Update typescript eslint dependencies (2 packages)

[fossabot]

This PR catches up on 2 dependency updates.

Why These Dependencies Were Grouped

Both packages are from the same @typescript-eslint suite and must be kept in sync for TypeScript linting to work properly

Summary

The risk vs reward score of this upgrade is 328 (higher is better). View full report

Breaking	Security	Bug Fixes	Features	Deprecations
0	2	96	32	9

fossabot has not analyzed the impact of these changes on your codebase yet.

You can start an analysis with @fossabot analyze.

---

Package Updates (2)

• @typescript-eslint/eslint-plugin: 8.58.2 → 8.63.0 (notes | diff)
• @typescript-eslint/parser: 8.58.0 → 8.63.0 (notes | diff)

---

fossabot created this PR

[fossabot]

✓ Safe to upgrade

I recommend merging this upgrade because both @​typescript-eslint/eslint-plugin and @​typescript-eslint/parser are pure developer tooling dependencies confined entirely to eslint.config.mjs, with zero runtime impact on the application. The upgrade spans several minor and patch releases delivering 96 bug fixes — notably a stack overflow fix in the no-floating-promises rule when evaluating recursive types — and 28 new features. No breaking changes affecting the codebase were detected. The project's declared typescript version (^5.x) falls comfortably within the supported peer dependency range for this release, so the TypeScript 7.x runtime crash reported upstream does not apply here. The security-themed entries in the changelog ('Configured pnpm for better security') are internal housekeeping items within the typescript-eslint monorepo itself — no CVEs were validated for either package in this upgrade range. The two malicious packages flagged (@​typescript_eslinter/eslint and @​typescript_eslinter/prettier) are entirely distinct typosquatting packages and pose no risk to this upgrade; the legitimate packages being upgraded are not compromised.

What we checked

• @​typescript-eslint/eslint-plugin is declared as ^8.63.0 in devDependencies — confirms it is a dev-only tooling dependency with no runtime exposure. ^[1]
• @​typescript-eslint/parser is declared as ^8.63.0 in devDependencies — same dev-only scope, no production bundle impact. ^[2]
• Project declares typescript: "^5.9.3", which is within the peer dependency range (>=4.8.4 <6.1.0) supported by this release. The TypeScript 7.x crash reported upstream is not applicable. ^[3]
• @​typescript-eslint/eslint-plugin is imported as typescriptEslint and used solely within ESLint configuration — confirms no presence in application source code. ^[4]
• @​typescript-eslint/parser is imported as tsParser and registered as the ESLint language parser — dev tooling only, zero runtime impact. ^[5]
• tsParser is set as the languageOptions.parser — confirms the parser is consumed exclusively during linting, not in any shipped artifact. ^[6]
• A TypeScript 7.x peer dependency conflict causes a TypeError crash in @​typescript-eslint/typescript-estree at runtime. This is not relevant here because the project pins typescript to ^5.x, which is within the officially supported range. ^[7]
• Malicious typosquatting packages @​typescript_eslinter/eslint and @​typescript_eslinter/prettier impersonate the legitimate @​typescript-eslint packages. These are completely different packages and do not affect the packages being upgraded in this PR. The legitimate @​typescript-eslint/eslint-plugin and @​typescript-eslint/parser are not compromised. ^[8]

Dependency Usage

@​typescript-eslint/eslint-plugin and @​typescript-eslint/parser are exclusively used within eslint.config.mjs as developer tooling dependencies, with no presence in application source code. Together, they form the foundation of the project's TypeScript linting infrastructure — the parser enables ESLint to understand TypeScript syntax, while the plugin enforces a rich set of opinionated rules including @​typescript-eslint/naming-convention, @​typescript-eslint/array-type, @​typescript-eslint/no-use-before-define, and several others configured across the codebase. These are pure code-quality and standards-enforcement dependencies with zero runtime impact, serving only to maintain consistency and catch TypeScript-specific issues during development and CI.

