chore(deps): update all non-major dependencies (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@ember/optional-features	2.2.0 → 2.3.0
@typescript-eslint/eslint-plugin (source)	8.47.0 → 8.52.0
@typescript-eslint/parser (source)	8.47.0 → 8.52.0
ember-auto-import (source)	2.11.2 → 2.12.0
ember-cli (source)	6.8.1 → 6.9.1
ember-source (source)	6.8.1 → 6.10.0
express (source)	5.1.0 → 5.2.1
prettier (source)	3.6.2 → 3.7.4
release-it	19.0.6 → 19.2.3
release-plan	0.17.2 → 0.17.4
rollup (source)	4.53.3 → 4.55.1
webpack	5.103.0 → 5.104.1

---

Release Notes

emberjs/ember-optional-features (@​ember/optional-features)

v2.3.0

Compare Source

@​ember/optional-features 2.3.0 (minor)

🚀 Enhancement

• @ember/optional-features
  • #​349 Introducing use-ember-modules flag (@​ef4)

Committers: 1

• Edward Faulkner (@​ef4)

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.52.0

Compare Source

🚀 Features

• eslint-plugin-internal: [no-multiple-lines-of-errors] add rule (#​11899)

🩹 Fixes

• eslint-plugin: [no-base-to-string] detect @​@​toPrimitive and valueOf (#​11901)
• eslint-plugin: [no-useless-default-assignment] handle conditional initializer (#​11908)

❤️ Thank You

• Josh Goldberg ✨
• Ulrich Stark

You can read about our versioning strategy and releases on our website.

v8.51.0

Compare Source

🚀 Features

• eslint-plugin: add namespace to plugin meta (#​11885)
• eslint-plugin: [no-useless-default-assignment] fix some cases to optional syntax (#​11871)

🩹 Fixes

• eslint-plugin: [prefer-optional-chain] handle MemberExpression in final chain position (#​11835)
• eslint-plugin: bump ts-api-utils to 2.2.0 (#​11881)
• eslint-plugin: remove fixable from no-dynamic-delete rule (#​11876)
• eslint-plugin: fix crash and false positives in no-useless-default-assignment (#​11845)

❤️ Thank You

• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• mdm317
• Ulrich Stark
• Yannick Decat @​mho22

You can read about our versioning strategy and releases on our website.

v8.50.1

Compare Source

🩹 Fixes

• eslint-plugin: [no-unnecessary-type-assertion] correct handling of undefined vs. void (#​11826)
• eslint-plugin: [method-signature-style] ignore methods that return this (#​11813)

❤️ Thank You

• Josh Goldberg ✨
• Tamashoo @​Tamashoo

You can read about our versioning strategy and releases on our website.

v8.50.0

Compare Source

🚀 Features

• eslint-plugin: [no-useless-default-assignment] add rule (#​11720)

❤️ Thank You

• Josh Goldberg ✨
• Ulrich Stark

You can read about our versioning strategy and releases on our website.

v8.49.0

Compare Source

🚀 Features

• eslint-plugin: use Intl.Segmenter instead of graphemer (#​11804)

🩹 Fixes

• deps: update dependency prettier to v3.7.2 (#​11820)

❤️ Thank You

• Justin McBride
• Kirk Waiblinger @​kirkwaiblinger

You can read about our versioning strategy and releases on our website.

v8.48.1

Compare Source

🩹 Fixes

• eslint-plugin: [restrict-template-expressions] check base types in allow list (#​11764, #​11759)
• eslint-plugin: honor ignored base types on generic classes (#​11767)
• eslint-plugin: [consistent-type-exports] check value flag before resolving alias (#​11769)

❤️ Thank You

• Josh Goldberg
• OleksandraKordonets
• SangheeSon @​Higangssh
• tao

You can read about our versioning strategy and releases on our website.

v8.48.0

Compare Source

🚀 Features

• eslint-plugin: [no-redundant-type-constituents] use assignability checking for redundancy checks (#​10744)

🩹 Fixes

• typescript-estree: disallow binding patterns in parameter properties (#​11760)
• eslint-plugin: [consistent-generic-constructors] ignore when constructor is typed array (#​10477)

❤️ Thank You

• Dima Barabash @​dbarabashh
• JamesHenry @​JamesHenry
• Josh Goldberg
• mdm317 @​gen-ip-1

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.52.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.51.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.50.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.50.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.49.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.48.1

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.48.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

embroider-build/ember-auto-import (ember-auto-import)

v2.12.0

ember-auto-import 2.12.0 (minor)

🚀 Enhancement

• ember-auto-import, @ef4/test-scenarios
  • #​677 Implicit modules support (@​ef4)

📝 Documentation

• ember-auto-import
  • #​675 Add conditionName config example to readme (@​apellerano-pw)

Committers: 2

• Andrew Pellerano (@​apellerano-pw)
• Edward Faulkner (@​ef4)

ember-cli/ember-cli (ember-cli)

v6.9.0

• ember-cli 6.9.0-alpha.2 (minor)
• @​ember-tooling/classic-build-addon-blueprint 6.9.0-alpha.2 (minor)
• @​ember-tooling/classic-build-app-blueprint 6.9.0-alpha.2 (minor)
• @​ember-tooling/blueprint-blueprint 0.2.1 (patch)
• @​ember-tooling/blueprint-model 0.4.1 (patch)

🚀 Enhancement

• ember-cli
  • #​10844 [beta] Error when ember (generate|destroy) (http-proxy|http-mock|server) is used in a Vite-based project (@​kategengler)
• ember-cli, @ember-tooling/classic-build-addon-blueprint, @ember-tooling/classic-build-app-blueprint
  • #​10831 [bugfix beta] enable --strict by default to match new app blueprint (@​mansona)

🐛 Bug Fix

• ember-cli
  • #​10846 [beta bugfix] allow build --watch only in EMBROIDER_PREBUILD (@​mansona)
  • #​10834 [bugfix release] Fix tests using wrong versions (@​mansona)
  • #​10826 move resolution of @​ember/app-blueprint to prevent loading latest (@​mansona)
• @ember-tooling/classic-build-addon-blueprint, @ember-tooling/classic-build-app-blueprint
  • #​10838 Add package license metadata to match repository (@​davidtaylorhq)

📝 Documentation

• ember-cli
  • #​10843 Further contextualize help output and error when options and commands that are no longer supported in Vite-based projects are used (@​kategengler)
  • #​10840 [beta] fix help for vite-based projects (@​kategengler)
  • #​10835 Update deprecation message for --embroider option (@​kategengler)

🏠 Internal

• ember-cli, @ember-tooling/classic-build-addon-blueprint, @ember-tooling/classic-build-app-blueprint, @ember-tooling/blueprint-blueprint, @ember-tooling/blueprint-model
  • #​10851 Merge beta into master (@​mansona)
  • #​10848 merge origin/release into beta (@​mansona)
• ember-cli, @ember-tooling/classic-build-app-blueprint
  • #​10847 Prepare Beta Release (@​mansona)
  • #​10825 Prepare Beta Release (@​mansona)
  • #​10820 Prepare Beta Release (@​mansona)
• ember-cli, @ember-tooling/classic-build-addon-blueprint, @ember-tooling/classic-build-app-blueprint
  • #​10836 Prepare Beta Release (@​mansona)
• ember-cli
  • #​10845 [beta] update @​ember/app-blueprint to latest beta (@​mansona)
  • #​10833 [bugfix beta] bump the @​ember/app-blueprint version (@​mansona)
  • #​10823 fix incorrect ember-cli-update version in tests (@​mansona)
  • #​10819 update @​ember/app-blueprint beta version (@​mansona)
  • #​10809 Update RELEASE (@​mansona)

Committers: 3

• Chris Manson (@​mansona)
• David Taylor (@​davidtaylorhq)
• Katie Gengler (@​kategengler)

emberjs/ember.js (ember-source)

v6.10.0

Compare Source

• #​21013 / #​21009 [DEPRECATION] Deprecate use of amd bundles per RFC #​1101.
• #​21004 Remove deprecated TypeScript compiler options for TS 6.0 compatibility

v6.9.0

Compare Source

• All changes were internal, docs, and/or bugfixes that were backported.

