build: bump the dependencies group across 1 directory with 11 updates

[dependabot]

Bumps the dependencies group with 11 updates in the / directory:

Package	From	To
eslint-config-availity	16.0.1	16.0.2
lint-staged	17.5.1	17.6.0
prettier	3.9.6	3.9.9
@availity/analytics-core	7.3.1	7.3.4
moment	2.30.1	2.31.0
@availity/message-core	9.3.2	9.4.0
@availity/native-form	8.3.1	8.3.4
@availity/resolve-url	5.3.1	5.4.0
qs	6.15.2	6.16.0
libphonenumber-js	1.13.13	1.13.14
react-select-async-paginate	0.6.2	0.7.11

Updates eslint-config-availity from 16.0.1 to 16.0.2

Release notes

Sourced from eslint-config-availity's releases.

v16.0.2

16.0.2 (2026-09-29)

Bug Fixes

• deps: update ESLint runtime dependencies (ee9889d)

Changelog

Sourced from eslint-config-availity's changelog.

16.0.2 (2026-09-29)

Bug Fixes

• deps: update ESLint runtime dependencies (ee9889d)

Commits

• 947c0ec Merge pull request #494 from Availity/release-please--branches--master--compo...
• da97b8d chore(master): release 16.0.2
• c336a4c Merge pull request #493 from Availity/chore/upgrade-vitest-v5
• 23d19c5 chore: remove stale dependabot ignore entries
• ee9889d fix(deps): update ESLint runtime dependencies
• See full diff in compare view

Updates lint-staged from 17.5.1 to 17.6.0

Release notes

Sourced from lint-staged's releases.

v17.6.0

Minor Changes

• #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*': {
  title: 'Fail if PDF files are committed',
  task: async (filepaths, { log }) => {
  const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
  if (pdfFiles.length > 0) {
  log('PDF files should not be committed: %s', pdfFiles)
  throw new Error('Failed')
  }
  },
  },
  })

• #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

  If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

• #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

• #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
  })

• #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

• #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

Changelog

Sourced from lint-staged's changelog.

17.6.0

Minor Changes

• #1850 938d3f4 - Task functions like { title, task } can now use a logger function log() to emit output while the task runs. By default, the output will only be visible if the task fails, unless the --verbose option was used. Additionally, when the task rejects, the error will be shown in the output.

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*': {
  title: 'Fail if PDF files are committed',
  task: async (filepaths, { log }) => {
  const pdfFiles = filepaths.filter((f) => f.toLowerCase().endsWith('.pdf'))
  if (pdfFiles.length > 0) {
  log('PDF files should not be committed: %s', pdfFiles)
  throw new Error('Failed')
  }
  },
  },
  })

• #1854 30562bc - lint-staged now stages changes to all tracked files modified by tasks, including files that weren’t originally staged or didn’t match the configured globs. This can happen when your task has side-effects, or it's a function that ignores the staged files like () => "prettier --write .".

  If you have unstaged changes in a file and the task also edits that file, your unstaged changes will be staged too. Use --hide-unstaged to hide your changes while tasks run.

Patch Changes

• #1860 4296532 - The assignment of staged files to lint-staged configuration files (when using multiple, for example in a monorepo) has been rewritten to be more efficient. As a reminder, each staged file is assigned to exactly one configuration (the closest one), even if that config doesn't match the file in its globs.

• #1861 c45f28a - Fix running parallel tasks for a single glob, when tasks are created by a function. Nesting one level of arrays inside an array of tasks will result in the inner tasks running in parallel. This behavior should now be consistent when creating tasks using functions. In the following example eslint and prettier will run in parallel (for all files, when any JS files are staged):

  import { defineConfig } from 'lint-staged/config'
  export default defineConfig({
  '*.js': () => [['eslint --max-warnings=0 .', 'prettier --list-different .']],
  })

• #1859 f0ea69d - Various performance improvements from skipping redundant internal Git calls.

• #1856 69d7d17 - Partially staged changes are hidden in a uniquely-named patch file to avoid multiple invocations of lint-staged overwriting it. This makes it safer to run lint-staged in multiple worktrees at the same time.

