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.0

8.61.0 (2026-06-08)

🚀 Features

• ast-spec: change type of UnaryExpression.prefix to always true (#12372)
• ast-spec: tighten types of ArrowFunction, YieldExpression, TSTypePredicate (#12373)

🩹 Fixes

• rule-schema-to-typescript-types: respect ECMAScript line terminators (#12374)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger
• lumir

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.1

8.60.1 (2026-06-01)

🩹 Fixes

• eslint-plugin: respect ECMAScript line terminators in ts-comment rules (#12352)

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.61.1 (2026-06-15)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.61.0 (2026-06-08)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.60.1 (2026-06-01)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.60.0 (2026-05-25)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.4 (2026-05-18)

🩹 Fixes

• typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.59.3 (2026-05-11)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

... (truncated)

Commits

• aaad718 chore(release): publish 8.61.1
• 16a5b24 chore(release): publish 8.61.0
• 4f84a69 chore(release): publish 8.60.1
• 1849b53 chore: typecheck using tsgo (#12139)
• f891c29 chore(release): publish 8.60.0
• ca6ca14 chore(release): publish 8.59.4
• 4b927c6 fix(typescript-eslint): export Compatible* types from typescript-eslint to re...
• 48e13c0 chore(release): publish 8.59.3
• 44f9625 chore(deps): update vitest monorepo to v4.1.5 (#12307)
• 2ec35f1 chore(release): publish 8.59.2
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud