chore(deps): bump the npm_and_yarn group across 6 directories with 14 updates

[dependabot]

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
turbo	1.13.4	2.10.12
@babel/core	7.28.4	7.29.7
ws	6.2.3	6.2.6
js-yaml	3.14.2	3.15.2
brace-expansion	1.1.12	1.1.18
body-parser	1.20.3	1.20.8
fast-uri	3.1.0	3.1.7
ip-address	10.0.1	10.7.0
launch-editor	2.11.1	2.14.1

Bumps the npm_and_yarn group with 5 updates in the /airborne-react-native/ExampleOldArch directory:

Package	From	To
@babel/core	7.27.1	7.29.7
ws	7.5.10	7.5.13
ws	6.2.3	6.2.6
js-yaml	3.14.1	3.15.2
js-yaml	4.1.0	4.3.2
brace-expansion	1.1.12	1.1.18
brace-expansion	2.0.2	2.1.4
shell-quote	1.8.3	1.10.0

Bumps the npm_and_yarn group with 6 updates in the /airborne-react-native/ExampleSplitBundle directory:

Package	From	To
@babel/core	7.28.0	7.29.7
ws	6.2.3	6.2.6
js-yaml	3.14.1	3.15.2
brace-expansion	1.1.12	1.1.18
body-parser	1.20.3	1.20.8
launch-editor	2.10.0	2.14.1

Bumps the npm_and_yarn group with 6 updates in the /airborne_dashboard directory:

Package	From	To
js-yaml	4.2.0	4.3.2
brace-expansion	1.1.15	1.1.18
fast-uri	3.1.2	3.1.7
next	15.5.18	15.5.25
postcss	8.5.15	8.5.23
tar	7.5.16	7.5.22

Bumps the npm_and_yarn group with 4 updates in the /airborne_docs directory: fast-uri, postcss, brace-expansion and body-parser.
Bumps the npm_and_yarn group with 1 update in the /airborne_server/cf_host directory: body-parser.

Updates turbo from 1.13.4 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

• chore: Release Turborepo 2.10.11 by @​github-actions[bot] in vercel/turborepo#13765
• feat: Refresh documentation social cards by @​christopherkindl in vercel/turborepo#13764
• fix: Preserve showcase logo sizes by @​christopherkindl in vercel/turborepo#13766
• fix: Refine mobile homepage interactions by @​christopherkindl in vercel/turborepo#13767
• fix: Align homepage KPIs to the right by @​christopherkindl in vercel/turborepo#13769
• fix: Prevent homepage KPI overflow by @​christopherkindl in vercel/turborepo#13770
• chore: Update Geistdocs to 1.20.4 by @​molebox in vercel/turborepo#13771
• perf: Skip unused Package Configuration stats by @​vercel-gh-bot-4[bot] in vercel/turborepo#13746
• chore: Update with-solid example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13752
• chore: Update with-tailwind example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13762
• perf: Stream dry-run JSON output by @​vercel-gh-bot-4[bot] in vercel/turborepo#13760
• chore: Update with-ultracite example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13772
• perf: Merge same-prefix tree-wildcard globs into one directory walk by @​vercel-gh-bot-5[bot] in vercel/turborepo#13763
• chore: Update with-svelte example by @​floriansalihovic in vercel/turborepo#13118
• chore: Add unified agent control plane by @​anthonyshew in vercel/turborepo#13757
• fix: Remove incremental task caching by @​anthonyshew in vercel/turborepo#13773
• chore: Rename agents app to factory by @​anthonyshew in vercel/turborepo#13774
• chore: Update oxlint and oxfmt by @​charpeni in vercel/turborepo#13777
• feat: Add security.txt endpoint by @​charpeni in vercel/turborepo#13778
• feat: Redesign factory control plane by @​anthonyshew in vercel/turborepo#13775
• perf: Replace regex captures with hand-written parsers in berry lockfile identifiers by @​vercel-gh-bot-2[bot] in vercel/turborepo#13776
• chore: Upgrade the factory eve agent to 0.39.3 by @​anthonyshew in vercel/turborepo#13783
• chore: Update with-rsbuild-module-federation example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13786
• perf: Index Berry lockfile resolution overrides by dependency name by @​vercel-gh-bot-5[bot] in vercel/turborepo#13787
• chore: Update remote cache action to v1.1.0 by @​anthonyshew in vercel/turborepo#13789
• docs: Fix reference links and validation by @​charpeni in vercel/turborepo#13784
• feat: Add SSH command affordance for factory sandboxes by @​anthonyshew in vercel/turborepo#13779
• fix: Show invalid affected task glob by @​anthonyshew in vercel/turborepo#13793
• perf: Skip unused repository indexing for package listings by @​vercel-gh-bot-4[bot] in vercel/turborepo#13792
• feat: Rebuild the factory image on every merge to main by @​anthonyshew in vercel/turborepo#13781
• chore: Add full-page terminal SSH sessions to Factory sandbox inventory by @​anthonyshew in vercel/turborepo#13780
• chore: Update with-shell-commands example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13791
• chore: Allow SSH terminal for completed-run sandboxes in Factory by @​anthonyshew in vercel/turborepo#13782
• fix: Decouple graceful shutdown tests from the shell commands example by @​anthonyshew in vercel/turborepo#13799
• feat: Start ad-hoc factory work from the operator page by @​anthonyshew in vercel/turborepo#13798
• chore: Update with-solid example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13797
• fix: Rebuild factory images without custom workflows by @​anthonyshew in vercel/turborepo#13801
• feat: Add factory navigation by @​anthonyshew in vercel/turborepo#13802
• refactor: Migrate Factory styles to Tailwind by @​anthonyshew in vercel/turborepo#13803
• feat: Add durable Factory workspaces by @​anthonyshew in vercel/turborepo#13804
• feat: Stream Factory sandbox as terminal by @​anthonyshew in vercel/turborepo#13807
• fix: Restore Factory workspace creation by @​anthonyshew in vercel/turborepo#13812
• fix: Update Factory session network policy by @​anthonyshew in vercel/turborepo#13814
• fix: Improve Factory terminal line spacing by @​anthonyshew in vercel/turborepo#13815
• fix: Install Factory publishing skill by @​anthonyshew in vercel/turborepo#13817

