[dependabot]

Bumps the npm-minor group with 7 updates in the / directory:

Package	From	To
follow-redirects	1.16.1	1.16.2
node-forge	1.4.1	1.4.3
semver	7.8.5	7.8.6
@types/sinon	22.0.1	22.0.2
eslint-plugin-jsdoc	65.4.0	65.4.3
globals	17.13.0	17.14.0
typescript-eslint	8.72.0	8.72.1

Updates follow-redirects from 1.16.1 to 1.16.2

Commits

• e3b45a7 Release version 1.16.2 of the npm package.
• b0a7751 Use Array.isArray.
• d96d1fe Add funding emergency notice.
• See full diff in compare view

Updates node-forge from 1.4.1 to 1.4.3

Changelog

Sourced from node-forge's changelog.

1.4.3 - 2026-11-03

Security

• HIGH: X.509 certificate chain verification ignores name constraints.
  • pki.verifyCertificateChain() does not check the nameConstraints extension (RFC 5280 4.2.1.10). A non-critical nameConstraints extension in a CA certificate is ignored, so a name-constrained intermediate CA can issue certificates for names outside its permitted subtrees, or inside its excluded subtrees, and the chain verifies. Exploitation requires the private key of a name-constrained CA that chains to a trusted root. A critical nameConstraints extension is rejected as an unsupported critical extension.
  • Reported by @​bhaswanthc.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-3cc4-3294-vgjf
• MODERATE: TLS client crash on a handshake record without a session.
  • A TLS client throws an uncaught TypeError from process() when it receives a ServerHello while it has no session: after a close_notify alert or a call to close(), or before handshake() is called. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions. Servers are not affected.
  • Reported by @​manus-use.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-j8rw-jp99-435v
• MODERATE: ReDoS in forge.http response header parsing.
  • forge.http trims response header and Set-Cookie values with a regular expression that takes quadratic time on a long run of whitespace followed by another character. A server, or an on-path attacker, can block a forge.http client for minutes with one large header.
  • Reported by @​manus-pi.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-6cv4-p8m7-4r25
• MODERATE: TLS client crash on an unsupported ServerHello compression method.
  • A TLS client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes process() throw an uncaught Error at ServerHelloDone, before the server is authenticated. A malicious server, or an on-path attacker, can terminate a Node.js process that passes socket data to process() without catching exceptions, including through forge.tls.wrapSocket. Servers are not affected.
  • Reported by @​alienkeric.
  • CVE ID: CVE-TBD
  • GHSA ID: GHSA-w4xr-hqv8-ch44
• LOW: Ed25519 signature verification accepts small-order public keys.
  • ed25519.verify() does not reject public keys of small order, such as the identity point. Under such a key, a signature with S = 0 and a small-order R verifies for many or, with the identity key, all messages, without any private key. Applications are affected only if

... (truncated)

Commits

• 936b24d Release 1.4.3.
• 4d8f79a Update changelog.
• 1d9816d Check the ServerHello compression method.
• 326a4d0 Trim forge.http header values in linear time.
• 2cfaeb5 Ignore handshake messages on a TLS client without a session.
• 6b23eae Complete nameConstraints enforcement.
• 862aa5f Enforce nameConstraints in verifyCertificateChain().
• 956f2b5 Document ed25519.verify() small-order key behavior.
• 1b77e6f Reject small-order Ed25519 public keys in verify.
• 2bd5146 Add GitHub usernames to credits.
• Additional commits viewable in compare view

Updates semver from 7.8.5 to 7.8.6

Release notes

Sourced from semver's releases.

v7.8.6

7.8.6 (2026-11-02)

Bug Fixes

• 69b305d #918 improve range parsing performance (#918) (@​reggi, @​Copilot)

Chores

• 7257c14 #917 cover comparator normalization (#917) (@​reggi, @​Copilot)

Changelog

Sourced from semver's changelog.

7.8.6 (2026-11-02)

Bug Fixes

• 69b305d #918 improve range parsing performance (#918) (@​reggi, @​Copilot)

Chores

• 7257c14 #917 cover comparator normalization (#917) (@​reggi, @​Copilot)

Commits

• b37b033 chore: release 7.8.6 (#940)
• 69b305d fix: improve range parsing performance (#918)
• 7257c14 chore: cover comparator normalization (#917)
• See full diff in compare view

Updates @types/sinon from 22.0.1 to 22.0.2

Commits

• See full diff in compare view

Updates eslint-plugin-jsdoc from 65.4.0 to 65.4.3

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v65.4.3

65.4.3 (2026-11-03)

Bug Fixes

• require-param: add missing @param tags only once per fix; fixes #770 (ce20134)

v65.4.2

65.4.2 (2026-10-23)

Bug Fixes

• ts-method-signature-style: do not turn optional or readonly function properties into method signatures (94952b2)
• ts-method-signature-style: keep ? when converting between function properties and method signatures (a4040aa)

v65.4.1

65.4.1 (2026-10-22)

Bug Fixes

• ts-prefer-function-type: do not throw on call signatures inside object fields, parameters or return types, and keep the type when fixing (8830b2e)

Commits

• ce20134 fix(require-param): add missing @param tags only once per fix; fixes #770
• a4040aa fix(ts-method-signature-style): keep ? when converting between function p...
• 94952b2 fix(ts-method-signature-style): do not turn optional or readonly function p...
• e4a69dd refactor: share rule defaults between code and meta.defaultOptions
• 45c789c chore: lint rule files with eslint-plugin-eslint-plugin
• 44a3c45 chore: update jsdoccomment, devDep
• 8830b2e fix(ts-prefer-function-type): do not throw on call signatures inside object...
• 0a1b435 docs: move nojekyll file to /docs
• a218be3 docs: avoid jekyll processing
• 1b32353 docs: fix issues with GH Pages
• See full diff in compare view

Updates globals from 17.13.0 to 17.14.0

Release notes

Sourced from globals's releases.

v17.14.0

• Update globals (2026-11-01) (#355) 7abfb5d

---

sindresorhus/globals@v17.13.0...v17.14.0

Commits

• 3080111 17.14.0
• c61cc23 Tweaks
• 7abfb5d Update globals (2026-11-01) (#355)
• See full diff in compare view

Updates typescript-eslint from 8.72.0 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
eslint-plugin-jsdoc	[>= 63.a, < 64]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Pushed a commit to rebuild the Action. Please approve running the PR checks.

[Copilot]

🟡 Changes recommended

The checked-in lib/ bundle was not rebuilt, so the Action still runs the old bundled dependencies and the runtime fixes do not reach users.

1 open issue

• Rebuild checked-in bundle to include runtime dependency updates · New

What changed in this PR

Updates seven npm dependencies used by the CodeQL Action and its development tooling.

Changes:

• Bumps runtime dependencies, including upstream security fixes in node-forge.
• Refreshes Sinon typings and ESLint-related tooling.
• Aligns the pr-checks workspace’s semver requirement and shared lockfile.

File	Description
pr-checks/​package.json	Updates the workspace’s semver requirement.
package.json	Bumps three runtime and four development dependencies.
package-lock.json	Records updated versions, transitive dependencies, and dependency metadata.

_{Review effort: Max (auto)}