Bump @typescript-eslint/eslint-plugin from 8.64.0 to 8.65.0

[dependabot]

Bumps @typescript-eslint/eslint-plugin from 8.64.0 to 8.65.0.

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
• typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.65.0 (2026-07-20)

🚀 Features

• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
• add warning when TS 7 is detected (#12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)

🩹 Fixes

• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 63ba81b chore(release): publish 8.65.0
• aa602bd fix(eslint-plugin): [no-unnecessary-parameter-property-assignment] don't flag...
• 1e90d67 feat(eslint-plugin): [no-shadow] specialized error on enum declaration and me...
• b32fb34 docs: fix broken code samples in no-extraneous-class and prefer-function-type...
• eaf4576 feat: add warning when TS 7 is detected (#12529)
• 18c01c7 feat(eslint-plugin): [no-restricted-imports] deprecate extension rule (#12527)
• 96e8fe2 fix(eslint-plugin): [unbound-method] report unbound methods accessed via memb...
• 0d06406 chore: add attw validation to repo (#12437)
• 9d9973b fix(eslint-plugin): [prefer-string-starts-ends-with] handle escaped $ ending ...
• c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
• See full diff in compare view

[fossabot]

✓ Safe to upgrade

I recommend merging this upgrade because this is a minor patch-level bump to a developer-only linting dependency with no breaking changes, no runtime impact, and no security vulnerabilities. The only notable change is the deprecation of the @​typescript-eslint/no-restricted-imports extension rule — however, a codebase search confirms this rule is not configured or used anywhere in eslint.config.mjs or related files, so no code changes are required. The new TypeScript version-range warning introduced in this release targets TypeScript 7+ users only; the project is pinned to TypeScript 5.x and is entirely unaffected. The flagged malicious package alert (@​typescript_eslinter/eslint) pertains to an unrelated typosquatting package using an underscore, not the legitimate @​typescript-eslint/eslint-plugin being upgraded here. The reported Node.js version mismatch is a false positive: the project requires Node >= 24.0.0, which comfortably satisfies the package's minimum engine requirement of >=21.1.0. The upgrade also ships 7 new features and 6 bug fixes in the plugin's internal ecosystem.

What we checked

• @​typescript-eslint/eslint-plugin is declared as a devDependency at ^8.65.0, confirming this is a linting-only tool with zero runtime footprint. ^[1]
• The plugin is imported and used exclusively in the ESLint configuration. No @​typescript-eslint/no-restricted-imports rule is configured anywhere in this file, meaning the deprecation of that extension rule has no impact on this project. ^[2]
• Active rules include @​typescript-eslint/naming-convention (line 67), @​typescript-eslint/array-type (line 163), @​typescript-eslint/no-use-before-define (line 201), and others — none of which are deprecated or changed in this release. ^[3]
• TypeScript is pinned at ^5.9.3. The new TypeScript version validation/warning in this release only triggers for TypeScript 7+ users, so the project is completely unaffected by that change. ^[4]
• The project engine requirement is >= 24.0.0. The @​typescript-eslint/eslint-plugin package supports >=21.1.0, so Node 24 is fully compatible — the flagged runtime mismatch is a false positive. ^[5]
• Official release notes confirm @​typescript-eslint/no-restricted-imports is deprecated as an extension rule in 8.65.0. This is a soft deprecation (warning, not removal), and the rule is not used in this codebase, so no action is needed. ^[6]
• The malicious package alert is for @​typescript_eslinter/eslint (underscore, typosquatting) — a completely different package that steals clipboard data and establishes C2 connections. The legitimate @​typescript-eslint/eslint-plugin (hyphen) being upgraded here is unaffected by this advisory. ^[7]

Dependency Usage

@​typescript-eslint/eslint-plugin is exclusively a developer tooling dependency, centrally configured in eslint.config.mjs alongside @​typescript-eslint/parser to enforce TypeScript-specific code quality rules across the codebase. The configuration applies several opinionated rules — including @​typescript-eslint/naming-convention and @​typescript-eslint/array-type — with inline rule suppressions visible in src/index.ts confirming active enforcement during development. This dependency has no impact on runtime application behavior; its sole purpose is to standardize TypeScript coding conventions and catch type-aware linting issues during the development and CI workflow.

• The plugin is imported and used exclusively in the ESLint configuration. No @​typescript-eslint/no-restricted-imports rule is configured anywhere in this file, meaning the deprecation of that extension rule has no impact on this project.
  

  fossa-action/eslint.config.mjs

  Line 3 in 55f4f63

  import typescriptEslint from "@typescript-eslint/eslint-plugin";

• Active rules include @​typescript-eslint/naming-convention (line 67), @​typescript-eslint/array-type (line 163), @​typescript-eslint/no-use-before-define (line 201), and others — none of which are deprecated or changed in this release.
  

  fossa-action/eslint.config.mjs

  Line 62 in 55f4f63

  rules: {

Changes

@​typescript-eslint/eslint-plugin was updated with TypeScript 7 detection warnings, a new onUnsupportedTypeScriptVersion parser option to error on unsupported TypeScript versions, and bug fixes for unbound-method (now correctly reports unbound methods on union types) and prefer-string-starts-ends-with (handles escaped $ in regex). The no-restricted-imports extension rule is deprecated and should be migrated away from.

• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889) (v8.64.0-8.65.0, changelog)
• feat(eslint-plugin): [no-restricted-imports] deprecate extension rule (v8.64.0-8.65.0, commit)
• add warning when TS 7 is detected (#12529) (v8.64.0-8.65.0, changelog)

View 34 more changes

• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465) (v8.64.0-8.65.0, changelog)
• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578) (v8.64.0-8.65.0, changelog)
• typescript-estree: throw for invalid import defer syntax (#12552) (v8.64.0-8.65.0, changelog)
• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515) (v8.64.0-8.65.0, changelog)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448) (v8.64.0-8.65.0, changelog)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568) (v8.64.0-8.65.0, changelog)
• Evyatar Daud @​StyleShit (v8.64.0-8.65.0, changelog)
• Josh Goldberg ✨ (v8.64.0-8.65.0, changelog)
• Kirk Waiblinger @​kirkwaiblinger (v8.64.0-8.65.0, changelog)
• Serhii Leniv @​Serhii-Leniv (v8.64.0-8.65.0, changelog)
• 송재욱 (v8.64.0-8.65.0, changelog)
• fix(eslint-plugin): [no-unnecessary-parameter-property-assignment] don't flag certain cases (v8.64.0-8.65.0, commit)
• fix(eslint-plugin): [unbound-method] report unbound methods accessed via member expressions (v8.64.0-8.65.0, commit)
• fix(eslint-plugin): [prefer-string-starts-ends-with] handle escaped $ ending (v8.64.0-8.65.0, commit)
• docs: fix typed-linting warning location (v8.64.0-8.65.0, commit)
• docs: fix broken code samples in no-extraneous-class and prefer-function-type (v8.64.0-8.65.0, commit)
• chore(eslint-plugin-internal): fix eslint-plugin/require-test-error-position (v8.64.0-8.65.0, commit)
• feat(eslint-plugin): [no-shadow] add specialized error on enum declaration and member (v8.64.0-8.65.0, commit)
• feat(parser): add onUnsupportedTypeScriptVersion option to error on unsupported versions (v8.64.0-8.65.0, commit)
• feat: add warning when TypeScript 7 is detected (v8.64.0-8.65.0, commit)
• docs: add troubleshooting section for out-of-memory errors (v8.64.0-8.65.0, commit)
• chore: add attw validation to repo (v8.64.0-8.65.0, commit)
• feat(typescript-estree): throw for invalid import defer syntax (v8.64.0-8.65.0, commit)
• chore(deps): update dependency eslint to v10.7.0 (v8.64.0-8.65.0, commit)
• chore(deps): update dependency knip to v6.26.0 and v6.25.0 (v8.64.0-8.65.0, commit)
• chore(deps): update dependency prettier to v3.9.5 (v8.64.0-8.65.0, commit)
• chore(deps): update dependency eslint-plugin-perfectionist to ^5.10.0 (v8.64.0-8.65.0, commit)
• chore(deps): update matteogabriele/agentscan-action digest to e02ef27 (v8.64.0-8.65.0, commit)
• chore: remove unused vite (v8.64.0-8.65.0, commit)
• chore(ci): disable fail-fast (v8.64.0-8.65.0, commit)
• Updated internal dependencies @​typescript-eslint/scope-manager, @​typescript-eslint/type-utils, @​typescript-eslint/visitor-keys, @​typescript-eslint/utils, and @​typescript-eslint/parser from 8.64.0 to 8.65.0 (v8.65.0, package source)
• Updated dev dependencies @​typescript-eslint/rule-schema-to-typescript-types and @​typescript-eslint/rule-tester from 8.64.0 to 8.65.0 (v8.65.0, package source)
• Updated prettier dev dependency from 3.8.0 to 3.9.5 (v8.65.0, package source)
• Added new npm build task 'attw-check' for API surface verification with exclusions for use-at-your-own-risk/raw-plugin and use-at-your-own-risk/rules entrypoints (v8.65.0, package source)

References (7)

[1]: @​typescript-eslint/eslint-plugin is declared as a devDependency at ^8.65.0, confirming this is a linting-only tool with zero runtime footprint.

fossa-action/package.json

Line 24 in 55f4f63

"@typescript-eslint/eslint-plugin": "^8.65.0",

[2]: The plugin is imported and used exclusively in the ESLint configuration. No @​typescript-eslint/no-restricted-imports rule is configured anywhere in this file, meaning the deprecation of that extension rule has no impact on this project.

fossa-action/eslint.config.mjs

Line 3 in 55f4f63

import typescriptEslint from "@typescript-eslint/eslint-plugin";

[3]: Active rules include @​typescript-eslint/naming-convention (line 67), @​typescript-eslint/array-type (line 163), @​typescript-eslint/no-use-before-define (line 201), and others — none of which are deprecated or changed in this release.

fossa-action/eslint.config.mjs

Line 62 in 55f4f63

rules: {

[4]: TypeScript is pinned at ^5.9.3. The new TypeScript version validation/warning in this release only triggers for TypeScript 7+ users, so the project is completely unaffected by that change.

fossa-action/package.json

Line 37 in 55f4f63

"typescript": "^5.9.3"

[5]: The project engine requirement is >= 24.0.0. The @​typescript-eslint/eslint-plugin package supports >=21.1.0, so Node 24 is fully compatible — the flagged runtime mismatch is a false positive.

fossa-action/package.json

Line 12 in 55f4f63

"node": ">= 24.0.0"

[6]: Official release notes confirm @​typescript-eslint/no-restricted-imports is deprecated as an extension rule in 8.65.0. This is a soft deprecation (warning, not removal), and the rule is not used in this codebase, so no action is needed. (source link)

[7]: The malicious package alert is for @​typescript_eslinter/eslint (underscore, typosquatting) — a completely different package that steals clipboard data and establishes C2 connections. The legitimate @​typescript-eslint/eslint-plugin (hyphen) being upgraded here is unaffected by this advisory. (source link)

---

fossabot analyzed this PR using static analysis and dependency research. View this analysis on the web

[fossabot]