... (truncated)

Changelog

Sourced from turbo's changelog.

Release Documentation

Quick Start

Automated Canary Releases

Canary releases run on an hourly schedule via the [Release workflow][1]:

1. Runs every hour via cron, skipping if no relevant files in crates/ or packages/ changed since the last canary tag
2. Skips if the latest commit is a release PR merge (to avoid releasing the version bump itself)
3. Publishes to npm with the canary tag
4. Opens and merges a PR to return the version bump to main after required checks pass

No manual intervention required for canary releases.

Manual Releases (Stable/Custom)

1. Create a release by triggering the [Turborepo Release][1] workflow

   • For stable releases, use patch, minor, or major
   • For custom pre-releases, use prepatch, preminor, or premajor
   • Check the "Dry Run" box to test the workflow without publishing

2. A PR is automatically opened and merged into main after its required workflows are approved and pass.

Release @turbo/repository

1. Run [bump-version.sh][4] to update the versions of the packages. Merge in the changes to main.

2. Create a release by triggering the [Turborepo Library Release][5] workflow.

   • Check the "Dry Run" box to run the full release workflow without publishing any packages.
   • The release PR is automatically merged after its required workflows are approved and pass.

Notes

• GitHub Release Notes are published automatically using the config from [turborepo-release.yml][2], triggered by the [turbo-orchestrator][3] bot.

---

Turborepo CLI Release Process - In-Depth Guide

This section provides comprehensive documentation on how the Turborepo CLI is released, including the architecture, workflows, and detailed step-by-step processes.

Table of Contents

1. Architecture Overview
2. Automated Canary Releases
3. Version Management
4. Release Workflow Stages
5. Packages Released

... (truncated)

Commits

• 53752d4 publish 2.10.12 to registry
• 9d2b03b fix: Run pnpm directly on Windows (#13843)
• c97782b feat: Require high confidence for issue fixes (#13842)
• f153cda chore: Alert Slack for low-confidence issues (#13841)
• e1674e4 chore: Add automatic issue handling (#13840)
• 7107f26 fix: Escape ampersands in RSS feed enclosure URLs (#13839)
• a76330b chore: Handle feedback on Factory pull requests (#13836)
• 3787c06 chore: Use geistdocs 1.23.1 (#13834)
• bbe5406 chore: Skip redundant Factory PR approval (#13837)
• 72805d7 fix: Move model selector to workspace creation (#13835)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for turbo since your current version.