• @​typescript-eslint/eslint-plugin is imported as typescriptEslint and used solely within ESLint configuration — confirms no presence in application source code.
  

  fossa-action/eslint.config.mjs

  Line 3 in 8c0afc7

  import typescriptEslint from "@typescript-eslint/eslint-plugin";

• @​typescript-eslint/parser is imported as tsParser and registered as the ESLint language parser — dev tooling only, zero runtime impact.
  

  fossa-action/eslint.config.mjs

  Line 7 in 8c0afc7

  import tsParser from "@typescript-eslint/parser";

View 1 more usage

• tsParser is set as the languageOptions.parser — confirms the parser is consumed exclusively during linting, not in any shipped artifact.
  

  fossa-action/eslint.config.mjs

  Line 45 in 8c0afc7

  parser: tsParser,

Changes

@​typescript-eslint/eslint-plugin and @​typescript-eslint/parser were updated with 2 security fixes (pnpm configuration hardening), along with numerous bug fixes targeting crash-prone rules including no-unnecessary-type-assertion (which previously threw TypeError: checker.getTypeArguments is not a function), no-floating-promises (stack overflow on recursive types), and several autofix correctness issues in no-unnecessary-boolean-literal-compare, consistent-indexed-object-style, and prefer-optional-chain. No breaking changes were introduced.

• Configured pnpm for better security (v8.60.0-8.60.1, commit)
• Configure pnpm for better security (v8.60.0-8.60.1, commit)
• eslint-plugin: [no-deprecated] object destructuring values should be treated as declarations (#12292) (v8.59.1-8.59.2, changelog)

