[posit-snyk-bot]

Snyk has created this PR to upgrade acorn-walk from 8.2.0 to 8.3.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 6 versions ahead of your current version.

• The recommended version was released 8 months ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: acorn-walk

• 8.3.5 - 2026-02-19
• 8.3.4 - 2024-09-09
• 8.3.3 - 2024-06-14
• 8.3.2 - 2024-01-11
• 8.3.1 - 2023-12-06
• 8.3.0 - 2023-10-26
• 8.2.0 - 2021-09-06

from acorn-walk GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[posit-snyk-bot]

This upgrade of acorn-walk from 8.2.0 to 8.3.5 includes new features, bug fixes, and significant improvements to its TypeScript definitions. While there are no major API removals, there are changes that could require developer verification.

Key Changes:

• v8.3.0: Introduces a set of "much more precise, TypeScript types". This is a significant enhancement but may cause build failures in TypeScript projects if existing code does not align with the stricter types.
• v8.3.1: The this context within visitor functions now refers to the visitor object itself. Code that relied on the previous behavior of this may need to be updated.
• v8.2.0: Adds support for walking ES2022 class static blocks.

Recommendation: This upgrade is considered medium risk. It is recommended to review your usage of acorn-walk, especially in TypeScript projects, to ensure compatibility with the updated, more precise types. You should also verify any visitor functions that rely on the this context.

Source: GitHub CHANGELOG.md

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cderv]

Closing in favor of #15151. This package.json belongs to the Node-runtime spike in dev-docs/runtime-migration/ — frozen, throwaway evidence tooling whose pinned versions don't flow into shipped quarto code (the real sources get these deps via src/import_map.json / packages/ojs). Merging all 8 spike PRs individually would leave 7 of them conflicted; one representative merge records the "we don't take Snyk bumps here" signal. A request has been filed to disable upgrade PRs for this Project in the Snyk UI.