Commits

• 48f9f4e Merge pull request #1857 from lint-staged/changeset-release/main
• 16b2e21 chore(changeset): release
• 195f156 docs: improve changeset
• 0ba6261 fix: create hidden directory only when required
• 66ac2de docs: fixes to changesets
• 80af8d7 Merge pull request #1863 from lint-staged/fix-issues
• e433488 fix: handle task editing a symlinked file to a regular file, and --fail-on-ch...
• e5019b3 fix: handle trailing newlines when detecting changed files
• 74efec8 ci: run Cygwin and MSYS2 tests on Node.js 26
• 655b7dc fix: use TypeScript types instead of JSDoc
• Additional commits viewable in compare view

Updates prettier from 3.9.6 to 3.9.9

Release notes

Sourced from prettier's releases.

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
</tr></table> 

... (truncated)

Commits

• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• Additional commits viewable in compare view

Updates @availity/analytics-core from 7.3.1 to 7.3.4

Changelog

Sourced from @​availity/analytics-core's changelog.

7.3.4 (2026-10-02)

Dependency Updates

• api-axios updated to version 7.3.3

7.3.3 (2026-10-01)

Dependency Updates

• api-axios updated to version 7.3.2

7.3.2 (2026-10-01)

Dependency Updates

• api-axios updated to version 7.3.1

Commits

• a5fbe8e chore(analytics-core): release version 7.3.4 [skip ci]
• f450051 chore(analytics-core): release version 7.3.3 [skip ci]
• 0a88496 chore: improve test correctness and coverage across packages
• 2ef52c0 chore(analytics-core): release version 7.3.2 [skip ci]
• See full diff in compare view

Updates moment from 2.30.1 to 2.31.0

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

Changelog

Sourced from moment's changelog.

2.31.0

Released Sep 14, 2026

Security fixes

• Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

• #6376 Prevent object prototype properties from being used as format tokens
• #6386 Normalize lazy-loaded locale names
• #6404 Fix parsing issue with eHHmm format
• #6433 Ignore non-Moment arguments in min and max
• #6434 Fix inherited lowercase long date formats
• #6436 Reset locale parsing caches after updates
• #6437 Fix weekday mismatch when the format only has part of a date
• #6442 Fix locale('__proto__') corrupting the global locale
• #6443 Avoid Object.assign in duration.humanize
• #6446 Validate range when parsing a time zone offset
• #6447 Include metadata in all-locales bundle
• #6448 Apply postformat to locale relative time methods
• #6450 Add stack traces to conditional deprecation warnings

New features

• #6451 Add internal date-default hook for Moment Timezone

New locales

• #6000: Pashto ('ps')
• #6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

• #5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time
• #6197 Indonesian ('id'): Correct the abbreviation for August
• #6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats
• #6289 Swedish ('sv'): Correct the abbreviation for Thursday
• #6306 Catalan ('ca'): Use typographic apostrophes in relative time
• #6347 Swahili ('sw'): Correct the spelling of hour in calendar output
• #6360 Ukrainian ('uk'): Use ISO week numbering
• #6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names
• #6371 Hungarian ('hu'): Preserve numeric values in relative seconds
• #6391 Swahili ('sw'): Fix weekday and relative-time grammar
• #6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots
• #6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting
• #6410 Polish ('pl'): Use genitive month names in dotted day formats

Commits

• 15b45d4 [pkg] Build 2.31.0 (#6452)
• 631cd81 [pkg] Update changelog for upcoming release (#6394)
• 6caff9e Merge commit from fork
• 710703b [feature] Add internal date-default hook for Moment Timezone (#6451)
• 863ed94 [bugfix] Add stack traces to conditional deprecation warnings (#6450)
• 2c7abe1 [bugfix] Apply postformat to locale relative time methods (#6448)
• 9c45ac3 [bugfix] Include metadata in all-locales bundle (#6447)
• f6eefc5 [bugfix] Validate timezone offset range (#6446)
• 136b441 [bugfix] Avoid Object.assign in duration.humanize (#6443)
• 0d10504 [bugfix] Fix locale('proto') corrupting the global locale (#6442)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for moment since your current version.

Updates @availity/message-core from 9.3.2 to 9.4.0

Changelog

Sourced from @​availity/message-core's changelog.

9.4.0 (2026-10-02)

Features

• message-core: convert package to TypeScript (888963d)

9.3.3 (2026-10-01)

Commits

• 4ad760a chore(message-core): release version 9.4.0 [skip ci]
• 888963d feat(message-core): convert package to TypeScript
• e98472e chore(message-core): release version 9.3.3 [skip ci]
• 0a88496 chore: improve test correctness and coverage across packages
• See full diff in compare view

Updates @availity/native-form from 8.3.1 to 8.3.4

Changelog

Sourced from @​availity/native-form's changelog.

