[dependabot]

Bumps @typescript-eslint/eslint-plugin from 8.69.0 to 8.70.0.

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)

❤️ Thank You

• Josh Goldberg ✨ @​JoshuaKGoldberg
• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• f66bdca test(eslint-plugin): [member-ordering] use RuleTester directly in `optional...
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• f8e1e4e fix(eslint-plugin): [no-unnecessary-condition] no false positive on RHS of a ...
• 889cece fix(eslint-plugin): [member-ordering] don't report fields that read fields de...
• 1a5a8b1 feat(eslint-plugin): [no-generated-empty-object-type] add rule (#12730)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

supply-chain-guard Scan Report

WARNING: Findings were detected.

Canonical JSON report: 3 reportable finding(s).

## 🛡️ supply-chain-guard Scan Report

| Property | Value |
|----------|-------|
| Tool | `supply-chain-guard v6.0.10` |
| Target | `.` |
| Type | directory |
| Time | 2026-09-14T22:55:00.390Z |
| Commit | `8042e701f68ed78de7267f3f4c3d158deb92b766` |
| Detection Set | `v6.0.10 (20140 entries, generated 2026-09-02T00:00:00.000Z)` |
| Duration | 1417ms |
| **Risk Score** | **9/100** (LOW) |

### Summary

Scanned 83 of 88 files.

🟡 1 medium | 🔵 2 low

### Findings

#### 🟡 [MEDIUM] Workflow requests OIDC id-token:write permission. If combined with unreviewed third-party actions or outbound curl, an attacker can steal the OIDC token to impersonate the workflow's cloud identity.

- **Rule:** `GHA_OIDC_WRITE_PERM`
- **File:** `.github/workflows/release.yml:388`
- **Match:** `id-token: write`
- **Recommendation:** Audit all steps in this workflow when id-token:write is set. Ensure no third-party action or run step can exfiltrate the OIDC token. Scope permissions as narrowly as possible.

#### 🔵 [LOW] Action "homeofe/supply-chain-guard@v6.0.10" uses a version tag instead of a commit SHA. Tags can be force-pushed to point to different commits.

- **Rule:** `GHA_TAG_NOT_SHA`
- **File:** `.github/workflows/supply-chain-guard.yml:25`
- **Match:** `homeofe/supply-chain-guard@v6.0.10`
- **Recommendation:** Consider pinning this action to a full commit SHA for maximum security. Tags can be moved to point to malicious code.

#### 🔵 [LOW] Action "homeofe/supply-chain-guard@v6.0.10" is from third-party owner "homeofe". Third-party actions can be compromised.

- **Rule:** `GHA_THIRD_PARTY_ACTION`
- **File:** `.github/workflows/supply-chain-guard.yml:25`
- **Match:** `homeofe/supply-chain-guard@v6.0.10`
- **Recommendation:** Pin "homeofe/supply-chain-guard@v6.0.10" to a specific commit SHA and audit the action source code before use.

### Recommendations

- Review the listed findings and assess whether they represent legitimate functionality or potential threats.

---
*Generated by [supply-chain-guard](https://github.com/homeofe/supply-chain-guard)*