v6.8.2

Compare Source

• #​21002 [BUGFIX] Don't render if we're mid-destroy

expressjs/express (express)

v5.2.1

Compare Source

=======================

• Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)

v5.2.0

Compare Source

========================

• Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
• deps: body-parser@^2.2.1
• A deprecation warning was added when using res.redirect with undefined arguments, Express now emits a warning to help detect calls that pass undefined as the status or URL and make them easier to fix.

prettier/prettier (prettier)

v3.7.4

Compare Source

diff

LWC: Avoid quote around interpolations (#​18383 by @​kovsu)

<!-- Input -->
<div foo={bar}>   </div>

<!-- Prettier 3.7.3 (--embedded-language-formatting off) -->
<div foo="{bar}"></div>

<!-- Prettier 3.7.4 (--embedded-language-formatting off) -->
<div foo={bar}></div>

TypeScript: Fix comment inside union type gets duplicated (#​18393 by @​fisker)

// Input
type Foo = (/** comment */ a | b) | c;

// Prettier 3.7.3
type Foo = /** comment */ (/** comment */ a | b) | c;

// Prettier 3.7.4
type Foo = /** comment */ (a | b) | c;

TypeScript: Fix unstable comment print in union type comments (#​18395 by @​fisker)

// Input
type X = (A | B) & (
  // comment
  A | B
);

// Prettier 3.7.3 (first format)
type X = (A | B) &
  (// comment
  A | B);

// Prettier 3.7.3 (second format)
type X = (
  | A
  | B // comment
) &
  (A | B);

// Prettier 3.7.4
type X = (A | B) &
  // comment
  (A | B);

v3.7.3

Compare Source

diff

API: Fix prettier.getFileInfo() change that breaks VSCode extension (#​18375 by @​fisker)

An internal refactor accidentally broke the VSCode extension plugin loading.

v3.7.2

Compare Source

diff

JavaScript: Fix string print when switching quotes (#​18351 by @​fisker)

// Input
console.log("A descriptor\\'s .kind must be \"method\" or \"field\".")

// Prettier 3.7.1
console.log('A descriptor\\'s .kind must be "method" or "field".');

// Prettier 3.7.2
console.log('A descriptor\\\'s .kind must be "method" or "field".');

JavaScript: Preserve quote for embedded HTML attribute values (#​18352 by @​kovsu)

// Input
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;

// Prettier 3.7.1
const html = /* HTML */ ` <div class=${styles.banner}></div> `;

// Prettier 3.7.2
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;

TypeScript: Fix comment in empty type literal (#​18364 by @​fisker)

// Input
export type XXX = {
  // tbd
};

// Prettier 3.7.1
export type XXX = { // tbd };

// Prettier 3.7.2
export type XXX = {
  // tbd
};

v3.7.1

Compare Source

diff

API: Fix performance regression in doc printer (#​18342 by @​fisker)

Prettier 3.7.1 can be very slow when formatting big files, the regression has been fixed.

v3.7.0

Compare Source

diff

🔗 Release Notes

release-it/release-it (release-it)

v19.2.3

Compare Source

• Reuse generated changelog (316dbfa)
• Remove obsolete eslint compat packages/config (f6cc8f3)
• Update remark-preset-webpro and fix broken links (6e6dd4b)

v19.2.2

Compare Source

• Improve getChangelog method (7a56364)

v19.2.1

Compare Source

• Improve commit prompt (b7aca7c)
• Remedy potential edge case in template helper (5c0a6ee)

v19.2.0

Compare Source

• Add option to exit gracefully (e1f825d)
• Update dependencies (424c9f6)
• Auto-format docs (06f41bb)
• fix: add shell mode for npm commands on windows (#​1266) (382e346) - thanks @​julienbenac!
• Feat: Add publishPackageManager config option in NPM plugin to allow using different package manager for publishing (e.g. Bun) (#​1169) (0dafc0b) - thanks @​chrispader!
• Only use --workspaces=false with npm (12bb89c)
• Fix up docs/types a bit (05a5986)
• Format (c9d6ebf)

v19.1.0

Compare Source

• Ignore .npmrc (8ccd060)
• Update lockfile (c4cd2ba)
• Support interactive shell in non-CI mode for 2FA flow (resolve #​1263) (a10b20d)
• Add --workspaces=false to get rid of the null/matches error (14a4907)
• Remove npm config env var warnings (b8c1247)
• doc(readme): add release-it-beautiful-changelog plugin to list of plugins (#​1261) (1b68c21)
• Add 403 to consider resource alive (7969849)

release-plan/release-plan (release-plan)

v0.17.4

• release-plan 0.17.4 (patch)

🐛 Bug Fix

• release-plan
  • #​228 Update github-changelog to v2.1.4 to support bot users (@​gossi)

📝 Documentation

• release-plan
  • #​230 Rename embroider-build to release-plan (@​gossi)
  • #​178 Documentation site with vitepress (@​gossi)

🏠 Internal

• release-plan
  • #​214 Prepare Release (@​github-actions[bot])
  • #​213 Sanitize Package Manager Version (@​gossi)

Committers: 2

• GitHub Actions [Bot] (@​github-actions)
• Thomas Gossmann (@​gossi)

rollup/rollup (rollup)

v4.55.1

Compare Source

2026-01-05

Bug Fixes

• Fix artifact reference for OpenBSD (#​6231)

Pull Requests

• #​6231: Fix OpenBSD artifacts and ensure OIDC is working (@​lukastaegert)

v4.54.0

Compare Source

2025-12-20

Features

• Enable tree-shaking for Symbol.hasInstance, Symbol.dispose and Symbol.asyncDispose properties if unused (#​6046)

Bug Fixes

• Ensure that well-known-Symbol-valued properties are not tree-shaken except in select cases (#​6046)
• Ensure namespace properties are included when referenced only from a try-catch (#​6216)

Pull Requests

• #​6046: fix: correctly handle wellknown protocols (@​cyyynthia, @​lukastaegert)
• #​6201: chore(deps): update dependency lru-cache to v11 (@​renovate[bot], @​lukastaegert)
• #​6211: chore(deps): update msys2/setup-msys2 digest to 4f806de (@​renovate[bot], @​lukastaegert)
• #​6212: chore(deps): update actions/cache action to v5 (@​renovate[bot])
• #​6213: chore(deps): update github artifact actions (major) (@​renovate[bot])
• #​6214: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #​6215: chore(deps): lock file maintenance (@​renovate[bot])
• #​6216: fix: include namespace variable paths during try-catch deoptimization (@​schwing)

v4.53.5

Compare Source

2025-12-16

Bug Fixes

• Fix wrong semicolon insertion position when using JSX (#​6206)
• Generate spec-compliant sourcemaps when sources content is excluded (#​6196)

Pull Requests

• #​6196: fix: set sourcesContent to undefined instead of null when excluding sources content (@​TrickyPi)
• #​6206: Fix semicolon order in JSX (@​TrickyPi)

v4.53.4

Compare Source

2025-12-15

Bug Fixes

• Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)

Pull Requests

• #​6185: chore(deps): update dependency @​inquirer/prompts to v8 (@​renovate[bot], @​lukastaegert)
• #​6186: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #​6187: chore(deps): lock file maintenance (@​renovate[bot])
• #​6188: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #​6190: Fix syntax error in manualChunks example (@​jonnyeom)
• #​6194: chore(deps): update actions/checkout action to v6 (@​renovate[bot])
• #​6195: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)
• #​6202: fix(deps): update swc monorepo (major) (@​renovate[bot])
• #​6203: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)
• #​6209: Do not tree-shake handlers for "using" (@​lukastaegert)

webpack/webpack (webpack)

v5.104.1

Compare Source

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

Compare Source

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Some tests with 'continue-on-error: true' have failed:

• test-app test:one embroider-optimized

Created by continue-on-error-comment