chore(deps): Bump the dev-dependencies group with 3 updates

[dependabot]

Bumps the dev-dependencies group with 3 updates: @jridgewell/trace-mapping, @swc/core and cspell.

Updates @jridgewell/trace-mapping from 0.3.29 to 0.3.31

Changelog

Sourced from @​jridgewell/trace-mapping's changelog.

[0.3.31] - 2025-09-10

• Improve the performance of generatedPositionFor: #42

Full Changelog: jridgewell/sourcemaps@trace-mapping/0.3.30...trace-mapping/0.3.31

[0.3.30] - 2025-08-12

• Use default subpath export: jridgewell/sourcemaps@aab8d72
• Transform export default into module.exports = in UMD plugin: jridgewell/sourcemaps@cf85c75

Full Changelog: jridgewell/sourcemaps@trace-mapping/0.3.29...trace-mapping/0.3.30

Commits

• 74fc8e1 trace-mapping/0.3.31
• 2042d5f Use real arrays
• e2f5db1 simplifiy with PR feedback
• 5c8e94e Merge remote-tracking branch 'upstream/main' into connor4312/41
• 08f7307 Benchmark generatedPositionFor
• d3b3fcd lint
• 392ea80 fix: pathological slow case in bySource
• 095a582 trace-mapping/0.3.30
• aab8d72 Use default subpath condition for fallback
• See full diff in compare view

Updates @swc/core from 1.16.2 to 1.16.13

Changelog

Sourced from @​swc/core's changelog.

[1.16.13] - 2026-09-30

Bug Fixes

• (swc_config) Show why an options object failed to deserialize (#12441) (e92460a)

Performance

• (node) Optimize macOS native addon first load (#12436) (0b151bf)

Testing

• (es/ast) Add missing ctxt field to jsx_element serde test (#12439) (7dc1796)

[1.16.12] - 2026-09-29

Bug Fixes

• (binding/node) Return an error when a file cannot be read instead of panicking (#12379) (d342acd)

• (bindings) Detect macOS ACLs with supported APIs (#12391) (a73ea68)

• (es) Decode template raw values when cooked is missing (#12347) (7898152)

• (es/codegen) Minify unicode escapes in template literals (#12284) (76ef91c)

• (es/codegen) Separate generic type assertion openers (#12340) (8948dac)

• (es/compat) Preserve array rest when lowering nested object rest (#12352) (9348083)

• (es/lexer) Stop iteration when input is exhausted (#12388) (c392686)

• (es/minifier) Check eval and arguments usage in var define scope (#12174) (5d1aa16)

... (truncated)

Commits

• 1391a34 chore: Publish 1.16.13 with swc_core v81.0.2
• a006b7f chore: Publish 1.16.13-nightly-20260930.1 with swc_core v81.0.2
• 1b2c264 chore: Publish 1.16.12 with swc_core v81.0.1
• 5a1b45a chore: Publish 1.16.12-nightly-20260929.1 with swc_core v81.0.1
• 75a5566 chore: Publish 1.16.11-nightly-20260928.1 with swc_core v81.0.0
• 4c771b8 chore: Publish 1.16.10-nightly-20260928.1 with swc_core v81.0.0
• 2b292c8 fix(node): Repair native release verification and cache handling (#12415)
• 0c5c602 chore: Publish 1.16.9-nightly-20260923.1 with swc_core v80.0.1
• f6561b8 chore: Publish 1.16.8-nightly-20260918.1 with swc_core v80.0.0
• eea8cf9 chore: Publish 1.16.8-nightly-20260917.1 with swc_core v80.0.0
• Additional commits viewable in compare view

Updates cspell from 10.3.4 to 10.3.6

Release notes

Sourced from cspell's releases.

v10.3.6

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

cspell lint reports unknown in-document directives again, such as cspell:bad-dir, when --validate-directives or validateDirectives: true in the config asks for them. Since 9.1.0 they were found but never shown or counted.

• --validate-directives and --no-validate-directives override the config setting.
• An unknown directive counts as an issue, so cspell lint exits with an error, as it did before 9.1.0.
• The JSON reporter, @cspell/cspell-json-reporter, includes them in its output again.

• The default reporter and the JSON reporter now ask to receive directive issues. Other reporters still only get them if they ask for them.
• The command-line flag is now applied as a setting, like --report, so it controls what is shown as well as what is checked.

---

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

createRedirectProvider in cspell-io now only serves requests that map to a location under its private root. A request that would resolve outside the private root is refused with VFSErrorUnsupportedRequest, the same error as a request outside the public root.

• Refused: a path that starts with a separator (/, \, %2F, %5C) right after the public root.
• Now served from inside the private root: file names that look like a URL scheme or a drive, such as a:b.txt or C|. They used to resolve to a different URL.

cspell itself does not use createRedirectProvider. This affects projects that use cspell-io directly.

• The part of the URL after the public root is resolved as a relative path under the private root, and the result is checked to be under the private root: same protocol, same host, and the same path prefix.
• Results coming back from the private file system are checked the same way before they are shown under the public root.
• The change is in commit 25359026e1.

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.3.6 (2026-09-29)

Fixes

fix: Report unknown CSpell directives again (#9319)

Summary

cspell lint reports unknown in-document directives again, such as cspell:bad-dir, when --validate-directives or validateDirectives: true in the config asks for them. Since 9.1.0 they were found but never shown or counted.

• --validate-directives and --no-validate-directives override the config setting.
• An unknown directive counts as an issue, so cspell lint exits with an error, as it did before 9.1.0.
• The JSON reporter, @cspell/cspell-json-reporter, includes them in its output again.

• The default reporter and the JSON reporter now ask to receive directive issues. Other reporters still only get them if they ask for them.
• The command-line flag is now applied as a setting, like --report, so it controls what is shown as well as what is checked.

---

fix(cspell-io): Keep redirected requests under the private root (#9329)

Summary

createRedirectProvider in cspell-io now only serves requests that map to a location under its private root. A request that would resolve outside the private root is refused with VFSErrorUnsupportedRequest, the same error as a request outside the public root.

• Refused: a path that starts with a separator (/, \, %2F, %5C) right after the public root.
• Now served from inside the private root: file names that look like a URL scheme or a drive, such as a:b.txt or C|. They used to resolve to a different URL.

cspell itself does not use createRedirectProvider. This affects projects that use cspell-io directly.

• The part of the URL after the public root is resolved as a relative path under the private root, and the result is checked to be under the private root: same protocol, same host, and the same path prefix.
• Results coming back from the private file system are checked the same way before they are shown under the public root.
• The change is in commit 25359026e1.

... (truncated)

Commits

• 8559198 v10.3.6
• 72e1be3 chore: Prepare Release v10.3.6 (auto-deploy) (#9305)
• e230ca0 test: Give time-limited RPC and worker tests room on slow runners (#9330)
• 8eae6b6 fix: Report unknown CSpell directives again (#9319)
• a5f5111 fix: Don't reuse cached results made with different command-line options (#9318)
• 2f897be fix: --show-perf-summary shows where all of the run's time goes (#9307)
• fe37b7b chore: Label per package, and bugs links to its open issues (#9309)
• f37a244 v10.3.5
• b36374c chore: Prepare Release v10.3.5 (auto-deploy) (#9277)
• 93e55c0 fix(cspell-lib): shouldCheckDocument honors the forceCheck option (#9303)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions