[posit-snyk-bot]

Snyk has created this PR to upgrade acorn from 8.4.0 to 8.18.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 23 versions ahead of your current version.

• The recommended version was released 3 months ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: acorn

• 8.18.0 - 2026-07-28
  

  New features

  The new startLocation option can now be used to tell the parser the line and column the parse starts at (mostly useful with parseExpressionAt).

  Bug fixes

  Reject uses of ** with a non-parenthesized arrow function as left-hand side.

  Avoid computing the start line in parseExpressionAt when locations aren't used.

• 8.17.0 - 2026-06-11
  

  New features

  The new strict option can be used to start script sources in strict mode.

  Bug fixes

  Fix a number of corner case bugs when using or await using appear in for loop specs.

  Disallow new super() expressions.

  Don't allow the conditional in a ternary expression to be a (naked) arrow function.

• 8.16.0 - 2026-02-19
  

  New features

  The sourceType option can now be set to "commonjs" to have the parser treat the top level scope as a function scope.

  Add support for Unicode 17.

  Bug fixes

  Don't recognize await using as contextual keywords when followed directly by a backslash.

  Fix an issue where the parser would allow return statements in static blocks when allowReturnOutsideFunction was enabled.

  Properly reject using declarations that appear directly in switch or for head scopes.

  Fix some corner case issues in the recognition of using syntax.

• 8.15.0 - 2025-06-08
  

  New features

  Support using and await using syntax.

  The AnyNode type is now defined in such a way that plugins can extend it.

  Bug fixes

  Fix an issue where the bigint property of literal nodes for non-decimal bigints had the wrong format.

  The acorn CLI tool no longer crashes when emitting a tree that contains a bigint.

• 8.14.1 - 2025-03-05
  

  Bug fixes

  Fix an issue where await expressions in class field initializers were inappropriately allowed.

  Properly allow await inside an async arrow function inside a class field initializer.

  Mention the source file name in syntax error messages when given.

  Properly add an empty attributes property to every form of ExportNamedDeclaration.

• 8.14.0 - 2024-10-27
  

  New features

  Support ES2025 import attributes.

  Support ES2025 RegExp modifiers.

  Bug fixes

  Support some missing Unicode properties.

• 8.13.0 - 2024-10-16
  

  New features

  Upgrade to Unicode 16.0.

• 8.12.1 - 2024-07-03
  

  Bug fixes

  Fix a regression that caused Acorn to no longer run on Node versions <8.10.

• 8.12.0 - 2024-06-14
  

  New features

  Support ES2025 duplicate capture group names in regular expressions.

  Bug fixes

  Include VariableDeclarator in the AnyNode type so that walker objects can refer to it without getting a type error.

  Properly raise a parse error for invalid for/of statements using async as binding name.

  Properly recognize "use strict" when preceded by a string with an escaped newline.

  Mark the Parser constructor as protected, not private, so plugins can extend it without type errors.

  Fix a bug where some invalid delete expressions were let through when the operand was parenthesized and preserveParens was enabled.

  Properly normalize line endings in raw strings of invalid template tokens.

  Properly track line numbers for escaped newlines in strings.

  Fix a bug that broke line number accounting after a template literal with invalid escape sequences.

• 8.11.3 - 2023-12-29
• 8.11.2 - 2023-10-27
• 8.11.1 - 2023-10-26
• 8.11.0 - 2023-10-26
• 8.10.0 - 2023-07-05
• 8.9.0 - 2023-06-16
• 8.8.2 - 2023-01-23
• 8.8.1 - 2022-10-24
• 8.8.0 - 2022-07-21
• 8.7.1 - 2022-04-26
• 8.7.0 - 2021-12-27
• 8.6.0 - 2021-11-18
• 8.5.0 - 2021-09-06
• 8.4.1 - 2021-06-24
• 8.4.0 - 2021-06-11

from acorn GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[posit-snyk-bot]

This is a minor version upgrade for the Acorn JavaScript parser. While not immediately breaking for most users, it introduces changes that require developer attention.

Key Changes:

• ecmaVersion is now required: In version 8.18.0, the ecmaVersion option is now required during initialization. While omitting it currently only produces a warning, it will become a hard requirement in a future release.
• Plugin Author Breaking Changes: The release notes mention changes to method signatures that may affect custom plugins.

Recommendation:
To ensure future compatibility, it is strongly recommended to explicitly set the ecmaVersion option in all Acorn parser initializations.

Source: Acorn Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cderv]

Closing in favor of #15151. This package.json belongs to the Node-runtime spike in dev-docs/runtime-migration/ — frozen, throwaway evidence tooling whose pinned versions don't flow into shipped quarto code (the real sources get these deps via src/import_map.json / packages/ojs). Merging all 8 spike PRs individually would leave 7 of them conflicted; one representative merge records the "we don't take Snyk bumps here" signal. A request has been filed to disable upgrade PRs for this Project in the Snyk UI.