View 448 more changes

• eslint-plugin: [no-unnecessary-type-assertion] fix crash "TypeError: checker.getTypeArguments is not a function" (#12246) (v8.59.0-8.59.1, changelog)
• typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340) (v8.59.3-8.59.4, changelog)
• eslint-plugin: [no-shadow] correct rule to match ESLint v10 handling (#12182) (v8.60.0-8.60.1, changelog)
• ast-spec: change type of UnaryExpression.prefix to always true (#12372) (v8.60.1-8.61.0, changelog)
• eslint-plugin: [consistent-indexed-object-style] do not remove comments when fixing (#12396, #10577) (v8.61.0-8.61.1, changelog)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] fix precedence bug in autofix (#12413) (v8.61.0-8.61.1, changelog)
• eslint-plugin: [prefer-optional-chain] use suggestion instead of autofix for trailing binary operator (#12328) (v8.62.0-8.62.1, changelog)
• eslint-plugin: [no-unnecessary-boolean-literal-compare] preserve boolean result in fixer for nullable true comparisons (#12365) (v8.62.0-8.62.1, changelog)
• rule-tester: add TypeScript as a peer dependency (#12288) (v8.59.1-8.59.2, changelog)
• rule-tester: added updates of RuleTester from upstream (#12291) (v8.59.4-8.60.0, changelog)
• add "files" to rule-schema-to-typescript-types (#12441) (v8.61.1-8.62.0, changelog)
• eslint-plugin: [no-unnecessary-type-assertion] report more cases based on assignability (#11789) (v8.58.2-8.59.0, changelog)
• Ulrich Stark (v8.58.2-8.59.0, changelog)
• eslint-plugin: [no-unnecessary-type-assertion] preserve index signatures in undefined unions (#12257) (v8.59.0-8.59.1, changelog)
• eslint-plugin: [no-unnecessary-type-assertion] preserve phantom type arguments in generic inference (#12269) (v8.59.0-8.59.1, changelog)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive in logical assignment assertions (#12278) (v8.59.0-8.59.1, changelog)
• eslint-plugin: [no-unnecessary-type-arguments] handle instantiation expressions (#12220) (v8.59.0-8.59.1, changelog)
• eslint-plugin: [no-unnecessary-condition] treat void as nullish in no-unnecessary-condition (#12241) (v8.59.0-8.59.1, changelog)
• anasm266 @​anasm266 (v8.59.0-8.59.1, changelog)
• Anshika Jain @​Anshikakalpana (v8.59.0-8.59.1, changelog)
• Ulrich Stark (v8.59.0-8.59.1, changelog)
• yugo innami @​nami8824 (v8.59.0-8.59.1, changelog)
• eslint-plugin: [no-unsafe-type-assertion] handle crash on recursive template literal types (#12150) (v8.59.1-8.59.2, changelog)
• Dariusz Czajkowski (v8.59.1-8.59.2, changelog)
• Dima Barabash (v8.59.1-8.59.2, changelog)
• Kirk Waiblinger @​kirkwaiblinger (v8.59.1-8.59.2, changelog)
• eslint-plugin: [no-floating-promises] stack overflow when using recursive types (#12294) (v8.59.3-8.59.4, changelog)
• project-service: throw error cause in getParsedConfigFileFromTSServer (#12321) (v8.59.3-8.59.4, changelog)
• Evyatar Daud @​StyleShit (v8.59.3-8.59.4, changelog)
• Kirk Waiblinger @​kirkwaiblinger (v8.59.3-8.59.4, changelog)
• lumir (v8.59.3-8.59.4, changelog)
• playground TS version selector is not working (#12326, #12325) (v8.59.4-8.60.0, changelog)
• Evyatar Daud @​StyleShit (v8.59.4-8.60.0, changelog)
• Vinccool96 (v8.59.4-8.60.0, changelog)
• eslint-plugin: respect ECMAScript line terminators in ts-comment rules (#12352) (v8.60.0-8.60.1, changelog)
• lumir (v8.60.0-8.60.1, changelog)
• Nevette Bailey @​nevette-bailey (v8.60.0-8.60.1, changelog)
• ast-spec: tighten types of ArrowFunction, YieldExpression, TSTypePredicate (#12373) (v8.60.1-8.61.0, changelog)
• rule-schema-to-typescript-types: respect ECMAScript line terminators (#12374) (v8.60.1-8.61.0, changelog)
• Kirk Waiblinger @​kirkwaiblinger (v8.60.1-8.61.0, changelog)
• lumir (v8.60.1-8.61.0, changelog)
• eslint-plugin: [no-unnecessary-type-assertion] avoid false positive for template literal expressions (#12281) (v8.61.0-8.61.1, changelog)
• eslint-plugin: [no-unnecessary-type-assertion] wrap object literal in parens when removing TSTypeAssertion in arrow body (#12394, #12393) (v8.61.0-8.61.1, changelog)
• eslint-plugin: [no-unnecessary-template-expression] respect ECMAScript line terminators (#12388) (v8.61.0-8.61.1, changelog)
• Anas @​anasm266 (v8.61.0-8.61.1, changelog)
• Deftera @​Deftera186 (v8.61.0-8.61.1, changelog)
• Kirk Waiblinger @​kirkwaiblinger (v8.61.0-8.61.1, changelog)
• lumir (v8.61.0-8.61.1, changelog)
• Sarath Francis @​sarathfrancis90 (v8.61.0-8.61.1, changelog)
• remove redundant package.json "files" (#12444) (v8.61.1-8.62.0, changelog)
• Kirk Waiblinger @​kirkwaiblinger (v8.61.1-8.62.0, changelog)
• eslint-plugin: [no-unnecessary-type-assertion] parenthesize object literal at left edge of expression statement (#12443, #12418) (v8.62.0-8.62.1, changelog)
• Kirk Waiblinger @​kirkwaiblinger (v8.62.0-8.62.1, changelog)
• mdm317 (v8.62.0-8.62.1, changelog)
• Patrick Aleite (v8.62.0-8.62.1, changelog)
• 송재욱 (v8.62.0-8.62.1, changelog)
• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426) (v8.62.1-8.63.0, changelog)
• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446) (v8.62.1-8.63.0, changelog)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485) (v8.62.1-8.63.0, changelog)
• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492) (v8.62.1-8.63.0, changelog)
• scope-manager: export ClassStaticBlockScope (#12460) (v8.62.1-8.63.0, changelog)
• Evyatar Daud @​StyleShit (v8.62.1-8.63.0, changelog)
• Kristjan @​KristjanTammekivi (v8.62.1-8.63.0, changelog)
• Michael Naumov @​mnaoumov (v8.62.1-8.63.0, changelog)
• Serhii Leniv @​Serhii-Leniv (v8.62.1-8.63.0, changelog)
• 송재욱 (v8.62.1-8.63.0, changelog)
• chore: fix cspell violations in code blocks (v8.58.2-8.59.0, commit)
• Fixed [no-unnecessary-condition] to treat void as nullish (v8.59.0-8.59.1, commit)
• Fixed [no-unnecessary-type-arguments] to handle instantiation expressions (v8.59.0-8.59.1, commit)
• Fixed [no-unnecessary-type-assertion] to avoid false positive (v8.59.0-8.59.1, commit)
• Fixed [no-unnecessary-type-assertion] to preserve phantom type arguments (v8.59.0-8.59.1, commit)
• Fixed [no-unnecessary-type-assertion] crash with "TypeError: ch..." (v8.59.0-8.59.1, commit)
• Fixed no-deprecated rule to properly handle object destructuring values (v8.59.1-8.59.2, commit)
• Corrected ESLint capitalization typos in playground documentation (v8.59.1-8.59.2, commit)
• Fixed no-unsafe-type-assertion rule to handle crash on recursive types (v8.59.1-8.59.2, commit)
• Fixed error cause handling in getParsedConfigFileFromTSServer in project-service (v8.59.3-8.59.4, commit)
• Fixed problems with generate-website-dts script (v8.59.3-8.59.4, commit)
• Fixed playground TS version selector (v8.59.4-8.60.0, commit)
• Fixed failing integration tests (v8.60.0-8.60.1, commit)
• Fixed defineConfig typos in documentation (v8.60.0-8.60.1, commit)
• Fixed lint issues (v8.60.0-8.60.1, commit)
• Fixed zizmor issues (v8.60.0-8.60.1, commit)
• Fixed [no-shadow] rule to match ESLint v10 handling (v8.60.0-8.60.1, commit)
• Fixed ts-comment rules to respect ECMAScript line terminators (v8.60.0-8.60.1, commit)
• Fix rule-schema-to-typescript-types to respect ECMAScript line terminators (v8.60.1-8.61.0, commit)
• Change type of UnaryExpression.prefix to always true in ast-spec (v8.60.1-8.61.0, commit)
• Fix typo in pack-packages.ts (v8.60.1-8.61.0, commit)
• fix(eslint-plugin): [no-unnecessary-template-expression] respect ECMAScript version (v8.61.0-8.61.1, commit)
• fix(eslint-plugin): [no-unnecessary-boolean-literal-compare] fix precedence (v8.61.0-8.61.1, commit)
• fix(eslint-plugin): [no-unnecessary-type-assertion] wrap object literal in parentheses (v8.61.0-8.61.1, commit)
• fix(eslint-plugin): [no-unnecessary-type-assertion] avoid false positives (v8.61.0-8.61.1, commit)
• fix(eslint-plugin): [consistent-indexed-object-style] do not remove comments (v8.61.0-8.61.1, commit)
• Fixed nx release dry run issues (v8.62.0-8.62.1, commit)
• Fixed eslint-plugin/require-test-error-position rule in eslint-plugin-internal (v8.62.0-8.62.1, commit)
• Fixed [no-unnecessary-type-assertion] rule to parenthesize object literals (v8.62.0-8.62.1, commit)
• Fixed [no-unnecessary-boolean-literal-compare] rule to preserve boolean context (v8.62.0-8.62.1, commit)
• Fixed [prefer-optional-chain] rule to use suggestion instead of autofix (v8.62.0-8.62.1, commit)

View 351 more changes in the full analysis

References (8)

[1]: @​typescript-eslint/eslint-plugin is declared as ^8.63.0 in devDependencies — confirms it is a dev-only tooling dependency with no runtime exposure.

fossa-action/package.json

Line 24 in 8c0afc7

"@typescript-eslint/eslint-plugin": "^8.63.0",

[2]: @​typescript-eslint/parser is declared as ^8.63.0 in devDependencies — same dev-only scope, no production bundle impact.

fossa-action/package.json

Line 25 in 8c0afc7

"@typescript-eslint/parser": "^8.63.0",

[3]: Project declares typescript: "^5.9.3", which is within the peer dependency range (>=4.8.4 <6.1.0) supported by this release. The TypeScript 7.x crash reported upstream is not applicable.

fossa-action/package.json

Line 37 in 8c0afc7

"typescript": "^5.9.3"

[4]: @​typescript-eslint/eslint-plugin is imported as typescriptEslint and used solely within ESLint configuration — confirms no presence in application source code.

fossa-action/eslint.config.mjs

Line 3 in 8c0afc7

import typescriptEslint from "@typescript-eslint/eslint-plugin";

[5]: @​typescript-eslint/parser is imported as tsParser and registered as the ESLint language parser — dev tooling only, zero runtime impact.

fossa-action/eslint.config.mjs

Line 7 in 8c0afc7

import tsParser from "@typescript-eslint/parser";

[6]: tsParser is set as the languageOptions.parser — confirms the parser is consumed exclusively during linting, not in any shipped artifact.

fossa-action/eslint.config.mjs

Line 45 in 8c0afc7

parser: tsParser,

[7]: A TypeScript 7.x peer dependency conflict causes a TypeError crash in @​typescript-eslint/typescript-estree at runtime. This is not relevant here because the project pins typescript to ^5.x, which is within the officially supported range. (source link)

[8]: Malicious typosquatting packages @​typescript_eslinter/eslint and @​typescript_eslinter/prettier impersonate the legitimate @​typescript-eslint packages. These are completely different packages and do not affect the packages being upgraded in this PR. The legitimate @​typescript-eslint/eslint-plugin and @​typescript-eslint/parser are not compromised. (source link)

---

fossabot analyzed this PR using static analysis and dependency research. View this analysis on the web

[fossabot]