8.3.4 (2026-10-02)

Dependency Updates

• api-axios updated to version 8.3.3

8.3.3 (2026-10-01)

Dependency Updates

• api-axios updated to version 8.3.2

8.3.2 (2026-10-01)

Dependency Updates

• api-axios updated to version 8.3.1

Commits

• 5b54cd3 chore(native-form): release version 8.3.4 [skip ci]
• e025005 chore(native-form): release version 8.3.3 [skip ci]
• 8b19a68 chore(native-form): release version 8.3.2 [skip ci]
• See full diff in compare view

Updates @availity/resolve-url from 5.3.1 to 5.4.0

Changelog

Sourced from @​availity/resolve-url's changelog.

5.4.0 (2026-10-02)

Features

• resolve-url: convert package to TypeScript (60d5cd9)

Commits

• cbb6393 chore(resolve-url): release version 5.4.0 [skip ci]
• 231981d refactor(resolve-url): replace indexOf === 0 with startsWith
• f815176 refactor(resolve-url): replace deprecated substr with slice
• 60d5cd9 feat(resolve-url): convert package to TypeScript
• See full diff in compare view

Updates qs from 6.15.2 to 6.16.0

Changelog

Sourced from qs's changelog.

6.16.0

• [New] stringify: add a depth option to bound recursion depth (default Infinity)
• [Fix] stringify: serialize Date values when a filter is provided
• [Fix] parse: enforce arrayLimit on comma groups under []= when throwOnLimitExceeded is set
• [Fix] parse: flatten a collection appended to an overflowed array (#571)
• [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or drop own keys) on an empty array with own properties
• [Fix] stringify: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
• [Docs] threat model: clarify stringify deep-nesting DoS is caller-bounded
• [Docs] clarify arrayLimit is a representation threshold, not an element-count cap
• [Tests] parse: remove a test that pinned []= comma groups escaping arrayLimit
• [Tests] stringify: pin current encodeDotInKeys separator-dot behavior
• [Dev Deps] update @ljharb/eslint-config, eslint
• [Dev Deps] update eslint, evalmd

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

Commits

• bb9379e v6.16.0
• 62fd254 [Fix] stringify: serialize Date values when a filter is provided
• 8859c37 [Fix] parse: enforce arrayLimit on comma groups under []= when `throwOn...
• 8079adc [Tests] parse: remove a test that pinned []= comma groups escaping `array...
• d56f48c [Fix] parse: flatten a collection appended to an overflowed array
• e83d321 [Fix] utils: isBuffer: do not invoke a non-callable constructor.isBuffer
• 7e87a07 [Dev Deps] update @ljharb/eslint-config, eslint
• 9a76af2 [Dev Deps] update eslint, evalmd
• 3a890d4 [Dev Deps] update eslint, evalmd
• b433a9b [Fix] stringify: do not let allowEmptyArrays skip cycle detection (or dro...
• Additional commits viewable in compare view

Updates libphonenumber-js from 1.13.13 to 1.13.14

Changelog

Sourced from libphonenumber-js's changelog.

1.13.14 / 24.9.2026

• Updated metadata to version 9.0.40:
  • Updated phone metadata for region code(s): BD, CA, CD, EE, IL, LI, PA, SB, SR, UG, VN, ZW
  • New geocoding data for country calling code(s): 1273 (en)
  • Updated geocoding data for country calling code(s): 263 (en)
  • Updated carrier data for country calling code(s): 36 (en), 39 (en), 81 (en), 84 (en), 226 (en), 243 (en), 256 (en), 597 (en), 677 (en), 880 (en), 972 (en), 994 (en)
  • Updated / refreshed time zone meta data.

Commits

• 1d7eda2 1.13.14
• 8658979 Updated metadata
• a972d30 Update README.md
• See full diff in compare view

Updates react-select-async-paginate from 0.6.2 to 0.7.11

Release notes

Sourced from react-select-async-paginate's releases.

0.7.11

Bugfix

• Fixed import FilterOptionOption from react-select #194. Thanks @​martinnaj

0.7.10

Bugfix

• Fixed menu auto positioning #187

New features

• Added clearCacheOnSearchChange and clearCacheOnMenuClose props #185

Commits

• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions