chore(deps-dev)(deps-dev): bump the dev-tooling-minor-patch group with 3 updates

[dependabot]

Bumps the dev-tooling-minor-patch group with 3 updates: @typescript-eslint/parser, eslint-plugin-sonarjs and mysql2.

Updates @typescript-eslint/parser from 8.63.0 to 8.64.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

• support parsing import defer (#12513)
• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.64.0 (2026-07-13)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 414d9ab chore(release): publish 8.64.0
• See full diff in compare view

Updates eslint-plugin-sonarjs from 4.1.0 to 4.2.0

Changelog

Sourced from eslint-plugin-sonarjs's changelog.

Release Guide

SonarJS currently has two distinct release targets:

Target	Artifact	Main workflow	Notes
Standard SonarQube analyzer	Maven/JAR release artifacts	.github/workflows/automated-release.yml	This is the normal SonarJS release flow.
SQAA (previously A3S)	Docker image for LanguageAnalyzerService	.github/workflows/docker-sqaa.yml	Manual SQAA-only entry point and fallback.

Terminology

• SQAA is the current name for what older docs and repository names still call A3S.
• Some external identifiers still keep the legacy a3s name for compatibility. The important ones are:
  • the Docker repository path a3s/analysis/javascript
  • packages/grpc/src/proto/language_analyzer.proto with option java_package = "com.sonarsource.a3s.analyzer.grpc";
• Do not rename those compatibility-sensitive identifiers as part of a routine release.

Standard SonarQube Analyzer Release

This is the regular SonarJS analyzer release. It produces the standard SonarQube analyzer artifacts and can also automate the SQAA handoff using the same build number.

Entry points

1. Start .github/workflows/automated-release.yml.
2. That workflow orchestrates the release and then calls .github/workflows/release.yml for the actual artifact publication.
3. After the release succeeds, .github/workflows/bump-versions.yml opens the next development iteration PR.

What .github/workflows/automated-release.yml does

The SonarJS workflow is a thin wrapper around SonarSource/release-github-actions/.github/workflows/automated-release.yml@v1 with SonarJS-specific inputs:

• project name SonarJS
• plugin name javascript
• Jira project JS
• optional SQC and SQS integration PRs
• optional SQAA integration, enabled in the SonarJS wrapper and implemented by a custom local workflow
• SLVS, SLVSCODE, SLE, and SLI integration tickets enabled
• the generic release-github-actions SQAA integration explicitly disabled, because SonarJS uses analysis/js_ts_image_tag instead of gradle/sonar-plugins.versions.toml

The reusable workflow performs the following steps:

1. Freeze the target branch.
2. Run the releasability checks with SonarSource/gh-action_releasability@v3.
3. Resolve the release version with get-release-version.
4. Resolve the Jira version with get-jira-version.
5. Generate Jira-based release notes with get-jira-release-notes unless explicit notes were provided.
6. Create the REL Jira ticket with create-jira-release-ticket.
7. Publish the GitHub release with publish-github-release.
8. Unfreeze the branch.
9. Release the Jira version, create the next Jira version, and move the REL ticket to Technical Release Done.

... (truncated)

Commits

• See full diff in compare view

Updates mysql2 from 3.22.6 to 3.23.1

Release notes

Sourced from mysql2's releases.

v3.23.1

3.23.1 (2026-07-19)

Bug Fixes

• security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
• parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

v3.23.0

3.23.0 (2026-07-13)

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

Changelog

Sourced from mysql2's changelog.

3.23.1 (2026-07-19)

Bug Fixes

• security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
• parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

3.23.0 (2026-07-13)

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (5034e57)

Commits

• 3de28fb chore(master): release 3.23.1 (#4408)
• 01f1092 fix(parser): call typeCast for NULL values in the binary protocol (#3368) (#4...
• 534c552 build(deps): bump lucide-react from 1.24.0 to 1.25.0 in /website (#4407)
• 7c48343 Merge commit from fork
• 3e13d7b docs: establish security charter (#4404)
• 26c135b build(deps): bump websocket-driver from 0.7.4 to 0.7.5 in /website (#4403)
• f86cfb1 chore(master): release 3.23.0 (#4387)
• 6316492 build(deps): bump the docusaurus group in /website with 2 updates (#4396)
• 6b933f6 feat(sql-escaper): add Temporal support when escaping values (#4392)
• 457c316 build(deps): bump lucide-react from 1.23.0 to 1.24.0 in /website (#4391)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

📊 Coverage Report

Metric		PR	Base	Diff
Statements	████████████████████	2070/2070 (100%)	2070/2070 (100%)	⚪ 0%
Branches	████████████████████	279/279 (100%)	279/279 (100%)	⚪ 0%
Functions	████████████████████	88/88 (100%)	88/88 (100%)	⚪ 0%
Lines	████████████████████	2070/2070 (100%)	2070/2070 (100%)	⚪ 0%

---

_{Updated for 1e18854 | Compared against base branch}

[github-actions]

⏱️ Performance Report

✅ Tests	135 passed, 0 failed, 0 skipped
🧪 Suites	32
⏱️ Total step time	261.00s 🔴 +1.00s
⚙️ Test execution	253.43s 🔴 +793ms

🐢 Slowest test suites

#	Suite	Tests	Duration	vs Base
1	PostgresWakeListener	17	28.80s	🟢 -726ms
2	runWorkerLoop	13	22.20s	🟢 -174ms
3	OutboxClaimer (publish outcomes)	9	15.89s	⚪ ~0
4	WakeSocketServer + WakeSocketClient	9	15.81s	🔴 +74ms
5	KafkaInboxConsumer	8	13.90s	🔴 +119ms
6	SqliteOutboxStore	8	13.81s	🔴 +361ms
7	MysqlOutboxStore	7	12.42s	🔴 +467ms
8	OutboxWaker	7	12.08s	🟢 -317ms
9	InProcessOutboxTransport	5	8.80s	🔴 +446ms
10	SqliteInboxStore	5	8.71s	🔴 +254ms

🐌 Slowest individual tests

#	Suite	Test	Duration	vs Base
1	PostgresOutboxStore wakeChannel	PostgresOutboxStore wakeChannel enqueue fires pg_notify on the configured channel (observed via LISTEN)	3.56s	🔴 +86ms
2	OutboxProducer (atomic enqueue)	OutboxProducer (atomic enqueue) enqueue commits the outbox row with the business write	2.65s	⚪ ~0
3	OutboxClaimer (publish outcomes)	OutboxClaimer (publish outcomes) tick publishes a pending row and marks it completed	2.03s	🔴 +191ms
4	OutboxProducer (atomic enqueue)	OutboxProducer (atomic enqueue) a throw rolls back BOTH the outbox row and the business write	2.00s	🟢 -52ms
5	transport errors	transport errors RetryableError carries name and optional delay	1.92s	🔴 +154ms
6	InProcessOutboxTransport	InProcessOutboxTransport publish dispatches the payload AND the full message to the topic handler	1.91s	🔴 +107ms
7	KafkaInboxConsumer	KafkaInboxConsumer dead-letters an invalid payload (with x-error) and acks	1.91s	🔴 +228ms
8	KafkaOutboxTransport	KafkaOutboxTransport publishes JSON value, prefixed topic, key and dedup headers	1.89s	🔴 +90ms
9	PostgresWakeListener	PostgresWakeListener a server-side clean end (no error) also reconnects	1.89s	🔴 +69ms
10	PostgresOutboxStore	PostgresOutboxStore markCompleted / retry / markFailed transition the row	1.88s	🔴 +95ms
11	MysqlOutboxStore	MysqlOutboxStore markCompleted transitions the row to completed	1.88s	🔴 +225ms
12	isMysqlUniqueViolation	isMysqlUniqueViolation rejects other errors and non-objects	1.88s	⚪ ~0
13	OutboxClaimer (publish outcomes)	OutboxClaimer (publish outcomes) a PermanentError fails the row immediately (and warns with the reason)	1.88s	🔴 +181ms
14	runWorkerLoop	runWorkerLoop aborting during a tick short-circuits the idle sleep	1.88s	🔴 +192ms
15	KafkaInboxConsumer	KafkaInboxConsumer reads a string message key (dedup falls back to it without headers)	1.87s	🔴 +209ms

---

_{Updated for 1e18854 | Compared against base branch}

[github-actions]

🧠 Cognitive Complexity Report

Metric	PR	Base	Diff
Total complexity	79	79	⚪ 0
Max function complexity	12	12	⚪ 0
Functions measured	39	39	⚪ 0

🧩 Most complex functions

Function	Location	Complexity	Status
runWorkerLoop	packages/messaging/outbox-worker.ts:34	12	🟢 OK
KafkaInboxConsumer.consume	packages/messaging/adapters/kafka/kafka-inbox-consumer.ts:67	5	🟢 OK
PostgresWakeListener.#supervise	packages/messaging/dialects/postgres/wake.ts:122	5	🟢 OK
WakeSocketServer.listen	packages/messaging/wake-socket.ts:52	5	🟢 OK
OutboxClaimer.onPublishError	packages/messaging/outbox-claimer.service.ts:84	4	🟢 OK
deriveDedupKey	packages/messaging/wire-contract.ts:55	4	🟢 OK
MysqlInboxStore.runOnce	packages/messaging/dialects/mysql/inbox-store.ts:43	3	🟢 OK
PostgresInboxStore.runOnce	packages/messaging/dialects/postgres/inbox-store.ts:37	3	🟢 OK
SqliteInboxStore.runOnce	packages/messaging/dialects/sqlite/inbox-store.ts:39	3	🟢 OK
KafkaInboxConsumer.readKey	packages/messaging/adapters/kafka/kafka-inbox-consumer.ts:90	2	🟢 OK

🧭 Cognitive complexity is reported as a review signal, not a merge gate. Prefer small, intention-revealing refactors when complexity rises.

---

_{Updated for 1e18854 | Compared against base branch}