Bump brace-expansion, ava, eslint and nyc

[dependabot]

Bumps brace-expansion to 5.0.8 and updates ancestor dependencies brace-expansion, ava, eslint and nyc. These dependencies need to be updated together.

Updates brace-expansion from 1.1.8 to 5.0.8

Release notes

Sourced from brace-expansion's releases.

v4.0.1

• fmt 5a5cc17
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 0b6a978

---

juliangruber/brace-expansion@v4.0.0...v4.0.1

v4.0.0

• feat: use string replaces instead of splits (#64) 278132b
• fmt dd72a59
• add tea.yaml 70e4c1b

juliangruber/brace-expansion@v3.0.0...v4.0.0

As a precaution to not risk breaking anything with 278132b, this is a new semver major release

v3.0.1

• pkg: publish on tag 3.x 3059c07
• fmt 8229e6f
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 15f9b3c

---

juliangruber/brace-expansion@v3.0.0...v3.0.1

v3.0.0

• Switch to ES Modules and balanced-match 3.0.0 (#62) c0360e8
• added jsdoc (#55) 68c0e37
• node 16 is EOL 9e781e9
• add standard 3494c4d
• use const and let (#57) dd5a4cb
• docs 6dad209
• remove test e3dd8ae
• ci: update node versions d23ede9
• docs: add @​lanodan to contributors 1eb3fa4
• docs 1e7c9cd
• switch from tape to test module (#60) 2520537
• Bump minimist from 1.2.5 to 1.2.6 (#59) 61a94f1
• Bump path-parse from 1.0.6 to 1.0.7 (#51) dc741cf
• docs: add back ci badge 8ee5626
• Add github actions, remove travis. Closes #52 (#53) 5c8756a
• CI: Drop unused sudo: false Travis directive (#50) 05978a7

juliangruber/brace-expansion@v2.0.1...v3.0.0

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

... (truncated)

Commits

• 96a63c0 5.0.8
• a1bd339 Merge commit from fork
• 592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
• bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
• e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
• 5bf809e Remove Node.js 18 support (#110)
• 8cb5716 Bump markdown-it from 14.1.0 to 14.2.0 (#113)
• 43122df Bump sigstore from 4.1.0 to 4.1.1 (#119)
• 69bd65a Bump @​sigstore/verify from 3.1.0 to 3.1.1 (#118)
• b3bfbf0 Bump @​sigstore/core from 3.1.0 to 3.2.1 (#117)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates ava from 0.21.0 to 8.0.1

Release notes

Sourced from ava's releases.

v8.0.1

What's Changed

This release officially adds Node.js 26 support, with thanks to @​novemberborn in avajs/ava#3450.

Per our policy, support for Node.js 25 has been removed.

Full Changelog: avajs/ava@v8.0.0...v8.0.1

v8.0.0

Breaking Changes

AVA now expects Node.js 22.20, 24.12 or newer.

Internally AVA is now fully ESM. This is possible now that Node.js supports loading ES modules using require() calls and simplifies AVA's types and internals.

If you use AVA from a CommonJS project you'll have to update your imports:

-const test = require('ava');
+const {default: test} = require('ava');

We expect an increasing number of projects to be ESM only. As per the above, CommonJS is still supported, but we don't expect cjs extensions to be used. The default file extensions are now js and mjs. Specify extensions: ['cjs', 'js', 'mjs'] for AVA to run test files with the cjs extension.

All test files (and those loaded through AVA's require config) are now loaded via import(). Use customization hooks for transpilation. The object form of the extensions configuration is no longer supported.

If you use AVA with @​ava/typescript you must upgrade that package to v7.

New Features

There's two new test modifiers courtesy of @​sindresorhus: test.skipIf() to skip a test based on a runtime condition. test.runIf() is the inverse: the test only runs when the condition is true.

test.skipIf(process.platform === 'win32')('not on Windows', t => {
	t.pass();
});
test.runIf(process.platform === 'linux')('Linux only', t => {
t.pass();
});

These work with other modifiers like .serial and .failing:

test.serial.skipIf(process.platform === 'win32')('serial, not on Windows', t => {
	t.pass();
});
</tr></table>

... (truncated)

Commits

• bbfd946 v8.0.1
• 332fcd7 Pre-release updates (#3451)
• fcaaf43 Add Node.js 26 support; drop 25 (#3450)
• a913804 Test using AVA 8 (#3440)
• fe31286 v8.0.0
• 7bdbabb Improve error when throwsAsync/notThrowsAsync is not awaited (#3436)
• a304990 Full ESM internals; bias away from CJS; require @​ava/typescript@​7
• d012c64 Update release process documentation (#3435)
• 2cea71e CI tweaks (#3438)
• 27e9c84 Remove Node.js 20 support; update dependencies prior to release (#3432)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ava since your current version.

Updates eslint from 4.4.1 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)

... (truncated)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by eslintbot, a new releaser for eslint since your current version.

Updates nyc from 11.1.0 to 18.0.0

Release notes

Sourced from nyc's releases.

nyc: v18.0.0

18.0.0 (2026-02-22)

⚠ BREAKING CHANGES

• deps: transitive dependencies now require node 20 || >=22.

Bug Fixes

• deps: update dependencies pulling in old glob (#1612) (0707729)

nyc: v17.1.0

17.1.0 (2024-09-19)

Features

• deps: bump foreground-child from ^2.0.0 to ^3.0.0 (#1546) (af74d1e)

Bug Fixes

• reduce size of serialized JSON output (#1570) (ae657b6)

nyc: v17.0.0

17.0.0 (2024-04-19)

⚠ BREAKING CHANGES

• minimum Node version now 18

Bug Fixes

• deps: address security alerts in deps (#1555) (b6ed598)

Build System

• minimum Node version now 18 (9ef340e)

Changelog

Sourced from nyc's changelog.

18.0.0 (2026-02-22)

⚠ BREAKING CHANGES

• deps: transitive dependencies now require node 20 || >=22.

Bug Fixes

• deps: update dependencies pulling in old glob (#1612) (0707729)

17.1.0 (2024-09-19)

Features

• deps: bump foreground-child from ^2.0.0 to ^3.0.0 (#1546) (af74d1e)

Bug Fixes

• reduce size of serialized JSON output (#1570) (ae657b6)

17.0.0 (2024-04-19)

⚠ BREAKING CHANGES

• minimum Node version now 18

Bug Fixes

• deps: address security alerts in deps (#1555) (b6ed598)

Build System

• minimum Node version now 18 (9ef340e)

16.0.0 (2024-04-10)

⚠ BREAKING CHANGES

• minimum Node version now 18

Bug Fixes

• deps: address security alerts in deps (#1555) (b6ed598)

... (truncated)

Commits

• 3ce6d97 chore(main): release nyc 18.0.0 (#1613)
• b9f6781 build: publication is now manual again due to changes in tokens
• 0707729 fix(deps)!: update dependencies pulling in old glob (#1612)
• 41f4476 chore(main): release nyc 17.1.0 (#1572)
• d338985 chore(deps-dev): bump requirejs from 2.3.6 to 2.3.7 (#1582)
• af74d1e feat(deps): bump foreground-child from ^2.0.0 to ^3.0.0 (#1546)
• ae657b6 fix: reduce size of serialized JSON output (#1570)
• b6a9484 chore(deps-dev): bump braces from 3.0.2 to 3.0.3 (#1571)
• b86edbc chore(deps-dev): bump ws from 8.16.0 to 8.17.1 (#1568)
• fee2821 chore(main): release nyc 17.0.0 (#1558)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.