Updates @babel/core from 7.28.4 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

• babel-generator
  • #18014 Catchup source map position in preserveFormat (@​nicolo-ribaudo)
• babel-core
  • #18001 [7.x packport]Improve input source map handling (@​JLHwung)
• babel-core, babel-generator
  • #17998 Preserve original identifier names from input sourcemaps (#17992) (@​Andarist)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Mateusz Burzyński (@​Andarist)
• Nicolò Ribaudo (@​nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser

... (truncated)

Commits

• 4fba754 v7.29.7
• 04ea6b2 v7.29.6
• 99f498a [7.x packport]Improve input source map handling (#18001)
• feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
• aa8394e v7.29.0
• ad0d03f [7.x backport] feat: Allow specifying startLine in code frame (#17739)
• d7f4008 v7.28.6
• e130225 Polish(standalone): improve message on invalid preset/plugin (#17606)
• 99dcba5 chore: enable some ts-eslint rules (#17592)
• c92c491 Improve Unicode handling in code-frame tokenizer (#17589)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/core since your current version.

Updates ws from 6.2.3 to 6.2.6

Release notes

Sourced from ws's releases.

6.2.6

Bug fixes

• Fixed a bug introduced in version 6.2.5 that prevented the fragment counter from resetting (899bf9e5).

6.2.5

Bug fixes

• Backported a2f4e7c0 and f197ac65 to the v6.x release line (58ddc8c3, 4f19c0cd).

6.2.4

Bug fixes

• Backported 2b2abd45 to the 6.x release line (a76e2111).

Commits

• dd3ae14 [dist] 6.2.6
• 899bf9e [fix] Reset the fragment counter when the message is complete
• 1a0afaf [dist] 6.2.5
• 4f19c0c [fix] Lower default values of maxBufferedChunks and maxFragments
• 58ddc8c [fix] Count empty fragments toward the limit (#2329)
• 86d3e8a [dist] 6.2.4
• a76e211 [security] Limit retained message parts
• See full diff in compare view

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• ab85ae2 3.15.1 released
• 30a5e76 dist rebuild
• 22a8071 Backport quadratic complexity fix for !!omap
• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• 2203f4f 1.1.15
• 0b09384 Backport v5.0.6 change to v1 (#111)
• 10c05fc 1.1.14
• Additional commits viewable in compare view

Updates body-parser from 1.20.3 to 1.20.8

Release notes

Sourced from body-parser's releases.

1.20.8

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

• ci: backport npm-publish workflow from master by @​UlisesGascon in expressjs/body-parser#769
• 1.20.8 by @​UlisesGascon in expressjs/body-parser#770

Full Changelog: expressjs/body-parser@1.20.7...1.20.8

1.20.7

What's Changed

• docs: include security fix in 1.20.6 changes by @​UlisesGascon in expressjs/body-parser#747
• deps: qs@~6.16.0 by @​krzysdz in expressjs/body-parser#761
• 1.20.7 by @​UlisesGascon in expressjs/body-parser#767

Full Changelog: expressjs/body-parser@1.20.6...1.20.7

1.20.6

Important: Security

• Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• fix: improve limit option validation by @​Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (expressjs/body-parser#716)

• refactor(json): simplify strict mode error string construction by @​jonchurch in expressjs/body-parser#692
• fix: correct off-by-one error in parameterCount by @​abhu85 in expressjs/body-parser#716
• deps(qs): bump qs to 6.15.1 by @​jonchurch in expressjs/body-parser#722
• Release: 1.20.5 by @​jonchurch in expressjs/body-parser#721

New Contributors

• @​abhu85 made their first contribution in expressjs/body-parser#716

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.8

• Same code base as 1.20.7. This was created to test the new release process.

1.20.7

• deps: qs@~6.16.0

1.20.6

• Security fix for GHSA-v422-hmwv-36x6
• fix: improve limit option validation (#698)
  • Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement
  • null and undefined fall back to the default 100kb limit

1.20.5

• refactor(json): simplify strict mode error string construction
• fix: extended urlencoded parsing of arrays with >100 elements (#716)
• deps: qs@~6.15.1

1.20.4

• deps: qs@~6.14.0
• deps: use tilde notation for dependencies
• deps: http-errors@~2.0.1
• deps: raw-body@~2.5.3

Commits

• 5c08c20 1.20.8 (#770)
• 0cea4f4 ci: backport npm-publish workflow from master (#769)
• 0f0f0d7 1.20.7 (#767)
• 355eb04 deps: qs@~6.16.0 (#761)
• 8be369a docs: include security fix in 1.20.6 changes
• 5cc4fb8 1.20.6 (#746)
• 3492672 fix: improve limit option validation (#741)
• 0defdbe release(patch): 1.20.5
• cd0e7a0 deps(qs): bump qs to 6.15.1
• 6f24d7e fix: correct off-by-one error in parameterCount (#716)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for body-parser since your current version.

Updates fast-uri from 3.1.0 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

• Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

... (truncated)

Commits

• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• ae92a4c Merge commit from fork
• 444ecda Merge commit from fork
• Additional commits viewable in compare view

Updates ip-address from 10.0.1 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

• Honor the fromURL graceful-failure contract for non-IPv6 hosts by @​beaugunderson in beaugunderson/ip-address#218
• Correct the documentation where it disagreed with the library by @​beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

• Add GitHub Actions CI by @​beaugunderson in beaugunderson/ip-address#213
• Keep the package loadable on node 12, and enforce it by @​beaugunderson in beaugunderson/ip-address#216
• Validate the byte arrays Address6 is given by @​beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

• 2b7cab5 10.7.0
• 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
• 42c1f8b 10.6.0
• fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
• 38b02d7 10.5.1
• d03e960 Merge commit from fork
• ab3dc88 Merge commit from fork
• ef98e0a 10.5.0
• 9fd1110 Correct the documentation where it disagreed with the library (#219)
• d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates launch-editor from 2.11.1 to 2.14.1

Commits

• 3f97c64 v2.14.1
• 0cc9550 fix: reject UNC paths (#138)
• afd1ab9 ci: run tests on mac and windows (#136)
• 0bfa328 test: add some tests for launch-editor package (#135)
• 1b006ae chore: add README (#134)
• 383ef26 v2.14.0
• 6277209 ci: harden publish settings
• 520b2f7 fix(deps): update all non-major dependencies (#129)
• 475ac66 chore(deps): update dependency lint-staged to v17 (#130)
• 247bf1d chore(deps): update dependency yorkie to v2 (#131)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for launch-editor since your current version.

Updates shell-quote from 1.8.3 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3
• [readme] remove the space in js code fences so evalmd evaluates them 2116fa3
• [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f
• [readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e
• [readme] document parse's supported parameter-expansion subset e1c75cd
• [Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3
• [readme] fix stale example outputs 2de86f5
• [Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236
• [readme] quote: use output verbatim; do not re-quote it (#11) 1b36468
• [Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c
• [types] fix an error TS v6 ignores but v7 fails on 59bbf8b
• [Dev Deps] update @arethetypeswrong/cli, evalmd a04d475
• [Dev Deps] update @arethetypeswrong/ci, eslint d390f9a
• [Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

• [New] add types dca6e21
• [Dev Deps] update eslint 9aa9e8f
• [Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488
• [actions] update workflows 75e8497
• [actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d
• [actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163
• [actions] Windows + node 5/7: install deps with a modern node b4bafa2
• [Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a
• [Dev Deps] update auto-changelog, tape 7184b44
• [Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

• [Fix] quote: validate object-token shapes 4378a6e
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0
• [Tests] increase coverage 9f3caa3
• [readme] replace runkit CI badge with shields.io check-runs badge 3344a04
• [Dev Deps] update @ljharb/eslint-config 699c511

Commits

• 64988d9 v1.10.0
• 617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
• 59bbf8b [types] fix an error TS v6 ignores but v7 fails on
• 190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
• a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
• b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting...

  Description has been truncated

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
airborne-react-native/example/package.json	63% smaller
airborne-react-native/package.json	62% smaller
airborne-react-native/ExampleSplitBundle/package-lock.json	57% smaller
airborne_docs/package-lock.json	53% smaller
airborne_dashboard/package-lock.json	52% smaller
airborne_server/cf_host/package-lock.json	46% smaller
package-lock.json	37% smaller
airborne-react-native/ExampleOldArch/package-lock.json	32% smaller
airborne-react-native/ExampleOldArch/package.json	0% smaller
airborne-react-native/ExampleSplitBundle/package.json	0% smaller
airborne_dashboard/package.json	0% smaller

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 23f38d99-c715-43ed-820e-afb07cc6c46d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}